The CBN risk-based cybersecurity framework, explained

On 31 May 2024 the Central Bank of Nigeria (CBN) issued a new Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks. Full compliance was required from 1 July 2024. It replaced the version from October 2018, which was written before many of today’s threats, and before newer laws such as the Nigeria Data Protection Act 2023.

This guide explains the framework in plain English. Always check the official document (linked below) for the exact wording that applies to you.

Who it covers

The framework applies to deposit money banks, meaning commercial, merchant and non-interest banks, and to payment service banks. Microfinance banks, fintechs and other financial institutions have separate CBN guidance. In practice, their regulators and partner banks expect the same standards, so the steps below are a sensible guide for them too.

What “risk-based” means

The framework doesn’t hand you a fixed checklist. It expects you to understand your own risks and put controls in place that match them. A bank with millions of mobile users faces different threats from a small merchant bank, and the framework expects each to protect itself accordingly.

The main areas it covers

The official document is organised around:

• Governance and oversight: clear duties for the board, senior management and the Chief Information Security Officer (CISO). Cybersecurity is a board-level responsibility, not just an IT task.
• Risk management: identifying your important systems and data, assessing the threats to them, and treating those risks.
• Resilience: being able to detect attacks, respond to them and recover your services quickly.
• Emerging technologies: handling the risks of cloud, mobile, APIs and other new technology.
• Metrics and reporting: measuring how well your security works, and reporting to management and to the CBN.
• Compliance and enforcement: how the CBN checks compliance, and what happens if a bank falls short.

What this means in practice

Most banks meet the framework through a handful of habits:

1. A security strategy the board has approved, with a named CISO who reports regularly.
2. An up-to-date list of critical systems: core banking, mobile apps, internet banking, APIs and payment links, with an owner for each.
3. Regular testing, including penetration tests of internet-facing systems and apps. These show whether controls work against a real attacker, not just on paper.
4. Round-the-clock monitoring, so attacks are spotted in hours, not weeks.
5. An incident response plan that has been practised, covering who decides, who tells customers, and how services are restored.
6. Strong access control: two-factor login, least privilege, and quick removal of leavers’ access.
7. Third-party oversight, so cloud providers, fintech partners and vendors meet your standards.
8. Evidence. Keep records of tests, fixes, training and reviews, so you can show the CBN what you did.

Where banks most often fall short

• Testing once and filing the report. Findings need fixing, and the fixes need re-testing.
• APIs left out of scope. Mobile and partner APIs are now a main way in for attackers.
• Plans that were never rehearsed. A plan only works if people have practised it.
• Too much reliance on vendors. Outsourcing a service does not outsource the responsibility.

How we help

We test banking apps and APIs the way a real attacker would, check every finding by hand, help you close each gap, and re-test for free within 90 days to prove the fixes work. We also provide monitoring and prepare the evidence auditors and regulators ask for. We built BravePay, a licensed banking app, so we understand how these systems fit together.