The Central Bank of Nigeria has directed banks to complete a mandatory cybersecurity self-assessment within three weeks as part of efforts to strengthen resilience across the financial system.
In a letter dated March 30, 2026, and published Tuesday on its website, the apex bank said deposit money banks must submit their completed Cybersecurity Self-Assessment Tool within three weeks, while other regulated institutions have five weeks.
The directive, addressed to banks and other financial institutions, as well as payment service providers, introduced the Cybersecurity Self-Assessment Tool to evaluate cyber risk exposure across the sector.
The CBN said the move aligns with its statutory mandate under the Banks and Other Financial Institutions Act 2020 and reflects its broader commitment to strengthening cybersecurity standards.
According to the regulator, the tool is designed to provide a comprehensive view of institutions’ cybersecurity posture. It will assess areas including governance, risk management, technology systems, third-party risks, incident response and operational resilience.
The bank said insights from the exercise will support risk-based supervision and improve regulatory oversight of cyber threats within Nigeria’s financial system.
Affected institutions are required to complete and submit the assessment through a dedicated portal. Access credentials will be provided to chief information security officers and other relevant officials.
The CBN said all submissions must be complete and supported by relevant documentation, reflecting each institution’s position as of Dec. 31, 2025.
It warned that inaccurate or misleading disclosures would attract sanctions.
The regulator added that it will validate submissions through off-site reviews and supervisory engagements to ensure data reliability.
The directive takes immediate effect, signaling tighter regulatory scrutiny of cyber risks amid rising digital transactions.
