KENYA · GUIDE 0600 · EDITION 4.2
Small business cybersecurity training in Kenya: Registration and Activity Checks
Define the activity that authorities need to assess
Teach small-business cybersecurity awareness using safe examples.
Train staff on the business's actual account, payment, device, and reporting practices, using safe examples and a named escalation route for suspicious requests.
Describe that exact operation when checking requirements. State where the work takes place, whether customers enter the premises, who performs technical tasks and whether you manufacture, resell, deliver or coordinate the service. Requirements can change with these facts; a broad business category is not a complete permit determination.
Sector questions to investigate
- Assess data-controller/processor duties and registration requirements for systems handling personal data.
- Obtain written authority for access, backups, testing and changes.
- Use properly licensed software and assets; document responsibility for third-party renewals and processor contracts.
Keep registration separate from permission to operate
A registered business name does not itself establish approval of premises, products or professional work. Use the Business Registration Service to check the appropriate registration route. Ask the relevant county office which premises and trading checks apply to the actual activity. Confirm tax and invoicing obligations with KRA for your circumstances rather than copying another trader's treatment.
Prepare a written enquiry
| Information to provide | Business-specific starting point |
|---|---|
| Proposed output | Teach small-business cybersecurity awareness using safe examples. |
| Scope and exclusions | Train staff on the business's actual account, payment, device, and reporting practices, using safe examples and a named escalation route for suspicious requests. |
| First operating step | Agree the specific risks, learner audience and reporting contacts, then prepare original safe examples without probing live systems or collecting passwords. |
| Quality and acceptance | Ask participants to examine realistic messages and payment-change requests, explaining their verification decision and reporting action without interacting with any live malicious content. |
Add the county, location, premises arrangement, scale, equipment and responsible person's qualifications. Ask which authority handles an issue if it falls outside the first office's remit. Record the answer, reference link, date checked and any renewal or inspection condition. A guide's reference list is a route to verification, not an approval document.
Decide what must wait
Do not offer a regulated service or make a safety, accreditation or certification claim that you cannot substantiate. Resolve an unanswered prerequisite before accepting work that depends on it. A demand interview can often precede trading; a paid or physical trial still needs the appropriate permissions and safe arrangements.
Training misses its purpose when staff memorize warning signs but still have no practical way to verify an urgent payment instruction from apparent management.
No universal licence package, current fee or exemption is asserted here. The official links below support only their stated scope.
Prepare a precise activity enquiry
Describe this actual operating scope to the relevant authority or competent adviser: Fictional cyber-awareness CYB-100 is a 90-minute session for eight staff using three harmless exercises: identify a suspicious payment-change request, practise reporting it through an approved internal channel and explain recovery from a backup. A fictional email asks to change bank details urgently; it contains no live link or credential form. Security testing, phishing campaigns against employees, incident response and certification are excluded.
Use these operating details to make the enquiry specific:
| Detail to disclose | Why it can affect the answer |
|---|---|
| Owner procedure sheet - Named reporting/payment-verification owners. | Explain the actual premises, scale, use and who will perform the task. Ask which current rule applies to these facts. |
| Harmless exercise pack - Three fictional scenarios and answer notes. | Explain the actual premises, scale, use and who will perform the task. Ask which current rule applies to these facts. |
| Demonstration account - Disposable approved examples. | Explain the actual premises, scale, use and who will perform the task. Ask which current rule applies to these facts. |
Keep the reply date, official source, exact activity facts and any conditions together. This is an enquiry preparation method, not a determination that a licence, exemption or fee applies. The earlier source dates do not mean legal requirements were rechecked today. Resolve these outstanding checks before relying on a broad business description:
- Actual policies, staff practice and security state unverified.
- Not a security audit/certification; no phishing messages sent.