CYBERSECURITY PREPAREDNESS IN COUNTY E-GOVERNMENT SYSTEMS

A CASE STUDY OF BOMET COUNTY, KENYA

Abstract

Kenya's adoption of e-government systems has significantly improved public service delivery, transparency, and citizen participation within county governments. However, the increasing reliance on digital technologies has also heightened exposure to cybersecurity threats, including phishing, ransomware, unauthorized access, and data breaches. Although national frameworks such as the Data Protection Act (2019) and the National Cybersecurity Strategy (2022–2027) provide guidance for securing digital systems, empirical evidence on cybersecurity preparedness within county governments remains limited. Existing studies have largely focused on national government institutions, leaving a knowledge gap regarding the preparedness of devolved governments to secure their e-government systems. This study therefore evaluated the level of cybersecurity preparedness in Bomet County's e-government systems by examining technical controls, policy implementation, and human capacity. The broader study adopted a Design Science Research (DSR) framework, while this paper presents findings from the mixed-methods assessment undertaken to address the first study objective. Quantitative data were collected using structured questionnaires administered to county employees and ICT personnel (n = 45), while qualitative data were obtained through semi-structured interviews with key informants. Quantitative data were analyzed using descriptive statistics, while qualitative data were analyzed thematically to provide contextual insights into cybersecurity practices and challenges. The findings indicate that cybersecurity preparedness in Bomet County is moderate despite the presence of basic security controls. Approximately 66.7% of respondents had not received formal cybersecurity training during the previous twelve months, while 55% reported experiencing cybersecurity incidents, highlighting significant gaps in staff capacity, policy implementation, and incident response. Although access control mechanisms were available, their effectiveness was constrained by inadequate cybersecurity awareness and weak policy enforcement. The study concludes that strengthening staff capacity, improving policy implementation, and institutionalizing regular cybersecurity preparedness assessments are essential for enhancing the resilience of county e-government systems. The findings provide empirical evidence to support county-level cybersecurity governance and offer practical insights for strengthening secure and sustainable digital service delivery within devolved government institutions.