Critical National Information Infrastructure: Tinubu orders NSA to secure 13 key sectors including banking, ICT tech assets

President Bola Tinubu has directed Mallam Nuhu Ribadu, the National Security Adviser (NSA), to provide security protection for 13 designated critical sectors and several other sub sectors of the Nigerian economy following the gazetting of a presidential order on Critical National Information Infrastructure (CNII). 

According to the Act, “The President may, on the recommendation of the National Security Adviser published in the Federal Gazette, designate certain computer systems or networks, whether physical or virtual, the computer programs, computer data or traffic data vital to this country that the incapacity or destruction of or interference with such systems and assets would have debilitating impact on security, national or economic security, national public health and safety, or any combination of those matters as constituting Critical National Information Infrastructure.”

Nigeria’s Cybercrimes (Prohibition, Prevention, ETC.)  Act 2015.

President Bola Tinubu has directed Mallam Nuhu Ribadu, the National Security Adviser (NSA), to provide security protection for 13 designated critical sectors and several other sub sectors of the Nigerian economy following the gazetting of a presidential order on Critical National Information Infrastructure (CNII). 

Technology Times review of the “Designation and Protection of Critical National Information Infrastructure Order, 2024” reveals that a total of 13 critical sectors, 52 critical sub sectors; 243 critical services and 52 regulatory agencies have been designated for the top-level security protection under the purview of the Office of the NSA (ONSA).

The Federal Government says that the official gazette of “Designation and Protection of Critical National Information Infrastructure Order, 2024” serves as a legal documentation of the law enacted to protect CNII and strengthen investments in ICT and other sectors of the Nigerian economy. 

The designated sectors and allied services were identified as essential for the operational continuity of Nigeria’s critical infrastructure sectors, each playing a vital role in maintaining national security, economic stability, and public safety.

Tinubu’s order signed into law on June 24, 2024 and now officially gazetted emanates from the powers vested in his office by Nigeria’s Cybercrimes (Prohibition, Prevention, ETC.)  Act 2015 that empowers the Nigerian President to designate certain computer systems or networks as Critical National Information Infrastructure.

According to the Act, “The President may, on the recommendation of the National Security Adviser published in the Federal Gazette, designate certain computer systems or networks, whether physical or virtual, the computer programs, computer data or traffic data vital to this country that the incapacity or destruction of or interference with such systems and assets would have debilitating impact on security, national or economic security, national public health and safety, or any combination of those matters as constituting Critical National Information Infrastructure.”

The nation’s top cybercrime law also empowers the President to prescribe minimum standards, guidelines, rules or procedures for:

1. Protection or preservation of critical information infrastructure;
2. The general management of critical information infrastructure;
3. Access to, transfer and control of data in any critical information infrastructure;
4. Infrastructural or procedural rules and requirements for securing the integrity and authenticity of data or information contained in critical national information infrastructure;
5. The storage or archiving of data or information designated as critical national information infrastructure; 
6. Recovery plans in the event of disaster, breach or loss of the critical national information infrastructure or any part of it; and 
7. Any other matter required for the adequate protection, management and control of data and other resources in any critical national information infrastructure.

According to details of the official gazette reviewed by Technology Times, apart from designating certain ICT systems and networks operating in Nigeria as Critical National Information Infrastructure, the President’s order also aims to develop cohesive measures and strategies for the security of CNII and ensure their continued operation.

The order adopts a proactive and holistic approach to the identification, security and protection of CNII and in addition “reduce to the barest minimum, incidences capable of damaging, disrupting, or interfering with the operation, functionality, or integrity of CNII.”

It equally seeks to “ensure the effective functioning of ICT systems, networks, and infrastructure, which are critical to driving national imperatives, economic development, national security and defense, public health and safety, and government operations.

Under the plan, the Presidential order has mandated the NSA, among other responsibilities, to develop a Critical National Information Infrastructure Protection Plan (CNIPP), and equally collaborate with relevant stakeholders to establish a Trusted Information Sharing Network (TISN), a multidisciplinary framework of owners and operators of CNII, representatives of relevant MDAs and identified private sector organisations. 

The NSA will further work with the TISN members and entities to collaborate and share information on threats and vulnerabilities as well as develop strategies and solutions to mitigate known and evolving risks.

Working to relevance CNII stakeholders, according to the Presidential order, the NSA’s Office will implement the CNIPP and other measures “as may be established, to prevent unauthorised access, disclosure, theft, vandalism, destruction, and unlawful interference with the operations of designated CNII in the various sector of the Nigerian economy.”

Apart from being tasked the responsibility to protect the CNII in the designated sector and sub sectors across the Nigerian economy, the Office of the NSA may with the President’s approval, update the list of sectors covered under the rules “taking into consideration emerging technologies and platforms, in line with the Cybercrimes (Prohibition, Prevention, Etc.) Act (“the Act”), and the National Cybersecurity Policy and Strategy (“the Policy”).

