Attending Gitex Global in Dubai recently was an inspiring experience. This time, rather than joining as a speaker or moderator, I engaged in networking, discussing cybersecurity—my area of expertise—with peers, exploring innovative technologies, and examining how different countries and industries are implementing security measures. The conversations highlighted the impressive global progress being made, particularly in Nigeria, where various agencies are working to close cybersecurity gaps. This progress is promising for the country’s digital economy, yet challenges remain.
As an avid cyber expert with interest in Nigeria’s cybersecurity landscape and specific interest in understanding Nigeria’s approach to cybersecurity and how the country is progressively adopting digital technology across various sectors, I have observed that Nigeria’s cybersecurity environment remains complex and fragmented with overlapping agencies, frameworks, standards and regulations that sometimes create more confusion than clarity.
These overlaps can lead to conflicting guidance, making it challenging for organisations to maintain consistent security measures and creating compliance gaps. The multitude of standards and frameworks also leads to confusion for organisations navigating sometimes contradictory requirements, as highlighted in discussions around Nigeria’s cybersecurity framework (Cybersecurity & Privacy Journal, 2021; Nigeria IT Review, 2022).
Currently, Nigeria lacks a universal, cross industry cybersecurity certification program. While there are sector specific standards in finance and telecommunications, and while certain agencies have made strides to improve cybersecurity, a unified approach is still missing. This lack of a standardised certification represents both a gap and an opportunity to establish a programme that could drive consistency and build trust across Nigeria’s growing digital economy.
So far, the National Information Technology Development Agency (NITDA) has made significant commendable contributions towards setting cybersecurity standards. In 2019, NITDA introduced the Nigeria Data Protection Regulation (NDPR) to safeguard personal data and establish data privacy requirements for Nigerian businesses. While not a full cybersecurity certification, the NDPR provides essential guidelines for data protection. The Central Bank of Nigeria (CBN) has also implemented cybersecurity standards, particularly for financial institutions, addressing threats specific to the financial sector.
In 2021, Nigeria launched its National Cybersecurity Policy and Strategy (NCPS), underscoring a commitment to a secure digital environment. This strategy highlights the need for industry compliance and standardised security practices. However, it stops short of establishing a comprehensive, cross sector cybersecurity certification—something akin to the UK’s Cyber Essentials or Singapore’s Cybersecurity Labelling Scheme. Countries like the UK, Singapore, and Japan have developed national cybersecurity certifications that bolster their security infrastructure, enhance international trust, and attract foreign investment.
In 2014, the UK introduced Cyber Essentials, encouraging basic cybersecurity practices among businesses. This certification has increased trust in UK small and medium-sized enterprises (SMEs), allowing them to qualify for public sector contracts. Ian Levy, of the UK’s National Cyber Security Centre, noted, “Cyber Essentials has given businesses a standard to aim for, making cybersecurity accessible and trusted.”
Singapore’s Cybersecurity Labelling Scheme (CLS) assigns security labels to Internet of Things (IoT) devices to enhance consumer protection. David Koh, CEO of Singapore’s Cyber Security Agency, stated, “The scheme encourages businesses to prioritise cybersecurity,” elevating awareness and establishing Singapore as a leader in secure digital products.
Japan’s ISMS Conformity Assessment, based on ISO 27001, enables businesses to meet global security requirements. “ISMS certification allows Japanese companies to operate securely in the international market,” said Hiroshi Ito, Director-General of Japan’s Information-technology Promotion Agency.
The NITDA Strategic Roadmap and Action Plan 2024 – 2027(SRAP 2.0) outlines Nigeria’s vision for digital transformation, with cybersecurity as a key pillar. NITDA has stated in its recently published SRAP 2.0 identifying “cybersecurity as crucial for building trust in digital services, emphasising the need for secure infrastructure resilient to cyber threats. One of its key initiatives is to promote industry-specific cybersecurity certifications, encouraging organisations to align with international standards like ISO 27001”. While these efforts are commendable, the introduction of a national certification, owned and mandated by Nigeria, would further elevate the country’s cybersecurity framework.
Recommendation:
I would strongly recommend Nigeria should establish a tailored specific National Cybersecurity Certification Programme, coordinated by the Office of the National Security Adviser.
Benefits:
- Tailored to Nigeria’s Needs: A Nigeria-specific cybersecurity certification could directly address the country’s unique challenges and close existing gaps.
- Addressing Fragmentation: A Nigeria-specific cybersecurity certification would help address the current fragmentation challenges, promoting a more unified approach to cybersecurity adaptation across industries.
- Enhanced Security and Credibility: A unified certification would better protect businesses from cyber risks, fostering a secure environment within Nigeria’s digital economy and enhancing its international reputation.
- Alignment with Global Standards: By establishing minimum security standards across industries, especially those handling sensitive data, Nigeria could address both local and international cybersecurity requirements. Aligning with recognised standards, like ISO 27001, would help Nigerian companies meet international expectations, making them more competitive on the global stage and strengthening cross-border partnerships.
– Chika Amadi is Senior Cyber Security Consultant at the Bank of England, UK.
Disclaimer: This article is entirely the opinion of the writer and does not represent the views of The Whistler.
