Ghana's Cybersecurity Act 2020 (Act 1038) regulates cybersecurity as an activity, not just cybercrime: it licenses the firms that sell security services, accredits the people and facilities that deliver them, and puts 24-hour reporting and yearly audit duties on owners of critical information infrastructure (CII). The Cyber Security Authority (CSA) began licensing on 1 March 2023 and announced that sanctions for unlicensed providers and unaccredited professionals apply from 31 January 2026, which makes this a live compliance issue for any firm offering penetration testing, forensics, managed security or GRC services in Ghana. This guide covers scope, the CII Directive, licensing and accreditation, incident reporting, enforcement, the 2025 amendment bill, and what the regime means for machine identities and AI agents. It is for security leads at CII operators, security service providers and organisations buying security services in Ghana. Data protection sits under a different law and is out of scope here.
Confirm every obligation, figure and penalty on this page against the official text of the law before relying on it.
Key takeaways
- Selling security services needs a licence: section 49(1) bars anyone from providing a cybersecurity service without a CSA licence; licences run for two years and renewal applications are due at least one month before expiry (section 53).
- Enforcement started on 31 January 2026: the CSA's press release (as published by MyJoyOnline; we could not retrieve it from csa.gov.gh) of 23 January 2026 said unlicensed service providers and unaccredited establishments and professionals face criminal prosecution and administrative penalties from that date.
- Two 24-hour clocks: CII owners report incidents to their sectoral CERT or the National CERT within 24 hours (section 39 and the CII Directive), and persons in charge of institutions also report within 24 hours of detection under section 47(5).
- The CII Directive sets the baseline: in force since 1 October 2021 for 13 designated sectors, it requires quarterly risk assessments, yearly audits, a 24/7 contact point, and reporting of audit-found vulnerabilities within 72 hours.
- An amendment is in progress: the CSA consulted on a draft Cybersecurity (Amendment) Bill from 1 October to 14 November 2025; check its status before finalising a compliance plan.
Scope: who and what is covered
Act 1038 establishes the Cyber Security Authority (section 2), a National Computer Emergency Response Team (CERT-GH, section 41) and sectoral CERTs (section 44), a Cybersecurity Fund (sections 29 to 34), and the licensing and accreditation regime (sections 49 to 59). It also creates child online protection and online sexual offences (sections 62 to 68) and investigatory powers. The groups below carry duties.
| Group | Trigger | Main provisions |
|---|---|---|
| CII owners | Systems or networks in a designated CII sector | Sections 35 to 40; CII Directive 2021 |
| Cybersecurity service providers (CSPs) | Providing a cybersecurity service in Ghana | Sections 49 to 56 (licence) |
| Cybersecurity establishments (CEs) | Running digital forensics or managed security facilities | Accreditation under the Act's regime |
| Cybersecurity professionals (CPs) | Practising in the licensed service areas | Section 57 (accreditation) |
| Institutions generally | Detecting a cybersecurity incident | Section 47(5) (24-hour report) |
| Sectoral CERTs | Established by Gazette notice for a sector | Section 44 (monthly reports), section 47(1) |
Designated CII sectors
Section 35 lets the Minister, on the CSA's advice, designate a computer system or network essential to national security or the economic and social well-being of citizens. On 23 September 2021, Gazette Notice No. 132 designated 13 sectors: National Security and Intelligence; ICT; Banking and Finance; Energy; Water; Transport; Health; Emergency Services; Government; Food and Agriculture; Manufacturing; Mining; and Education. The Act's definition of "computer system" includes operational technology such as SCADA and distributed control systems, so plant networks are in scope, not just IT. For a cross-country view see the Critical Infrastructure Regulation Map.
Licensed service categories
When licensing opened, the CSA described these categories:
- Licensed CSPs: vulnerability assessment and penetration testing (VAPT), digital forensics services, managed cybersecurity services, cybersecurity governance, risk and compliance (GRC), and cybersecurity training.
- Accredited CEs: digital forensics facilities and managed cybersecurity service facilities.
- Accredited CPs: individuals with relevant qualifications, demonstrable competence and industry experience in the same areas.
Key obligations
CII owners
Section 36 requires the CSA to register CII, and owners must notify a change of ownership within seven days. Section 38 provides for periodic audits and inspections, and section 39 requires owners to report incidents within 24 hours of detection, commission audits and submit audit reports. The Directive for the Protection of CII, issued under section 92 and effective 1 October 2021, turns this into a baseline.
