NG v13.3.0

Nigeria (NG) · Module Detail

Nigeria: Operational Resilience & Critical Infrastructure

← Full Nigeria overview Build report with Nigeria Request deeper dive

#

Operational resilience is governed primarily by the CBN Risk-Based Cybersecurity Framework, first effective 1 January 2019 for DMBs/PSPs and replaced by a May 2024 version for DMBs and Payment Service Banks (with a separate 2022 OFI framework), structured around governance/oversight, risk management, operational resilience, metrics/monitoring/reporting and statutory compliance. It mandates a board-level CISO, annual cybersecurity self-assessment by 31 March, and incident reporting to the CBN within 24 hours. The financial sector is designated Critical National Information Infrastructure, and the framework reads with BOFIA 2020 and NDPA 2023.

Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →

Standing sub-brief · as of 26 June 2026215 words

Operational Resilience & Critical Infrastructure

Nigeria has no standalone DORA-equivalent; operational resilience is embedded in its cybersecurity regime. The CBN Risk-Based Cybersecurity Framework for DMBs and PSBs (May 2024) replaces the October 2018 guidelines, applies to commercial, merchant and non-interest banks and PSBs as Supervised Financial Institutions, incorporates BOFIA 2020 and the NDPA 2023, mandates a board-level CISO, an annual cybersecurity self-assessment by 31 March, and incident reporting to the CBN within 24 hours. The financial sector is designated National Critical Information Infrastructure under Part 7.5 of the National Cybersecurity Policy. The 24-hour incident-reporting clock, mandatory CISO and 31 March self-assessment define the compliance burden for banks and PSBs and increasingly for fintechs.

no periodic updates on record for this sub-brief

Sources and findings (4)
  1. T1https://www.cbn.gov.ng/Out/2024/BSD/CBN%20Risk-Based%20Cybersecurity%20Framework%20for%20DMBs%20and%20PSBs_2024.pdfretrieved
  2. T3https://www.cyberkach.com/2020/04/25/cbn-framework [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  3. T3https://businessday.ng/news/article/cbn-gives-banks-three-weeks-to-deploy-cybersecurity-self-assessment-tools/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  4. T3https://tnp.com.ng/insights/dissecting-the-central-bank-of-nigeria-risk-based-cybersecurity-frameworks-and-guidelines-for-deposit-money-banks-and-payment-service-providers [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]