Question 1

What is the BoG Cyber and Information Security Directive?

Accepted Answer

The Bank of Ghana Cyber and Information Security Directive is the mandatory cyber and information security framework for the Ghanaian financial sector. Issued and enforced by the Bank of Ghana under its supervisory authority, the CISD sets requirements across information security governance, risk management, incident management, third-party risk, and business continuity. It is not optional best practice. It is a regulatory obligation with supervisory teeth.

Question 2

Which institutions does CISD apply to?

Accepted Answer

The CISD applies to all institutions licensed by the Bank of Ghana: universal banks, specialised deposit-taking institutions, savings and loans companies, payment service providers, and other BoG-supervised entities. Approximately 100 plus licensed institutions sit in scope.

Question 3

How does ISO 27001 satisfy CISD requirements?

Accepted Answer

CISD's five domains map directly onto ISO 27001 Annex A controls with substantial overlap. An institution implementing ISO 27001 addresses the majority of CISD requirements through the same control set, with localised additions to satisfy Bank of Ghana-specific reporting and supervisory expectations. This is why a single programme can deliver both outcomes efficiently.

Question 4

What is the typical engagement timeline?

Accepted Answer

Timeline depends on the institution's size, current CISD maturity, ISO 27001 baseline (if any), and operational complexity. The diagnostic call confirms the scope and the timeline. Pricing and timeline are calibrated together at scoping rather than stated as a fixed window.

Question 5

How does pricing work?

Accepted Answer

Fixed-fee project. Pricing is discussed directly on the scoping call and reflects the institution's size, scope, current CISD maturity, and whether the certification track is included. Payment terms and phasing are agreed at engagement letter.

Question 6

How is the local partner involved in delivery?

Accepted Answer

Goldline operates in Ghana through a senior practitioner delivery model with local in-market partnership. The senior practitioner scopes, designs, and leads the engagement from London. The local partner provides in-market relationship continuity, supports site visits, and handles regional coordination with the institution and the Bank of Ghana where required.

Question 7

What if our institution is part-way through CISD implementation?

Accepted Answer

A gap analysis at scoping confirms where you are against the full CISD requirement set and what remains. Most institutions partway through CISD have substantial work in some domains and gaps in others, particularly third-party risk and business continuity. The engagement is calibrated to close those gaps efficiently without duplicating completed work.

Question 8

Can the programme also support international partner audits?

Accepted Answer

Yes. The ISO 27001 certificate delivered through the programme is recognised internationally. For institutions facing specific international partner audits, the engagement scope can extend to include partner-specific evidence preparation and audit support.

BoG CISD compliance and ISO 27001 certification, delivered as one programme.

BoG CISD is not optional best practice. It is a regulatory obligation with supervisory teeth.

Regulatory compliance and international certification, built once.

What the BoG CISD 2026 Programme covers.

Who delivers this

Questions buyers ask before scoping.

Ready to scope your CISD programme?