What happened

During the ISACA Kenya Chapter’s annual conference held in Naivasha, President Boniface Asiligwa addressed the press and urged the Kenyan government to introduce stronger, more agile regulations for information systems, cyber security and data governance. He emphasized that the current regulatory framework is lagging behind rapid technological change, leaving organisations vulnerable to emerging risks. Asiligwa highlighted recent incidents of data breaches in the region as evidence that existing rules are insufficient. He called for a collaborative approach involving regulators, industry bodies and the private sector to craft policies that protect stakeholders while fostering innovation. The remarks were made in front of a mixed audience of auditors, IT professionals and senior executives from Kenyan SMEs and multinational firms.

Context and background

ISACA, the global association for IT governance, audit and security professionals, operates a Kenya Chapter that brings together over a thousand members from the public and private sectors. The chapter’s mandate includes professional development, knowledge sharing and advocacy on issues that affect the integrity of information systems in Kenya. Boniface Asiligwa, a seasoned auditor and former senior manager at a leading consultancy, was elected president earlier this year and has been vocal about the need for regulatory reform. His leadership coincides with a period of accelerated digital adoption in Kenya, where cloud services, mobile payments and e‑commerce platforms have expanded dramatically.

The call for stronger regulations comes after a series of high‑profile cyber incidents across East Africa, including ransomware attacks on hospitals and data leaks from financial institutions. While Kenya has introduced the Data Protection Act 2019, critics argue that enforcement mechanisms remain weak and that the law does not fully address newer threats such as AI‑driven fraud or supply‑chain attacks. ISACA Kenya has previously submitted policy recommendations to the Ministry of Information, Communications and Technology, but progress has been slow due to competing legislative priorities.

In the months leading up to the Naivasha conference, the chapter organised workshops on emerging standards such as ISO 27001 and the NIST Cybersecurity Framework, drawing participation from both large corporations and small‑medium enterprises. These sessions revealed a gap in practical guidance for SMEs, many of which lack dedicated IT security staff. Asiligwa’s speech therefore reflects a broader industry consensus that regulation must be both robust and adaptable, offering clear compliance pathways for organisations of all sizes.

Compared with what is normal

Historically, Kenya’s regulatory approach to information systems has been reactive, often updating laws after major incidents have occurred. For example, the Computer Misuse Act was amended in 2018 following a series of high‑profile hacking cases, but the amendment focused mainly on criminal penalties rather than preventive controls. In contrast, countries such as South Africa and Singapore have adopted proactive, risk‑based frameworks that require regular assessments and continuous monitoring. The current Kenyan environment still relies heavily on periodic audits rather than real‑time governance, which can delay detection of threats. Moreover, while most Kenyan firms conduct annual financial audits, only a minority integrate IT audit components into their routine checks, leaving a blind spot in overall risk management.

• Regulatory cadence: Kenya typically revises major ICT laws every 5‑7 years, whereas peers in the region update key provisions annually to keep pace with technology.
• Compliance burden: Existing Kenyan regulations often impose flat compliance requirements that do not scale with company size, making it harder for SMEs to meet standards without disproportionate cost.
• Enforcement mechanisms: Penalties for non‑compliance are generally monetary fines, with limited provisions for mandatory remediation, unlike the corrective action plans mandated in some neighbouring jurisdictions.

Why it matters

The push for stronger regulations directly impacts Kenyan SMEs, which are the backbone of the economy and increasingly rely on digital tools for operations, payments and customer engagement. Without clear, enforceable standards, these businesses risk data breaches that can erode customer trust, attract regulatory fines, and disrupt supply chains. For finance teams, tighter rules mean more rigorous reporting requirements, potentially increasing the workload for accounting and audit functions. At the same time, a well‑structured regulatory environment can level the playing field, allowing smaller firms to demonstrate compliance and compete with larger players that already have sophisticated IT controls. Ultimately, aligning Kenya’s regulatory framework with global best practices will improve overall cyber resilience, protect consumer data and support sustainable digital growth.

Practical steps

• Review your current data protection policies against the Data Protection Act 2019 and identify gaps related to emerging technologies.
• Engage an IT audit professional to conduct a risk‑based assessment of your information systems, focusing on areas highlighted by ISACA’s recent workshops.
• Implement basic controls such as multi‑factor authentication, regular patch management and employee cybersecurity awareness training.
• Monitor updates from the Ministry of ICT and the Kenya Data Protection Commissioner to stay informed about forthcoming regulatory changes.
• Document all security measures and incident response procedures to demonstrate compliance during future audits.

Beavoren Ventures’ Bookkeeping & Accounting service can help your business align financial reporting with emerging IT audit requirements, ensuring both compliance and operational efficiency.

Talk to our team at Beavoren Ventures - info@beavorenventures.co.ke - to set up your systems correctly.

Disclaimer: This article is informational and does not constitute formal tax, audit or legal advice. For guidance specific to your circumstances, please contact Beavoren Ventures.