What Ghana's CSA licensing means for businesses buying security

If you hire a firm in Ghana to test your systems, review your compliance or run your security, that firm now needs a licence from the Cyber Security Authority (CSA). The requirement comes from the Cybersecurity Act, 2020 (Act 1038), and the CSA began strict enforcement on 31 January 2026.

This post explains what that means for you as a buyer of security services, not as a provider.

Which services need a licence

The CSA licenses Cybersecurity Service Providers by category. The services most businesses buy fall inside it:

• Vulnerability assessment and penetration testing (VAPT): testing your web apps, APIs, mobile apps and networks.
• Governance, risk and compliance (GRC): gap assessments, policy work and audit readiness.
• Managed security services: monitoring, detection and response run on your behalf.
• Security training: awareness and technical courses.

Individual practitioners also need professional accreditation from the CSA, separate from the firm’s licence.

Why it matters to you

Enforcement is real. In August 2026 the CSA fined EY Ghana GH¢360,000 for operating without a licence. A provider that is not licensed is exposed to sanctions mid-engagement, and you are left with a half-finished test and a report you may not be able to rely on in front of a regulator or partner bank.

If you are regulated yourself, for example under the Bank of Ghana’s 2026 cyber security directive, your own compliance can depend on the evidence your provider gives you. Evidence from an unlicensed provider is a weak foundation.

Five questions to ask before you sign

1. What is your CSA licence number, and for which categories? A testing licence does not cover managed security, and the reverse.
2. Are the people doing the work accredited? Ask for names, not just the firm’s credentials.
3. Will you give us a written scope and rules of engagement? No legitimate tester starts without signed authorisation.
4. How will you store and delete our findings? Findings are a map of how to attack you. They should be encrypted and deleted on a schedule.
5. What happens if you find something critical? You want a same-day call, not a surprise in the final report.

Where W5 stands

We are applying for our CSA licence now. Until it is granted, we do not sell security testing or GRC services in Ghana. Our security pages say so plainly, and our engineering work continues as normal. When the licence is granted, the number will be in our footer and on our about page.

If you want to be told when we can take on security work, join the waitlist.