Auditing of critical information infrastructures to ensure compliance

(1) The owner or person in control of a critical information infrastructure shall annually submit a compliance report on the critical information infrastructure to the Committee in line with a critical infrastructure framework in order to evaluate compliance.
(2) The Director, shall within a reasonable time before an audit on a critical information infrastructure or at any time there is an imminent threat in the nature of an attack that amounts to a computer and cybercrime, notify the owner or person in control of a critical information infrastructure in writing —
the date on which an audit is to be performed; and
(b) the particulars and contact details of the person who is responsible for the overall management and control of the audit.
(3) The Director shall monitor, evaluate and report on the adequacy and effectiveness of any audit.
(4) The Director may request the owner or person in control of a critical information infrastructure to provide such additional information as may be necessary within a specified period in order to evaluate the issues raised from the audit.
(5) An owner or authorised person in control of a critical information infrastructure commits an offence and if convicted is liable to a fine not exceeding two hundred thousand shillings or to term of imprisonment not exceeding five years or both if the owner or authorized person —
(a) fails to file a compliance report and fails to cooperate with an audit to be performed on a critical information infrastructure in order to evaluate compliance with the directives issued;
(b) fails to provide to the Director such additional information as may be necessary within a specified period in order to evaluate the report of an audit in line with the critical infrastructure after he or she has been requested to do so to the Director;
(c) hinders, obstructs or improperly attempts to influence any member of the Committee, person or entity to monitor, evaluate and report on the adequacy and effectiveness of an audit;
(d) hinders, obstructs or improperly attempts to influence any person authorized to carry out an audit;
(e) fails to co-operate with any person authorized to carry out an audit; or
(f) fails to assist or provide technical assistance and support to a person authorized to carry out an audit.
(6) A person shall not perform an audit on a critical information infrastructure unless he or she —
(a) has been authorized in writing by the Director to perform such audit; or
(b) is in possession of a certificate of appointment, in the prescribed form, issued by the Director, which certificate must be submitted to the owner or person in control of a critical information infrastructure at the commencement of the audit.