Ghana Cybersecurity Act 39.1a: Section 39(1)(a): report a cybersecurity incident on critical information infrastructure within 24 hours

What does 39.1a require?

The owner of a critical information infrastructure must report a cybersecurity incident within twenty-four hours after it is detected to the relevant Sectoral Computer Emergency Response Team or, where the infrastructure belongs to no sectoral team, to the National Computer Emergency Response Team (CERT-GH). A cybersecurity incident is any act or attempt, successful or not, to gain unauthorised access to, disrupt or misuse an information system or the information on it, so attempts count. The CII Directive repeats the duty (5.3(b)). Failure carries 250 to 10,000 penalty units under the Second Schedule.