Why the CBN Framework should be taken seriously!

The Central Bank of Nigeria (CBN) has set December 1, 2023, as the deadline for banks to comply with its Cybersecurity Framework for Banks and Other Financial Institutions. This framework is designed to improve the resilience of Nigeria’s financial system against cyber threats, including cyber-attacks, data breaches, and other cyber-related risks.

While the framework is a positive step towards strengthening Nigeria’s cybersecurity landscape, the C-suite level of Nigerian banks and financial institutions must be cautious and take the necessary steps to ensure compliance. Failure to comply with the framework can lead to significant financial, operational, and reputational consequences.

One of the primary reasons why the C-suite level of Nigerian banks should be wary of the CBN’s Cybersecurity Framework is the increasing frequency and sophistication of cyber-attacks. According to the 2021 Global Risks Report by the World Economic Forum, cyber-attacks and data breaches are ranked among the top five global risks in terms of likelihood and impact. This report highlights the need for organisations to prioritise cybersecurity and adopt a proactive approach to managing cyber risks.

In Nigeria, cyber threats are on the rise, and banks are one of the primary targets. In 2020, the Nigeria Inter-Bank Settlement System (NIBSS) reported that there were over 56,000 fraud cases in the banking industry, with a total value of over N18 billion. These figures represent a significant increase from the previous year and demonstrate the need for banks to take cyber threats seriously.

By complying with the CBN’s Cybersecurity Framework, banks can improve their cybersecurity posture and reduce the risk of cyber-attacks. The framework provides guidelines on how banks can implement measures to prevent, detect, and respond to cyber threats. Some of the key requirements of the framework include implementing cybersecurity governance, risk management, and compliance policies, conducting regular vulnerability assessments and penetration testing, and implementing multi-factor authentication for online banking transactions.

While compliance with the framework may require significant investment in cybersecurity infrastructure, the cost of non-compliance can be much higher. In addition to the direct financial losses associated with cyber-attacks, banks can also suffer significant reputational damage, loss of customer trust, and regulatory penalties.

What’s more, the consequences of a cyber-attack can be felt beyond the bank’s immediate financial and operational impact. Cybersecurity breaches can cause systemic risk to the financial sector, impacting the wider economy and leading to a loss of confidence in the financial system.

Therefore, the C-suite level of Nigerian banks must take a proactive approach to comply with the CBN’s Cybersecurity Framework. This involves conducting a comprehensive risk assessment to identify the organisation’s cyber risks, developing and implementing a cybersecurity strategy that aligns with the CBN’s requirements, and investing in cybersecurity infrastructure and training for employees.

In addition, banks must also ensure that their third-party vendors comply with the CBN’s Cybersecurity Framework. This is because third-party vendors can pose significant cyber risks to banks, particularly if they have access to sensitive data or critical systems.

The CBN’s Cybersecurity Framework for Banks and Other Financial Institutions is a positive step towards strengthening Nigeria’s cybersecurity landscape. However, the C-suite level of Nigerian banks must be cautious and take the necessary steps to ensure compliance. Failure to comply with the framework can lead to significant financial, operational, and reputational consequences, and can also pose systemic risks to the financial sector. By investing in cybersecurity infrastructure and training, Nigerian banks can improve their cybersecurity posture and reduce the risk of cyber-attacks.

• business a.m. commits to publishing a diversity of views, opinions and comments. It, therefore, welcomes your reaction to this and any of our articles via email: comment@businessamlive.com