01
Board and senior management
A board cyber committee with a cyber-qualified director, and reporting every quarter.
Bank of Ghana CISD
Meet the Bank of Ghana's cyber directive with evidence that collects itself.
CyberPlug maps the directive to your controls, collects evidence from your systems and reports your posture to the board.
- Issuer
- Bank of Ghana
- In force
- March 2026
- Applies to
- Licensed institutions
What it is
What the directive asks of you
In March 2026 the Bank of Ghana replaced its 2018 framework with the Cyber and Information Security Directive. It binds banks, non-bank financial institutions, payment service providers, credit bureaus and virtual asset service providers.
It requires certification, not intent. It puts accountability with the board and a named CISO. It expects continuous posture, with regular exercises and reporting to the board and the regulator. Non-compliance carries statutory sanctions.
Who needs it
- Every licensed institution the Bank of Ghana supervises.
- The technology providers those institutions depend on, who are asked for evidence in every review.
What it covers
From the boardroom to incident reporting
The directive runs to 21 Parts, 129 sections and 8 annexures. CyberPlug organises it into the areas your team actually works in.
02
The CISO mandate
A CISO whose appointment needs the Bank of Ghana's prior written approval and who reports to the CEO.
03
Risk management
Cyber risk identified, scored, owned and treated, with a register the board can read.
04
Cyber defence
The technical controls the directive expects, from access control to monitoring.
05
Incident reporting
Detect, escalate and report incidents to the regulator on its timetable.
The problem
A directive with a deadline you did not choose
- Every institution is re-mapping its posture against the same directive at the same time, mostly in spreadsheets.
- The board asks for a quarterly picture and gets a slide deck assembled the week before.
- Section 4.9 of the directive asks for ISO 27001 certification, and most institutions hold neither the certificate nor the evidence yet.
How CyberPlug helps
Map the directive once, report from live data
- 01
The directive mapped to your controls
CISD requirements link to the same controls that serve ISO 27001 and the Data Protection Act, so one piece of work satisfies all three.
- 02
Evidence from your systems
Read-only connectors collect configuration evidence from AWS, GitHub, Google Workspace, Okta and PostgreSQL every 24 hours. Documents such as board minutes and signed policies are uploaded and reviewed the same way.
- 03
Named owners and a human approval
Every control has an owner. Nothing turns green until a person approves the evidence, so the answer to who signed off is always a name.
- 04
A register and a dashboard for the board
Likelihood-and-impact scoring, heat maps and posture trends give your cyber committee the same numbers your team works from.
- 05
Your data stays isolated
Your data is kept separate from every other institution's, and it is encrypted whether it is stored or being sent.
Path to ready
From gap analysis to examiner-ready
- 1
Identify what applies to you
Confirm your institution type and which parts of the directive bind you.
- 2
Assign ownership
Name the CISO, the cyber committee and an owner for each control.
- 3
Connect your systems
Start evidence collection from the platforms you run.
- 4
Close the gaps
Work the list of controls still missing evidence, each with an owner.
- 5
Report to the board
Take posture and risk reporting into each quarterly meeting.
- 6
Meet the examiner
Share read-only access with your examiner or auditor.
CyberPlug prepares and tracks. The Bank of Ghana supervises and decides.
One control, many frameworks
The directive points to ISO 27001. Your evidence can too.
Section 4.9 requires ISO 27001 certification and section 4.10 requires PCI DSS for institutions that handle cards. A control evidenced once counts toward each.
FAQ
Questions we hear most
Is CyberPlug approved by the Bank of Ghana?
No. The Bank of Ghana does not approve compliance tools. CyberPlug helps you organise and evidence your own compliance.
Does your library cover the whole directive?
We add the directive's requirements to the library section by section, and we show you what is covered today in a demo.
Does the directive apply to a payment service provider?
The directive applies to licensed institutions the Bank of Ghana supervises, which include payment service providers. Confirm your obligations with your supervisor.
Can board members see this?
Board and committee members can be invited with a read-only Viewer role and read the executive dashboard.
Do we need ISO 27001 as well?
The directive asks for ISO 27001 certification, so most institutions pursue both. CyberPlug maps one set of controls to the two.