Listed: Critical National Information Infrastructure: Critical Sectors, Critical Sub Sectors, Critical Services and Regulatory Agencies in Nigeria

President Tinubu’s “Designation and Protection of Critical National Information Infrastructure Order, 2024” has designated the underlisted totalling 13 critical sectors, 52 critical sub sectors; 243 critical services and 52 regulatory agencies in Nigeria for protection:

Critical National Information Infrastructure: Critical Sectors in Nigeria

• There are 13 sectors listed (Power and Energy, Water, Information, Communications, Banking/Finance & Insurance, Health, Public Administration, Education, Defence and Security, Transport, Food and Agriculture, Emergency Services, Industrial and Manufacturing, Mines and Steel).

Critical National Information Infrastructure: Critical Subsectors in Nigeria

• Power and Energy: 2 (Oil and Gas, Power Generation and Distribution)
• Water: 1 (Dams and Water Stations)
• Information, Communications, Communications Science and Technology: 3 (Communications Companies, Internet Service Providers, Other ICT)
• Banking/Finance & Insurance: 4 (Inter-Bank Payment Systems, Electronic Transaction, Financial Trading, Federal Civil Service Management and Payroll System)
• Health: 2 (National Health Insurance Scheme, Hospitals)
• Public Administration: 7 (Ministry Department and Agencies, Nigeria Immigration Service, Federal Inland Revenue Service, Nigerian Correctional Service, Independent National Electoral Commission, Secretary to the Government of the Federation)
• Education: 5 (Joint Admissions and Matriculation Board (JAMB), West African Examination Council (WAEC), National Examination Council (NECO), Tertiary Education Trust Fund (TetFund), Universal Basic Education)
• Defence and Security: 13 (Nigerian Army, Nigerian Navy, Nigerian Air Force, Defence Space Administration, Office of the National Security Adviser, Defence Intelligence Agency (DIA), Department of State Service (DSS), National Intelligence Agency (NIA), National Centre for the Control of Small arms and Light Weapons (NCCSALW), Nigeria Police Force (NPF), Nigeria Security and Civil Defence Corps (NSCDC), Nigerian Custom Service (NCS), National Drug Law Enforcement Agency (NDLEA), Critical Defence Establishments)
• Transport: 9 (Federal Airport Authority of Nigeria (FAAN), Nigerian Civil Aviation Authority (NCAA), Nigerian Airspace Management System (NAMA), Nigerian Civil Aviation Technology (NCAT), Nigerian Meteorological Agency (NIMET), Accident Investigation Bureau (AIB), Nigeria Railway Corporation (NRC), Nigeria Ports Authority, Nigerian Maritime Administration and safety Agency)
• Food and Agriculture: 1 (Nigeria Incentive-Based Risk Sharing system for Agricultural Landing)
• Emergency Services: 2 (National Emergency Management Agency (NEMA), Federal Road Safety Corps)
• Industrial and Manufacturing: 2 (Textiles, Automobiles and other critical industrial sectors Solid Minerals)
• Mines and Steel: 1 (Ajaokuta Steel Company)

Total Critical Subsectors: 52

Critical National Information Infrastructure: Critical Services in Nigeria

These 243 critical services have been designated as essential for the operational continuity of Nigeria’s critical infrastructure sectors, each playing a vital role in maintaining national security, economic stability, and public safety.

1. Power and Energy

• Oil and Gas: 6
  1. Transmission and Distribution Information System
  2. Energy Management System
  3. Vendors Financing System
  4. Pipeline Product Data Management System
  5. Geospatial Management Systems
  6. Oil and Gas Assets Information System
• Power Generation and Distribution: 5
  1. Grid Substation (SCADA System)
  2. Bulk-load Substation
  3. Transmission Base Station
  4. Generation, Transmission, and Distribution of Critical ICT Infrastructure
  5. Computerized Systems and Networks

Total for Power and Energy: 11

2. Water

• Dams and Water Stations: 4
  1. Spillways/Dam Gate Control Systems
  2. Water Treatment Plants
  3. National Water Resources Information System
  4. SCADA and other ICT related Systems

