The Cybersecurity Act, 2020 (Act 1038) created the Cyber Security Authority (CSA) and made selling cybersecurity services in Ghana a regulated activity. If your business offers security services, or hires someone to test or monitor its systems, it helps to know who needs what. This is a plain-language overview, not legal advice; the CSA's own licensing FAQ is the authority.

Licence or accreditation

  • Cybersecurity Service Providers (CSPs), businesses that sell cybersecurity services, need a licence.
  • Cybersecurity Establishments (CEs) and individual Cybersecurity Professionals (CPs) need accreditation.

Which services count

The CSA lists these services for licensed providers:

  • Vulnerability assessment and penetration testing (VAPT)
  • Digital forensics
  • Managed cybersecurity services
  • Cybersecurity governance, risk and compliance (GRC)
  • Cybersecurity training

The CSA says other services may also qualify after it assesses them, so if your work sits near this list, ask the Authority rather than assume.

How it works

  • Applications go through the CSA's online portal.
  • The CSA responds within 30 days of receiving a complete application.
  • A licence or accreditation is valid for two years. Apply to renew no later than one month before it expires.
  • A licence cannot be transferred to another business.

The deadline has passed

Existing providers had until 31 December 2023 to get licensed or accredited (the original date, 30 September 2023, was extended). After that, the CSA warned that anyone offering cybersecurity services without a licence or accreditation would face administrative penalties and prosecution. Under section 49 of the Act, operating without a licence attracts a penalty equal to the cost of the damage caused and the financial gain made.

If you are buying security services

  • Ask the provider for their CSA licence and check the expiry date. Two years passes quickly.
  • For a penetration test, confirm the licence covers VAPT specifically.
  • Put the scope, the dates and the confidentiality terms in writing before any testing starts.
  • Agree who receives the findings and how they will be stored. A test report is a map of your weaknesses.