NigeriaDesignation and Protection of Critical National Information Infrastructure Order, 2024, Protection of Designated Critical National Information Infrastructure
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://cert.gov.ng/ngcert/resources/cnii-gazette.pdfIn force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to an owner or operator of a computer system, network or communication infrastructure acquired, installed, deployed and operated in a sector the Order lists in its Schedule (power and energy; water; information, communication, science and technology; banking, finance and insurance; health; public administration; education; defense and security; transport; food and agriculture; safety and emergency services; industrial and manufacturing; mines and steel), which paragraph 2(1) designates as Critical National Information Infrastructure (reached by declaring that you operate an essential service).
- Collaborate with the other members of the Trusted Information Sharing Network, which the Office of the National Security Adviser establishes and of which owners and operators of Critical National Information Infrastructure are members, and share information on threats and vulnerabilities (paragraph 4).
- Submit the designated infrastructure to the periodic audit and inspection that the Office of the National Security Adviser carries out to ensure compliance with the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015 and with any guideline or rule made under the Order (paragraph 6).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Office of the National Security Adviser, which periodically audits and inspects Critical National Information Infrastructure to ensure compliance with the Act and any guideline or rule made under the Order.
Settledness
- As of
- Open questions
- Has the President approved the guidelines on minimum standards, rules and procedures that paragraph 3 of the Order directs the Office of the National Security Adviser to develop?
What this law does
Paragraph 2(1) of the Designation and Protection of Critical National Information Infrastructure Order, 2024 designates as Critical National Information Infrastructure the computer systems, networks and communication infrastructures acquired, installed, deployed and operated in the sectors listed in the Schedule to the Order.
The Order lists as sectors power and energy, water, information, communication, science and technology, banking, finance and insurance, health, public administration, education, defense and security, transport, food and agriculture, safety and emergency services, industrial and manufacturing, and mines and steel.
Paragraph 3 of the Order requires the Office of the National Security Adviser to develop, with the stakeholders in the infrastructure and for the approval of the President, a protection plan and guidelines specifying minimum standards, rules and procedures for the protection, preservation and general management of designated Critical National Information Infrastructure.
Paragraph 4 of the Order requires the Office of the National Security Adviser to establish a Trusted Information Sharing Network whose members include the owners and operators of Critical National Information Infrastructure. Members and entities within that Network must collaborate and share information on threats and vulnerabilities.
Paragraph 6 of the Order requires the Office of the National Security Adviser to periodically audit and inspect Critical National Information Infrastructure to ensure compliance with the Act and any guideline or rule made under the Order. Paragraph 7 of the Order makes it an offence to access or tamper with a Critical National Information Infrastructure without authorisation and for fraudulent purposes, or to hinder or interfere with its functioning, and leaves the penalty to the Act.
Section 3(1) of the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015 lets the President, on the recommendation of the National Security Adviser, designate computer systems and networks as Critical National Information Infrastructure by an Order published in the Federal Gazette. Section 5(1) of the Act sets, for an offence committed against a designated Critical National Information Infrastructure, imprisonment for a term of not more than 10 years without an option of fine. The Order is dated and is made under section 3 of the Act.
When LexLint raises it
When your app profile says your app runs an essential service.