Ghana Cybersecurity Act
Ghana CSA: Critical Information Infrastructure (CII) Designation, Plan, Audit and Risk Assessment

Ghana Cybersecurity Act GhCSA-CII-Designation-Plan-Audit-Risk: CII Designation, Registration, Cybersecurity Plan, Audit and Risk Assessment

Ghana CSA Critical Information Infrastructure (CII) regime (Part III of Act 1038). CII DESIGNATION: CSA Ghana designates CII owners across 13 SECTORS: (1) BANKING + FINANCE; (2) ENERGY (electricity + oil + gas); (3) WATER; (4) TELECOMMUNICATIONS; (5) TRANSPORT (aviation + maritime + rail + road); (6) HEALTH SERVICES; (7) GOVERNMENT SERVICES (including national security + military communications); (8) FOOD + AGRICULTURE supply chains; (9) EMERGENCY SERVICES; (10) MEDIA + INFORMATION services; (11) EDUCATION; (12) JUDICIARY + LEGAL SERVICES; (13) OTHER systems designated by CSA based on national-security + economic + societal significance. CII REGISTRATION + NOTIFICATION (Sec.20-21): designated entities must register with CSA + notify changes + provide ownership + control + technical contacts + system descriptions + dependencies. CII CYBERSECURITY PLAN (Sec.22): mandatory written plan covering risk assessment + protective measures + incident response + business continuity + supplier oversight + workforce training + reviewed annually + after major incidents. CII RISK ASSESSMENT (Sec.23): annual + comprehensive + identifying threats + vulnerabilities + impacts + likelihood + risk-treatment options + residual risk acceptance. CII AUDIT (Sec.24): annual independent cybersecurity audit by CSA-accredited auditors covering plan effectiveness + control implementation + incident-handling capability + supplier oversight + workforce competency; audit reports submitted to CSA + retained 5+ years.

What else in your programme already covers this

This control maps to 182 controls across 78 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

BSI IT-Grundschutz · 7 controls

  • BSI-02 Access enforcement and least privilege
  • BSI-03 Multi-factor authentication requirements
  • BSI-04 Remote access controls
  • BSI-05 Wireless access restrictions
  • BSI-13 Risk assessment procedures
  • BSI-15 Security categorization
  • BSI-17 Continuous monitoring strategy

API 1164 · 4 controls

  • 3.10 Encrypt Sensitive Data in Transit
  • 3.11 Encrypt Sensitive Data at Rest
  • 3.7 Establish and Maintain a Data Classification Scheme
  • 3.7.1 Key-management policies and procedures are implemented to include generation of strong cryptographic keys used to protect stored account data

OWASP Top 10:2025 · 4 controls

  • ASD37-18 Restrict administrative privileges (Essential)
  • ASD37-20 Multi-factor authentication (Essential)
  • ASD37-23 Protect authentication credentials (Excellent)

ISO/IEC 29134:2023 · 3 controls

  • NGCB-1 Regulation 5.260 Scope, Applicability, and Licensee Categories
  • NGCB-5 Technical Security Controls - Access + Network + Encryption + Vulnerability + Logging
  • NGCB-8 Annual Independent Cybersecurity Assessment + Reporting + Board Oversight
  • OWASPAPI-1 Broken Object Level Authorization (BOLA) and BFLA
  • OWASPAPI-2 Broken Authentication and Token Management
  • OWASPAPI-3 Broken Object Property Level Authorization (BOPLA)
  • DSOMM-1 Culture, Organization, Education, and Governance
  • DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management
  • DSOMM-4 Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing
  • CH-FADP-15 Cooperation with the FDPIC
  • CH-FADP-21 Data protection impact assessments
  • FADP-7 Data Protection Impact Assessment (Articles 9-10)

Bahrain PDPL · 2 controls

  • 6.4 Logging and Monitoring
  • 6.5 Preparing and Distributing Audit Report

ISO 19011 · 2 controls

  • 6.4 Logging and Monitoring
  • 6.5 Preparing and Distributing Audit Report

ISO/IEC 27010:2015 · 2 controls

ISO/IEC 27011:2024 · 2 controls

ISO/IEC 27014:2020 · 2 controls

India DPDP Act · 2 controls

OWASP ASVS · 2 controls

  • ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration
  • ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process
  • AUPRV-4 APP 10-11 Quality, Security of Personal Information
  • AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children
  • PSPF24-2 Information Security, Cybersecurity Maturity, Essential Eight
  • PSPF24-4 Physical Security
  • 2.4.4 Hazard Analysis and Risk Assessment
  • 2.7.2 Food Fraud Plan
  • CRM-1 AML/CFT Compliance
  • CRM-4 Business Risk Assessment

APPI · 1 control

  • APPI-A26 Report of Leakage to the Commission and Notification to the Person
  • CPS230-11 Identification, Assessment and Management of Operational Risk
  • 4.3.1 Risk Assessment and Impact Analysis
  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities

FIDO2 / WebAuthn · 1 control

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

GDPR · 1 control

  • 62351-8 Role-based access control (RBAC)

ISO 13485 · 1 control

  • 6.4 Logging and Monitoring
  • 23837-1.7.3 Authentication and classical post-processing

ISO/IEC 27031:2011 · 1 control

ISO/IEC 27400:2022 · 1 control

ISO/IEC 29147:2018 · 1 control

  • 29147-5.11 Researcher Safe Harbour and Legal Posture

MITRE D3FEND · 1 control

MiFID II / MiFIR · 1 control

  • RUSPD-2 Lawful Basis, Consent, Notice

SWIFT CSCF · 1 control

South Korea PIPA · 1 control

  • TEFCAREC-1 Common Agreement Conformance and Onboarding
  • USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR)
  • USMCADIGITAL-2 Personal Information Protection and Consumer Protection

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 182 it maps to, and the evidence behind each claim, over MCP and REST.