Ghanaian Researcher at US University Builds Cybersecurity Framework That Could Transform Digital Security at Home and Abroad

A Ghanaian researcher based in the United States is working to close one of the most dangerous gaps in modern institutional security — not the absence of technology, but the failure to use it properly. Johnnecia Serwaa Agyemang, affiliated with the Department of Cybersecurity Management at the University of Illinois Springfield, has developed a structured governance framework aimed at helping organisations strengthen cybersecurity from the inside out, with potential lessons that could directly benefit Ghana's rapidly digitising institutions.

Beyond firewalls: what Agyemang's research actually proposes

Agyemang's research, titled A Cybersecurity Governance Framework for Strengthening Policy Compliance and Organizational Cybersecurity Management, tackles a problem that many institutions overlook. Organisations often invest heavily in advanced security technologies and write comprehensive cybersecurity policies, yet still suffer breaches — not because their tools failed, but because their people and processes did.

Her proposed framework addresses this by identifying seven interconnected components that must work together: leadership and accountability, policy development, security awareness and communication, policy implementation, compliance monitoring, corrective action, and continuous improvement. Rather than treating cybersecurity as a purely technical challenge, the framework positions it as a shared organisational responsibility that must be driven from the top down and embedded across every level of an institution.

The framework draws on globally recognised standards, including the National Institute of Standards and Technology Cybersecurity Framework 2.0, ISO/IEC 27001:2022, and COBIT 2019. Its distinguishing feature, however, is the deliberate integration of organisational governance with the full policy-compliance cycle — an approach that recognises senior leadership, managers, cybersecurity professionals, and everyday employees as equally accountable actors in keeping institutions secure.

Why it matters for Ghana

Ghana's digital economy has expanded significantly in recent years. Mobile money platforms process billions of cedis in transactions annually, government services are increasingly delivered online, and the healthcare and education sectors are adopting digital record-keeping at pace. This growth brings enormous opportunity — but also growing exposure to cyberattacks, data breaches, and digital fraud.

Ghana has taken steps to address these risks, including the establishment of the Cyber Security Authority under the Cybersecurity Act, 2020 (Act 1038), which provides a legislative foundation for cybersecurity governance in the country. However, as Agyemang's research highlights, laws and technologies alone are insufficient. The critical challenge lies in implementation: ensuring that institutions consistently follow their own policies, that staff understand their responsibilities, and that leadership treats cybersecurity as a governance priority rather than an IT afterthought.

This is precisely the gap her framework is designed to fill. Applied to Ghanaian institutions — from hospitals managing patient records to financial institutions handling customer data to public agencies responsible for sensitive government information — the framework could provide a practical roadmap for reducing vulnerabilities that stem not from a lack of tools, but from weak accountability and inconsistent practice.

The relevance extends beyond the public sector. Ghana's growing fintech ecosystem, expanding e-commerce landscape, and increasing reliance on cloud-based systems mean that private sector organisations face equally significant risks if cybersecurity governance remains weak.

A Ghanaian voice in a global conversation

Agyemang's work places a Ghanaian researcher at the centre of an international conversation that has historically been dominated by voices from North America and Europe. Her dual focus — strengthening US institutions while creating a knowledge base transferable to Ghana — reflects a broader trend of Ghanaian academics and professionals in the diaspora generating expertise with direct relevance to their home country.

As cyber threats grow more sophisticated and more frequent worldwide, the question for institutions in Ghana and beyond is no longer simply whether to invest in cybersecurity, but how to govern it effectively. Agyemang's framework offers a structured, evidence-based answer to that question — one grounded in international best practice but designed with the realities of diverse institutional environments in mind.

• Her seven-component framework covers everything from leadership accountability to continuous security improvement.
• Ghana's Cybersecurity Act 2020 provides a legal base, but implementation gaps remain a key vulnerability.
• The research builds on NIST, ISO/IEC 27001, and COBIT 2019 standards, applied through an organisational governance lens.