GhanaCritical Information Infrastructure Directive, Incident and Vulnerability Reporting
CII Directive (CSA, 2021) incident and vulnerability reporting para 5.3, Directive for the Protection of Critical Information Infrastructure
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds every designated CII Owner, meaning the legal owner or operator of a critical information infrastructure designated by the Minister under section 35 of the Cybersecurity Act, 2020, in the thirteen designated sectors, among them banking and finance, information and communications technology, energy, water, transport and health (reached by declaring that you operate an essential service).
- Report all cybersecurity incidents to the relevant Sectoral Computer Emergency Response Team, or directly to the National Computer Emergency Response Team (CERT-GH) where no Sectoral team exists, within twenty-four hours of becoming aware of an incident (paragraph 5.3).
- Establish a point of contact for reporting cybersecurity incidents and receiving cybersecurity information, including security advisories relevant to your sector (paragraph 5.3).
- Disclose and report any vulnerability identified or discovered through internal or external security audits and assessments within 72 hours of identifying or discovering it (paragraph 5.3).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Cyber Security Authority, established under section 2 of the Cybersecurity Act, 2020 (Act 1038).
Settledness
- As of
- Open questions
- To whom must a vulnerability found through an audit be disclosed within 72 hours, which the Directive does not say?
What this law does
A designated critical information infrastructure owner must report all cybersecurity incidents to the relevant Sectoral Computer Emergency Response Team, or directly to the National Computer Emergency Response Team where none exists, within twenty-four hours of becoming aware of an incident. A designated owner must establish a point of contact for reporting cybersecurity incidents and receiving cybersecurity information, including security advisories relevant to its sector.
A designated owner must disclose and report any vulnerabilities identified or discovered through internal or external security audits and assessments within 72 hours of identifying or discovering the vulnerability. An owner that fails to comply with a directive the Authority issues under section 92 of the Act is liable to an administrative penalty of not less than two hundred and fifty penalty units and not more than ten thousand penalty units.
When LexLint raises it
When your app profile says your app runs an essential service.