The Central Bank of Nigeria (CBN) has officially launched its enhanced Cybersecurity Framework for 2024, marking a significant shift in regulatory expectations for Nigerian financial institutions. The updated framework, released on January 15, 2024, introduces several critical changes that will impact banks, fintech companies, payment service providers, and other CBN-regulated entities.

Key changes include:

Mandatory Annual Penetration Testing: All institutions must conduct comprehensive penetration testing by September 30, 2024, with reports submitted directly to CBN.

Real-Time Threat Monitoring: Implementation of Security Information and Event Management (SIEM) systems becomes compulsory for Tier 1 and Tier 2 banks.

Enhanced Incident Reporting: Cyber incidents must be reported within 2 hours of discovery, down from the previous 24-hour window.

Third-Party Risk Management: Stricter controls over vendor cybersecurity assessments, with mandatory due diligence for all service providers.

Ransomware Response Protocols: New requirements for ransomware prevention, detection, and response, including mandatory backup verification.

The framework specifically addresses emerging threats targeting Nigerian financial institutions, including sophisticated phishing campaigns, Business Email Compromise (BEC) attacks, and mobile banking vulnerabilities. CBN has emphasized that compliance will be monitored through both self-assessment submissions and targeted on-site examinations.

Industry experts estimate that implementing the new requirements could cost large banks between ?500 million to ?2 billion in security infrastructure upgrades. However, CBN has provided a phased implementation approach, with different timelines based on institution size and complexity.

Financial institutions are advised to:

Conduct immediate gap assessments against the new framework

Update cybersecurity policies and procedures

Allocate budget for required security investments

Train staff on new incident reporting requirements

Begin vendor risk assessment processes

Failure to comply could result in sanctions ranging from monetary penalties to suspension of certain banking activities. The CBN has scheduled industry workshops throughout February 2024 to provide detailed guidance on implementation requirements.