The Central Bank of Nigeria (CBN) has issued cybersecurity guidelines for other financial institutions (OFIs), instructing them to begin compliance from January 2023.
Nkiru Asiegbu, the bank’s director, other financial institutions supervision department disclosed this in a circular dated June 29, 2022.
According to the CBN, all OFIs are expected to fully comply with the provisions of the guidelines by January 1, 2023.
It explained that threats such as ransomware, targeted phishing attacks, and advanced persistent threats (APT) have become prevalent, demanding that financial institutions, including OFIs, strengthen their cyber resilience and take proactive steps to secure their critical information assets.
“As a result of the recent increase in the number and sophistication of cybersecurity threats against financial institutions, especially other financial institutions (OFIs), it has become mandatory for institutions to strengthen their cyber defenses if they are to remain safe and sound,” the circular reads.
“Consequently, the CBN hereby issues the attached risk-based cybersecurity framework and guidelines for OFIs, which represent the minimum requirements to be put in place by all OFIs.
“The effective date for full compliance with the provisions of the guidelines is January 1, 2023, and all OFIs are expected to comply on or before that date.”
The CBN said the guidelines specify the minimum requirements the OFIs need to observe in the development and implementation of strategies, policies, procedures, and related activities aimed at mitigating cyber risks.
“OFIs should note that for a cybersecurity programme to be successful, it must be fully integrated into their business goals and objectives, and must be an integral part of the overall risk management processes,” it added.
“The framework provides a risk-based approach to cybersecurity risk.
“The document comprises six parts: cybersecurity governance and oversight, cybersecurity risk management system, cyber resilience assessment, cybersecurity operational resilience, cyber-threat intelligence and metrics, monitoring and reporting.”
