NATIONAL POLICY ON CYBERSECURITY

A Policy protects Nigeria's critical information infrastructure and combats cybercrime through a secure digital framework. It targets government agencies, businesses handling sensitive data, and internet users. This aims to build a trusted online environment and reduce vulnerabilities to fraud.

What Is This Policy?

The National Cybersecurity Policy and Strategy (NCPS 2021) is Nigeria's updated blueprint for protecting the nation's critical information infrastructure, combating cybercrime, and building the legal and institutional framework for a trusted, secure digital ecosystem. It coordinates the cybersecurity roles of ONSA, NITDA, NCC, CBN, and sector agencies.

Who Does It Target?

Critical national infrastructure operators: banks, telcos, power utilities, government IT systems, and hospitals All government ministries, departments, and agencies handling citizen data and public services online Businesses of all sizes using digital systems, particularly those handling financial, health, and personal data Citizens and internet users vulnerable to fraud, identity theft, ransomware, and online harassment

What Does It Aim to Achieve?

Achieve a robust, resilient national cybersecurity posture that protects Nigeria's digital economy and critical infrastructure Reduce cybercrime losses, which cost Nigeria an estimated $500 million annually Build a national cybersecurity workforce: 10,000 certified cybersecurity professionals by 2025 Establish a 24/7 National Computer Emergency Response Team (ngCERT) to detect and respond to cyber incidents across all sectors

Key Features

ngCERT: Nigeria Computer Emergency Response Team provides 24/7 incident response, threat intelligence sharing, and sector-specific cybersecurity advisories Critical Infrastructure Protection: Designated critical national infrastructure (CNI) sectors must implement sector-specific cybersecurity frameworks and report major incidents within 24 hours Cybercrimes Act 2015 (Amended 2024): Criminal penalties for hacking, fraud, identity theft, cyberstalking, and online terrorism; maximum sentence of 10 years for critical infrastructure attacks Nigeria Data Protection Act 2023: Organisations must protect personal data and appoint a data protection compliance organisation; breaches must be reported to NITDA within 72 hours Cybersecurity Fund: 1% levy on gross profit of mobile money operators and other specified businesses funds national cybersecurity capacity building Capacity Building: 3MTT programme includes cybersecurity as a core digital skills track; scholarships for advanced cybersecurity certifications (CISSP, CEH, CISM)

Current Status

Rollout Stage: Active; NCPS 2021 in full implementation; Cybercrimes Act amended in 2024 to address new threat vectors Implementing Body: Office of the National Security Adviser (ONSA); National Cybersecurity Coordination Centre (NCCC); ngCERT; NITDA; NCC; CBN Threat Landscape: Nigeria recorded over 700,000 ransomware and phishing attacks in 2023; financial sector remains the primary target ITU Ranking: Nigeria ranks 50th globally on ITU's Global Cybersecurity Index 2024, up from 104th in 2018

How to Access

Businesses: Register with ngCERT for free threat intelligence feeds; appoint a Data Protection Compliance Organisation under the Nigeria Data Protection Act 2023 Report a Cybercrime: File reports with the Nigeria Police Force Cybercrime Unit or the Economic and Financial Crimes Commission (EFCC): efcc.gov.ng Training: Enrol in cybersecurity courses under the 3MTT programme at 3mtt.nitda.gov.ng Contact: ngCERT: ngcert.gov.ng | NITDA: nitda.gov.ng | ONSA Cybersecurity: onsa.gov.ng

Official Resources

Legal Framework

The National Policy on Cybersecurity operates under the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, the Office of the National Security Adviser Establishment Act, and the National Information Technology Development Agency Act 2007. It aligns with the National Cybersecurity Policy and Strategy (NCPS) 2021, the Data Protection Act 2023, the African Union Convention on Cyber Security and Personal Data Protection, and the Budapest Convention on Cybercrime standards.