NigeriaNCC Cyber Resilience Framework for the Nigerian Communication Sector, Cyber Incident Reporting to NCC-CSIRT
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a communication service provider licensed under the Nigerian Communications Act, 2003, including a mobile network operator, internet service provider, mobile virtual network operator, infrastructure provider and data centre (reached by declaring that you provide telecom services).
- Report cybersecurity breaches and incidents to the Nigerian Communications Commission's Computer Security Incident Response Team, NCC-CSIRT, in line with the Framework (section 4.4).
- Make the first report within the 4 hour reporting timeline for detection, then confirm within 24 hours, with periodic 4-hour updates after the first detection (section 7.2 and Annexure IV).
- Classify each incident as critical, high, medium or low by the Framework's severity matrix, and report it by email, the NCC-CSIRT web portal, telephone or, where necessary, physical submission (section 7.2 and Annexure IV).
- Maintain a dedicated focal point for incident reporting, with clearly defined escalation and contact protocols (section 7.2).
- Submit a follow-up report within 7 days of the initial notification, with the post-incident analysis and lessons learned, the mitigation steps and updates on corrective actions, and the final assessment of impact and restoration status (Annexure IV).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Nigerian Communications Commission, whose NCC-CSIRT receives the reports and which may impose sanctions or penalties for a failure to report within the specified timeframes.
Settledness
- As of
- Open questions
- From what event does the 4 hour reporting timeline for detection run, and what does the first report have to contain?
- Do the baseline and intermediate requirements that Table 10.1.1 of the Framework sets at 6 and 9 months bind before the date in section 8.4?
What this law does
Section 4.4 of the Cyber Resilience Framework for the Nigerian Communication Sector requires service providers to report cybersecurity breaches and incidents to NCC-CSIRT, in line with the Framework. Section 7.2 of the Framework adopts a two-step reporting approach with a reporting timeline for detection of 4 hours and a confirmation reporting timeline of 24 hours, with periodic 4-hour updates after the first detection.
Section 7.2 of the Framework requires service providers to classify and report incidents with potential impact based on a severity matrix. Section 7.2 of the Framework requires service providers to maintain a dedicated focal point for incident reporting, with clearly defined escalation and contact protocols in place. Annexure IV to the Framework requires the reporting entity to submit a follow-up report within 7 days of its initial notification.
Annexure IV to the Framework provides that failure to report incidents within the specified timeframes may result in sanctions or penalties in accordance with applicable Nigerian Communications Commission regulations and the Framework. Section 2.3 of the Framework makes it applicable and enforceable on all communication service providers who provide services as defined in the Nigerian Communications Act, 2003. Section 8.4 of the Framework states that compliance with it takes effect on .
When LexLint raises it
When your app profile says your app provides telecom services.