| Directive area | Requirement | Frequency or deadline |
|---|---|---|
| Governance | Board-approved cybersecurity policy aligned with sector best practice; senior accountable officer for cybersecurity | Policy reviewed at least annually |
| Assets and access | Identify, classify and catalogue CII assets; control access to systems and services; screen personnel handling CII data | Ongoing |
| Risk | Cybersecurity risk assessment and a risk register | Quarterly assessment |
| Audit | Cybersecurity audit; submit audit reports, risk register and activity records to the CSA when required | Yearly |
| Incidents | Report all incidents to the sectoral CERT, or CERT-GH where none exists | Within 24 hours of becoming aware |
| Vulnerabilities | Report vulnerabilities found through internal or external audits | Within 72 hours of discovery |
| Contact | 24/7 point of contact for incident reporting and advisories | Standing |
| Resilience | Tested business continuity and disaster recovery plans; source code of critical systems in escrow | Regular testing |
| Third parties | Manage cyber risk from suppliers, service providers and other affiliates | Ongoing |
| Change | Notify the CSA of significant design, configuration, security or operational changes before final board approval; seek clearance for major organisational change | At least one month before major change |
Cybersecurity service providers and professionals
- Licence before service: apply under section 50; a licence is granted under section 51 and lasts two years (section 53(1)).
- Renew on time: apply for renewal at least one month before expiry (section 53(2)). The CSA can suspend or revoke a licence under sections 54 and 55.
- Accreditation for people and facilities: section 57 requires a mechanism to accredit professionals; section 58 covers certification of cybersecurity products and solutions.
- Verify status publicly: the CSA publishes a licence verification service at csa.gov.gh/licence where buyers can check a certificate number.
All institutions: section 47 reporting
Section 47 routes sectoral CERT reports to the CSA through the National CERT, and section 47(5) requires the person in charge of an institution to report a cybersecurity incident within 24 hours of detection. Failure attracts an administrative penalty under section 47(6). For comparison with other regimes see the Cyber Incident Reporting Requirements Map.
Timeline and current status
| Date | Event |
|---|---|
| 2020 | Cybersecurity Act 2020 (Act 1038) enacted |
| 23 September 2021 | Gazette Notice No. 132 designates 13 CII sectors |
| 1 October 2021 | Directive for the Protection of CII takes effect |
| 1 March 2023 | Reported start date: CSA begins licensing CSPs and accrediting CEs and CPs |
| 1 October to 14 November 2025 | Public consultation on the draft Cybersecurity (Amendment) Bill, which would expand the CSA's role and functions |
| 23 January 2026 | CSA press release (CSA/COMMS/PR/2026-1/1) announces enforcement |
| 31 January 2026 | Sanctions apply to unlicensed CSPs and unaccredited CEs and CPs |
As of November 2026, the Act and the CII Directive are in force. We did not confirm whether the 2025 amendment bill has been laid before or passed by Parliament; treat its proposals as pending and check the CSA's announcements.
Enforcement and penalties
The CSA enforces through licensing decisions, audits, directives under section 92 and administrative penalties set in the Act's Second Schedule. Section 93 lists factors for setting penalties, such as the size of the provider and the criticality of the sector, and section 96(l) lets the Minister amend penalties by regulation. Fines in Ghanaian law are expressed in penalty units; confirm the current value of a penalty unit before estimating exposure.
| Provision | Conduct | Sanction |
|---|---|---|
| Section 40(2) | Unauthorised access to CII | 2,500 to 15,000 penalty units, 2 to 5 years' imprisonment, or both |
| Section 40(3) | Aggravated CII offences (financial loss, damage, serious injury; terrorist act) | Heavier penalties; 7 to 25 years where deemed a terrorist act |
| Section 49(2) | Providing a cybersecurity service without a licence | Administrative penalty under the Second Schedule; the CSA also cites criminal prosecution |
| Section 47(6) | Failure to report an incident | Administrative penalty |
| Section 36(4) and Second Schedule | CII non-compliance (cited by the Directive) | Administrative sanctions |
| Section 95 | General contravention with no specific penalty | 2,500 to 20,000 penalty units, 2 to 5 years, or both |
The cedi value of a penalty unit is set separately under Ghana's fines legislation and can change; we did not confirm the current value on an official source, so check it before estimating exposure. We also did not confirm the date of presidential assent to Act 1038 on an official source.
What it means for AI agents and non-human identities
The CII Directive asks owners to catalogue assets and control access to systems and services. In practice most access to CII systems is by machines: integration accounts, historians pulling plant data, monitoring agents, backup jobs and, increasingly, AI agents that query or act on operational data. These belong in the same programme.
- Catalogue machine identities as CII assets: list service accounts, API keys, certificates and agent identities with reach into CII, each with an owner and purpose. The NHI Discovery Across Cloud, SaaS, CI/CD and On-Premises Environments guide covers how to find them.
- Put them in the quarterly risk assessment: the Directive's quarterly cycle is a natural review point for machine access to CII. NHI Mgmt Group recommends a quarterly entitlement review for identities that can change OT or payment systems.
- Licensed providers hold your credentials: a licensed managed security provider or penetration tester will be given privileged access. Issue it as named, time-bound access, rotate it at contract end and record it in the third-party risk register the Directive requires. See the Service Account Security Guide.
- Agents and the 24-hour clock: a compromised token or a misbehaving agent that disrupts a CII system is an incident. Make sure agent and service account telemetry reaches the SOC so the 24-hour clock can be met. The Detection Engineering for Non-Human Identities Guide lists the signals.
