At a Cyber Security Authority (CSA) workshop in Accra during National Cyber Security Awareness Month, the Minister for Communication, Digital Technology and Innovations, Samuel Nartey George, told owners of critical information infrastructure that their cybersecurity obligations are mandatory. The workshop's theme was "Critical Information Infrastructure Resilience Beyond IT: Securing Ghana's Operational Technology Ecosystem".

That last part is the news for anyone who runs a plant, a pumping station, a mine, a hospital or a large site. The rules are not only about the server room.

What was said

Reports of the workshop (published 8 and 9 October 2026) say:

  • Compliance is mandatory for owners of critical information infrastructure (CII), under the CSA's Directive for the Protection of Critical Information Infrastructure.
  • About 200 institutions have been identified as CII owners, across 13 sectors.
  • Operational technology (OT) is in scope: industrial control systems, SCADA platforms, sensors and field devices. The Minister warned that an attack on these could disrupt essential services and put lives at risk.
  • Boards and chief executives own it. He told board chairs and CEOs that cyber resilience is not a job for technical teams alone.
  • What owners were urged to do: strengthen cybersecurity governance, report incidents on time, run regular audits and vulnerability assessments, and engage only Tier 1 licensed cybersecurity service providers.

The Minerals Income Investment Fund made the same point for mining at the workshop: an attack on mining control systems is not only an IT problem, because it can affect safety, production and national revenue.

The directive is not new, but its reach is easy to miss

The CSA's directive came into effect on 1 October 2021, under sections 35 to 40 and 92 of the Cybersecurity Act, 2020 (Act 1038). What many owners miss is how it defines a "computer system". The definition covers information systems and operational technology: programmable logic controllers (PLCs), SCADA and distributed control systems.

So a control network in a power substation or a water treatment plant is covered in the same way as the finance server.

The 13 designated CII sectors are:

  • National Security and Intelligence
  • Information and Communication Technology
  • Banking and Finance
  • Energy
  • Water
  • Transport
  • Health
  • Emergency Services
  • Government
  • Food and Agriculture
  • Manufacturing
  • Mining
  • Education

Not every organisation in these sectors is a designated CII owner. Designation is notified to the institution. If you are not sure whether yours has been designated, ask your management and the CSA before you assume either way.

What a designated owner has to do

The directive's baseline requirements include:

  • A cybersecurity policy, approved by the board, reviewed at least once a year, and covering data protection under the Data Protection Act, 2012 (Act 843).
  • An accountable officer at senior management level for cybersecurity governance.
  • An inventory: identify, classify and catalogue every CII asset.
  • Access control to CII systems and services.
  • Physical security for CII systems and the assets they depend on.
  • Security monitoring to detect incidents in time.
  • Maintenance and software updates to reduce equipment failure.
  • A tested business continuity and disaster recovery plan.
  • A risk assessment every quarter and a cybersecurity audit every year, with a risk register.
  • Incident reporting within 24 hours of becoming aware of an incident, to the sector CERT or, where there is none, to CERT-GH at the CSA.
  • Vulnerability disclosure within 72 hours of finding one through an audit or assessment.
  • Notice to the CSA of significant changes to the design, configuration, security or operation of the CII before final board approval.

Failure to comply carries the sanctions set out in the Cybersecurity Act.

Where cameras, access control and the site network fit

On a real site, operational technology rarely sits alone. The same switches and cabling often carry the control system, the CCTV recorder, the access control panels and staff Wi-Fi. A camera with a default password on the same network as a PLC is a way in.

The directive asks for physical security, access control and an asset inventory. On our reading, those reach the cameras, door controllers and network equipment around the control system, not just the control system itself. Practical steps for any site, designated or not:

  • List everything on the network, including cameras, recorders, door controllers, sensors and the box in the corner nobody remembers installing.
  • Separate the networks. Put CCTV, access control, control systems and office IT on separate segments (VLANs or physically separate switches), and allow only the traffic each one needs.
  • Change every default password and turn off remote access that nobody uses. Our guide to viewing CCTV on your phone safely covers this for cameras.
  • Keep the power on. Cameras and controllers that drop out in a power cut leave gaps in the record. See keeping CCTV recording through dumsor.
  • Lock the cabinets and the server or control room, and log who goes in. Access control with an audit trail gives you that record.
  • Keep firmware current on cameras, recorders, switches and controllers, and write down when it was done.

Who does what

The audits, assessments and licensed cybersecurity services the directive calls for belong with a provider licensed by the CSA. Check a provider's licence with the CSA before you sign. Our earlier piece on the Cybersecurity Act and CSA licensing explains how licensing works.

Teknikal Ghana designs and installs the physical and network layer underneath: security systems (CCTV, access control, IoT sensors) and network infrastructure (structured cabling, switching, segmentation and Wi-Fi), for sites across Ghana. If your auditor has given you a list of findings on cameras, doors or network layout, our IT consultancy team can turn it into a plan and a price.

Sources

  • Cyber Security Authority, Directive for the Protection of Critical Information Infrastructure (2021), csa.gov.gh.
  • Cyber Security Authority, Overview of CII, csa.gov.gh/cii.
  • MyJoyOnline, "Cybersecurity compliance mandatory for critical infrastructure owners - Sam George", 8 October 2026.
  • TechAfrica News, "Ghana Strengthens Cyber Resilience for Critical Infrastructure", 8 October 2026.
  • Graphic Online, "MIIF calls for stronger cyber resilience to secure mining operations", 9 October 2026.