Assurance, testing and what a security services contract has to prove
Security services are bought as assurance, which means the supplier's own credentials are part of the deliverable. Buyers require certified testers from a recognised scheme for penetration testing, accredited consultancies for risk assessment against a named framework, and evidence that the supplier's own environment meets at least the standard it is being engaged to assess. A firm that cannot evidence its own information security management is a poor advertisement for the advice it is selling, and evaluations increasingly say so explicitly.
Scope definition is the contractual heart of testing work and the commonest source of dispute. Rules of engagement set out which systems are in scope, which techniques are permitted, what happens when a critical finding is discovered mid-test, out-of-hours windows, and the authorisation that makes otherwise unlawful activity lawful. Testing against systems hosted by a third party requires that party's written permission, which is a lead time bidders should assume rather than discover.
Monitored services -- detection and response delivered continuously -- are a different commercial animal from assessment. They are priced by volume of telemetry or by assets covered, and the terms that matter are coverage hours, time to detect and time to respond by severity, who is authorised to take containment action on the buyer's systems, and how incident evidence is preserved for later investigation. Clearance for analysts, the location of the operations centre, and data residency for logs are usually fixed by the buyer rather than proposed, and the exit terms should leave the buyer holding its own detection content.
This section describes how this category is bought generally, across the public buyers that publish it. The figures elsewhere on this page are measured for this market alone.
Who buys cybersecurity in Kenya?
GlobalGov holds 148 cybersecurity records from 57 distinct buying organisations in Kenya. The most frequent publishers are ICT Authority (14 records); Kenya Power & Lighting Company (7 records); Unclaimed Financial Assets Authority (7 records); Kenya Railways (5 records); National Construction Authority (5 records); Communications Authority Of Kenya (4 records). Between them the 6 largest account for 28% of everything published, so buying here is spread across many separate authorities.
| Buying organisation | Records | Share |
|---|---|---|
| ICT Authority | 14 | 9.5% |
| Kenya Power & Lighting Company | 7 | 4.7% |
| Unclaimed Financial Assets Authority | 7 | 4.7% |
| Kenya Railways | 5 | 3.4% |
| National Construction Authority | 5 | 3.4% |
| Communications Authority Of Kenya | 4 | 2.7% |
How long do bidders get to respond to cybersecurity tenders in Kenya?
Across the 88 Kenya cybersecurity notices that publish both a publication date and a closing date, the median response window is 14 days. A quarter of them allowed 9 days or fewer and a quarter stayed open for more than 22. 50 of them (57%) closed within a fortnight of being published, so on this market a bidder who reviews notices once a week can lose most of the response window before reading one.
How often are cybersecurity tenders published in Kenya?
Kenya published 18 notices in this category in the last twelve months. That is 28% fewer than the 25 published in the twelve months before that. Over the last three years there were 76, spread across 62 separate months of activity since 17 January 2019. April is historically the busiest month. No new notice has been published in this category since 16 June 2026, 107 days ago, so treat the figures above as a record of the market rather than as this week's pipeline.
How does Kenya compare with other cybersecurity markets?
Among the 21 countries where GlobalGov holds a comparable cybersecurity market, Kenya ranks 7th by number of records. The largest is France (420 records against 148 here). Within Kenya itself, cybersecurity is the 49th largest of the 83 procurement categories tracked here.
Where do the Kenya cybersecurity records on this page come from?
These 148 records are collected from 2 official sources: the Kenya PPRA (146), the World Bank (2). GlobalGov is an independent aggregator and is not affiliated with any of them; each record links back to the notice on its issuing portal. The set is rebuilt nightly, and the counts on this page were taken on 2026-10-01.
Most recent Cybersecurity tenders in Kenya
No individual notice in this category currently has a public record page. The market figures above are computed over all 148 records GlobalGov holds for it.
Other procurement categories in Kenya
Cybersecurity procurement in other markets
Never Miss a Kenya Government Contract
Finding Kenya tenders usually means a local portal, a local registration and someone who reads the language. Get an alert you can read when a new cybersecurity opportunity is published there.
Start Free Trial