NCC Mandates Dedicated Cybersecurity Budgets for Nigerian Telcos

The Nigerian Communications Commission (NCC)  has established requirements for communications service providers to formally allocate financial resources towards cybersecurity as part of the Cyber Resilience Framework for the Nigeria Communication Sector (CRF-NCS).

Under the framework’s “GC-BS: Budget and Spending” control, service providers are required to have access to dedicated financial resources for strengthening cybersecurity measures and initiatives. The framework states that budgetary planning must be aligned with information security and privacy management objectives and processes, with adequate resources allocated to support the organisation’s cybersecurity efforts.

The framework further requires that cybersecurity budgets be “strategically allocated to align with specific cybersecurity objectives and their associated implementation activities.” Service providers are also required to track cybersecurity budget expenditures and adjust future budgets where necessary to ensure optimal resource allocation and improve security effectiveness.

The requirement forms part of the framework’s broader governance approach to cyber resilience. The CRF-NCS states that service providers’ cybersecurity budgets should be strategically aligned with specific cybersecurity objectives and the activities required to implement them.

The framework places responsibility for cybersecurity risk at the leadership level. Boards or executive management of service providers bear responsibility and accountability for cybersecurity risk, while a Chief Information Security Officer (CISO) or designated officer is required to coordinate, develop, implement and maintain the organisation’s overall cybersecurity strategy, plan, programme and activities.

The CRF-NCS also requires service providers to establish processes for identifying, assessing and mitigating supply-chain risks through effective third-party risk management, alongside the strategic allocation of cybersecurity budgets.

The framework’s approach is based on cyber resilience, which it describes as the capacity of organisations to anticipate, withstand, respond to and recover from adverse cybersecurity events while maintaining essential functions. It emphasises preparedness, continuity and the ability to recover rapidly from disruptions.

The CRF-NCS applies a tiered approach to communications service providers, classifying them into Tier 1, Tier 2 and Tier 3 according to factors including their networks, coverage, infrastructure and role in the communications sector.

Through the budget and spending requirements, the framework therefore links cybersecurity funding directly to risk management, security objectives and implementation activities, while requiring service providers to monitor how their cybersecurity resources are spent and adjust future allocations where necessary.