Caleb Amisi Demands Answers Over KSh4.7 Million Government Cybersecurity Bill

Caleb Amisi (centre) Speaks to Media Over KSh4.7 Million Cybersecurity Bill.

By: Gladys Karuga

People’s Renaissance Movement has raised questions over the cost of implementing the government’s domain and email security directive, with Hon. Caleb Amisi demanding greater transparency on how public institutions arrived at a bill of approximately KSh4.7 million per institution.

Amisi said the concern is not about the need for cybersecurity, but rather the financial burden being placed on public institutions through the Whole-of-Government Domain and Email Security initiative.

According to the briefing, the Head of Public Service issued a circular on January 13, 2025, requiring ministries, departments, agencies and state corporations to adopt approved domain and email protection measures. The Communications Authority of Kenya (CA) was designated as the central government entity responsible for coordinating and overseeing the initiative.

Subsequent reminders were reportedly issued on November 11, 2025, January 26, 2026, and July 28, 2026, with implementation currently ongoing and public institutions required to make payments to the Communications Authority.

Amisi questioned how the cost had reached approximately KSh4.7 million per institution, arguing that the public deserves a clear explanation of what services are covered by the amount and whether the charges represent their actual market value.

He further questioned whether alternative service providers were considered and whether the procurement process fully complied with the law.

The People’s Renaissance Movement also raised concerns over the cost of registering and maintaining government .go.ke domains, noting that ordinary .KE domains can cost significantly less depending on the provider and package.

Amisi acknowledged that government institutions require strong cybersecurity measures, including secure email systems, firewalls, data encryption and protection against cyberattacks such as Distributed Denial-of-Service (DDoS). However, he argued that expenditure running into millions of shillings must be supported by a clear and transparent justification.

Another major concern raised was the alleged distribution of the funds. Amisi said he had been informed that although the Communications Authority is the recipient of the payments, only about 15 percent remains with the Authority, while the rest is reportedly transferred to a private entity.

He questioned how the private entity was selected and whether it was chosen through a competitive process.

The issue, he said, is particularly concerning for public universities and other institutions experiencing financial difficulties. Some institutions, according to Amisi, are struggling to pay staff, settle suppliers, maintain facilities and provide quality services while simultaneously being required to meet the cybersecurity-related payments.

He also raised concerns over reports that some institutions have received show-cause letters after failing to make the payments, while others have received invoices from the Communications Authority.

Amisi called on the Head of Public Service, the Communications Authority of Kenya, relevant government agencies and Parliament to provide a comprehensive explanation of how the KSh4.7 million per institution figure was determined.

He stressed that Kenya needs stronger cybersecurity to protect government systems from increasing cyber threats, but warned that cybersecurity should not be used to justify unexplained or excessive expenditure.

“At a time when Kenyans are being asked to tighten their belts, every shilling of public money must be accounted for,” Amisi said.

He maintained that the issue goes beyond government domain names and email addresses, arguing that it is ultimately about accountability, value for money and protecting public institutions from unnecessary financial burdens