Kenya ICTA-8.003:2023 Cloud Computing Standard
Kenya's Government ICT Standard ICTA-8.003:2023 on cloud computing for ministries, counties, departments and agencies: general and contract requirements, the roles of cloud service customers and providers, and the cross-cutting aspects of auditability, availability, governance, interoperability, maintenance, performance, portability, PII protection, resiliency, reversibility, security and service level agreements.
Kenya ICTA-8.003:2023 Cloud Computing Standard is a compliance framework from Kenya with 5 domains and 35 controls. The largest domains are Section 6: General requirements – Kenya ICTA-8.003:2023 Cloud Computing Standard (13 controls), Section 8: Cross-cutting aspects (PII, resiliency, reversibility, security, service levels) – Kenya ICTA-8.003:2023 Cloud Computing Standard (7 controls), Section 7: User context, roles of the cloud service customer and provider – Kenya ICTA-8.003:2023 Cloud Computing Standard (6 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Section 6.15: Contract requirements – Kenya ICTA-8.003:2023 Cloud Computing Standard
| Code | Title |
|---|---|
| kenya-icta-8-003-2023-cloud-computing-standard::6.15.1 | Contracts provide for exit, data sanitisation, confidentiality and breach disclosure |
| kenya-icta-8-003-2023-cloud-computing-standard::6.15.10 | Contracts provide audit mechanisms, retention compliance, end-of-contract data handling and protection on provider takeover |
| kenya-icta-8-003-2023-cloud-computing-standard::6.15.5 | Contracts fix data ownership, intellectual property, Kenyan data location, data protection compliance and service levels |
Section 6: General requirements – Kenya ICTA-8.003:2023 Cloud Computing Standard
| Code | Title |
|---|---|
| kenya-icta-8-003-2023-cloud-computing-standard::6.1 | Comply with law, the information security standard and risk policies in every use of cloud |
| kenya-icta-8-003-2023-cloud-computing-standard::6.10 | Consider a cloud solution only after a risk evaluation accepted by the chief information security officer |
| kenya-icta-8-003-2023-cloud-computing-standard::6.11 | Use facilities rated Uptime Institute Tier III or higher, or add resiliency |
| kenya-icta-8-003-2023-cloud-computing-standard::6.12 | Safeguard authentication, authorisation and identity and access management |
| kenya-icta-8-003-2023-cloud-computing-standard::6.13 | Acquire cloud solutions from ICT Authority accredited providers and prioritise government cloud |
| kenya-icta-8-003-2023-cloud-computing-standard::6.14 | Make negotiated SLA requirements supersede the master service agreement |
| kenya-icta-8-003-2023-cloud-computing-standard::6.2 | Do not host critical applications in the public cloud |
| kenya-icta-8-003-2023-cloud-computing-standard::6.3 | Prepare an exit strategy when contracting with the provider |
| kenya-icta-8-003-2023-cloud-computing-standard::6.4 | Obtain providers' latest standards-based security assurance early in procurement |
| kenya-icta-8-003-2023-cloud-computing-standard::6.5 | Store and process MCDA data within Kenya |
| kenya-icta-8-003-2023-cloud-computing-standard::6.6 | Project licensing needs and confirm the provider meets them |
| kenya-icta-8-003-2023-cloud-computing-standard::6.7 | Protect data on foreign nationals under the Data Protection Act and their home laws |
| kenya-icta-8-003-2023-cloud-computing-standard::6.8 | Encrypt cloud data with keys owned and managed by the Government of Kenya |
Section 7: User context, roles of the cloud service customer and provider – Kenya ICTA-8.003:2023 Cloud Computing Standard
| Code | Title |
|---|---|
| kenya-icta-8-003-2023-cloud-computing-standard::7.1.1 | Identify cloud service users and manage their credentials and use |
| kenya-icta-8-003-2023-cloud-computing-standard::7.1.2 | Appoint a cloud service administrator |
| kenya-icta-8-003-2023-cloud-computing-standard::7.1.3 | Appoint a cloud service business manager |
| kenya-icta-8-003-2023-cloud-computing-standard::7.1.4 | Appoint a cloud service integrator |
| kenya-icta-8-003-2023-cloud-computing-standard::7.2.1 | Government cloud providers appoint operations, deployment and service managers |
| kenya-icta-8-003-2023-cloud-computing-standard::7.2.4 | Government cloud providers appoint business, support, inter-cloud, security and risk, and network roles |
Section 8: Cross-cutting aspects (PII, resiliency, reversibility, security, service levels) – Kenya ICTA-8.003:2023 Cloud Computing Standard
| Code | Title |
|---|---|
| kenya-icta-8-003-2023-cloud-computing-standard::8.10 | Secure reversibility: retrieve data and artefacts and have the provider delete all copies |
| kenya-icta-8-003-2023-cloud-computing-standard::8.11.1 | Implement cloud security capabilities, detection and network protection |
| kenya-icta-8-003-2023-cloud-computing-standard::8.11.4 | Define security responsibilities, address model-specific threats, catalogue data sensitivity and control keys |
| kenya-icta-8-003-2023-cloud-computing-standard::8.12.1 | Hold a cloud SLA covering quality, security, performance, remedies and stated limitations |
| kenya-icta-8-003-2023-cloud-computing-standard::8.12.4 | Have the SLA classify data objects, state availability, confidentiality, integrity, access and PII handling, and align it with the master agreement |
| kenya-icta-8-003-2023-cloud-computing-standard::8.8 | Protect personally identifiable information and comply with the Data Protection Act |
| kenya-icta-8-003-2023-cloud-computing-standard::8.9 | Implement resiliency processes for continuous or predictable operation |
Section 8: Cross-cutting aspects (auditability to portability) – Kenya ICTA-8.003:2023 Cloud Computing Standard
| Code | Title |
|---|---|
| kenya-icta-8-003-2023-cloud-computing-standard::8.1 | Have cloud services independently audited and secure audit evidence in the agreements |
| kenya-icta-8-003-2023-cloud-computing-standard::8.2 | Guarantee availability and implement governance over the provider relationship |
| kenya-icta-8-003-2023-cloud-computing-standard::8.4 | Require interoperability through standard interfaces and standards evolution |
| kenya-icta-8-003-2023-cloud-computing-standard::8.5 | Govern maintenance and versioning transparently |
| kenya-icta-8-003-2023-cloud-computing-standard::8.6 | Define and monitor SLA performance metrics |
| kenya-icta-8-003-2023-cloud-computing-standard::8.7 | Avoid lock-in through data and application portability |
What is Kenya ICTA-8.003:2023 Cloud Computing Standard and who does it apply to?
Kenya ICTA-8.003:2023 Cloud Computing Standard is a compliance framework from Kenya with 5 domains and 35 controls. Kenya's Government ICT Standard ICTA-8.003:2023 on cloud computing for ministries, counties, departments and agencies: general and contract requirements, the roles of cloud service customers and providers, and the cross-cutting aspects of auditability, availability, governance, interoperability, maintenance, performance, portability, PII protection, resiliency, reversibility, security and service level agreements. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Kenya ICTA-8.003:2023 Cloud Computing Standard actually require?
Kenya ICTA-8.003:2023 Cloud Computing Standard has 35 controls organised across 5 domains. The largest domains are Section 6: General requirements – Kenya ICTA-8.003:2023 Cloud Computing Standard (13 controls), Section 8: Cross-cutting aspects (PII, resiliency, reversibility, security, service levels) – Kenya ICTA-8.003:2023 Cloud Computing Standard (7 controls), Section 7: User context, roles of the cloud service customer and provider – Kenya ICTA-8.003:2023 Cloud Computing Standard (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Kenya ICTA-8.003:2023 Cloud Computing Standard do I already cover?
Kenya ICTA-8.003:2023 Cloud Computing Standard does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Kenya ICTA-8.003:2023 Cloud Computing Standard?
Start your Kenya ICTA-8.003:2023 Cloud Computing Standard compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Kenya ICTA-8.003:2023 Cloud Computing Standard requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 35 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required