Executive Analysis

The proposed plan focuses on five key areas:

1. Immediate infrastructure protection
2. Governance and control
3. Human resource capacity
4. Security culture
5. Monitoring and maturity development

This is a strong stabilization framework because it addresses both technical weaknesses and management gaps.

The biggest concern is that some recommendations depend heavily on executive approval, which may delay urgent action.

---

1. Firewall License Renewal

Analysis

This is correctly listed as Priority 1.

An expired firewall license creates major exposure because it may affect:

• Threat intelligence updates
• Malware signature updates
• IPS/IDS effectiveness
• Web filtering controls
• Security patch updates

This leaves the organization exposed to:

• Malware infiltration
• Unauthorized access
• Command-and-control communication
• Zero-day vulnerability exploitation

For a broadcaster like Kenya Broadcasting Corporation, this could affect:

• Internal communication systems
• Broadcast transmission infrastructure
• Corporate network services
• Digital platforms

---

Strength

Immediate escalation to CEO level is appropriate.

---

Recommendation

Add Business Impact Statement

The recommendation should include measurable business risk.

Example:

This creates urgency for finance approval.

---

Add Temporary Risk Mitigation

While waiting:

• Restrict unnecessary inbound traffic
• Review firewall rules manually
• Increase log monitoring
• Disable unused exposed services

---

K24 Score

24/25

Strong recommendation, but needs contingency actions.

---

2. Centralization of Platforms under ICT

Analysis

This is one of the most strategic recommendations.

Decentralized platform ownership creates:

• Shadow IT
• Inconsistent patching
• Weak access control
• Poor incident visibility
• Uncontrolled third-party access

The website issue is especially serious because public-facing systems are common attack entry points.

---

Strength

You correctly identify:

• Governance fragmentation
• Security ownership gaps
• Developer management risk

The recommendation for centralized developer management is highly relevant.

---

Risk

The wording may appear operationally forceful.

Executive leadership often responds better to governance language.

---

Recommendation

Reframe as:

---

Add Governance Structure

Recommend creation of:

Digital Security Governance Committee

Members:

• ICT
• Legal
• Corporate Communication
• Digital teams
• Audit

This improves implementation.

---

K24 Score

23/25

Very strong but needs governance framework detail.

---

3. Recruitment of Cybersecurity Officer

Analysis

This is critical.

The absence of a dedicated Cybersecurity Officer creates:

• Lack of security ownership
• Weak policy enforcement
• Delayed incident response
• Poor risk oversight

The HR rejection indicates governance misalignment.

---

Key Concern

The recommendation should include operational risk evidence.

Executives approve positions faster when tied to business risk.

---

Recommendation

Add justification:

---

Interim Recommendation

Until recruitment:

Assign an Acting Cybersecurity Lead

This prevents a leadership vacuum.

---

K24 Score

22/25

Critical recommendation, needs interim ownership.

---

4. Security Training and Awareness

Analysis

This is essential because people remain the largest attack surface.

Common risks:

• Phishing
• Credential theft
• Social engineering
• Unsafe browsing
• Unauthorized software installation

---

Weakness

The recommendation is too broad.

---

Recommendation

Break into phases:

Month 1–2

Executive awareness

---

Month 2–4

Departmental staff training

---

Month 4–6

Phishing simulation exercises

---

Add KPIs

Measure:

• Training completion rate
• Phishing failure rate
• Incident reporting improvement

---

K24 Score

20/25

Good recommendation, needs measurable outputs.

---

5. Security Monitoring and Controls

Analysis

This is important for maturity progression.

Without monitoring:

• Threats remain undetected
• Response is delayed
• Logs go unanalyzed

---

Weakness

Too general.

---

Recommendation

Specify controls:

Immediate

Centralized log collection

---

Month 2–3

Vulnerability scanning

---

Month 3–4

Endpoint monitoring

---

Month 4–6

Incident alerting dashboards

---

Long-term

SIEM deployment

Possible examples:

• Microsoft Sentinel
• Wazuh
• Splunk

---

K24 Score

19/25

Needs more technical specificity.

---

Overall Strategic Assessment

Overall Score:

104/125 (83%)

This is a strong executive proposal.

It shows clear understanding of organizational cybersecurity needs.

---

Final Recommendations

Immediate Additions Before Submission

1. Add Success Metrics

Examples:

• Firewall renewed by Week 1
• Platform centralization completed by Month 2
• Security officer recruited by Month 3
• 90% staff trained by Month 5
• Monitoring dashboards active by Month 6

---

2. Add Risk of Inaction

Executives respond strongly to consequences.

Include:

• Financial loss
• Broadcast disruption
• Reputational damage
• Regulatory exposure

---

3. Add Executive Decision Requests

Be explicit:

Approval required for:

• Budget release
• Governance directive
• Recruitment authorization
• Policy enforcement mandate

---

K24 Executive Recommendation

Your plan should be approved, with refinement to include:

• Clear KPIs
• Interim controls
• Governance structure
• Defined deliverables
• Business impact language

This will elevate it from a technical proposal to an executive cybersecurity transformation roadmap.