The Office of the Registrar of Companies (ORC) has challenged a cybersecurity sanction imposed by the Cyber Security Authority (CSA), arguing that the penalty was premature and procedurally unfair.

The ORC says the sanction relates to its procurement of a Network Operations Centre (NOC) and Security Operations Centre (SOC), a process it insists was substantially completed before the CSA directed Critical Information Infrastructure (CII) institutions to engage Tier One licensed cybersecurity service providers.

The dispute follows a CSA statement announcing sanctions against the ORC and Purpleline Solutions Limited for alleged cybersecurity non-compliance.

The ORC has rejected what it says is the impression created by some reports that it deliberately engaged an unlicensed cybersecurity provider.

According to the ORC, the Ministry of Finance issued a Commitment Authorisation for the NOC/SOC project on November 28, 2025.

The Office subsequently advertised the procurement in the Daily Graphic and on the Public Procurement Authority's GHANEPS platform on December 4, 2025, with December 19 set as the deadline for bids.

Two companies submitted bids, after which an evaluation conducted on December 22 recommended Purpleline Solutions for the contract.

The procurement was subsequently reviewed by the Central Tender Review Committee of the Ministry of Finance, which approved it on December 31, 2025.

The ORC said the project was subsequently incorporated into its 2026 work plan, with the contract eventually awarded to Purpleline Solutions and executed on February 11, 2026.

The ORC's principal argument is that the procurement and contract were already in place before the CSA issued directives requiring CII institutions, including the ORC, to engage Tier One cybersecurity companies.

The Office says the relevant directives were issued on May 20 and June 15, 2026, several months after the procurement process had been completed and the contract awarded.

It therefore argues that it could not reasonably have been expected to comply during the procurement process with a requirement that had not yet been communicated.

The ORC further contends that applying the subsequent directive to an already-concluded procurement would amount to retrospective application of the requirement.

The Office is also challenging the timing of the CSA's enforcement action.

It says the Authority had given it 90 days to rectify identified cybersecurity deficiencies and that it had already begun implementing corrective measures.

According to the ORC, some of the identified issues had been resolved while work on others was ongoing.

The Office says it engaged the CSA and explained that the NOC/SOC procurement arrangements had been initiated and completed before the Tier One directives were issued.

It was therefore surprised when the CSA announced the sanction on August 12, 2026.

The ORC argues that the announcement came 57 days into the 90-day compliance period, leaving 33 days before the deadline expired.

It consequently contends that the sanction deprived it of the full opportunity to complete the corrective measures and submit a comprehensive response.

The ORC has also raised concerns about the manner in which the sanction was imposed and publicly announced.

It has cited Articles 23 and 296 of the 1992 Constitution, arguing that public administrative bodies are required to exercise their powers fairly, reasonably and without arbitrariness.

The Office says the public announcement of the penalty before the expiry of its compliance period has caused reputational damage and could potentially expose the institution to additional cybersecurity risks.

It further argues that the CSA's public statement did not sufficiently reflect what it considers important facts, including the timing of the procurement, the prior approval and award of the contract, and corrective measures already underway.

The petition is seeking administrative redress over what the ORC considers an unfair and premature enforcement action.

Among other requests, the Office is seeking the intervention of the Attorney-General's Office over the circumstances surrounding the sanction.

It is also calling on the CSA to issue a public clarification and apology over what it describes as the premature publication of the penalty.

The ORC, however, says its challenge should not be interpreted as a rejection of Ghana's cybersecurity requirements.

It maintains that it remains committed to complying with the country's cybersecurity laws and cooperating with the CSA to address legitimate cybersecurity concerns.

The dispute now centres on whether the CSA was entitled to sanction and publicly name the ORC before the expiration of the 90-day compliance period, particularly given the Office's claim that the procurement at the heart of the matter was initiated, evaluated and approved months before the Tier One requirement was communicated.