Ghana Cybersecurity Act

Directive for the Protection of Critical Information Infrastructure (2021) – Ghana Cybersecurity Act

Ghana Cybersecurity Act CIID.5.3a: Directive 5.3(a): investigate and mitigate incidents to the Authority's standards

What does CIID.5.3a require?

In the event of a cybersecurity incident the designated CII owner must investigate it, report it and mitigate its impact according to the cybersecurity standards the Authority requires (the reporting clock is the 24 hours of section 39(1)(a)).

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Directive for the Protection of Critical Information Infrastructure (2021) – Ghana Cybersecurity Act

CIID.5.1 Directive 5.1: board-approved cybersecurity policy for the designated CII, reviewed yearly
CIID.5.1c Directive 5.1(c): appoint a senior accountable officer for cybersecurity governance
CIID.5.2a Directive 5.2(a): identify, classify and catalogue all CII assets
CIID.5.2b Directive 5.2(b): control and manage access to CII systems and services
CIID.5.2c Directive 5.2(c): mitigate cyber risk from employees, customers, suppliers and other third parties
CIID.5.2d Directive 5.2(d): security screening of personnel who handle CII information
CIID.5.2e Directive 5.2(e): cybersecurity awareness and training for all employees
CIID.5.2f Directive 5.2(f): security monitoring and response for timely detection

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Ghana Cybersecurity Act controls