An assessment of The Central Bank of Nigeria Risk-based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks

Contributor: Betseabasi Asuquo

INTRODUCTION

The banking system in Nigeria is fundamental to the facilitation of economic growth and stability, primarily through its functions of financial intermediation, capital formation, and effective resource allocation.^[1] Financial institutions, particularly banks, play an essential role in mobilizing savings, extending credit to both businesses and individuals and aiding government initiatives via financing and payment systems.^[2] Moreover, these institutions are instrumental in promoting financial inclusion, thereby enhancing access to financial services and fostering economic development in both urban and rural contexts. As integral components of the monetary system, Nigerian banks provide a robust foundation for the country’s financial infrastructure, significantly contributing to trade, investment, and overall economic resilience.^[3]

The critical role of banks in safeguarding financial assets, facilitating transactions, and maintaining trust in Nigeria’s economy necessitates robust cybersecurity measures in an era marked by diverse and evolving cyber threats.^[4] As custodians of sensitive customer data and intermediaries in high-value transactions, banks are prime targets for cybercriminals, with attacks ranging from phishing to sophisticated ransomware.^[5] A breach can result in financial losses, reputational damage, and regulatory penalties, undermining public confidence in the banking system. Consequently, banks must implement heightened security frameworks, leveraging advanced technologies, continuous monitoring, and employee training to anticipate, detect, and mitigate cyber risks effectively, ensuring resilience and trust in Nigeria’s financial sector.

Recognising, this the Central Bank of Nigeria introduced the Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks. This comprehensive framework outlines the minimum cybersecurity standards for financial institutions, focusing on governance, risk management, resilience, and emerging technologies. It replaces the 2018 version, integrating recent legal and technological advancements, and aims to strengthen the cybersecurity posture of supervised financial institutions (SFIs). This article will examine some vital provisions of the Guidelines.

AN OVERVIEW OF THE CENTRAL BANK OF NIGERIA RISK-BASED CYBERSECURITY FRAMEWORK AND GUIDELINES FOR DEPOSIT MONEY BANKS AND PAYMENT SERVICE BANKS

Cybersecurity governance in SFIs^[6] defines roles for the Board of Directors, Senior Management, and the Chief Information Security Officer (CISO), emphasizing policy development, enforcement, and compliance with regulations. The Board oversees cybersecurity programs, ensuring integration with business goals, qualified NEDs, a CISO, and a dedicated cybersecurity budget. It also mandates quarterly reports on risk, incidents, and compliance.^[7] Senior Management implements approved policies, incorporates risk management into governance, and ensures training and reporting. The CISO manages daily cybersecurity operations, including strategy implementation, risk mitigation, and staff awareness. Requirements for appointing a CISO include relevant certifications, independence, and experience.^[8] An Information Security Steering Committee (ISSC) governs cybersecurity initiatives, aligning policies with objectives and ensuring risk management. Risk management functions independently evaluate cyber risks, audits assess control effectiveness, and compliance reviews ensure adherence to regulations.^[9]

The cybersecurity risk management system in SFIs^[10] is designed to address evolving threats through dynamic processes based on their risk profile and tolerance levels. Key activities include identifying threats and vulnerabilities, assessing risks annually or during significant changes, measuring financial impacts, and selecting appropriate risk mitigation strategies such as reduction, transfer, or acceptance. Continuous monitoring is supported by a Risk Register, with regular reporting to the Board and Senior Management.^[11] SFIs must conduct vulnerability assessments annually, quarterly scans, and third-party penetration tests to evaluate risks to their assets. Third-party risk management frameworks must include vendor assessment, compliance monitoring, cybersecurity awareness, and business continuity planning. Cybersecurity maturity is assessed annually using the CBN Cybersecurity Self-Assessment Tool (CSAT) to determine current and target maturity states, with a roadmap aligned to corporate strategy.^[12] Annual self-assessment reports, endorsed by Executive Management, must be submitted to the CBN by February 28 each year.

