title: Nigeria — Operational Resilience & Critical Infrastructure | World Payments Monitor canonical: https://payments.gi/jurisdictions/nigeria/w3/ publisher: Asymmetric Intelligence ### W3 Operational Resilience & Critical Infrastructure Confirmed confirmed 2026-06-23 Operational resilience is governed primarily by the CBN Risk-Based Cybersecurity Framework, first effective 1 January 2019 for DMBs/PSPs and replaced by a May 2024 version for DMBs and Payment Service Banks (with a separate 2022 OFI framework), structured around governance/oversight, risk management, operational resilience, metrics/monitoring/reporting and statutory compliance. It mandates a board-level CISO, annual cybersecurity self-assessment by 31 March, and incident reporting to the CBN within 24 hours. The financial sector is designated Critical National Information Infrastructure, and the framework reads with BOFIA 2020 and NDPA 2023. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/nigeria/) Standing sub-brief · as of 26 June 2026 215 words #### Operational Resilience & Critical Infrastructure Nigeria has no standalone DORA-equivalent; operational resilience is embedded in its cybersecurity regime. The CBN Risk-Based Cybersecurity Framework for DMBs and PSBs (May 2024) replaces the October 2018 guidelines, applies to commercial, merchant and non-interest banks and PSBs as Supervised Financial Institutions, incorporates BOFIA 2020 and the NDPA 2023, mandates a board-level CISO, an annual cybersecurity self-assessment by 31 March, and incident reporting to the CBN within 24 hours. The financial sector is designated National Critical Information Infrastructure under Part 7.5 of the National Cybersecurity Policy. The 24-hour incident-reporting clock, mandatory CISO and 31 March self-assessment define the compliance burden for banks and PSBs and increasingly for fintechs. That perimeter is widening. In a 30 March 2026 circular the CBN mandated DMBs, PSBs, microfinance lenders, fintechs and other institutions to complete a newly deployed Cybersecurity Self-Assessment Tool (CSAT) capturing governance, third-party exposures, incident response and operational resilience, reflecting data as of 31 December 2025. This extends formal third-party-exposure and resilience self-assessment beyond banks to fintechs and MFBs, signalling a widening operational-resilience supervisory perimeter. #### Outlook Resilience supervision is escalating. The CSAT extension to non-bank operators is the clearest signal that the supervisory perimeter is broadening; absent a dedicated DORA-equivalent, the cybersecurity framework remains the vehicle through which operational-resilience expectations are imposed. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.cbn.gov.ng/Out/2024/BSD/CBN%20Risk-Based%20Cybersecurity%20Framework%20for%20DMBs%20and%20PSBs_2024.pdf](https://www.cbn.gov.ng/Out/2024/BSD/CBN%20Risk-Based%20Cybersecurity%20Framework%20for%20DMBs%20and%20PSBs_2024.pdf) retrieved 2026-06-23 2. T3 [https://www.cyberkach.com/2020/04/25/cbn-framework [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.cyberkach.com/2020/04/25/cbn-framework [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 3. T3 [https://businessday.ng/news/article/cbn-gives-banks-three-weeks-to-deploy-cybersecurity-self-assessment-tools/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://businessday.ng/news/article/cbn-gives-banks-three-weeks-to-deploy-cybersecurity-self-assessment-tools/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 4. T3 [https://tnp.com.ng/insights/dissecting-the-central-bank-of-nigeria-risk-based-cybersecurity-frameworks-and-guidelines-for-deposit-money-banks-and-payment-service-providers [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://tnp.com.ng/insights/dissecting-the-central-bank-of-nigeria-risk-based-cybersecurity-frameworks-and-guidelines-for-deposit-money-banks-and-payment-service-providers [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication])