I.      General information

I.      Objectives and desired results

 1)      General objective

The general objective is to provide high-level technical and legal expertise to the Ministry of ICT and Digital Economy (MICDE) in the finalization of the draft National Cybersecurity Policy, ensuring alignment with Kenya’s existing digital transformation initiatives, the draft National Cybersecurity Strategy, and international best practices, particularly the EU NIS2 Directive principles. 

2)      Specific objectives

(I)                  To conduct a technical and legal review of the draft National Cybersecurity Policy to ensure internal consistency and alignment with national and regional frameworks.

(II)                To assess the coherence of the draft policy with the National Cybersecurity Strategy, the Critical Infrastructure Protection Bill, and other relevant policies and legal instruments.

(III)              To provide technical assistance to the MICDE technical working group (TWG) in preparing and conducting public participation and stakeholder consultations, in compliance with Kenya’s 2024 Policy Development Guidelines.

(IV)             To assist the MICDE in consolidating, analysing, and integrating public feedback into a final validated policy draft ready for Cabinet consideration.

(V)               To provide strategic guidance and technical notes supporting the final stages of approval, up to Cabinet submission and potential gazettement.

 3)      Expected results

This short term expertise needs to provide strategic advices to the MICDE in close collaboration with the Project Team. The expected results following this short term expertise are: 

·       A technically sound, inclusive, and coherent draft National Cybersecurity Policy aligned with national and international standards is finalized.

·       Coordination and ownership of the policy process among key Kenyan institutions are improved.

·       Effective and well-documented public participation process is conducted according to Kenyan law.

·       A final policy ready for Cabinet is ready for approved and published in the Kenya Gazette. 

II.      Description of the assignement

 1)      Planned activities

The expert will be responsible for carrying out, under the supervision of the Project Team, all the necessary tasks needed to deliver the expected deliverables in accordance with best international recognized practices in the field. These tasks may include:

 Phase 1 – Review and alignment

·     Review the latest draft of the National Cybersecurity Policy and related documents.

·     Map and assess coherence with national (e.g., National Cybersecurity Strategy, CIIP Bill, Data Protection Act, Digital Economy Blueprint) and regional/international frameworks (e.g., AU Convention, EAC, EU NIS2) and best practices.

·     Identify gaps, overlaps, and inconsistencies, and provide annotated feedback and recommendations.

·     Prepare an Inception Report summarizing approach, methodology and initial findings

 Phase 2 – Support to public participation with a stakeholder consultation

·     Advise and assist the TWG in developing the Public Participation Plan, ensuring compliance with Kenya’s guidelines for the development of National Government Policy and Legislation (2024).

·     Prepare or contribute to preparation of materials for public participation (summaries, briefing notes, online consultation guidance, validation templates).

·     Where relevant and feasible, participate in stakeholder engagement meetings, provide facilitation support, and ensure proper documentation of feedback.

 Phase 3 – Policy finalization and approval process

·     Consolidate stakeholder input and support the revision of the final draft National Cybersecurity Policy.

·     Prepare the cabinet memorandum and validation report and explanatory note in line with official processes.

·     Provide guidance to MICDE for the submission of the final policy to the cabinet and its subsequent gazettement.

·     Deliver a final technical report summarizing the review, process, and recommendations for next steps (if required).

 2)      Deliverables

 3)      Technical-methodological concept

The consultant shall provide a comprehensive approach covering:

•      Analytical framework: Systematic policy review using benchmark criteria (legality, coherence, feasibility, inclusivity).

•      Stakeholder management: Clear engagement strategy for government, private sector, civil society and academia.

•      Knowledge management: Documenting lessons, providing templates and recommendations for future cybersecurity governance.

•      Monitoring and reporting: Progress updates, milestone tracking and coordination meetings with MICDE and Expertise France.

•      Gender and inclusion: Ensuring gender-responsive approaches and inclusion of marginalized groups.

•      Sustainability: Integrating recommendations for policy implementation, capacity development and institutionalization.

 4)      Coordination

The expert will be reporting to the Project Manager.

A launch meeting shall be held few days after the contract has been notified.

Close collaboration must take place with the project team and the other experts from assignment preparation right up to completion. Furthermore, regular exchanges must take place with the Project Manager and the Key expert on assignment progress and any difficulties that may be encountered. 

III.      Place, duration and terms of performance

1)      Place: Home based and/or in Nairobi, Kenya

2)      Implementation period: November 2025 to March 2026

3)      Start date: as soon as possible

4)      Effective duration per assignment: 40 man-days

5)      Schedule/programme: 

The provisional programme for assignment implementation is as follows: