Cybersecurity Policy (Nigeria)

A Cybersecurity Policy in Nigeria establishes the obligations and procedures governing the conduct it regulates.

The primary cybersecurity legislation in Nigeria is the Cybercrimes (Prohibition, Prevention, Etc.) Act 2015 (Cybercrime Act), which criminalises unauthorised access to computer systems, cyberstalking, phishing, identity theft, and other cybercrime offences. The Cybercrime Act imposes obligations on Critical National Information Infrastructure (CNII) operators — identified by Presidential Directives — to implement specific cybersecurity measures, conduct periodic risk assessments, and report cybersecurity incidents to the Office of the National Security Adviser (ONSA) and the Nigeria Computer Emergency Response Team (ngCERT).

The Nigeria Data Protection Act 2023 (NDPA), which replaced the Nigeria Data Protection Regulation (NDPR) 2019 issued by the National Information Technology Development Agency (NITDA), imposes obligations on data controllers and processors to implement appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. The Nigeria Data Protection Commission (NDPC), established under the NDPA, supervises compliance and has powers to impose administrative fines of up to 2% of annual global turnover or NGN 10 million (whichever is higher) for violations.

Financial institutions regulated by the Central Bank of Nigeria (CBN) are subject to the CBN Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers (Revised 2021), which mandates board-level cybersecurity governance, Chief Information Security Officer (CISO) appointment, security operations centre (SOC) operation, and annual cybersecurity penetration testing. The CBN Cyber Incident Reporting Guidelines require financial institutions to report cybersecurity incidents to the CBN Financial Services Information Sharing and Analysis Centre (FS-ISAC) within specified timeframes.

Telecommunications operators and internet service providers licensed by the Nigerian Communications Commission (NCC) are subject to the NCC Cybersecurity Regulations 2022, which impose network security, subscriber data protection, and lawful interception obligations.

The legal framework governing the Cybersecurity Policy (Nigeria) in Nigeria draws on several key statutes and regulatory bodies. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Parties executing a Cybersecurity Policy (Nigeria) in Nigeria should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Companies and Allied Matters Act (CAMA) 2020 sets the foundational requirements.

A Nigeria Cybersecurity Policy is needed by every organisation that operates information systems, processes digital data, or provides electronic services — regulatory requirements and risk management make a formal policy essential rather than optional.

Financial institutions — including deposit money banks, microfinance banks, payment service providers, and FinTech companies — regulated by the CBN are mandated by the CBN Cybersecurity Framework 2021 to maintain a formal, board-approved cybersecurity policy. The CBN conducts cybersecurity assessments and examinations of regulated financial institutions; the absence of a documented policy is a compliance finding.

Organisations processing personal data of Nigerian residents are data controllers or processors under the NDPA 2023 and must implement appropriate security measures as required by Section 24 of the NDPA. A cybersecurity policy is the foundational document demonstrating that the organisation has systematically addressed security risk, which the NDPC may require on investigation or audit.

Critical National Information Infrastructure (CNII) operators — in sectors including energy, telecommunications, banking and finance, transport, and government — identified by Presidential Declaration under Section 3 of the Cybercrime Act 2015 are legally required to implement the cybersecurity standards specified by ONSA and ngCERT. A formal cybersecurity policy is the starting point for this compliance.

Companies seeking to contract with the Nigerian government or with multinational organisations — particularly in the technology, financial services, and telecoms sectors — are increasingly required to present cybersecurity policies as part of procurement qualification and vendor due diligence processes.

Organisations applying for ISO/IEC 27001 Information Security Management System certification — recognised internationally and increasingly required by Nigerian corporate clients — must demonstrate a documented information security policy as a baseline requirement of the standard.

Parties in Nigeria should prepare a Cybersecurity Policy (Nigeria) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A Nigeria Cybersecurity Policy must address the following key areas to meet regulatory requirements and provide effective security governance.

Scope and applicability: the policy must specify which systems, data, locations, employees, contractors, and third parties it covers. For regulated entities, the scope must encompass all systems and data in scope of the CBN Cybersecurity Framework, NDPA 2023, or NCC Regulations as applicable.

Governance and accountability: the policy must assign cybersecurity responsibilities at board level (board oversight of cybersecurity risk), executive level (CISO or equivalent responsible officer), and operational level (IT security team, data protection officer under NDPA Section 30). The CBN Cybersecurity Framework 2021 requires board-approved cybersecurity strategy and board-level Cybersecurity Committee.

Access control and authentication: rules governing who can access which systems and data, minimum password standards, multi-factor authentication requirements, and procedures for granting, reviewing, and revoking access. The NDPA 2023, Section 24, requires appropriate access controls for personal data.

Data classification and protection: a framework for classifying data (public, internal, confidential, strictly confidential) and the security controls required for each classification level, consistent with NDPA 2023 data security obligations and CBN data classification requirements.

Incident detection, reporting, and response: procedures for detecting, assessing, and responding to cybersecurity incidents, including the timeframes for internal reporting and external regulatory notification. The CBN requires financial institutions to report material cyber incidents to the CBN within 24 hours of detection; the NDPC under the NDPA 2023 requires notification of personal data breaches within 72 hours.

Third-party and vendor security: requirements for assessing and managing cybersecurity risks from third-party vendors, contractors, and outsourced service providers, consistent with NDPA 2023 data processor obligations and CBN outsourcing guidelines.

Employee security obligations and training: mandatory cybersecurity awareness training, staff obligations regarding acceptable use of information systems, and consequences for policy violations under the employment contract and the Cybercrime Act 2015.

Business continuity and disaster recovery: plans for maintaining or restoring critical business operations following a cybersecurity incident, aligned with the CBN Business Continuity Management Guidelines.

Additional compliance elements for a Cybersecurity Policy (Nigeria) used in Nigeria include: Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Forms-legal.com provides this template as a starting point for Nigeria-compliant documentation.