Website Terms of Use.

Effective date: 27 October 2026 · Version: 1.0 · Reference: CCIB/LEGAL/WEB/001

1. Introduction and acceptance

These Terms of Use (“Terms”) govern access to and use of websites, portals, membership interfaces, knowledge repositories and other online services expressly operated or designated by Cybersecurity Control and Information Bureau LTD (“CCIB”, “we”, “us” or “our”) (the “Platform”). By accessing or using the Platform, you agree to comply with these Terms to the extent an enforceable agreement is formed under applicable law. If you do not agree, discontinue use, except where access is otherwise protected by law. Where a restricted service requires registration, CCIB may require affirmative acceptance. These Terms operate alongside the Privacy Notice, Cookie Policy, Membership Scheme and applicable service-specific agreements; a separately executed agreement prevails for its subject matter to the extent of any inconsistency, subject to mandatory law.

2. Definitions and service scope

“User” means a person or entity accessing the Platform; “Member” means a person or organization formally admitted under a CCIB membership scheme; “Content” includes publications, reports, advisories, databases, media, software and learning materials; “User Content” means materials submitted by Users; “Restricted Information” means confidential, controlled or access-limited information. The Platform may provide cybersecurity awareness, threat intelligence, research, institutional membership, training, recognition programme information, events and collaboration services. Specific services may require eligibility checks, separate agreements or fees. Online descriptions do not themselves constitute a binding offer.

3. Eligibility, accounts and authority

Users must provide accurate registration information and keep it current. A person acting for an organization represents that they have authority to do so. Account holders must safeguard credentials, avoid sharing access and promptly report suspected compromise. CCIB may verify eligibility and reasonably restrict access to approved Members, researchers or authorized participants. Submission of an application or payment does not alone confer membership, accreditation or recognition.

4. Acceptable use

Users shall use the Platform lawfully and shall not: (a) access systems or data without authorization; (b) distribute malware or malicious code; (c) undertake unauthorized scanning, penetration testing, exploitation or service disruption; (d) bypass access controls; (e) impersonate others or engage in fraud or harassment; (f) scrape or extract restricted information without permission; (g) disclose unlawfully obtained personal data, credentials or confidential material; or (h) infringe intellectual property or privacy rights. CCIB may use proportionate security controls. This clause does not prohibit expressly authorized or legally protected activity.

5. Vulnerability reporting and responsible research

CCIB encourages good-faith reporting of suspected vulnerabilities through its published security reporting channel. These Terms do not themselves authorize security testing. Unless separately authorized in writing, researchers must not exploit systems, access third-party information, persist in systems, disrupt services or publish sensitive exploit details that create unreasonable risk. Reports will be handled under CCIB’s applicable vulnerability disclosure and incident response procedures. Any safe-harbour commitment must be set out in a separately published vulnerability disclosure policy.

6. Cyber threat intelligence and restricted information

Technical advisories, indicators of compromise and research materials are supplied for legitimate defensive, educational and research purposes. Users must observe confidentiality labels, redistribution restrictions and information-sharing protocols. Restricted intelligence may not be republished, sold or disclosed without authorization. Users remain responsible for evaluating accuracy, timeliness, context and suitability before operational reliance. CCIB does not guarantee that intelligence is complete or prevents all incidents.

7. Intellectual property and permitted use

Unless otherwise stated, CCIB or its licensors retain rights in the Platform and protected Content, including text, designs, databases, logos, marks and software. Users receive a limited, non-exclusive, non-transferable permission to access public Content for lawful personal, educational, research or internal institutional purposes, subject to applicable licences. Commercial exploitation, bulk redistribution, modification or sublicensing requires permission unless otherwise allowed by law or licence. Attribution and proprietary notices must be preserved. Access does not grant a licence to CCIB trademarks, membership marks or recognition seals.

8. User submissions

Users retain their lawful rights in submitted materials. By submitting User Content, they grant CCIB a non-exclusive, worldwide, royalty-free licence to host, store, process, reproduce and display it only as reasonably necessary to deliver the relevant service, administer submissions or comply with law. This is not permission to publicly disclose confidential submissions. Users warrant that they have authority to submit materials. CCIB may remove unlawful or policy-violating content. Joint research and intellectual property ownership may require separate written terms.

9. Privacy and cookies

CCIB processes personal data in accordance with the Kenya Data Protection Act, 2019, and other laws applicable to particular activities, including GDPR or UK GDPR where their territorial rules apply. The separate Privacy Notice shall describe processing purposes, lawful bases, retention, recipients, international transfers, safeguards and data subject rights. Non-essential cookies or tracking will be subject to consent where legally required; users should consult the Cookie Policy for available choices. Nothing in these Terms limits mandatory privacy rights.