Cyber resilience in SFIs^[13] ensures their ability to prevent, withstand, and recover from cyber incidents, enhancing the overall cybersecurity posture of the financial industry. SFIs must maintain up-to-date inventories of critical assets, software, hardware, and network connections while monitoring associated threats and vulnerabilities. Preventive administrative, logical, and physical controls must be implemented to mitigate risks and continuous 24/7 monitoring of IT systems and infrastructure is required, with capabilities for prompt detection of cyber threats.^[14] SFIs should have in-house or readily accessible response capabilities to address incidents effectively and restore operations quickly to minimize impact. Cyber-threat intelligence should encompass emerging threats, attack vectors, and indicators of compromise. Participation in industry-wide exercises, such as cyber drills, is mandated to evaluate preparedness and prevent single points of failure, with proactive plans to mitigate risks.^[15]

Emerging technologies are transforming SFIs through innovative advancements like contactless payments, open banking, distributed ledger technology (DLT), artificial intelligence (AI), cloud computing, Internet of Things (IoT), and FinTech integrations. These technologies enhance efficiency, scalability, and customer experiences but also introduce cyber risks such as data breaches, API compromise, fraud, and privacy violations. SFIs must ensure compliance with regulations, including obtaining CBN approval before deploying new technologies, avoiding partnerships with sanctioned entities, and maintaining due diligence. Specific controls for mitigating risks in these technologies are detailed in regulatory appendices, emphasizing security, privacy, and operational integrity.

SFIs must measure the effectiveness of their cybersecurity programs using metrics aligned with strategic objectives, such as key performance, risk, and goal indicators, reviewed annually.^[16] These metrics identify deficiencies, monitor security control failures, and track progress in addressing issues. SFIs are required to establish communication channels to implement security requirements effectively and provide quarterly cybersecurity status reports to the Board.^[17] Furthermore, all cyber incidents must be reported to the CBN within 24 hours of detection, following specified formats and providing supplementary details when required.

SFIs must ensure compliance with relevant statutes, including the Cybercrimes Act 2015, NDPA 2023, National Cybersecurity Policy, and CBN directives, to prevent regulatory breaches.^[18] Participation in industry cyber exercises, such as drills or war games conducted by NigFinCERT or similar bodies, is mandatory to assess preparedness for cyber incidents.^[19] Non-compliance attracts sanctions under BOFIA 2020 and the CBN will enforce compliance through annual reviews, risk-based examinations, industry compliance audits, and periodic spot checks.

These provisions are essential to strengthen the cybersecurity framework of SFIs, ensuring the protection of critical financial assets, sensitive data, and the stability of Nigeria’s financial system. Compliance with statutory and regulatory requirements prevents legal breaches, mitigates risks of cyber-attacks, and aligns SFIs with global best practices. Regular cyber exercises and CBN oversight enhance preparedness, resilience, and accountability, minimizing the impact of incidents on operations and public confidence.

CONCLUSION

In conclusion, the Central Bank of Nigeria’s Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks signify a crucial advancement in enhancing the resilience, governance, and accountability of Nigeria’s financial institutions in response to the dynamic nature of cyber threats. By prioritizing proactive risk management, establishing robust governance frameworks, and facilitating the integration of emerging technologies alongside rigorous compliance protocols, these guidelines play a vital role in protecting critical financial assets and sensitive data. This framework not only serves to mitigate cyber-related risks but also ensures that Nigeria’s banking sector aligns with international best practices, thereby promoting trust, operational stability, and fostering economic growth.

1. Abubakar, A. and Gani, I.M. “Impact of banking sector development on economic growth: Another look at the evidence from Nigeria.” Journal of Business Management & Social Sciences Research 2, no. 4 (2013): 47-57. Available at https://www.academia.edu/download/33257058/1221M.pdf ↑
2. Ibid ↑
3. Atsanan, A. and Onuigwe, G.C.”The Impact of Financial Institutions Intermediation Activities to Economic Growth in Nigeria: 2000 –2016.” NIU Journal of Humanities 3, no. 4 (2019): 27-42 available at https://ijhumas.com/ojs/index.php/niuhums/article/view/414 accessed November 2024. ↑
4. See Hassan, A.O., Ewuga, S.K., Abdul, A.A., Abrahams, T.O., Oladeinde, M. and Dawodu, S.O., “Cybersecurity in banking: a global perspective with a focus on Nigerian practices.” Computer Science & IT Research Journal 5, no. 1 (2024): 41-59. Available at https://fepbl.com/index.php/csitrj/article/view/701 ↑
5. Daoud, G. “The Evolving Nature of Financial Crime With The Increase Of Internet Capabilities. Challenge Identification, Legal Considerations and Policy Recommendations.” PhD diss., School of Advanced Study, 2023. ↑
6. Paragraph 1. ↑
7. Ibid. ↑
8. Ibid. ↑
9. Ibid. ↑
10. Paragraph 2. ↑
11. Ibid. ↑
12. Ibid. ↑
13. Paragraph 3 ↑
14. Ibid. ↑
15. Ibid. ↑
16. Paragraph 4. ↑
17. Ibid. ↑
18. Paragraph 6. ↑
19. Ibid. ↑