Kenya’s Cybersecurity Agency Gets A Board. The Law Has Yet To Catch Up

Kipchumba Murkomen, Cabinet Secretary for Interior and National Administration, chaired the inaugural meeting of the National Cybersecurity Agency’s board on Monday at Harambee House, marking the first time the agency has convened as a governing body.

The meeting establishes a governance structure for an institution that has existed on paper since July. It was attended by Raymond Omollo, Principal Secretary in the Ministry of Interior and National Administration, and led by Martin Koyabe, the board’s non-executive chairman, alongside Stephen Obare, the agency’s acting director-general.

Murkomen used the sitting to place the agency outside the technology portfolio where cybersecurity has historically been filed.

“Cybersecurity is no longer merely an ICT concern. It is a matter of national security,” he said.

He asked the board to prioritise building the capacity of the National Cybersecurity Operations Centre to detect, analyse and coordinate responses to threats in real time. He also called for the promotion of Kenyan expertise, local research and indigenous technological solutions, alongside deeper collaboration with universities and research institutions.

According to Koyabe, the immediate task is to establish the agency’s human resource and operational structures, followed by the transparent recruitment of qualified Kenyan professionals.

Omollo highlighted the agency’s role in strengthening national capacity to anticipate, prevent, detect and respond to emerging threats.

The numbers behind the urgency

The case for an operations centre with real-time capabilities is not abstract.

The National KE-CIRT/CC, Kenya’s existing computer incident response team, detected just under 2.36 billion cyber threat events between April and June this year and issued 20.7 million advisories during the same quarter.

System attacks accounted for more than 2.25 billion events, while web application attacks rose 43.7 per cent from the preceding quarter, even as the overall figure fell by about 30 per cent.

Communications Authority of Kenya data cited at the inauguration put distributed denial-of-service attacks at 72.16 million for the year to June 2026, an increase of 114.3 per cent on the previous year.

What the agency is, in law

The National Cybersecurity Agency was established through the National Cybersecurity Agency Order, 2026, gazetted as Legal Notice No. 89 and made by President William Ruto under the State Corporations Act. Parliament approved its creation in June.

Its mandate is broad. The agency is tasked with formulating and overseeing national cybersecurity strategy across the public and private sectors, auditing and certifying the cyber resilience of designated critical information infrastructure, and operating the National Cybersecurity Operations Centre while supporting sector-based operations centres.

It is also mandated to conduct technical assessments of digital networks and issue advisories, coordinate national incident response, establish a cybersecurity centre of excellence, and facilitate information sharing and the harmonisation of standards.

The certification function has direct consequences for organisations. Once an institution’s systems are designated as critical information infrastructure, audit and certification requirements apply directly. Obligations can also extend to dependent institutions through contracts and service-level agreements.

The question the order does not settle

The board is now seated. The institutional map it operates within, however, remains unfinished.

The agency was created by executive order under the State Corporations Act. Kenya’s draft National Cybersecurity Strategy 2025–2029 had recommended a different route: amending the Computer Misuse and Cybercrimes Act, 2018, to establish the agency in statute and define its relationship with existing bodies. That amendment has yet to be passed.

The bodies in question are not minor.

The National Computer and Cybercrimes Coordination Committee, known as NC4, was established under the 2018 Act to coordinate cybersecurity policy and cybercrime response. Several of its statutory functions overlap with those of the new agency.

The National KE-CIRT/CC, which produced the detection figures above, sits under the Communications Authority and has long been the country’s principal technical incident response body. That role now coexists with the agency’s mandate to operate the national operations centre and coordinate incident response.

Sector regulators retain their own supervisory powers over the institutions they license. These include the Central Bank of Kenya, the Capital Markets Authority, the Insurance Regulatory Authority, the Energy and Petroleum Regulatory Authority, and the Office of the Data Protection Commissioner.

For an organisation operating designated infrastructure, the practical question is immediate: during a serious incident, whom does it call first, and whose instructions take precedence?

Practitioners who have examined Legal Notice 89 have raised that point since July. Neither the order nor Monday’s meeting answers it.

A board drawn from the security side

The composition of the board is itself a statement about where cybersecurity now sits in the Kenyan state.

It includes representatives from internal security, the National Treasury, the Ministry of Information, Communications and the Digital Economy, the Office of the Attorney-General, the Kenya Defence Forces, the National Police Service, the National Intelligence Service and the Office of the Director of Public Prosecutions, alongside academia and the private sector.

That is a security and prosecutorial table with technology representation, rather than a technology table with security representation. It reflects Murkomen’s framing and differs from the arrangement under which Kenya’s cyber coordination previously operated.

Martin Koyabe, the National Cybersecurity Agency’s non-executive board chairman, was appointed in August and brings more than 30 years of experience in ICT, cybersecurity, research, policy and regulation. His previous work includes developing national cybersecurity strategies and establishing CERT and CSIRT capabilities, as well as critical information infrastructure protection frameworks, in several African countries.

What to watch

Four developments will show whether this week’s meeting translates into capability.

The first is the designation of critical information infrastructure, which triggers audit and certification requirements. The second is the agency’s first certification cycle and what it finds.

The third is whether legislation follows to settle NC4’s status and clarify the relationship between the agency and KE-CIRT/CC. The fourth is whether the recruitment Murkomen described produces a staffed operations centre capable of the real-time detection and coordination he called for.

Until then, Kenya has an agency, a board, a mandate and a threat volume measured in billions of events a quarter.