Ghana Cybersecurity Act

Critical information infrastructure (sections 35 to 40) – Ghana Cybersecurity Act

Ghana Cybersecurity Act 39.1c: Section 39(1)(c) and Directive 7(b): submit the audit report and the other required reports to the Authority

What does 39.1c require?

The owner must submit a copy of the audit report to the Authority, and under the CII Directive must also submit copies of reports on the audits, the cybersecurity risk register and the cybersecurity activities the Directive requires. Failing to submit the audit report carries 250 to 10,000 penalty units.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Critical information infrastructure (sections 35 to 40) – Ghana Cybersecurity Act

36.1 Section 36(1) and (2): register the designated critical information infrastructure with the Authority
36.3 Section 36(3): tell the Authority of a change in legal ownership within seven days
39.1a Section 39(1)(a): report a cybersecurity incident on critical information infrastructure within 24 hours
39.1b Section 39(1)(b) and Directive 5.2(k): cause a cybersecurity audit of the critical information infrastructure every year

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Ghana Cybersecurity Act controls