A plain-language glossary of key cybersecurity and compliance terms — useful for non-technical stakeholders, board members, and anyone new to the field.
ODPC
The Office of the Data Protection Commissioner — Kenya's regulatory authority responsible for enforcing the Data Protection Act 2019, handling complaints, conducting investigations, and imposing penalties on non-compliant organisations.
Kenya DPA
The Kenya Data Protection Act 2019 — legislation that establishes the rights of individuals over their personal data and the obligations of organisations that collect and process it. Modelled closely on the EU GDPR.
Data Controller
An entity that determines the purposes and means of processing personal data. Under Kenya DPA, data controllers must register with the ODPC and are responsible for ensuring compliance with the Act's requirements.
Data Processor
An entity that processes personal data on behalf of a data controller — such as a cloud provider, payroll system, or marketing agency. Processors must also register with the ODPC and comply with the DPA.
Phishing
A cyberattack method where criminals send fraudulent emails, SMS messages, or WhatsApp messages impersonating trusted organisations (M-Pesa, KRA, HELB, banks) to trick recipients into revealing credentials or sensitive information.
Ransomware
Malicious software that encrypts an organisation's files and demands a ransom payment for the decryption key. Ransomware attacks against African businesses increased 74% in 2024 and can result in weeks of operational disruption.
ISO 27001
The international standard for Information Security Management Systems (ISMS). Organisations that achieve certification have demonstrated to an independent auditor that they have implemented systematic controls to protect information security.
GRC
Governance, Risk and Compliance — an integrated approach to managing an organisation's governance framework, risk posture, and regulatory compliance obligations. A mature GRC programme gives leadership real-time visibility into security and compliance status.
vCISO
Virtual Chief Information Security Officer — a senior cybersecurity executive hired on a part-time or fractional basis rather than as a full-time employee. Provides strategic security leadership at a fraction of the cost of a full-time CISO hire.
Penetration Testing
An authorised simulated cyberattack against an organisation's systems, networks, or applications — designed to identify exploitable vulnerabilities before real attackers find them. Also known as "pen testing" or "ethical hacking."
DPIA / PIA
Data Protection Impact Assessment (also called Privacy Impact Assessment) — a process required under Kenya DPA and GDPR for assessing the privacy risks of new systems, processes, or significant changes to data processing activities.
NIST CSF
The NIST Cybersecurity Framework — a voluntary framework developed by the US National Institute of Standards and Technology that provides guidance on managing and reducing cybersecurity risk, organised around six core functions: Govern, Identify, Protect, Detect, Respond, Recover.
Multi-Factor Authentication (MFA)
A security method requiring users to provide two or more verification factors before accessing a system — typically a password plus a one-time code sent by SMS or generated by an authenticator app. MFA blocks over 99% of automated account compromise attacks.
Encryption
The process of converting data into an unreadable format using a cryptographic key — ensuring that even if data is intercepted or stolen, it cannot be read without the decryption key. Required for sensitive personal data under Kenya DPA.
Incident Response (IR)
The organised approach an organisation takes when it detects or suspects a cybersecurity breach — covering detection, containment, investigation, recovery, and lessons learned. Under Kenya DPA, data breaches must be reported to the ODPC within 72 hours.
Zero Trust
A security architecture principle that assumes no user, device, or network should be automatically trusted — even inside the organisation's perimeter. Every access request is verified, authorised, and logged regardless of where it originates.
SOC
Security Operations Centre — a team and facility responsible for continuously monitoring an organisation's IT infrastructure for cybersecurity threats, detecting incidents, and coordinating response activities 24 hours a day, 7 days a week.
Vulnerability Assessment
A systematic review of security weaknesses in an organisation's information systems — identifying, classifying, and prioritising vulnerabilities so they can be remediated before attackers exploit them.