GhanaCybersecurity Act, Critical Information Infrastructure Designation, Registration and Audit
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Reporting, Governance
As of .
What it requires
- This binds the owner of a computer system or computer network that the Minister has designated as a critical information infrastructure by notice in the Gazette (reached by declaring that you operate an essential service). The Minister designates on the advice of the Cyber Security Authority a system essential for national security or the economic and social well-being of citizens (section 35).
- Register the critical information infrastructure with the Authority on the requirements and by the procedure the Authority determines by publication in the Gazette (section 36(1)-(2)).
- Inform the Authority within seven days after any change in the legal ownership of the registered critical information infrastructure (section 36(3)).
- Cause an audit to be performed on the critical information infrastructure and submit a copy of the audit report to the Authority (section 39(1)(b) and (c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The audit duties in section 39(1)(b)-(c) are enforced by an administrative penalty under section 39(2) and the Second Schedule; the Act makes no criminal offence of failing to meet them.
Who enforces it
Enforcement body
The Cyber Security Authority, established under section 2 of the Cybersecurity Act, 2020 (Act 1038).
Settledness
- As of
- Open questions
- Does a given business own a critical information infrastructure that the Minister has designated by notice in the Gazette?
What this law does
The Minister may, on the advice of the Cyber Security Authority, designate a computer system or computer network as a critical information infrastructure where it is essential for national security or the economic and social well-being of citizens, and must publish the designation in the Gazette. The Authority must register each critical information infrastructure.
The owner of a registered critical information infrastructure must inform the Authority within seven days after any change in its legal ownership. The owner of a critical information infrastructure must cause an audit to be performed on it and submit a copy of the audit report to the Authority. The Authority carries out a periodic audit and inspection of each critical information infrastructure.
The Minister prescribes minimum standards for the general management of a critical information infrastructure. Failing to notify a change of ownership is an administrative penalty of not less than five hundred penalty units and not more than ten thousand penalty units. Failing to cause the audit to be performed is an administrative penalty of not less than two hundred and fifty penalty units and not more than ten thousand penalty units.
Failing to submit a copy of the audit report to the Authority carries the same administrative penalty of not less than two hundred and fifty penalty units and not more than ten thousand penalty units.
When LexLint raises it
When your app profile says your app runs an essential service.