By 
Interior and National Administration Cabinet Secretary Kipchumba Murkomen has appointed Lorna A. Omondi Ogolla and Dr. Joy Kibor to the Board of Directors of the National Cybersecurity Agency, adding artificial intelligence and academic cybersecurity expertise to the young institution's governing structure.
The appointments, contained in Gazette Notice No. 14420, took effect on September 11, 2026, and will run for a three year term. Murkomen made the appointments under the State Corporations (National Cybersecurity Agency) Order, 2026, the legal instrument that established the agency earlier this year. The gazette notice names the two appointees as Jerop Joy Kibor (Dr.) and Lorna Ogolla Omondi, board members under paragraph 7(j)(ii) of the Order.
The two join a board that already has a chairperson in place. President William Ruto appointed UK based cybersecurity expert Dr. Martin Koyabe as Non-Executive Chairperson of the board in a gazette notice dated August 21, 2026, under section 7(a) of the same Order, also for a three year term. Koyabe, who has more than three decades of experience across ICT, cybersecurity, telecommunications and digital policy, currently serves as Senior Manager and Technical Lead at the Global Forum on Cyber Expertise in The Hague and is the founder of London based technology consultancy MWK Consult.
Who the new board members are
Ogolla brings a background concentrated in technology infrastructure and artificial intelligence. She studied at MIT, the University of Cambridge and Stanford before spending eight years at Google, where she rose to lead a team advising the company on the location, timing and scale of its global data centre investments. Since 2024 she has been based in Nairobi, where she leads Google Research's machine learning and AI partnerships across Africa, according to CIO Africa's reporting on the appointment.
Kibor's background spans the energy sector, cybersecurity, artificial intelligence and higher education. Her career includes a stint at Kenya Power, a tutorial fellowship at Kenyatta University and four years lecturing in cybersecurity and AI at Kiriri Women's University. She holds a PhD and currently serves as Head of Postgraduate Studies in ICT at Zetech University. Between them, the two appointees give the board direct experience in commercial data centre and AI infrastructure planning on one side, and cybersecurity pedagogy and research on the other, a combination the agency's public communications describe as bridging industry and academic perspectives.
Neither appointee's remuneration, committee assignments, or specific portfolio within the board has been disclosed in the gazette notice or in subsequent government communication.
An agency built through 2026
The National Cybersecurity Agency did not exist a year ago. President Ruto formally established it through a special gazette notice dated May 15, 2026, exercising powers under section 3(1) of the State Corporations Act to create a body corporate with perpetual succession, mandated to function as Kenya's autonomous regulatory and technical authority on national cybersecurity matters. The order gave the agency responsibility for formulating and overseeing implementation of national cybersecurity strategy across both the public and private sectors, auditing and certifying the cybersecurity resilience of designated critical information infrastructure, and running the day to day operations of the National Cybersecurity Operations Centre.
The push to create the agency followed warnings from Murkomen that Kenya had become one of the most targeted countries in Africa for cyberattacks, with fraud, ransomware and data breaches increasing in scale and complexity alongside the country's adoption of new technologies. The government had earlier sought approximately Sh4 billion from Parliament to establish the agency, arguing that existing arrangements left operational gaps in the country's cyber defences. Kenya has separately reported billions of attempted cyberattacks over short periods, a figure officials have cited to justify the scale of the new institution.
The agency's governing board was designed to be broad by statute, drawing in officials from the National Treasury, the ICT Ministry, the Attorney General's Office, the Kenya Defence Forces, the National Police Service, the National Intelligence Service and the Office of the Director of Public Prosecutions, alongside representatives from academia and the private sector. One analysis of the founding Order, published by CyberSpace Chronicles in July, described the resulting structure as an eleven member security, intelligence and finance board with sweeping authority over critical infrastructure, while noting that the Order left budget allocation, implementation timelines and jurisdictional boundaries with existing regulators largely unspecified.
That overlap is a live question for the agency as it moves from paper to practice. The Communications Authority of Kenya, the Central Bank of Kenya and the Office of the Data Protection Commissioner all have existing mandates that intersect with cybersecurity oversight of the sectors they regulate, whether in telecommunications, financial services or data protection. How the new agency's audit and certification powers over critical information infrastructure will be sequenced against those bodies' existing supervisory work has not yet been detailed publicly. Private sector firms operating infrastructure the government designates as critical also now face the prospect of mandatory audits under the agency's mandate, without a published compliance timeline.
Building out the leadership structure
The Ogolla and Kibor appointments follow a broader pattern of state board appointments Murkomen and other Cabinet Secretaries have made through August and September as the government fills out leadership at newly created or restructured agencies. In the same window, Murkomen appointed Joseph Gitonga Riungu as chairperson of the Intelligence Service Complaints Board, alongside Naema Ibrahim Somo, Lawrence Nyalle, Samwel Owino Wakiaga and Charity Kagwi Ndung'u as members, and re-appointed Hassan Kirua Ole Naado to the National Campaign Against Drug Abuse Authority board. Other Cabinet Secretaries used the same gazette notices to make appointments to the Public Procurement Regulatory Board, the National Transport and Safety Authority, the Railway Development Levy Fund Board and several national polytechnics, illustrating a period of concentrated institutional appointments across government rather than a cybersecurity specific push.
For the National Cybersecurity Agency specifically, the sequence has been methodical: the founding Order in May, the chairperson's appointment in August, and now two board members in September, each formalised through its own gazette notice rather than a single consolidated announcement. With Koyabe, Ogolla and Kibor now in place, the agency has the leadership core needed to begin exercising the strategic oversight functions set out in its founding Order, though the board's full eleven member complement, and the operational detail of how it will coordinate with existing regulators, remains to be filled in as the institution matures.
Comments