Saboti MP Caleb Amisi has questioned a government directive requiring public institutions to pay approximately KSh4.7 million each for domain and email security services, demanding answers over how the figure was arrived at and who stands to benefit.
Amisi said the requirement could place an additional financial burden on government agencies at a time when several public institutions are already struggling with limited resources.
According to the MP, the Head of Public Service issued a circular on January 13, 2025, requiring ministries, departments, agencies and state corporations to deploy approved domain and email protection measures under the Whole-of-Government Domain and Email Security initiative.
The Communications Authority of Kenya (CA) was designated as the central government agency responsible for coordinating and overseeing the initiative.
Amisi noted that further reminders were issued on November 11, 2025, January 26, 2026, and July 28, 2026, with public institutions subsequently being required to make payments to the Communications Authority.
“Our concern, however, is not cybersecurity. Our concern is the cost,” Amisi said.
The legislator questioned how the government arrived at the approximately KSh4.7 million charge per institution, which he estimated could translate to about KSh1.8 billion across the targeted institutions.
He argued that the cost required greater scrutiny, particularly given that government institutions can acquire ordinary .KE domains at significantly lower prices.
“The fundamental question is therefore: What exactly are public institutions paying for, and how was the KES 4.7 million figure arrived at?” he asked.
Amisi acknowledged the importance of enterprise-level cybersecurity, including firewalls, secure email and web hosting, data encryption and Distributed Denial-of-Service (DDoS) protection.
However, he said expenditure running into millions of shillings must be supported by a clear and transparent justification showing the services covered and their actual market value.
The Saboti MP also raised questions over the alleged financial arrangement surrounding the programme, claiming he had been reliably informed that the Communications Authority would retain only 15 per cent of the fees, with the remainder transferred to a private entity.
“The question is: Was this private entity chosen after a competitive bid?” Amisi asked.
He expressed concern that some of the institutions being required to make the payments were public universities facing serious financial difficulties.
He said universities were struggling to pay staff, settle suppliers, maintain facilities and provide quality education to thousands of students.
“Against this background, we must ask: Is this really a priority at this particular moment?” he said.
Amisi called on the Head of Public Service, Communications Authority, relevant government agencies and Parliament to provide a comprehensive explanation of how the KSh4.7 million figure was determined.
He maintained that stronger cybersecurity was necessary but insisted that it should go hand in hand with accountability, value for money and prudent management of public resources.