Bank of Ghana CISD 2026, Assessed And Evidenced
The Bank of Ghana Cyber and Information Security Directive 2026 runs to 129 controls across the 21 Parts, with five-tier proportionality supported in the assessment engine. Auditara scores every control, builds the remediation plan, and produces the gap report the regulator expects.
- Controls across 21 Parts
- 129Controls across 21 Parts
- Five tiers, full control set assessed
- 5 tiersFive tiers, full control set assessed
- Activities across 4 phases
- 22Activities across 4 phases
Who Needs It
Banks and Specialised Deposit Takers
The Directive applies in full at the upper tiers, where the widest control set is expected of you.
Savings and Loans, Finance Houses and Microfinance
Requirements are framed by tier in the Directive, and your tier is captured at intake and recorded on the programme.
Rural and Community Banks
The Directive frames lower tiers proportionately, and your tier is recorded so the position you assessed against is on record.
Payment Service Providers and Electronic Money Issuers
Payment and e-money institutions fall within scope, with tier driven expectations on controls and reporting.
Why This Matters to Regulated Institutions
The Directive Is Not Optional
Institutions regulated by the Bank of Ghana are expected to assess themselves against the Directive and evidence the result. The submission is the point, not a slide deck.
Proportionality Is Easy to Get Wrong
Assessing too little leaves gaps the regulator will find. Auditara scores the full control set and records your tier on the programme, so nothing is quietly left out.
Evidence Has to Be Traceable
Each control needs a status, a rationale, an owner, and a date. Auditara records all four and keeps the trail intact for the RFI that follows.
What Is Inside the CISD 2026 Programme
The full Directive, with the artefacts the regulator asks for.
All 129 Controls Across 21 Parts
Scored control by control with plain English guidance, and five-tier proportionality supported in the assessment engine. The assessment presents the full control set, so nothing is left out.
22 Activities Across 4 Phases
A phased programme with a deliverable per activity and a gate criterion before the phase can close, so an activity cannot be marked complete without written commentary and a recorded sign-off.
The Gap Report
A branded gap report with status per control, rationale, and a prioritised remediation plan carrying owners and target dates, exported as Word or PDF.
Audit Ready Evidence
Evidence linked per activity, approvals recorded with sign-off, and a read only room you can open for supervisory review.
How Auditara Runs It
- 1Step 1
Book the Call
Fifteen minutes with a PECB certified Lead Auditor and Lead Implementer. We confirm your tier, your scope, and your submission timeline, then your workspace opens.
- 2Step 2
Answer the Intake
A guided intake captures your institution's profile and tier in plain English, and records it on the programme.
- 3Step 3
Assess and Remediate
Score every applicable control, then give each gap an owner and a target date. AI drafts remediation wording from your notes, which you confirm.
- 4Step 4
Produce the Report
Generate the gap report and remediation plan, approve your document set, and keep the evidence trail ready for supervisory questions.
Two Ways to Run It
At Your Own Pace
Readiness Workspace: the guided workspace for the full Directive, opened after your onboarding call.
With Us Delivering
Guided Implementation: we run the programme with you to audit readiness, with a written guarantee. Scope is agreed on your onboarding call.
Every route starts with a call with a certified ISO 27001 and ISO 42001 Lead Implementer.
Book A CallQuestions
What is the Bank of Ghana CISD 2026?
The Cyber and Information Security Directive 2026 sets the cyber and information security requirements for institutions regulated by the Bank of Ghana. It runs to 129 controls across 21 Parts, with requirements framed by institution tier.
How does tier proportionality work?
The Directive applies across five tiers, and five-tier proportionality is supported in the assessment engine. Your tier is captured at intake and recorded on the programme, and the assessment currently presents the full control set so nothing is missed.
What does the Bank of Ghana actually want to see?
A documented, evidenced self assessment against the Directive. The gap report is the artefact they expect, and Auditara generates it from your scored assessment with owners and target dates attached.
How long does it take?
That depends on your scope, how much you already have in place, and how quickly your team can produce evidence. Rather than quote an average that will not match your situation, the product schedules the work backwards from a certification date you set, and shows you what is outstanding against it.
Where is our data held?
In the EU, in Ireland. Programme data and evidence are held in private storage served only through short lived signed links. Evidence can stay in the systems you already use, linked rather than copied. Our sub-processors are named publicly and our Article 28 data processing agreement is published.
Ready to Start Your Programme?
Readiness Workspace is free to start. Guided Implementation adds delivery to audit readiness, agreed with you on the call.