KENYA · GUIDE 0600 · EDITION 4.7
Small business cybersecurity training in Kenya: Delivery Planning and Acceptance Checks
Editorial update: 28 October 2026 · Business planning reference · Review scope
Plan delivery around observable acceptance
Plan the handover and acceptance record for small business cybersecurity training, using the specific checkpoints for the example offer.
This is a planning reference for small business cybersecurity training. The order below is an invented teaching case. It is not a completed customer job, an operating approval or a prediction of demand or earnings.
The example offer and its boundary
Fictional cyber-awareness CYB-100 is a 90-minute session for eight staff using three harmless exercises: identify a suspicious payment-change request, practise reporting it through an approved internal channel and explain recovery from a backup. A fictional email asks to change bank details urgently; it contains no live link or credential form. Security testing, phishing campaigns against employees, incident response and certification are excluded.
This page is a work-control sheet. It does not teach a qualified trade, prescribe a food process, approve equipment or replace the appropriate technical procedure. Confirm who has the competence and authority for any specialist task.
Prepare the control record
| Stage to schedule | Checkpoint from the scoped example | Actual record to complete |
|---|---|---|
| Define business procedures | Training does not invent a hotline or promise the trainer can investigate incidents. | Responsible person; evidence/reference; measured result; pass/hold decision; correction owner |
| Prepare safe examples | No staff password, code or customer record is collected. | Responsible person; evidence/reference; measured result; pass/hold decision; correction owner |
| Teach independent verification | Good grammar/logo alone cannot prove authenticity. | Responsible person; evidence/reference; measured result; pass/hold decision; correction owner |
| Practise account/backup decisions | Staff enrol their own factors privately; no trainer retains recovery codes. | Responsible person; evidence/reference; measured result; pass/hold decision; correction owner |
| Assess the three tasks | Record observed understanding and gaps, not a claim the business is secure. | Responsible person; evidence/reference; measured result; pass/hold decision; correction owner |
Keep accepted and unresolved work separate
| Issue to watch for | Evidence question |
|---|---|
| Staff rely on logo to trust email | Review verification exercise. |
| Nobody knows reporting owner | Check procedure sheet. |
| Trainer receives recovery code | Check demonstration process. |
The issues above are prompts to investigate, not a diagnosis of a real defect. Record what was observed, isolate the affected output where appropriate, and refer the technical decision to the competent person or approved process. Do not copy a hypothetical response into a real incident without assessment.
Reconcile the handover
Use the agreed charging basis: awareness session. Record ordered, completed, accepted, held and rejected output separately. Track rework time, changed scope, credits and collection dates against the same order reference. Record observed understanding and gaps, not a claim the business is secure.
Proceed within a defined trial limit only after the buyer's acceptance, actual full costs and collections are recorded, and the guide's unresolved checks are addressed. The final business-specific checkpoint is: Record observed understanding and gaps, not a claim the business is secure. Otherwise record a hold, revision or stop decision in file 10.
References and their limits
Small organisations guide to cyber security — NCSC
Defensive small-business account/device/backup/scam guidance, not a security certification. Reference check recorded 2026-10-26.
Rights Of A Data Subject
Kenyan privacy principles and data minimisation; not a complete compliance assessment. Reference check recorded 2026-10-26.
Connect domain DNS records — Microsoft 365
Mailbox preparation before MX change and tenant-specific DNS records. Reference check recorded 2026-10-26.
Recorded references support only the scope stated beside them. They do not prove current supplier stock, a local quotation, actual buyer demand, operator competence or the feasibility of this particular business. Later editorial changes do not refresh earlier source-check dates.
Prepared by Business Starter Guides using AI-assisted drafting and desk editorial checks. Independent operator trials and specialist certification are not claimed. See the editorial method for the review scope.
Editorial method and evidence limits