ORC Challenges CSA Cybersecurity Sanction in Ghana: No Premature Penalty

• The Office of the Registrar of Companies (ORC) has challenged a cybersecurity sanction imposed by the Cyber Security Authority (CSA).
• The ORC argues that the penalty was premature and procedurally unfair.
• The dispute follows a CSA statement announcing sanctions against the ORC and Purpleline Solutions Limited for alleged cybersecurity non-compliance.

The ORC's challenge to the sanction suggests that companies may be able to contest penalties if they can demonstrate that the procedures leading up to the imposition of the penalty were flawed.

The Office of the Registrar of Companies (ORC) has taken issue with a cybersecurity sanction imposed by the Cyber Security Authority (CSA). The ORC argues that the penalty was premature and procedurally unfair. According to the ORC, the sanction relates to its procurement of a Network Operations Centre (NOC) and Security Operations Centre (SOC), which it claims was substantially completed before the CSA directed Critical Information Infrastructure (CII) institutions to engage Tier One licensed cybersecurity service providers.

The dispute follows a CSA statement announcing sanctions against the ORC and Purpleline Solutions Limited for alleged cybersecurity non-compliance. The ORC's challenge to the sanction suggests that companies may be able to contest penalties if they can demonstrate that the procedures leading up to the imposition of the penalty were flawed.

Ghana's Critical Information Infrastructure (CII) regulations require institutions to engage Tier One licensed cybersecurity service providers. The Cyber Security Authority (CSA) is responsible for enforcing these regulations and imposing penalties on non-compliant entities. The ORC's challenge to the sanction highlights the potential for companies to contest penalties if they can demonstrate that the procedures leading up to the imposition of the penalty were premature or procedurally unfair.

The case also raises questions about the scope of the CII regulations and the extent to which companies must comply with them. Lawyers advising companies on compliance with Ghana's CII regulations should be aware of the implications for businesses that have already invested in cybersecurity measures, as this case highlights the potential for penalties to be challenged and overturned if deemed premature or procedurally unfair.

The ORC's challenge to the CSA sanction has significant implications for companies operating in Ghana. If the ORC is successful in challenging the penalty, it could set a precedent for other companies to contest penalties imposed by the CSA. This could lead to a re-evaluation of the CII regulations and the procedures used to impose penalties.

The case also highlights the importance of ensuring that procedures leading up to the imposition of penalties are fair and transparent. Companies should be aware of their obligations under the CII regulations and take steps to ensure compliance, but they should also be able to contest penalties if they can demonstrate that the procedures were flawed.

Lawyers advising companies on compliance with Ghana's Critical Information Infrastructure regulations should be aware of the implications for businesses that have already invested in cybersecurity measures, as this case highlights the potential for penalties to be challenged and overturned if deemed premature or procedurally unfair.

Source: Original reporting via [Source]