A Regulator’s Playbook : When a Private Company Becomes Critical National Infrastructure
Most critical infrastructure frameworks in Africa are architecturally sound on paper. Ghana’s Cybersecurity Act, Kenya’s CII Regulations, Nigeria’s 2024 Designation Order, and South Africa’s Critical Infrastructure Protection Act all establish the right foundations. The gap and it is a real gap between statutory designation and operational enforcement.
This playbook is written for the regulator who has done the hard part: secured the legislative mandate, navigated the political economy of designation frameworks, and published the statutory instrument. The problem, now, is what happens next.
That gap matters because the private operators who meet designation thresholds are not passive subjects of regulation. They are well-resourced, sophisticated, and in many cases genuinely critical to the national interest. Their cooperation is strategically valuable. Their non-cooperation creates a governance vacuum. The regulator’s job is to build the architecture that makes cooperation the rational choice and non-compliance genuinely costly.
This playbook provides that architecture: the designation methodology, incident disclosure machinery, supply chain accountability mechanisms, and exit readiness frameworks that turn legislative authority into operational grip.
DOWNLOAD REGULATORS PLAYBOOK