ANNEXURE A - PROPORTIONALITY FRAMEWORK 1 of 3
TIER ONE (1) TIER TWO (2) TIER THREE (3) TIER FOUR (4) TIER FIVE (5)
Banks, ARB Apex Bank, Microfinance Banks (S&L, Finance Last Mile Providers eg.
Apex Bank, DEMIs, PSP Houses, MFCs, MCCs, Credit Union), Community Banks (RCBs), (Cooperative Susu, Financial PSP Medium, PSPs Standards.
Scheme & Development Leasing Companies, PSP Enhanced, Digital Credit Service Providers Co-operative Societies, MC PFTSP
Finance Institutions Virtual Asset Service Providers Ent, FNGOs), FEBs
PARAGRAPH Key Alternative/Comments Key Alternative/Comments Key Alternative/Comments Key Alternative/Comments Key Alternative/Comments
PART I - PRELIMINARY MATTERS
1 Objective
2 Applicability
Proportionality and Case-by-Case

Assessment
An RFI may apply for An RFI may apply for An RFI may apply for
4 Obligations of Regulated Entities exemption for 4(9) exemption for 4(9) exemption for 4(9) and
4(10).
PART II - GOVERNANCE
5 (3) Board Cyber and 5 (3) Board Cyber and 5 (3) Board Cyber and
Information Security Information Security Information Security
5 The Board responsibilities shall be responsibilities shall be responsibilities shall be
included in the Board Risk included in the Board included in the Board
Committee charter. charter. charter.
6 The Senior Management
An RFI may outsource An RFI may outsource
Cyber and Information Cyber and Information
7 Internal Audits Security internal audit Security internal audit
responsibilities on case responsibilities on case
by case basis. by case basis.
An RFI may assign An RFI may assign An RFI may assign
Information Security Information Security Information Security
Department responsibilities Department Department
8 Information Security Department to Risk Office/ Department responsibilities to Risk responsibilities to Risk
or outsource on case by Office/ Department or Office/ Department or
case basis. outsource on case by outsource on case by
case basis. case basis.
An RFI may have a An RFI may have a An RFI may have a
Information Security Budget dedicated Information dedicated Information dedicated Information
9 Management Security Budget on case by Security Budget on Security Budget on
case basis. case by case basis. case by case basis.
PART III - THE CHIEF INFORMATION SECURITY OFFICER
An RFI may assign CISO An RFI may outsource An RFI may outsource
responsibilities to Risk CISO function on case CISO function on case
10 Appointment Manager or outsource CISO by case basis or apply by case basis or apply
function on case by case for exemption. for exemption.
basis.
An RFI may assign CISO An RFI may outsource An RFI may outsource
responsibilities to Risk CISO function on case CISO function on case
11 Status in the institutional Hierarchy Manager or outsource CISO by case basis or apply by case basis or apply
function on case by case for exemption. for exemption.
basis.
An RFI may assign CISO An RFI may outsource An RFI may outsource
responsibilities to Risk CISO responsibilities on CISO responsibilities on
12 Responsibilities Manager or outsource CISO case by case basis or case by case basis or
function on case by case apply for exemption. apply for exemption.
basis.
PART IV - CYBER AND INFORMATION SECURITY POLICY AND PROCEDURES
RFIs shall develop broad RFIs shall develop RFIs shall develop
policies to cover the broad policies to cover broad policies to cover
requirements of cyber the requirements of the requirements of
13 Policy security risk management. cyber security risk cyber security risk
management. management.
RFIs shall develop broad RFIs shall develop RFIs shall develop
procedures to cover the broad procedures to broad procedures to
14 Procedures requirements of cyber cover the requirements cover the requirements
security risk management. of cyber security risk of cyber security risk
management. management.
13 (3) The Committee 13(3) The Committee
member shall include MD, resposibilities may be
15 The Cyber and Information Security Risk Manager (CISO), IT assigned to the MD on
Risk Management Committee Manager and any senior case by case basis
management member.
PART V - CYBER AND INFORMATION SECURITY RISK MANAGEMENT
16 Risk Management
17 Risk Identification
18 Risk Analysis
Risk Assessments in Cloud

Environment
20 Risk Mitigation
21 Risk Evaluation
22 Risk Monitoring and Reporting
PART VI - ASSET MANAGEMENT
23 Inventory
24 Ownership
25 Acceptable Use
26 Asset Mapping and Classification
PART VII - CYBER DEFENCE
27 Security Infrastructure
28 Architecture
29 Network Elements
An RFI may implement An RFI may implement An RFI may implement
30 Network Management Network Management Network Management Network Management
based on risk profile based on risk profile based on risk profile
31 Encryption
32 Media Encryption
33 Remote Access
CISD 2026 - Proportionality Framework PUBLIC Version 1.0, March 2026

ANNEXURE A - PROPORTIONALITY FRAMEWORK 2 of 3
TIER ONE (1) TIER TWO (2) TIER THREE (3) TIER FOUR (4) TIER FIVE (5)
Banks, ARB Apex Bank, Microfinance Banks (S&L, Finance Last Mile Providers eg.
Apex Bank, DEMIs, PSP Houses, MFCs, MCCs, Credit Union), Community Banks (RCBs), (Cooperative Susu, Financial PSP Medium, PSPs Standards.
Scheme & Development Leasing Companies, PSP Enhanced, Digital Credit Service Providers Co-operative Societies, MC PFTSP
Finance Institutions Virtual Asset Service Providers Ent, FNGOs), FEBs
PARAGRAPH Key Alternative/Comments Key Alternative/Comments Key Alternative/Comments Key Alternative/Comments Key Alternative/Comments
An RFI may apply for
34 Internet Access exemption from 2 (a)
(i), (ii), (iii) and 2 (b)
Websites and Web Applications

