Ghana Cybersecurity Act 39.1b: Section 39(1)(b) and Directive 5.2(k): cause a cybersecurity audit of the critical information infrastructure every year

What does 39.1b require?

The owner of a critical information infrastructure must cause an audit to be performed on it; the CII Directive sets the cycle at a yearly cybersecurity audit against the Directive and the Act. This is separate from, and may be confirmed by, the periodic audits and inspections the Authority or its authorised auditor carries out under section 38(2). Failure carries 250 to 10,000 penalty units.