Eiiii, The Hackers Have Entered Our System!
Every Ghanaian business wants to succeed in the digital age. But between the goals and the glory sits a hacker in a basement somewhere — patient, creative, and entirely unbothered by your “Password123” policy.
Picture this. Your aunty has expanded. The chop bar near Accra Mall is now a thriving business — she has MoMo payments, a WhatsApp ordering line, a website, and an Instagram page that her nephew manages “for free.” Business is booming. Then one Tuesday morning, she calls you in a panic: “My MoMo account has been cleared. Someone sent all the money to a number in Kasoa. The website is showing something in Russian. And I think I clicked something in an email from the GRA.”
Welcome to cyber risk in Ghana. It is real, it is growing, and it does not care whether you are a multinational bank on Independence Avenue or a chop bar with a digital payment terminal. The attackers are equal-opportunity troublemakers.
This is why Cybersecurity GRC — Governance, Risk, and Compliance — is no longer optional. It is the difference between a business that gets hit and recovers, and one that gets hit and never quite recovers. And increasingly, there is an internationally recognised framework that ties all of this together:
ISO/IEC 27001.
GHANAIAN PROVERB “The thief who enters through the window does not announce himself.” Neither does ransomware. It sits quietly in your system for weeks before it strikes — usually on a Friday evening, when the IT person has already travelled to Kumasi. |
G is for Governance: who is minding the digital compound?
Cybersecurity Governance answers the question: who oversees protecting our digital assets, and how are they held accountable? In some companies, this is a dedicated CISO with board-level access and a proper budget. In others, it is Kwame from IT — who also fixes the printers, orders the toner, and is technically the only person who knows the Wi-Fi password. Kwame is doing his best. But Kwame is not a governance structure.
Good governance means the board understands cyber risk as a business risk. It means there is a cybersecurity policy that people have actually read. The Bank of Ghana and the Data Protection Commission are increasingly clear on this. Governance is not optional. It is regulated.
THE GOVERNANCE GAP Too many Ghanaian organisations treat cybersecurity as a technical problem to be solved by the IT department. A data breach is a business problem. A ransomware attack is a business problem. A phishing email that empties the company account is a business problem. The board must own it. |
The threat landscape: what is actually coming for you
Before we talk about risk assessment, let us be honest about what the risks actually are — because in Ghana’s growing digital economy, the threat landscape is no longer theoretical. These things are happening. Regularly.
Threat | The Ghanaian version | Likelihood |
Phishing | An email claiming to be from the GRA demands urgent action on your tax filing. Abena in accounts clicks the link. The link is not from the GRA. | HIGH |
MoMo fraud | A caller says they are from MTN and need to ‘verify your PIN to prevent suspension.’ The caller is not from MTN. | HIGH |
Ransomware | Every file on the company server is encrypted. A message demands Bitcoin. The last backup was four months ago. | MEDIUM |
Insider threat | A departing employee — upset about end-of-service benefits — copies the customer database to a USB drive on their last day. | MEDIUM |
Weak credentials | The system password is ‘Ghana2024’. It has been ‘Ghana[year]’ since 2019. The attackers have noticed the pattern. | HIGH |
Third-party risk | Your IT vendor has access to your systems but their own security is poor. An attacker compromises your vendor and walks straight into your network. | MEDIUM |
R is for Risk: know what is coming before it arrives
A cyber risk assessment is not a document you commission, print, bind nicely, and place on a shelf. It is a living process. It asks: what are our digital assets, what threatens them, how likely it is, and what happens to the business if they are compromised?
Risk identification means cataloguing your digital crown jewels — customer data, financial records, operational systems — and mapping every realistic way something bad could reach them. Your MoMo integration. Your cloud storage. The unsecured Wi-Fi in the meeting room. All of it goes on the list.
Risk analysis means being honest about likelihood and impact. It is very likely that a phishing campaign will hit your staff — because those campaigns hit everyone. The question is: when Abena clicks the link, how much damage can that one click actually cause?
Risk evaluation is where you decide which risks are acceptable, which need immediate controls, and which belong on a cyber insurance conversation. Hint: if you do not yet have that cyber insurance conversation, have it soon. Your insurer will want to know what controls you have in place — and that question alone usually accelerates the GRC conversation considerably.
