NigeriaCybercrimes (Prohibition, Prevention, etc.) Act, 2015, as amended in 2024, Reporting of Cyber Threats to the National CERT
Cybercrimes (Prohibition, Prevention, etc.) Act 2015, section 21, Reporting of Cyber Threats, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2023. Publisher's page: https://www.cert.gov.ng/ngcert/resources/CyberCrime__Prohibition_Prevention_etc__Act__2015.pdfIn force.
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
What it requires
- This binds any person or institution, whether public or private, that operates a computer system or a network in Nigeria; there is no sector or size gate.
- Immediately inform the National Computer Emergency Response Team (CERT) Coordination Center, through your sectoral CERT or sectoral Security Operations Centre, of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
- Report the incident to the National CERT within 72 hours of its detection. Failing to do so is itself an offence, punishable by denial of internet services and a mandatory fine of N2,000,000 payable into the National Cyber Security Fund.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Failing to report a qualifying incident to the National CERT within 72 hours of its detection is itself described as an offence, but section 21(3) states only denial of internet services plus a mandatory fine of N2,000,000; no term of imprisonment is stated for this specific offence.
Penalty structure
Section 21(3)'s fixed fine for failing to report a qualifying incident to the National CERT within the period that subsection sets, payable into the National Cyber Security Fund. The same subsection separately imposes denial of internet services, a non-monetary sanction in addition to the fine.
- Rule
- Fixed only
- As of
- Currency
- NGN
- Fixed cap
- 2,000,000
Who enforces it
Enforcement body
Office of the National Security Adviser (ONSA), the Act's own coordinating body for all security and enforcement agencies under it; the National Computer Emergency Response Team (CERT) Coordination Center is the reporting recipient named in section 21 itself.
What this law does
Section 21 of the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015 requires any person or institution, whether public or private, that operates a computer system or network in Nigeria to immediately inform the National Computer Emergency Response Team (CERT) Coordination Center of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network, so that the National CERT can take the necessary measures to address the issue.
The National CERT Coordination Center may propose isolating an affected computer system or network pending resolution. A person or institution that fails to report such an incident to the National CERT within the period that section 21(3) sets commits an offence and is liable to denial of internet services, and must in addition pay a mandatory fine of N2,000,000 into the National Cyber Security Fund. As enacted in 2015, section 21(3) set that period at 7 days of the incident's occurrence.
Section 3 of the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 substitutes the expression “72 hours of its detection” for “7 days of its occurance” in section 21(3), and inserts the words “through their respective sectoral CERTs or sectoral Security Operations Centres (SOC)” after “Coordination Center” in section 21(1). The text of that Amendment Act certified by the Clerk to the National Assembly on leaves its commencement line blank.
The Office of the National Security Adviser is the Act's own coordinating body for all security and enforcement agencies under it. Section 2(2)(a) of the Interpretation Act provides that, where no other provision is made as to the time when an enactment is to come into force, an enactment contained in an Act of the National Assembly comes into force on the day when the Act is passed. Under section 2(1) of the Interpretation Act, an Act is passed when the President assents to the Bill for the Act.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .