The publication of the National Cybersecurity Strategy in 2014 by the Kenyan Ministry of ICT is a really strong foundation upon which the country can build comprehensive cyber security policies and capabilities. The four goals listed in the strategy (enhancing the nation's cybersecurity posture, building national capability, foster information sharing and collaboration, and finally, providing national leadership) are probably the four key challenges for most countries. At the time, the accompanying maturity model suggested that Kenya was on the lowest tier of progress in respect of most evaluation areas. Whilst progress appears to have been made across a broad front; implementation is probably not as far forward as would have been expected over the intervening five years. The passing of the Computer Misuse & Cyber Crimes Act in 2018 was one of the exceptions. The CBK and SASRA guidelines on cyber security best practice in the financial sector are also exceptions. The passing the 2019 Data Protection Act (modelled on the EU's GDPR) and the establishment of the Data Protection Commissioner role are both signs of further progress. Anecdotal evidence that the Ministry of Interior has a mandate to oversee cyber security in the public and private sectors.