Vision: Safe and trusted cyberspace for the people of Kenya Directorate of Criminal Investigations (DCI). In regard to legislation, the Government enacted the Computer Misuse and Cybercrimes Act-2018 which is currently the overarching law for protection of Critical Information Infrastructures and management of cybercrime in Kenya. To achieve its objectives, the Act establishes and mandates the National Computer and Cybercrimes Co-ordination Committee (NC4) and the Secretariat, as the national authority to spearhead and coordinate cybersecurity matters. The Committee comprises of Principal Secretary in charge of internal security, Principal Secretary in charge of ICT, Attorney-General (AG), Chief of the Kenya Defence Forces (CDF), Inspector-General of NPS, Director-General NIS, Director-General CA, Director of Public Prosecutions (DPP), Governor CBK, and Director NC4 Secretariat. To initialize CII protection as provided by the CMCA, GoK designated sectors and critical systems that facilitate provision of essential services and are strategic to national security as Critical Information Infrastructures (CIIs) vide the Gazette Notice No.1043 of 31 January 2022. These are systems whose disruption would result in: interruption of life sustaining service; an adverse effect on the economy of the Republic of Kenya; an event that would result in massive casualties or fatalities; failure or disruption of money market of the Republic of Kenya; and adverse and severe effect on the security of the Republic of Kenya including Intelligence and Military services. This affirms the Republic of Kenya’s commitment to safeguard and protect Kenya’s sovereignty and its people. 1.2 Cybersecurity Strategy Rationale The Republic of Kenya identifies cybersecurity as a national economic and security challenge. The most prevalent cybersecurity challenges in Kenya include exploitation of the new operating environment by adversaries to conduct war like activities such as disruption of operations of critical infrastructure. Most ICT infrastructure and users in the Republic of Kenya have prioritized efficiency, cost and convenience and overlooked security during development and implementation. Interconnected ICTs have inherent vendor/manufacturer vulnerabilities that can be exploited by adversaries and expose Kenyan citizens, businesses and government to global threats. Despite a growing number of incidents, governance of cyberspace has remained uncoordinated with no clear structure. While Kenya has enacted various policies and laws, regular review and update is necessary in order to effectively address emerging risks and 2