- Change notification: deploying an AI agent with write access to CII may count as a significant configuration or operational change under the Directive. Assess it before board approval rather than after go-live.
Compliance steps
- Classify yourself: CII owner (check the 13 sectors and any CSA registration correspondence), CSP, CE, professional, buyer of security services, or none of these. Many organisations are more than one.
- Licensing check (providers): confirm every service line you offer in Ghana against the licence categories, hold a current licence, diary the renewal date at least one month before expiry, and confirm staff accreditation.
- Supplier check (buyers): verify every security supplier's licence number on the CSA verification page before contract and at renewal, and add the requirement to procurement terms.
- Gap-assess against the Directive (CII): policy, accountable officer, asset catalogue, access control, personnel screening, training, monitoring, BCDR, escrow, supplier risk.
- Set up reporting: name the 24/7 point of contact, identify your sectoral CERT or CERT-GH, define "becoming aware", and rehearse both the 24-hour incident report and the 72-hour vulnerability report. The Incident Response Plan Template can carry these steps.
- Run the cycles: quarterly risk assessments, yearly audits, an up-to-date risk register, and evidence ready for CSA requests.
- Track change: route significant changes through a CSA notification check, and monitor the amendment bill.
Framework mapping
| Act or Directive requirement | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Board policy, accountable officer | GV.OC-03, GV.RR-01 | PM-2, PM-9 |
| Asset catalogue | ID.AM-01, ID.AM-02 | CM-8 |
| Access control including machine identities | PR.AA-01, PR.AA-05 | AC-2, AC-6, IA-4, IA-5 |
| Quarterly risk assessment, risk register | ID.RA-01, GV.RM-01 | RA-3 |
| 24-hour incident report | RS.CO-02 | IR-6 |
| 72-hour vulnerability report | ID.RA-08 | RA-5 |
| Supplier risk, licensed providers | GV.SC-01, GV.SC-07 | SR-3, SA-9 |
| BCDR testing | RC.RP-01 | CP-4 |
Measuring it
- Licence coverage: percentage of active security suppliers with a verified, current CSA licence.
- Reporting time: median hours from detection to sectoral CERT report in incidents and exercises, against the 24-hour limit.
- Vulnerability reporting: share of audit-found vulnerabilities reported within 72 hours.
- Machine identity ownership: percentage of service accounts and agent identities with access to CII that have a named owner and a review in the last quarter.
- Cycle conformance: quarterly risk assessments and yearly audits completed on schedule.
Common failure patterns
- Assuming licensing applies only to local firms: the Act regulates providing a cybersecurity service in Ghana. Foreign providers serving Ghanaian clients should take legal advice on whether they need a licence.
- Letting the licence lapse: renewal must be applied for at least one month before the two-year licence expires.
- Treating OT as out of scope: the Act's definition of computer system includes SCADA and distributed control systems.
- Only counting human access: asset catalogues and access reviews that skip service accounts and agent tokens miss most access paths into CII.
- Waiting for root cause before reporting: the clock runs from detection or awareness, not from the end of the investigation.
- Forgetting the vulnerability clock: audit findings have their own 72-hour reporting duty under the Directive, separate from incidents.
Practitioner checklist
- Decide and record whether you are a CII owner, CSP, CE, professional or buyer.
- Providers: hold a current CSA licence for every service line and diary renewal one month early.
- Buyers: verify supplier licences on the CSA verification page and write the requirement into contracts.
- CII owners: gap-assess against the Directive and fix policy, asset, access and BCDR gaps first.
- Name a 24/7 contact and rehearse the 24-hour incident and 72-hour vulnerability reports.
- Run quarterly risk assessments and yearly audits, and keep the risk register current.
- Include service accounts, API keys and AI agents in the CII asset catalogue and access reviews.
- Issue time-bound credentials to licensed providers and revoke them at contract end.
- Track the Cybersecurity (Amendment) Bill and CSA directives.
Standards and references
- Parliament of Ghana: Cybersecurity Act 2020 (Act 1038), via GhaLII
- Cyber Security Authority: Directive for the Protection of Critical Information Infrastructure
- Cyber Security Authority: Overview of Critical Information Infrastructure
- Cyber Security Authority: Press release on enforcement of licensing and accreditation, 23 January 2026 (hosted by MyJoyOnline)
- Graphic Online: Regime to license cyber security operators starts March 1
- Digital Policy Alert: CSA consultation on the draft Cybersecurity (Amendment) Bill 2025
- Digital Watch Observatory: Ghana's Cybersecurity Act 2020 (Act 1038)
Related NHI Mgmt Group resources: Critical Infrastructure Regulation Map · Cyber Incident Reporting Requirements Map · Kenya Data Protection Act Guide. This guide summarises Ghana's Cybersecurity Act 2020 (Act 1038) and the CSA Directive for the Protection of CII as published at the date above and is not legal advice.