Runs an essential service, in Ghana

Cybersecurity Act, 2020 (Act 1038), s. 39(1)(a), and Second Schedule item 39(2)(a) · Read the law's page

• This binds the owner of a computer system or computer network designated as a critical information infrastructure by the Minister under section 35 (reached by declaring that you operate an essential service).
• Report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where the infrastructure does not belong to a Sectoral Computer Emergency Response Team, within twenty-four hours after the incident is detected (section 39(1)(a)).

Cybersecurity Act, 2020 (Act 1038), ss. 35-38 and 39(1)(b)-(c), and Second Schedule items 36(4), 39(2)(b) and 39(2)(c) · Read the law's page

• This binds the owner of a computer system or computer network that the Minister has designated as a critical information infrastructure by notice in the Gazette (reached by declaring that you operate an essential service). The Minister designates on the advice of the Cyber Security Authority a system essential for national security or the economic and social well-being of citizens (section 35).
• The Authority registers each critical information infrastructure and determines, by publication in the Gazette, the requirements and the procedure for registration and any other matter relating to it (section 36(1)-(2)).
• Inform the Authority within seven days after any change in the legal ownership of the registered critical information infrastructure (section 36(3)).
• Cause an audit to be performed on the critical information infrastructure and submit a copy of the audit report to the Authority (section 39(1)(b) and (c)).

Cybersecurity Act, 2020 (Act 1038), ss. 47(2) and 47(5)-(6), and Second Schedule item 47(6) · Read the law's page

• Report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where the institution has no Sectoral team, within twenty-four hours after the incident is detected.
• Where the institution is itself a cybersecurity service provider licensed by the Authority, also submit a periodic report on its operations, including any cybersecurity incident, within the period the Authority sets.
• Failing to report within the twenty-four-hour window is an administrative penalty of not less than two hundred and fifty penalty units and not more than five thousand penalty units, payable to the Cyber Security Authority.
• This binds the person in charge of any public or private institution in Ghana that detects a cybersecurity incident, not only the owner of a critical information infrastructure or a licensed cybersecurity service provider.

CII Directive (CSA, 2021) baseline requirements, paras 5.1, 5.2 and 7, Directive for the Protection of Critical Information Infrastructure · Read the law's page

• This binds every designated CII Owner, meaning the legal owner or operator of a critical information infrastructure designated by the Minister under section 35 of the Cybersecurity Act, 2020, in the thirteen designated sectors, among them banking and finance, information and communications technology, energy, water, transport and health (reached by declaring that you operate an essential service).
• Develop and implement a cybersecurity policy that addresses the risks of your critical information infrastructure, and review it at least once a year (paragraph 5.1).
• Appoint an accountable officer of senior management rank for cybersecurity governance, policy and strategy (paragraph 5.1).
• Conduct a quarterly cybersecurity risk assessment, conduct yearly cybersecurity audits, and create and keep a cybersecurity risk register (paragraph 5.2).
• Submit copies of your audit reports, risk register and cybersecurity activity reports to the Authority as the Directive requires, and seek the Authority's clearance within one month before any major organisational change in operation, personnel and infrastructure (paragraph 7).
• Comply with any additional directive the Authority issues to you without notice (paragraph 7).

CII Directive (CSA, 2021) incident and vulnerability reporting, para 5.3, Directive for the Protection of Critical Information Infrastructure · Read the law's page

• This binds every designated CII Owner, meaning the legal owner or operator of a critical information infrastructure designated by the Minister under section 35 of the Cybersecurity Act, 2020, in the thirteen designated sectors, among them banking and finance, information and communications technology, energy, water, transport and health (reached by declaring that you operate an essential service).
• Report all cybersecurity incidents to the relevant Sectoral Computer Emergency Response Team, or directly to the National Computer Emergency Response Team (CERT-GH) where no Sectoral team exists, within twenty-four hours of becoming aware of an incident (paragraph 5.3).
• Establish a point of contact for reporting cybersecurity incidents and receiving cybersecurity information, including security advisories relevant to your sector (paragraph 5.3).
• Disclose and report any vulnerability identified or discovered through internal or external security audits and assessments within 72 hours of identifying or discovering it (paragraph 5.3).