AceQu

Every working day, thousands of cargo manifests, customs entries, guest passport scans and payment records pass through computers in Mombasa. Most of that data belongs to someone else, and the businesses holding it are expected to keep it safe. An ISO 27001 information security management system is the most widely recognised way to show that you can.

For companies looking into ISO 27001 Certification Mombasa projects, the question usually isn’t whether security matters. It’s whether a formal standard is worth the effort when you already have a decent IT supplier and a firewall. Below, we look at how the standard supports data protection, how it handles risk, and what certification involves for a coastal business.

Why Data Protection Matters More on the Coast Than It Used To

Mombasa’s economy runs on information moving between parties who have often never met. A single shipment can pass through a shipping line, a clearing agent, a transporter, KRA’s systems and a bank before it leaves the port.

Along the way, local businesses end up holding a lot of sensitive data:

• Cargo and customs information handled by clearing and forwarding agents, freight firms and container depots.
• Guest details, ID copies and card payments held by hotels, resorts and tour operators along the coast.
• Patient records in hospitals, clinics and labs that serve the wider coastal region.
• Customer and transaction data at banks, SACCOs, insurers and mobile money agents.
• Staff records, payroll details and KRA PINs, which just about every employer keeps.

Most of this counts as personal data under Kenyan law, and all of it is attractive to criminals. Shipping has already learned that lesson the hard way. The 2017 NotPetya attack on Maersk disrupted container terminals worldwide and showed how one infected system can stop cargo moving for days.

What ISO 27001 Actually Asks You to Do

ISO/IEC 27001:2022 sets out the requirements for an Information Security Management System, usually called an ISMS. It isn’t software you install. It’s a way of running security as a managed part of the business, with owners, records and regular checks. If you’re new to the standard, our explainer on what ISO 27001 is covers the basics.

The Core Requirements

• Define the scope: which sites, systems and teams the ISMS covers.
• Carry out a documented information security risk assessment.
• Choose controls to treat those risks and record the reasons in a Statement of Applicability.
• Set security objectives and give top management clear accountability.
• Train staff so policies are understood, not just signed and filed.
• Run internal audits and management reviews, then fix what they turn up.

The Annex A Controls

The 2022 version groups its 93 reference controls into four themes:

• Organisational (37): policies, supplier security, incident management and more.
• People (8): screening, awareness training and confidentiality agreements.
• Physical (14): secure areas, clear desk rules and safe disposal of equipment.
• Technological (34): access control, backups, encryption, logging and malware protection.

You don’t have to use every control. You do need a reasoned decision for each one, based on your own risks rather than a template.

How ISO 27001 Supports Kenya’s Data Protection Act

The Data Protection Act, 2019 requires anyone handling personal data to protect it with appropriate technical and organisational measures. It’s enforced by the Office of the Data Protection Commissioner (ODPC), which has already issued penalty notices to Kenyan businesses.

The Act tells you what result is expected. ISO 27001 gives you a tested method for getting there, which is why many organisations use it as the backbone of their compliance work.

One honest caveat. Certification doesn’t make you compliant on its own. Registration with the ODPC, a lawful basis for processing and handling data subject requests all sit outside the standard, so you’ll still need to cover those separately.

Risk Management Is Where the Standard Earns Its Keep

The biggest change most firms notice is how they think about risk. Instead of reacting to the last scare, you work from a register of what could genuinely hurt the business.

How the Risk Process Works

1. List your information assets: systems, databases, laptops, paper files and the people who use them.
2. Identify the threats and weaknesses for each one.
3. Rate each risk by how likely it is and how much damage it would do.
4. Decide how to treat it: reduce it, avoid it, transfer it (through cyber insurance, for example) or accept it.
5. Give each risk an owner and a deadline, then review it regularly.

What This Looks Like for a Mombasa Business

• A clearing agent discovers that two former staff still have logins to its customs systems, and adds a leavers’ checklist.
• A beach hotel finds guest passport scans sitting in a shared email inbox and moves them to restricted storage.
• A transporter on the Mombasa to Nairobi corridor realises its only backup sits in the same room as the server.

None of those fixes cost much. In most cases, nobody had simply looked before.

Business Benefits Beyond Compliance

Security is the main reason to do it, but the commercial upside is often what gets the budget approved:

• Access to tenders from banks, government bodies, shipping lines and multinationals that ask for ISO 27001.
• Shorter security questionnaires, because the certificate answers most of the questions.
• Lower chances of a costly breach, and easier conversations with cyber insurers.
• More trust from overseas partners, especially European ones used to GDPR-level expectations.
• A framework that grows with you as you add branches, systems or staff.

Why More Coastal Firms Are Moving Now

A few years ago, ISO 27001 was something only banks and telecoms worried about. That has changed. Freight forwarders now receive security questionnaires from global shipping lines, and hotels get them from international booking partners.

Enforcement by the ODPC has also made directors pay closer attention. Put together, these pressures explain why interest in ISO 27001 Certification Mombasa services has grown so quickly, particularly among mid-sized firms that used to assume it wasn’t meant for them.

Getting Certified: What to Expect

Most projects take three to six months, depending on the size of the organisation and how much documentation already exists. The usual sequence is:

1. A gap analysis against ISO 27001:2022.
2. Scope, risk assessment and Statement of Applicability.
3. Policies, procedures and control implementation.
4. Staff awareness training.
5. Internal audit and management review.
6. A two-stage certification audit by an accredited body, followed by yearly surveillance audits.

Our guide to ISO certification audit stages explains the external audit in detail, and the checklist of documents required for ISO certification helps you prepare. For budgeting, see our breakdown of ISO certification cost in Kenya.

It’s also worth understanding the difference between an ISO consultant and a certification body before you sign anything. And if you already hold ISO 9001 or the ISO 22301 business continuity standard, much of your audit and document control work carries straight over.

Frequently Asked Questions

Is ISO 27001 certification mandatory in Kenya?

No, it’s voluntary. The security duties in the Data Protection Act are mandatory, though, and certification is one of the clearest ways to show you take them seriously.

Is it only for large companies?

Not at all. A 20-person clearing firm can be certified just like a bank. The scope and paperwork are simply sized to match the business.

Can we get support locally?

Yes. Our ISO consultants in East Africa work with organisations in Mombasa and across the coast, both on site and remotely.

Final Thoughts

Plenty of firms only start searching for ISO 27001 Certification Mombasa options after a client or tender board demands it. Starting earlier gives you time to fix real risks instead of rushing paperwork before a deadline.

• ISO 27001 gives you a practical method for meeting the Data Protection Act’s security duties.
• Its risk process catches the everyday gaps that lead to most breaches.
• The certificate opens doors with banks, shipping lines and international partners.

For the standard’s own summary, see ISO’s page on ISO/IEC 27001.