GHANAIAN PROVERB “In cybersecurity, the human being is simultaneously the most valuable asset and the most exploitable vulnerability.” Train your people. Then train them again. Then test them with a simulated phishing email and see who clicks. You will be humbled. |
C is for Controls: your digital compound wall
Once you know the risks, you build controls. Think of them as the layered security of a well-run Ghanaian compound: the outer wall, the gate, the watchman, the inner lock, and the dog that barks at anything unusual. Controls come in three types, and all three matter.
PREVENTIVE Stop the attack before it lands Multi-factor authentication (MFA). Least-privilege access — give staff only what they need. Regular patch management so systems are not running 2021 software in 2026. Security awareness training so Abena recognises the fake GRA email before she clicks it. |
DETECTIVE See the attack when it happens SIEM systems that monitor logs and raise alerts. Intrusion detection. Regular vulnerability scans. User behavioranalytics that flag when Kofi’s account downloads 50,000 customer records at 11pm on a Saturday. |
CORRECTIVE Recover when the attack succeeds A tested incident response plan — rehearsed, not theoretical. Offsite encrypted backups that are regularly verified and restored. Business continuity procedures. A communications plan for telling customers, regulators, and the Data Protection Commission what happened. |
THE MFA CONVERSATION GHANA NEEDS TO HAVE Multi-factor authentication prevents the vast majority of account takeover attacks. It costs almost nothing to implement on most platforms. And yet there are still Ghanaian organisations where critical systems are protected by a username, a password, and hope. Enable MFA. On everything. Today. This is the single most impactful control you can implement this week. |
ISO 27001: the international standard that ties it all together
If GRC is the philosophy, ISO/IEC 27001 is the blueprint. It is the internationally recognised standard for Information Security Management Systems (ISMS) – a systematic approach to managing sensitive information so that it stays secure. Think of it as the architectural plan for your digital compound: it does not just tell you to build a wall, it tells you exactly how high, where to put the gates, who holds the keys, and how to check every six months that the wall is still standing.
ISO 27001 is built around a core principle that will sound familiar: Plan, Do, Check, Act. Assess your risks. Implement controls. Monitor whether they work. Improve continuously. It is, at its heart, the GRC cycle — just formalised, auditable, and internationally certifiable.
ISO 27001 INSIGHT Certification signals to clients, partners, regulators, and investors that your organisation takes information security seriously — not just in words but in demonstrable, auditable practice. For financial institutions, fintechs, healthcare providers, and any business handling personal data under the Data Protection Act, this is increasingly not a nice-to-have. International clients and partners are beginning to ask for it as a prerequisite. Your competitors who have it are already winning on that point. |
The standard covers 93 controls across 4 themes in ISO 27001:2022. Here is how they map to the Ghanaian cyber reality:
ISO 27001 Domain | What it requires | The Ghana reality check |
A.5 — Organisational controls | Policies, roles, responsibilities. Someone must own information security. | Is it Kwame? Define it. Document it. Put it in someone’s job description — not just whoever is nearest the server. |
A.6 — People controls | Security awareness, training, staff screening, disciplinary processes. | Train Abena before the phishing email arrives. Not after. Background checks on staff with sensitive access are not paranoia — they are due diligence. |
A.7 — Physical & environmental | Physical access controls, equipment security, clear desk policies. | The server under the reception desk with cables trailing across the floor is a physical risk. So is the filing cabinet with customer data that anyone can open. |
A.8 — Technological controls | Access control, cryptography, malware protection, backups, network security. | MFA. Patch management. Encrypted offsite backups. Network segmentation. This is where most organisations start — and incorrectly stop. |
A.5.23 — Cloud security | Policies for acquiring, using and managing cloud services securely. | Moving to AWS or Azure without configuring security settings is like renting an office in Ridge and leaving the front door open. |
A.5.29 — Business continuity | Maintaining security during disruptions — technical or otherwise. | Dumsor is a business continuity event. A ransomware attack is a business continuity event. Plan for both. Test the plan. |
A.5.35 — Independent review | Regular independent review of the ISMS. | An internal audit that only finds what it is comfortable finding is not an audit. Independent means someone who will ask uncomfortable questions. |
GHANAIAN PROVERB “ISO 27001 certification is not the finish line. It is proof that you have built a track — and that you run on it every day.” The standard requires continuous improvement. An organisation that achieves certification and then relaxes will find the next audit very uncomfortable indeed. |
The regulatory picture: Ghana is not joking anymore
The Data Protection Act, 2012 (Act 843) requires organisations collecting personal data to protect it adequately. The Data Protection Commission has been increasingly active in enforcement. The Bank of Ghana’s Cybersecurity Directive sets specific requirements for financial institutions — and the BoG does not send polite reminders. The Cybersecurity Authority, under the Cybersecurity Act 2020 (Act 1038), is expanding its reach across sectors. ISO 27001 aligns directly with what these regulators are looking for. An organisation that can point to a certified ISMS enters regulatory conversations from a position of strength rather than apology.
WHAT THE REGULATORS ARE ASKING Do you have a cybersecurity policy? Do you conduct risk assessments? Do you have an incident response plan? Have you trained your staff? Do you know where your data is and who has access to it? These are not trick questions. They are the baseline. If you cannot answer them, that is your starting point. |
The myth buster: final edition
MYTH “We are too small to be a target.”
Most attacks are automated. Scanners probe millions of systems simultaneously looking for anything unlocked. If your system has a vulnerability, the scanner does not care that you are a small company in Tema. It finds the open door and it enters.
MYTH “We have antivirus. We are protected.”
Antivirus is like having a lock on the front door while the back window is wide open. Necessary. Not sufficient. You need layers.
MYTH “ISO 27001 is only for big companies.”
The standard is scalable. It has been implemented by organisations of every size. What matters is not how big you are — it is how seriously you take the protection of your information assets and your customers’ data.
GHANAIAN PROVERB “Onipa na ohwehwɛ ne ho.” “A person must look out for themselves.” In 2026, this means: patch your systems, enable MFA, train your staff, back up your data, pursue ISO 27001, and test your incident response plan — before the incident. |
Conclusion: the compound is digital now — guard it accordingly
There is an old instinct in Ghanaian culture to protect what is yours. The compound wall. The trusted gatekeeper. The elder who asks questions before anyone is allowed to enter. The community that watches out for itself. These instincts are not outdated. They are exactly right. They simply need to be applied to a new reality.
Your data is your compound. Your systems are your gates. Your staff are your gatekeepers — which is why training them is not optional. Your ISO 27001 ISMS is your architectural plan — proof, to yourself and to everyone who asks, that you did not just build a wall and hope for the best.
Ghana’s digital economy is growing fast. Fintech, mobile money, e-commerce, digital health, agritech — the opportunities are extraordinary. But every new digital connection is also a new surface that can be attacked. The businesses that will thrive are not the ones that move fastest and worry about security later. They are the ones that move fast and move securely — because they built the right foundations before the threat arrived at the gate.
Yɛbɛhyia bio. We will meet again — hopefully at your ISO 27001 certification ceremony.
YOUR SEVEN-STEP CYBER GRC ACTION PLAN Do this before the end of this quarter. Not next year. This quarter. | |
Step 1 | Enable MFA on every system. Today — not end of month. |
Step 2 | Assign a named owner for cybersecurity risk at board level. |
Step 3 | Conduct a cyber risk assessment. Document it honestly. |
Step 4 | Run a phishing simulation. Then train everyone who clicked. |
Step 5 | Test your backups. Verify they restore — not just that they run. |
Step 6 | Write and rehearse your incident response plan. |
Step 7 | Start your ISO 27001 journey. Scope it. Plan it. Begin. |
The hackers are not waiting for you to be ready. Do not wait either. | |
About the Author
Victor Tandoh is a Cybersecurity GRC Consultant and the founder of VT IT Consults, a consulting firm based in Columbus, Ohio. Victor is a Certified Information Systems Auditor (CISA) and a Certified Information Security Manager (CISM). You can contact him via email at [email protected].
