NigeriaCBN Risk-Based Cybersecurity Framework for Banks and Payment Service Banks, 2024, Cybersecurity Programme and Controls
Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks 2024, ss. 1 to 3 and Appendices III and IV
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.cbn.gov.ng/Out/2024/BSD/CBN%20Risk-Based%20Cybersecurity%20Framework%20for%20DMBs%20and%20PSBs_2024.pdfIn force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a commercial bank, merchant bank, non-interest bank or payment service bank supervised by the Central Bank of Nigeria's Banking Supervision Department, which the Framework calls a Supervised Financial Institution (reached by declaring that you are a bank). Full compliance was due on .
- Implement a cybersecurity programme that includes, at a minimum, risk assessment, security policy development, incident response planning, vulnerability management, log monitoring, a data backup and recovery plan, security awareness and training, initiatives to attain target maturity level and metrics to assess the effectiveness of the programme (section 1.1.2).
- Have a vulnerability assessment and threat analysis done every year, have a third party conduct a penetration test at least annually, and run internal vulnerability scans quarterly (section 2.2).
- Maintain ongoing (24/7) monitoring of your IT systems, infrastructure, applications and services to detect anomalies and cyber incidents promptly (section 3.3).
- Secure employee, customer and third-party access to your network, systems and applications with multifactor authentication, role based access control and layered controls, and use multi-factor authentication on critical systems (Appendix III, item 1.1).
- For any emerging technology you adopt, which the Framework says includes contactless payments, voice-initiated services, USSD codes, open banking, distributed ledger technology, artificial intelligence, cloud computing, the Internet of Things and fintech connections, establish strong authentication systems, encrypt sensitive data in transit and at rest, and run regular vulnerability assessments and penetration tests (section 4 and Appendix IV, item 2).
- Appoint a Chief Information Security Officer who meets the Framework's requirements, subject to Central Bank of Nigeria approval (section 1.4).
- Submit the annual cybersecurity self-assessment for January to December of the previous year to the Director, Banking Supervision Department of the Central Bank of Nigeria not later than February 28 (section 2.5).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Nigeria, which monitors and enforces compliance through the annual Cybersecurity Supervisory Review and Evaluation exercise, Risk Based Examination, Annual Industry Standard Compliance audit and periodic spot check.
Settledness
- As of
- Open questions
- Does the 2024 Framework, which replaces the 2018 edition issued to deposit money banks and payment service providers, bind a payment service provider that is not a bank?
What this law does
Section 1.1.2 of the Framework requires a Supervised Financial Institution to implement a cybersecurity programme that includes, at a minimum, risk assessment, security policy development, incident response planning, vulnerability management, log monitoring, a data backup and recovery plan, security awareness and training, initiatives to attain target maturity level and metrics to assess the effectiveness of the programme.
Section 2.2 of the Framework requires yearly vulnerability assessments and threat analysis, a penetration test by a third party at least annually and quarterly internal vulnerability scans. Section 3.3 of the Framework requires an institution to establish a capability for ongoing 24/7 monitoring of its IT systems to detect anomalies or cyber incidents promptly.
Item 1.1 of Appendix III to the Framework requires multifactor authentication, role based access control and layered controls to secure employee, customer and third-party access, and requires critical systems to use multi-factor authentication. Item 2 of Appendix IV to the Framework requires an institution adopting an emerging technology to establish strong authentication systems and to encrypt sensitive data both in transit and at rest.
Section 4 of the Framework lists contactless payments and USSD codes among the payment methods it treats as emerging technologies. Section 1.4 of the Framework requires an institution to appoint a Chief Information Security Officer subject to Central Bank of Nigeria approval. Section 2.5 of the Framework requires the annual cybersecurity self-assessment to reach the Director, Banking Supervision not later than February 28.
The Central Bank of Nigeria issued the Framework by a letter of as the minimum requirements to be put in place by all banks and payment service banks in their cybersecurity programmes. The Framework's covering letter sets as the effective date for full compliance. The Framework applies to commercial banks, merchant banks, non-interest banks and payment service banks.
The Framework replaces the Risk-based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers issued in October 2018. Section 6 of the Framework provides that non-compliance with it shall attract appropriate sanctions as defined in section 68 of BOFIA, 2020. Section 7 of the Framework provides that the Central Bank of Nigeria shall monitor and enforce compliance.
Section 33(1)(b) of the Central Bank of Nigeria (Establishment) Act, 2007 empowers the Bank to issue guidelines to any person and any institution under its supervision. Section 33(5)(a) of that Act makes an institution that fails to comply with such a guideline liable on conviction to a fine not exceeding N10,000,000.
When LexLint raises it
When your app profile says your app is a bank.