Accessible by design
A clear starting point for SMEs, startups, and organisations building their cybersecurity programme.
A Kenyan cybersecurity framework
Build trust.
Strengthen your
cyber resilience.
A practical, two-tier cybersecurity certification standard for organisations operating in Kenya — designed to make stronger security accessible to every organisation.
Built for SMEs, institutions, and growing organisations
Security that earns trust
13 controlsOne clear framework
02Certification tiers
13Security controls
08Regulatory instruments referenced
12moCertificate validity
The standard
Cybersecurity made practical.
A nationally relevant framework that helps organisations build stronger defences without the complexity of one-size-fits-all standards.
Relevant to Kenya
Aligned with the Data Protection Act 2019, SASRA and CBK guidelines, ICTA standards, and NC4 standards.
Built to grow with you
Choose five essential controls or progress to all 13 as your organisation's needs evolve.
Choose your level
Two tiers. One stronger future.
Start with the controls that fit your organisation, then build toward a more comprehensive level of assurance.
01Essential
Cyber Trust Core
A practical cybersecurity foundation.
KES 10,000–16,000 indicative range
- 5 foundational controls
- Self-assessment
- 12-month certificate validity
- Typical assessment: 2–4 weeks
- Ideal for SMEs, startups, and suppliers
02Advanced
Cyber Trust Plus
Deeper assurance for complex environments.
KES 30,000–50,000 indicative range
- All 13 controls (5 Core + 8 Advanced)
- Independent technical audit
- 12-month certificate validity
- Typical assessment: 4–6 weeks
- Ideal for SACCOs, fintechs, and institutions
Assessment fees are indicative ranges shown in the Cyber Trust Standard. Confirm current fees with your selected Certification Body.
A clear path to better security
The 13 controls, at a glance.
Core covers the first five controls. Plus extends the framework across all 13.
01Firewall and Network SecurityCore + Plus
02Secure ConfigurationCore + Plus
03Access Control and User ManagementCore + Plus
04Malware ProtectionCore + Plus
05Patch ManagementCore + Plus
06Backup and RecoveryPlus
07Incident ManagementPlus
08Data ProtectionPlus
09ICT GovernancePlus
10Third-Party ManagementPlus
11Human Resources SecurityPlus
12CryptographyPlus
13CompliancePlus
Need the full control requirements? Visit the Cyber Trust portal
The certification journey
Clear steps.
Confident progress.
Your organisation works with a licensed Certification Body from assessment through to certification.
Begin through the Cyber Trust portalSelect a licensed Certification Body
Choose a Certification Body for your assessment.
Complete your self-assessment
Document how your organisation meets the selected controls.
Review, decision, and certification
Your Certification Body reviews the submission and issues a decision.
Good to know
Frequently asked questions.
Is the Cyber Trust Standard mandatory?
The framework does not state that certification is mandatory. It provides a certification scheme for organisations operating in Kenya.
How many controls do I need?
Cyber Trust Core requires controls 1–5. Cyber Trust Plus requires all 13 controls (5 Core and 8 Advanced).
How long does an assessment take?
Cyber Trust Core assessments take 2–4 weeks. Cyber Trust Plus assessments take 4–6 weeks.
Who conducts the assessment?
A licensed Certification Body conducts the assessment, selected by the applicant.
What if I don't meet all controls?
Findings are classified as Major Nonconformity, Minor Nonconformity, or Observation. Certification outcomes may be Certified or Conditional, depending on the findings and corrective action plan.
Take the next step
Make trust part of your security story.
Applications and assessments are managed through the Cyber Trust portal, with a licensed Certification Body.
Visit the Cyber Trust portal