Kenya’s Cyber Compliance Crackdown: Over 100 State Corporation CEOs Face Sanctions Over Email Security Failures

Kenya has launched one of its most significant public-sector cyber governance enforcement exercises, with the chief executives and boards of more than 100 state corporations facing possible disciplinary action for failing to comply with mandatory government directives on domain and email security. The move marks a decisive shift in the government’s approach to cybersecurity, signalling that digital resilience is no longer viewed as a technical function but as a core governance responsibility.

The enforcement action follows a sustained wave of cyberattacks targeting government digital infrastructure. According to government figures, approximately four billion cyberattack attempts have been detected against public systems since 2022, exposing vulnerabilities in official communication channels and prompting authorities to tighten oversight of cybersecurity compliance. The latest measures are intended to strengthen the integrity of government communications, reduce exposure to phishing and domain spoofing, and improve the resilience of critical public infrastructure.

At the centre of the exercise is a directive issued by the Head of Public Service, Felix Koskei, requiring Ministries, Departments, Agencies and State Corporations to migrate to secure government domains and implement prescribed email authentication and domain protection measures. While institutions were initially granted six months to comply, followed by extensions, compliance levels reportedly remained below the government’s expectations, prompting the Executive Office of the President to issue show-cause letters to affected institutions.

The letters reportedly require chief executives to explain why disciplinary action should not be taken against them and their respective boards for failing to implement the mandatory cybersecurity controls. Officials have characterised the non-compliance as a serious governance lapse rather than a mere technical oversight, underscoring the growing expectation that organisational leaders must exercise effective oversight of cyber risk.

The Kenyan government’s response reflects a broader global trend in regulatory thinking. Around the world, cybersecurity has become an issue of corporate governance rather than simply information technology. Boards are increasingly expected to understand cyber risk, ensure that appropriate controls are implemented and monitored, and satisfy themselves that their organisations comply with applicable legal and regulatory obligations. Regulators are correspondingly becoming less tolerant of failures that stem from weak oversight, inadequate governance or delayed implementation of known security measures.

For compliance professionals, the significance of Kenya’s latest enforcement action extends well beyond the immediate sanctions. It demonstrates that regulatory compliance in the digital age encompasses more than financial reporting, procurement controls or anti-corruption measures. It now includes safeguarding an organisation’s digital identity, protecting official communications and ensuring that cybersecurity obligations receive the same level of executive attention as any other strategic risk.

The episode also reinforces an important lesson for boards and senior management: responsibility for cybersecurity cannot be delegated entirely to information technology teams. While technical specialists implement security controls, accountability for ensuring that those controls exist, remain effective and comply with government directives ultimately rests with organisational leadership.

As cyber threats continue to evolve in sophistication and scale, Kenya’s enforcement initiative may well become a benchmark for public-sector governance across Africa. It sends a clear message that compliance with cybersecurity directives is no longer a matter of administrative convenience but an essential component of institutional accountability. In today’s regulatory environment, protecting an organisation’s digital infrastructure is inseparable from protecting its reputation, maintaining public trust and fulfilling the fiduciary responsibilities of those charged with its leadership.