The prescribed NC4 audit template for designated CII owners. Seven sections covering everything the auditor examines, from network configuration to physical security to regulatory compliance. This is what you need to be ready for.
Authority
Form CMCA 6 [r.49(4)] is the prescribed audit template under the Computer Misuse and Cybercrimes (CII and Cybercrime Management) Regulations. The Director of NC4 (the National Computer and Cybercrimes Co-ordination Committee) is the enforcement authority.
Notice
Under Regulation 46, NC4 can require a designated CII owner to undergo a compliance audit. Auditors may enter premises and require production of documents. You have 30 days from the audit notice to be ready.
What We Do
We run pre-audit readiness assessments against this exact template, finding gaps before auditors do. Each section below maps to a specific port254 service. CII Compliance Audit Readiness →
Type of Organisation
CISO is mandatory. Under Regulation 32, every designated CII owner must appoint a named CISO:a Kenyan citizen with a master's degree in Information Security, Computer Science, or IT, and at least five years' experience in CII protection. If your CISO is not formally designated, this section of the audit cannot be completed satisfactorily.
Asset inventory is the foundation. If you cannot produce a complete, classified asset register at the start of the audit, the scope cannot be properly agreed, and auditors will note the absence. Asset identification and cataloguing is a mandatory obligation under Regulation 31(2)(a).
The core of the audit. Auditors examine five domains and record findings under each. Every item is a point of evidence:you either have documented controls and can produce them, or you don't.
OT environments need separate treatment. The audit template addresses IT security domains. For designated CII owners running SCADA (Supervisory Control and Data Acquisition) systems, industrial control systems, or energy management systems:the same domains apply, but the controls, tools, and constraints are fundamentally different. Standard IT security tools cannot be applied to live operational technology without risk to operations. IEC 62443 provides the correct technical framework for sections 3.1–3.3 in OT environments.
Your annual risk assessment (Reg 17) is the primary input here. Auditors will compare your own risk register against what they observe. If you have no documented risk assessment, or the last one was conducted more than 12 months ago, Section 4 becomes an immediate finding. The 12-month deadline from commencement of the Regulations fell in February 2025.
IEC 62443 is not explicitly listed in the template, but it is the right standard for OT environments. ISO 27001 and NIST were designed for IT security. For energy, water, and transport CII operators running industrial control systems, IEC 62443 is the internationally recognised best practice. Under Regulation 71(3), CII owners may identify and adopt global best practices on their own initiative. IEC 62443 is the defensible standard to present in Section 5.2 for operational technology environments.
A compliance order has legal force. Under Regulation 50, if the audit finds material non-compliance, the Director of NC4 can issue a formal compliance order specifying what must be done and by when. Failure to comply is an offence under the Act.
The CMCA 6 template was written for IT security environments. For designated CII owners running SCADA, distributed control systems (DCS), or energy management systems:network segmentation, patching, access control, and endpoint security all work differently. You cannot patch a running turbine on the same cycle as a corporate server. You cannot run endpoint security agents on a programmable logic controller. The approach must be adapted to operational constraints without weakening the compliance position. IEC 62443 provides that adaptation:it is the only international standard purpose-built for this environment, and under Regulation 71(3) it is the appropriate framework to present alongside the CMCA 6 findings.
Our CII Compliance Audit Readiness service runs a pre-audit gap assessment against Form CMCA 6, finding and closing weaknesses before NC4 auditors arrive. We also prepare the compliance documentation your CISO needs to present at each section.