Protection
36 Access Control and Authentication
37 Biometric Authentication
Compartmentalisation and

Permissions
39 Servers and Workstations
40 Databases
41 Software Information Security
Application Programming Interface

(API)
43 Auditing
44 Incident Preparedness
45 Cyber Intelligence and Research
PART VIII - CYBER RESPONSE
In addition to the In addition to the
proportionality provisons proportionality
for the CISO, an RFI shall provisons for the CISO,
46 Structure and Hierarchy include the cyber response an RFI shall include the
function in the CISO's cyber response function
terms of reference. in the CISO's terms of
reference.
Security Information and Event An RFI shall implement
47 Management (SIEM) alternate mechanisms
to monitor system logs
An RFI shall implement
mechanisms for
48 Security Operations Centre (SOC) monitoring cyber and
information security
alerts and incidents
49 Methodology
50 Incident Handling
51 Reporting to the BoG
Managed Security Service Provider

(MSSP)
PART IX - HUMAN RESOURCE SECURITY, ACCESS CONTROL AND CYBER COMPETENCY FRAMEWORK
53 Access Control
54 Hiring and Onboarding
55 New Employee
56 Sensitive Positions
57 Employee Lifecycle
58 Termination
59 Cyber Education
60 Cyber Exercise
Artificial Intelligence (AI) and

Machine Learning (ML)
PART X - CHANNELS OF COMMUNICATION WITH EXTERNAL ENTITIES
Data Transfer between Sites and

Organisations
63 Email
64 Web Access
65 Bring Your Own Device (BYOD)
66 Institutional mobile device
PART XI - ELECTRONIC BANKING PLATFORMS
67 General Controls
Subscribing to Electronic Banking

Platforms
69 Identification and Authentication
70 Website
71 Mobile Applications
72 Email
73 Telephony Services
74 Customer Security
Passwords and Password

Management
PART XII - EXTERNAL CONNECTIONS
76 Direct Connectivity
77 Other Financial and non-RFIs
78 Business Partners
79 Remote Access
80 External Parties
81 Data in Motion
PART XIII - CLOUD SERVICES
82 Corporate Governance
83 Risk Management
The Cloud Computing Service

Contract
Institutional Application

Development
86 Promotional Material
An RFI may apply for An RFI may apply for An RFI may apply for
Cloud Operations, Monitoring and
87 exemption on a case by exemption on a case by exemption on a case by
Resilience
case basis case basis case basis
CISD 2026 - Proportionality Framework PUBLIC Version 1.0, March 2026

ANNEXURE A - PROPORTIONALITY FRAMEWORK 3 of 3
TIER ONE (1) TIER TWO (2) TIER THREE (3) TIER FOUR (4) TIER FIVE (5)
Banks, ARB Apex Bank, Microfinance Banks (S&L, Finance Last Mile Providers eg.
Apex Bank, DEMIs, PSP Houses, MFCs, MCCs, Credit Union), Community Banks (RCBs), (Cooperative Susu, Financial PSP Medium, PSPs Standards.
Scheme & Development Leasing Companies, PSP Enhanced, Digital Credit Service Providers Co-operative Societies, MC PFTSP
Finance Institutions Virtual Asset Service Providers Ent, FNGOs), FEBs
PARAGRAPH Key Alternative/Comments Key Alternative/Comments Key Alternative/Comments Key Alternative/Comments Key Alternative/Comments
An RFI may apply for An RFI may apply for An RFI may apply for
Cloud Security Controls and
88 exemption on a case by exemption on a case by exemption on a case by
Assurance
case basis case basis case basis
PART XIV - RFIs WITH INTERNATIONAL AFFILIATION
89 Foreign RFIs in Ghana
90 Ghanaian RFIs Operating Abroad
PART XV - PHYSICAL SECURITY
91 General
92 Secured Zones
93 Segmentation
Physical Security of Hardware and

Other Equipment
PART XVI - CONTRACTUAL ASPECTS
95 Cyber Security Contracts
Supply Chain Cyber Security

Contracts Obligation
Contracts Involving AI, ML or

Algorithmic Services
PART XVII - DIGITAL INNOVATIONS
98 General
Data Privacy and ity

Requirements
100 AI/ML Governance and Security
PART XVIII - DATA CENTRE MANAGEMENT
101 Governance & Operations
102 Business Continuity & Recovery
103 Site & External Risk
104 Power & Energy
105 Cooling & Environmental Control
106 Fire Protection
107 Cabling & Connectivity
108 Physical Security
109 Segregation
110 Monitoring & Incident Response
111 Contracts & SLAs
Vulnerability & Maintenance of

Facility Systems
113 Colocation
PART XIX - CYBERSECURITY REQUIREMENTS FOR ARTIFICIAL INTELLIGENCE (AI) SYSTEMS
114 General Principles
115 Reporting and Notification
PART XX - CYBER AND INFORMATION SECURITY TESTING AND EXERCISE REGIME
116 Vulnerability Assessment
117 Configuration Compliance Scanning
Patch and Configuration Compliance

Validation
Web Application and API Testing

(DAST/SAST)
120 Penetration Testing
Red Team Exercises and Adversarial

Simulation
122 AI and ML Model-Specific Testing
Incident Response Plan Testing and

Drills
Business Continuity and Disaster

Recovery Testing (Including Cloud)
Call Centre and Telephony Security

Testing
126 User Access Reviews
127 Asset Inventory Review
128 Third-Party Security Assessment
129 Physical Security Control Testing
Legend
Key Description
Full Implementation: RFI ahall fully comply with all provisions in the paragraph
Partial Implementation: RFI shall fully comply with the alternative controls or apply for an exemption
Not Applicable
N&L
CISD 2026 - Proportionality Framework PUBLIC Version 1.0, March 2026