A ransomware incident at a Mombasa cement plant or a tampered SCADA setpoint at a Rift Valley water utility would not just be an IT problem. It would stop production, contaminate supply, trigger regulatory scrutiny from the Energy and Petroleum Regulatory Authority (EPRA) or WASREB, and potentially endanger lives. Yet most Kenyan industrial operators still treat Operational Technology (OT) security as an extension of their IT program. It is not.
OT and Industrial Control Systems (ICS) cybersecurity for Kenyan manufacturers, utilities, and agribusinesses requires a distinct governance model, a different risk calculus, and frameworks built for environments where availability and safety outrank confidentiality. This post lays out how to build that program.
Why OT Security Is a Different Discipline
IT security protects data. OT security protects physical processes — turbines spinning, pasteurizers heating, pumps dosing chlorine, conveyor belts moving tea leaves. The consequences of failure are measured in downtime, spoilage, environmental damage, or human harm.
Three realities make OT environments uniquely difficult to secure:
- Legacy equipment with decades-long lifecycles. PLCs and HMIs commissioned in the early 2000s often run unpatched Windows XP or proprietary firmware that vendors no longer support.
- Availability trumps patching. You cannot reboot a sugar mill's distributed control system during crushing season to apply a Tuesday patch.
- Convergence without controls. Many Kenyan operators have quietly connected OT networks to corporate IT, cloud historians, or remote vendor access portals — often without segmentation, monitoring, or formal risk assessment.
The threat is not theoretical. Groups like Sandworm, Volt Typhoon, and various ransomware affiliates have demonstrated capability and intent to disrupt industrial operations globally. African critical infrastructure is not off their map — it is simply less defended.
Anchor Your Program in the Right Frameworks
Do not try to force ISO 27001 onto your plant floor. It is a strong backbone for enterprise information security, but it does not address process safety, zone segmentation, or safe states. Use these instead, layered together:
IEC 62443 — The Core Standard
IEC 62443 is the global reference for industrial automation and control system security. It gives you:
- A zones-and-conduits model for segmenting OT networks
- Security levels (SL 1–4) you can target per zone based on threat profile
- Role definitions covering asset owners, system integrators, and product suppliers
For a Kenyan tea processor or a county water utility, targeting SL 2 across critical zones is a realistic starting posture.
NIST SP 800-82 — Practical Guidance
NIST's Guide to Operational Technology Security is free, prescriptive, and translates well to resource-constrained environments. Use it to shape your technical controls and incident response playbooks.
Kenya Data Protection Act and Sector Regulators
If your OT systems process personal data — customer meter readings, farmer biometric data at an outgrower scheme, patient data in a pharma plant — the Kenya Data Protection Act applies. Add sector-specific obligations from EPRA, WASREB, Communications Authority, or KEBS depending on your industry. Kenya Data Protection Act Compliance Service Page
Build the Governance Program in Five Moves
1. Create an OT Asset Inventory
You cannot protect what you have not catalogued. Document every PLC, RTU, HMI, engineering workstation, historian, and network device. Include firmware versions, communication protocols (Modbus, OPC-UA, DNP3), and criticality to the process.
2. Run an OT-Specific Risk Assessment
Standard IT risk methodologies miss OT-specific threats: safety instrumented system bypass, rogue firmware uploads, or loss of view/loss of control scenarios. Use a HAZOP-informed cyber risk approach. Risk Assessment Services
3. Segment Ruthlessly
Implement a Purdue Model-aligned architecture. At minimum, enforce a demilitarized zone between corporate IT (Level 4) and process control (Level 3 and below). No flat networks. No direct RDP from the finance VLAN to a PLC.
4. Govern Remote Access and Third Parties
Vendor remote access is the number one OT compromise vector worldwide. Enforce jump hosts, MFA, session recording, and time-boxed access. Treat every integrator and OEM as a third-party risk.
5. Plan for Incident Response in the Physical World
Your IR plan must answer: who authorises taking a production line offline? What is the safe state for each process? Who speaks to the regulator within 72 hours? Tabletop these scenarios annually with plant managers, not just IT.
Where Most Kenyan Operators Fail
Three recurring gaps:
- Treating OT as an IT department problem. OT security needs executive sponsorship and plant engineering ownership.
- Buying tools before writing policy. A fancy OT monitoring platform without zone definitions, response procedures, or trained operators generates alerts no one actions.
- No tabletop exercises for industrial scenarios. Ransomware playbooks written for office environments do not cover a compromised safety PLC.
Start with governance. Technology follows policy, not the other way around.
Moving Forward
OT cybersecurity is not optional for Kenyan critical infrastructure operators. The regulatory direction, the threat landscape, and the operational dependencies all point one way. The question is whether you build the program deliberately or react after an incident.
SecureZaidi helps East African enterprises achieve and maintain compliance. Get in touch.