Staff cybersecurity training is no longer optional in Nigeria. Two major regulations now require organizations to train their employees as part of their legal compliance obligations.
The Nigerian Communications Commission (NCC) and the Nigeria Data Protection Commission (NDPC) have both introduced frameworks that make staff cybersecurity training a formal requirement , not just a best practice.
If your organisation handles telecom infrastructure or processes personal data, this applies to you.
For years, cybersecurity was treated as a technical issue handled mainly by IT teams. However, that approach no longer works, and regulators have clearly made this shift.
As a result, two key legal instruments now enforce staff cybersecurity training across organisations:
- The NCC’s Cyber Resilience Framework for the Nigerian Communications Sector (CRF-NCS)
- The Nigeria Data Protection Act (NDPA) 2023, supported by the General Application and Implementation Directive (GAID)
Together, these regulations extend responsibility beyond IT departments. Specifically, they now include:
- Executives and board members
- Technical teams
- Non-technical staff
In short, everyone is now part of your organisation’s security posture.