Ghana CSA Critical Information Infrastructure (CII) regime (Part III of Act 1038). CII DESIGNATION: CSA Ghana designates CII owners across 13 SECTORS: (1) BANKING + FINANCE; (2) ENERGY (electricity + oil + gas); (3) WATER; (4) TELECOMMUNICATIONS; (5) TRANSPORT (aviation + maritime + rail + road); (6) HEALTH SERVICES; (7) GOVERNMENT SERVICES (including national security + military communications); (8) FOOD + AGRICULTURE supply chains; (9) EMERGENCY SERVICES; (10) MEDIA + INFORMATION services; (11) EDUCATION; (12) JUDICIARY + LEGAL SERVICES; (13) OTHER systems designated by CSA based on national-security + economic + societal significance. CII REGISTRATION + NOTIFICATION (Sec.20-21): designated entities must register with CSA + notify changes + provide ownership + control + technical contacts + system descriptions + dependencies. CII CYBERSECURITY PLAN (Sec.22): mandatory written plan covering risk assessment + protective measures + incident response + business continuity + supplier oversight + workforce training + reviewed annually + after major incidents. CII RISK ASSESSMENT (Sec.23): annual + comprehensive + identifying threats + vulnerabilities + impacts + likelihood + risk-treatment options + residual risk acceptance. CII AUDIT (Sec.24): annual independent cybersecurity audit by CSA-accredited auditors covering plan effectiveness + control implementation + incident-handling capability + supplier oversight + workforce competency; audit reports submitted to CSA + retained 5+ years.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.