Nigeria’s telecommunications operators will be required to allocate dedicated funding for cybersecurity under new requirements introduced by the Nigerian Communications Commission (NCC), as regulators seek to strengthen the resilience of critical communications infrastructure.
The directive forms part of an updated Guidance Note on the Implementation of the Cyber Resilience Framework for the Nigerian Communications Sector (CRF-NCS). Under the revised rules, operators must identify cybersecurity spending as a distinct item in their annual budgets, giving boards and senior management greater visibility over investments in protecting networks and customer information.
The NCC’s move comes as telecommunications networks face increasingly sophisticated cyber threats, with operators responsible for handling large volumes of subscriber information and digital traffic. Ransomware, malware and data breaches have increased the pressure on companies to strengthen their ability to prevent attacks and maintain services during disruptions.
Operators will also be expected to link cybersecurity expenditure to their wider risk-management strategies. The regulator plans to assess compliance through regular audits, requiring companies to demonstrate that their security programmes are supported by sufficient financial resources.
Incident reporting is another major element of the updated framework. Telecom companies must notify both the NCC and the Nigerian Data Protection Commission within four hours of detecting a cyberattack. They will also be required to provide progress updates during an incident and submit a final report within 24 hours.
Quarterly cybersecurity reports will provide regulators with information on incidents, emerging threats, breaches and the measures taken to address them. Companies must additionally appoint a Chief Information Security Officer to lead cybersecurity strategy, incident response and implementation of security policies approved by senior management.
The new requirements extend beyond internal systems. Operators are expected to educate subscribers about common online threats and warn customers against sharing passwords, one-time passwords and other sensitive credentials. They must also encourage users to report suspected phishing attempts.
The NCC is further requiring cybersecurity awareness programmes for employees and board members at least twice a year, broadening responsibility for digital security beyond technical departments.
Operators will also need regulator-approved recovery plans capable of restoring services following cyber incidents. Call records, user identification information and traffic data must be retained within Nigeria for at least two years to support lawful investigations.
The measures mark a significant tightening of cybersecurity governance in Nigeria’s telecommunications sector and place greater financial, operational and leadership responsibility on operators to protect the country’s digital communications infrastructure.