Nigerian Communications Commission (NCC) has directed telecommunications operators to make dedicated budgetary provisions for cybersecurity as part of measures to strengthen the resilience of Nigeria’s communications infrastructure against growing cyber threats.
The directive is contained in the Commission’s Cyber Resilience Framework for the Nigerian Communications Sector (CRF-NCS), which introduces new governance, risk management and operational requirements for protecting critical telecommunications infrastructure.
Under the framework, all licensed telecommunications operators are required to establish formal cybersecurity governance structures, allocate adequate financial resources to cyber resilience programmes and integrate cybersecurity into their enterprise-wide risk management processes.
The NCC said cybersecurity investments should no longer be treated as optional operational expenses but as strategic business priorities required to protect network infrastructure, customer information and Nigeria’s digital economy.
According to the Commission, operators are expected to provide sufficient funding for cyber risk assessments, security technologies, staff training, incident response capabilities, continuous monitoring and compliance with regulatory requirements.
The framework also requires telecommunications operators to designate senior executives with responsibility for cybersecurity oversight.
It further places responsibility on boards of directors to provide strategic direction and ensure adequate funding for cybersecurity and cyber resilience initiatives.
Speaking during the unveiling of the framework, Mr Abraham Oshadami, Executive Commissioner, Technical Services, NCC, said the increasing digitalisation of services and rapid growth in data exchange had made a robust cybersecurity framework more urgent.
“Given the increasing digitalisation of services, the rapid growth of data exchange, and the sophisticated nature of modern cyber threats, the need for a robust, adaptive and inclusive cybersecurity framework has become more urgent,” he said.
Oshadami said both state and non-state actors were increasingly targeting essential sectors through coordinated cyber and physical attacks.
He noted that such attacks frequently targeted control systems and data integrity, highlighting the critical risks posed to operational technology (OT) in the telecommunications sector.
“As cyber threats evolve, they endanger not only system performance but also human safety, amplifying the severity and consequences of disruptions to vital communications infrastructure.
“Cybersecurity now encompasses human safety and must address the real risk to people’s lives when a system is attacked or compromised,” he said.
The Commission further directed operators to develop comprehensive cybersecurity implementation plans, conduct periodic risk assessments and establish business continuity and disaster recovery procedures.
Operators are also required to regularly test their cyber defence capabilities to ensure their networks can withstand and recover from cyber incidents.
The framework makes cyber incident reporting compulsory, with licensees required to notify the NCC’s Computer Security Incident Response Team (CSIRT) of any major cybersecurity breach within four hours of discovery.
The affected operators must also submit a comprehensive post-incident analysis to the Commission after mitigation and recovery activities have been completed.
