CYBERSECURITY GOVERNANCE IN GOVERNMENT INSTITUTIONS IN NIGERIA

Background

Digitisation government services online portals interoperable databases digital identity systems automated back-office processing expanded attack surface available to malicious cyber actors even as improved efficiency citizen access. Government institutions attractive targets for cybercriminals state-sponsored actors hacktivists given sensitivity data they hold tax records biometric identity data health records and disruptive high-visibility impact successfully compromising public infrastructure. Cybersecurity governance institutional structures policies practices through which organisation identifies protects against detects responds to and recovers from cyber risk consequently become essential rather than peripheral dimension public-sector digital transformation. Internationally US NIST Cybersecurity Framework first released 2014 organised around five core functions Identify Protect Detect Respond Recover has become most widely referenced government-oriented cybersecurity framework mandated across all US federal agencies and voluntarily referenced by governments organisations worldwide. Comparative research on state-level US government adoption found majority state Chief Information Officers rely on NIST standards foundation enterprise-wide security policy adoption persistently constrained by funding governance stakeholder support skilled-personnel shortages illustrating even jurisdiction with strong central cybersecurity guidance institutional-level implementation remains uneven. Nigeria cybersecurity governance architecture rests principally on two instruments: Cybercrimes Act 2015 as amended criminalises range cyber offences and establishes institutional responsibilities including Nigeria Computer Emergency Response Team ngCERT and National Cybersecurity Policy and Strategy NCPS sets out Nigeria overarching approach to cybersecurity governance critical infrastructure protection capacity building. Recent scholarship examining instruments however finds remains unclear whether effectively secure Nigeria digital domain in practice notwithstanding existence on paper Falade & Osho 2026. Qualitative doctoral study information security officers across three information-security-certified government institutions central Nigeria similarly found Nigerian government organisations face significant challenges complying with cybersecurity policies threatening security efficiency e-government systems raising concerns data breaches service disruption diminished public trust Waldenu doctoral study 2025.

Cybersecurity governance project topics | External: NIST Cybersecurity Framework, Nigeria ngCERT, Nigeria Cybercrimes Act 2015

Statement of Problem

Nigeria cybersecurity legal and policy architecture Cybercrimes Act and NCPS existed close to decade yet recent research continues to question whether instruments translate into effective operational practice within government institutions they meant to protect Falade & Osho 2026. Broader Nigerian cybersecurity scholarship though concentrated substantially on tertiary-education and critical-infrastructure sectors rather than general public administration consistently identifies funding constraints weak legal enforcement skills shortages low institutional awareness insufficient collaboration between institutions and government agencies as recurring barriers to resilience. There is limited Nigerian empirical research systematically examining state cybersecurity governance as distinct from existence national-level policy instruments specifically within federal MDAs using recognised institutional-maturity framework such as NIST Identify-Protect-Detect-Respond-Recover structure and primary survey data. Creates policy-relevant gap: without evidence institutional-level cybersecurity governance maturity distinguishing which of five NIST functions comparatively well-developed and which weak policymakers and MDA leadership risk investing without clear evidential basis for prioritisation and risk continuing to treat existence national policy instruments as proxy for institutional-level preparedness when two may diverge substantially. Study addresses gap empirically examining governance maturity across selected federal MDAs structured around NIST framework and testing whether stronger governance structures statistically associated with staff-perceived institutional resilience to cyber incidents.

Aim and Objectives

·         Assess extent institutionalised cybersecurity governance structures in selected federal MDAs

·         Examine level staff awareness of and compliance with cybersecurity policy in selected MDAs

·         Evaluate incident-response preparedness in selected MDAs

·         Determine relationship between cybersecurity governance maturity and staff-perceived institutional resilience to cyber incidents

·         Recommend measures for strengthening cybersecurity governance in Nigerian public service

Research Questions

·         To what extent have selected federal MDAs institutionalised cybersecurity governance structures?

·         What is level staff awareness of and compliance with cybersecurity policy in selected MDAs?

·         How prepared are selected MDAs to respond to cybersecurity incidents?

·         What is relationship between cybersecurity governance maturity and staff-perceived institutional resilience to cyber incidents?

·         What measures can strengthen cybersecurity governance in Nigerian public service?

Research Hypotheses

·         H01: There is no statistically significant relationship between cybersecurity governance maturity and staff-perceived institutional resilience to cyber incidents in selected MDAs

·         H02: Organisational factors leadership commitment staff training budgetary allocation have no statistically significant influence on cybersecurity governance maturity in selected MDAs

·         H03: There is no statistically significant difference in cybersecurity governance maturity across selected MDAs

Tested at 0.05 significance level using Chi-square simple linear regression and ANOVA descriptive survey design Taro Yamane stratified random sampling Likert-scale questionnaire ICT information-security administrative staff complemented by document analysis Cybercrimes Act and NCPS anchored NIST framework Neo-Institutional Theory Routine Activity Theory.

Significance

Contributes to Nigerian public-administration scholarship by applying NIST Cybersecurity Framework most widely referenced government-oriented maturity model internationally to systematically structure empirical assessment Nigerian federal-MDA cybersecurity governance extending existing literature which concentrated substantially on tertiary-education institutions and critical-infrastructure sectors into general public-administration domain. For Office of National Security Adviser ONSA NITDA and ngCERT offers empirical baseline MDA-level cybersecurity governance maturity informing capacity-building priorities and compliance-monitoring design. For MDA leadership identifies specific governance gaps across Identify Protect Detect Respond Recover functions guiding institutional investment. For academic community extends qualitative case-study evidence prior Nigerian research Waldenu doctoral study central Nigerian institutions with quantitative NIST-structured instrument capable producing comparable aggregable maturity scores. For citizens stronger MDA-level governance directly reduces risk data breaches service disruption affecting government services citizens depend on. Expected to establish current maturity identify organisational factors most strongly shape that maturity and determine statistical relationship between maturity and staff-perceived institutional resilience.

Public administration project topics | Information security management topics

Scope and Limitations

Delimited to selected federal MDAs Abuja FCT that operate significant digital/e-government infrastructure see Section 3.2. Focuses cybersecurity governance structured around NIST framework five core functions as distinct from technical minutiae specific security tools or architectures. Empirical focus perceptions and institutional knowledge ICT information-security and administrative staff captured through cross-sectional questionnaire complemented by document analysis Cybercrimes Act and NCPS. Limitations: cross-sectional design limits causal inference between governance maturity and resilience outcomes. Self-reported staff perceptions may not fully capture actual technical security posture which would require specialised technical audit beyond this study public-administration research scope; acknowledged as limitation and mitigated through complementary document analysis where publicly available. Given sensitivity cybersecurity information some respondents may be cautious about disclosing security weaknesses even under assurances anonymity limitation addressed through careful item wording Appendix I avoiding requesting specific exploitable technical detail. Restricting sample to Abuja-based federal MDAs limits generalisability to state/local government or MDAs less digitally intensive operations.

Operational Definitions

Cybersecurity Governance: Institutional structures policies practices through which organisation directs oversees manages cyber risk across digital assets operations - anchored NIST CSF Neo-Institutional Theory Routine Activity Theory.

NIST Cybersecurity Framework: Framework five core functions Identify Protect Detect Respond Recover used structure assess organisation cybersecurity risk-management maturity first released 2014 mandated US federal agencies.

Incident-Response Preparedness: Extent organisation has documented plans trained personnel tested procedures for responding to and recovering from cybersecurity incident - evaluated via Likert questionnaire.

Cyber Incident: Event compromises or attempts compromise confidentiality integrity availability organisation information systems or data.

Policy Compliance: Extent staff behaviour and institutional practice conform documented cybersecurity policies and applicable statutory requirements Cybercrimes Act 2015 NCPS - compliance challenges threatening e-government systems identified Waldenu 2025 and Falade & Osho 2026.

MDAs: Constituent administrative units Nigerian federal public service Abuja FCT population ICT information-security administrative staff sample Taro Yamane stratified random sampling.

Conclusion

Study examines state cybersecurity governance institutional structures policy compliance staff preparedness within selected federal Ministries Departments and Agencies Abuja Federal Capital Territory. Anchored NIST Cybersecurity Framework Identify Protect Detect Respond Recover Neo-Institutional Theory Routine Activity Theory adopts descriptive survey research design complemented by document analysis Cybercrimes Act and NCPS. Population ICT information-security administrative staff selected MDAs sample determined Taro Yamane formula selected through stratified random sampling data collected via structured questionnaire five-point Likert scale addressing institutional governance structures policy compliance awareness incident-response preparedness analysed descriptive and inferential statistics Chi-square simple linear regression ANOVA at 0.05 significance. Expected to establish current maturity cybersecurity governance across sampled MDAs identify organisational factors leadership commitment staff training budgetary allocation most strongly shape maturity and determine statistical relationship between maturity and staff-perceived institutional resilience. Concludes with recommendations institutionalising NIST-aligned governance structures strengthening compliance monitoring building incident-response capacity across Nigerian federal public service reducing risk data breaches service disruption diminished public trust affecting e-government systems.

FAQs

What is cybersecurity governance in government institutions?

Institutional structures policies practices through which organisation directs oversees manages cyber risk across digital assets operations structured around NIST CSF Identify Protect Detect Respond Recover.

What is Nigeria cybersecurity governance architecture?

Principally Cybercrimes Prohibition Prevention Act 2015 as amended criminalising cyber offences establishing ngCERT and National Cybersecurity Policy and Strategy NCPS setting overarching approach governance critical infrastructure protection capacity building.

What challenges face Nigerian MDAs cybersecurity governance?

Funding constraints weak legal enforcement skills shortages low institutional awareness insufficient collaboration recurring barriers; Waldenu doctoral 2025 central Nigeria found compliance challenges threatening e-government security efficiency raising data breach service disruption public trust concerns; Falade & Osho 2026 question whether instruments effectively secure digital domain in practice.

What framework anchors this study?

NIST Cybersecurity Framework Identify Protect Detect Respond Recover most widely referenced government-oriented maturity model 2014 plus Neo-Institutional Theory and Routine Activity Theory.

What methodology does study adopt?

Descriptive survey complemented by document analysis Cybercrimes Act and NCPS population ICT information-security administrative staff selected federal MDAs Abuja FCT sample Taro Yamane formula stratified random sampling structured questionnaire five-point Likert addressing governance structures compliance awareness incident-response preparedness analysed descriptive Chi-square simple linear regression ANOVA 0.05 significance.

What are research hypotheses?

H01 no significant relationship governance maturity and staff-perceived resilience; H02 organisational factors leadership commitment training budgetary allocation no significant influence on maturity; H03 no significant difference maturity across selected MDAs.

Why focus on federal MDAs Abuja?

Operate significant digital/e-government infrastructure high-value targets tax biometric identity health records attractive to cybercriminals state-sponsored actors hacktivists; limited empirical research systematically examining governance maturity as distinct from existence national policy instruments within MDAs using NIST framework.

What is significance for ONSA NITDA ngCERT?

Offers empirical baseline MDA-level maturity informing capacity-building priorities compliance-monitoring design distinguishing which of five NIST functions comparatively well-developed and which weak guiding investment rather than treating existence national policy as proxy for preparedness.

What are limitations?

Cross-sectional limits causal inference maturity vs resilience; self-reported perceptions may not fully capture actual technical posture requiring specialised audit beyond public-administration scope; sensitivity may cause caution disclosing weaknesses mitigated careful wording avoiding exploitable detail; Abuja federal MDAs only limits generalisability state/local less digitally intensive.

What measures strengthen governance in public service?

Institutionalising NIST-aligned structures strengthening compliance monitoring building incident-response capacity documented plans trained personnel tested procedures across Identify Protect Detect Respond Recover functions guiding institutional investment reducing data breach service disruption risk.