10. Membership, recognition and programmes

Membership registration, renewal and contributions are governed by the applicable CCIB Membership Scheme, fee schedule and agreement. Membership does not itself constitute cybersecurity certification, accreditation, regulatory authorization, independent assurance or endorsement. Recognition and assessment programmes have their own eligibility, assessment, decision, appeal and mark-use rules. No User may claim a status that CCIB has not formally granted or that has expired or been suspended.

11. Third-party links and services

Links to external websites and services are provided for convenience or reference. CCIB does not control their content, security, availability or privacy practices, and a link does not imply endorsement. Users should review the relevant third-party terms and notices. CCIB may remove links for legal, security or institutional reasons.

12. Information accuracy and reliance

CCIB endeavors to provide useful and reasonably current Content, but cybersecurity threats, standards and laws change. Unless expressly agreed otherwise, public Content is general information rather than individualized legal, technical or professional advice. Users should independently verify material facts and assess applicability before acting. CCIB may correct or withdraw Content when reasonably necessary.

13. Availability and security

CCIB takes reasonable steps to maintain Platform integrity but does not guarantee uninterrupted access or freedom from every defect or vulnerability. Maintenance, cyber incidents, infrastructure failures and other events may affect availability. CCIB may temporarily restrict access to protect users or information. Users must maintain appropriate security on their own devices and networks. Mandatory legal duties remain unaffected.

14. Disclaimer of warranties

To the fullest extent permitted by applicable law, publicly available Platform Content and functionality are supplied “as is” and “as available”. Except for express written commitments or mandatory rights, CCIB does not warrant that Content is complete, suitable for every purpose, uninterrupted or error-free. This disclaimer does not override service-specific agreements or statutory obligations.

15. Liability and indemnification

To the extent permitted by applicable law, CCIB excludes liability for indirect, incidental, special and consequential losses arising solely from general public use of the Platform. Nothing excludes liability for fraud, fraudulent misrepresentation, wilful misconduct or any liability that cannot lawfully be limited. Commercial or institutional Users shall, to the extent permitted by law, indemnify CCIB against reasonable documented third-party claims and direct losses caused by their unlawful conduct, material breach or infringement, excluding losses attributable to CCIB’s own negligence, misconduct or breach. CCIB will provide reasonable notice of relevant claims.

16. Suspension and termination

CCIB may proportionately restrict or terminate access for material breach, fraud, unauthorized access, serious security risks or legal requirements. Where appropriate and practicable, notice and an opportunity to remedy will be provided; immediate action may be taken to prevent imminent harm. Suspension of Platform access does not automatically terminate a separately executed membership or service agreement. Accrued obligations and provisions intended to survive remain effective.

17. Changes to these Terms

CCIB may update these Terms for legal, security, technological or service changes. The updated version and revision date will be published. Material changes affecting registered Users will be notified reasonably in advance unless urgent law or security needs require otherwise. Where law requires express consent, CCIB will obtain it. Changes do not retrospectively remove accrued contractual rights or mandatory protections.

18. Governing law and disputes

These Terms are governed by the laws of the Republic of Kenya, without prejudice to mandatory protections or jurisdictional rights applying elsewhere. Parties should first attempt good-faith resolution. If unresolved within 30 calendar days of written notice, either party may seek relief in a competent Kenyan court, subject to mandatory jurisdiction rules. Mediation or arbitration may be agreed separately in writing. Urgent interim relief remains available where lawful.

19. Legal compliance

Users must comply with applicable cybersecurity, data protection, intellectual property and electronic communications laws. Relevant Kenyan legislation may include the Computer Misuse and Cybercrimes Act, 2018; Data Protection Act, 2019; Companies Act, 2015; and Copyright Act, 2001, each as applicable and amended. International Users must comply with applicable local laws and restrictions on controlled or classified information. No controlled or confidential information may be uploaded without authorization.

20. General provisions

If a provision is invalid or unenforceable, the remainder continues to the extent permitted by law. Failure to enforce a right is not a waiver. No agency, partnership or employment relationship is created by general website access. Headings are for convenience. Notices must use the contact methods stated below or otherwise required by law.

About these Terms

These Terms are issued by Cybersecurity Control and Information Bureau LTD, a company registered in the Republic of Kenya on 27 December 2018 (Company No. PVT-9XUJX2Q), of CCIB Headquarters, Riverside Drive, Nairobi City County, P.O. Box 35509-00100, Nairobi.