NigeriaNCC Cyber Resilience Framework for the Nigerian Communication Sector, Cybersecurity Programme and Controls
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a communication service provider licensed under the Nigerian Communications Act, 2003, in each of the Framework's three tiers (reached by declaring that you provide telecom services).
- Develop a cybersecurity and cyber resilience framework or strategy that includes internal cybersecurity governance structures, a cybersecurity officer or focal point, regular risk assessments with compliance reports, and sharing of threat intelligence with NCC-CSIRT (section 3.4).
- Document and implement approved cybersecurity and cyber resilience policies and procedures, and establish a cyber risk management framework (section 4.4).
- Implement technical and organizational measures to safeguard data at rest, in transit and in use, such as encryption, data loss prevention and regular backups (section 4.4).
- Ensure that cybersecurity audits and vulnerability assessment and penetration testing detect vulnerabilities in the IT and OT environments of critical systems (section 4.4).
- Establish or contract a Cyber Security Operations Centre to monitor the network, endpoints, personnel, malicious code and third-party activities, and onboard to the NCC-CSIRT Vulnerability and Threat Exposure Management platform (section 4.4).
- Develop and implement a Cyber Crisis Management Plan, and conduct recovery drills at least annually (section 4.4).
- Submit cyber audit reports and compliance reports to NCC-CSIRT at least annually or as the Commission requires (section 8.4).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Nigerian Communications Commission, as lead sector regulator, which enforces the Framework through the Nigerian Communications (Enforcement Processes, etc.) Regulations.
Settledness
- As of
- Open questions
- Do the baseline and intermediate requirements that Table 10.1.1 of the Framework sets at 6 and 9 months bind before the date in section 8.4?
What this law does
The Nigerian Communications Commission issued the Cyber Resilience Framework for the Nigerian Communication Sector, Version 1.0, in February 2026. The Framework is applicable and enforceable on all communication service providers who provide services as defined in the Nigerian Communications Act, 2003. Section 8.4 of the Framework states that compliance with it takes effect on , which is 12 months after the date of issuance.
Section 10.1 of the Framework requires all communication service providers across all tiers to achieve full compliance within 12 months from the effective date of the official release of the Framework, . Section 4.4 of the Framework requires service providers to document and implement approved cybersecurity and cyber resilience policies and procedures.
Section 4.4 of the Framework requires service providers to implement technical and organizational measures to safeguard data at rest, in transit and in use. Section 4.4 of the Framework requires service providers to ensure that cybersecurity audits and vulnerability assessment and penetration testing are conducted to detect vulnerabilities in the IT and OT environments of critical systems.
Section 4.4 of the Framework requires service providers to establish or contract a Cyber Security Operations Centre to monitor the network, endpoints, physical environment, personnel, malicious code and third-party activities. Section 4.4 of the Framework requires service providers to develop and implement a comprehensive Cyber Crisis Management Plan that includes scenario-based standard operating procedures.
Section 4.4 of the Framework requires service providers to get onboarded to the NCC-CSIRT Vulnerability and Threat Exposure Management platform and other ngCERT initiatives as notified from time to time. Section 8.4 of the Framework requires cyber audit reports and other required documentation to be submitted to the Nigerian Communications Commission at least annually or as it requires.
Section 8.6 of the Framework provides that non-compliance will be enforced in line with the Enforcement Processes Regulations. Regulation 14(1) of the Nigerian Communications (Enforcement Processes, etc.) Regulations lets the Commission impose administrative fines for enforcement purposes, including where no specific sanction is provided.
When LexLint raises it
When your app profile says your app provides telecom services.