Cybersecurity and records management practices as precursors to good governance in the digital age in public sector

Review

Musembe, Kwanya and Mutula examine the integration of cybersecurity and records management within Kenya's Information and Communications Technology Authority (ICTA), arguing that the two functions should be treated as interdependent components of public-sector governance rather than as separate technical and administrative disciplines. Based on interviews with 18 ICTA personnel across management, information security, records management and ICT roles, the study identifies a practical control set that links records governance to cybersecurity: role-based access control, least-privilege permissions, audit trails, version controls, digital signatures, security classification, backup and disaster recovery, monitoring, audits and incident-response arrangements. The contribution is institutional rather than merely technical. The paper makes visible that records systems are part of the state's accountability infrastructure because they determine what evidence exists, who may access or alter it, and whether administrative action can later be reconstructed.

The study also exposes the main implementation fault line. ICTA may define policies and standards, but execution varies across Ministries, Counties, Departments and Agencies because of uneven infrastructure, staffing, budgets, awareness and policy uptake. That distinction matters because governance quality cannot be inferred from the formal existence of controls. Classification rules, access permissions and audit mechanisms only become governance controls when they are consistently interpreted, enforced and reviewable across institutions. The paper's discussion of inconsistent security classification is especially consequential: classification is not simply an information-security technique. It allocates visibility, access and handling authority, and therefore becomes a decision-rights mechanism whose ambiguity can produce unequal treatment and weak accountability.

The evidence supports the claim that ICTA personnel understand cybersecurity and records management as mutually reinforcing and that formal integration mechanisms exist. It does not establish that those mechanisms cause better governance outcomes across Kenya's public sector. The case is confined to one coordinating institution, relies on purposively selected internal respondents, excludes citizens and frontline users, and does not independently test control effectiveness, service outcomes, compliance rates or the quality of audit evidence. The authors acknowledge these limits and frame future work around multi-institutional and mixed-method designs. That boundary is important: the paper demonstrates institutional intent, practices and perceived implementation gaps, not system-wide effectiveness.

Its proposed framework pushes beyond diagnosis toward central coordination, harmonized classification, annual policy review, mandatory training, a national taskforce, infrastructure modernization and a centralized security operations capability. These proposals make the paper useful for state-capacity analysis because they identify concrete administrative dependencies. They also introduce governance questions that remain underdeveloped. A stronger central coordinating role for ICTA and a national SOC may improve consistency and observability, but it would also concentrate monitoring, classification and enforcement capacity. The paper does not specify independent oversight, appeal routes for contested classifications, correction mechanisms for erroneous records, or how agencies and affected citizens could challenge misuse of centralized controls.

The resulting governance judgment is bounded but useful. The paper establishes that digital records security is not a back-office concern: it is part of the machinery through which public institutions produce evidence, allocate access and sustain accountability. What it does not yet establish is whether institutional integration reliably improves public outcomes or whether stronger centralization preserves contestability and proportionality. Evidence from multiple agencies, external audits, measurable governance outcomes and documented challenge or redress pathways would materially strengthen that claim.

Key Insight

Digital governance depends less on the existence of cybersecurity and records policies than on whether institutions can translate them into consistently enforced, auditable controls over public records and administrative action.