Why this matters
The Cybersecurity Act, 2020 (Act 1038) shapes how security works in Ghana. It created the regulator, set up incident response teams, protects critical systems and regulates the people and companies who sell security services. Employers expect security staff to know its basics, and it may affect your own career if you later offer services to clients.
What the Act does
Act 1038 was passed in 2020. Its main parts include:
- The Cyber Security Authority (CSA): established to regulate cybersecurity activities in Ghana and promote the development of cybersecurity in the country.
- Critical information infrastructure (CII): computer systems or networks essential for national security or the economic and social well being of citizens. The Act provides for designating, registering and auditing CII. The CSA states that thirteen sectors were designated as CII sectors in 2021.
- Computer emergency response teams: a National CERT and Sectoral CERTs that monitor and respond to incidents.
- Incident reporting: section 47 requires a person in charge of an institution to report a cybersecurity incident to the relevant Sectoral CERT or the National CERT within 24 hours of detecting it.
- Licensing and accreditation: cybersecurity service providers must be licensed (section 49), and the CSA accredits cybersecurity professionals and practitioners (section 57).