Total for Water: 4

3. Information, Communications, Science, and Technology

• Communications Companies: 20
  1. Telecommunication Towers/Sites
  2. Telecommunication Switch Stations
  3. Telecommunication Power System
  4. Telecommunication Cables
  5. Data Center Facilities
  6. Satellite Infrastructure
  7. Nigeria Internet Landing Points
  8. Submarine Cables (including but not limited to SAT-3 cable, Main One cable, Glo 1 cable, ACE Cable, West Africa Cable System (WACS) cable, Equiano Cable by Google/WOICC)
  9. Base Stations and Base Station Controllers
  10. Base Transceiver Stations
  11. Media Gateways
  12. Mobile Switching Centres
  13. Network Operating Centres
  14. Optic Fibre Networks, Fiber Optic Cables, Ducts, Optic Fibre Switching Centres, Routers, and other Fiber Equipment
  15. Transmission Equipment
  16. Satellites including Ground Equipment and Shelters
  17. Transponders
  18. Point of Presence Sites
  19. Cubicles for Nodal Points
  20. Telecommunications Power Systems
• Internet Service Providers: 3
  1. Africa Coast to Europe System
  2. National Fiber Network (Last Mile Providers)
  3. Platform, Systems, and Critical Infrastructures
• Other ICT: 13
  1. SIM Card Registration Database
  2. Galaxy Backbone E-government Platforms
  3. Galaxy Backbone National Centre
  4. National Shared Services Centre
  5. National Identity Management Commission (NIMC)
  6. NIMC Database
  7. NIMC Database Failover/Back-up
  8. Nigerian Communication Satellite (NigCOMSAT) and all its communications facilities
  9. Transponders
  10. All Satellite Ground Stations
  11. Nigerian Communication Satellite (NigCOMSAT)
  12. National Information Communications and Education Programme (NICEP) II Security Element
  13. Strategic Cybersecurity Platforms, Systems, and Databases

Total for Information, Communications, Science, and Technology: 36

4. Banking/Finance & Insurance

• Inter-Bank Payment Systems: 4
  1. Nigeria Inter-Bank Settlement System
  2. Real Time Gross Settlement System
  3. National Central Switch
  4. Nigerian Automated Clearing System
• Electronic Transaction: 2
  1. All Electronic Payment Gateways
  2. Interswitch Digital Payment Solutions of Payment Service Providers critical to Government and Public delivery
• Bank Verification Number Database: 3
  1. Treasury Single Account Database
  2. Security Operations Centres, Data Centres and Disaster Recovery Sites of Financial Institutions
  3. SWIFT Database
• Federal Civil Service Management and Payroll System: 2
  1. Integrated Personnel & Payroll Information System (IPPIS)
  2. Government Integrated Financial Management Information System (GIFMIS)
• Financial Trading: 2
  1. Trading Platforms and Systems for Capital Market Operations
  2. Central Security Clearing System

Total for Banking/Finance & Insurance: 13

5. Health

• National Health Insurance Scheme: 7
  1. Health Insurance Management System
  2. Telemedicine Services Information System
  3. Health Management Information System
  4. Monitoring & Evaluation Software
  5. Diseases Surveillance Management System
  6. Health Facility Register
  7. Yellow Card Registration System
• National Agency for Food and Drugs Administration and Control: 7
  1. NAFDAC e-license System
  2. Inspection Classification Database
  3. Product Registration & Regulation System
  4. Registered Products Database
  5. Foreign GMP Inspections System
  6. Ports Inspection System
  7. Local GMP Inspection System

Total for Health: 14

6. Public Administration

• Ministry Department and Agencies: 6
  1. Galaxy Backbone Information Infrastructure
  2. e-Governance System
  3. National Public Key Infrastructure (NPKI), its infrastructure and backups
  4. All the Sectorial CERTS not limited to the Defence CERT at DSA, NITDA-CERRT.ng, NCC CSIRT, CBN SOC, and all CERTs from MDA
  5. All Security Operations Centres for both Government and Private companies critical service delivery
  6. All infrastructures, databases, monitoring platforms, and backups of the Sectoral CERTs and SOCs
• Nigeria Immigration Service: 5
  1. e-Passport Database
  2. NIS Portal & Database
  3. Personnel Management System
  4. NIS Management System and database
  5. Other Critical ICT Database, Infrastructure, and Systems
• Federal Inland Revenue Service: 5
  1. Cloud Solutions and Services
  2. Content & Portal Solutions
  3. Enterprise Backup and Recovery Solutions
  4. ERP & CRM Solutions
  5. Unified Communications Solutions
• Nigerian Correctional Service: 2
  1. Inmates Database
  2. Other Critical ICT Database, Infrastructure, and Systems
• Independent National Electoral Commission (INEC): 2
  1. Voters’ Register Database
  2. Card Readers

Total for Public Administration: 20

7. Education

• Joint Admissions and Matriculation Board (JAMB): 6
  1. JAMB Portal & Database
  2. JAMB Payment Systems
  3. JAMB Records Management System
  4. UTME Databases
  5. Personnel Management System
  6. Computer Based Test Databases
• West African Examination Council (WAEC): 3
  1. WAEC Recruitment/Examiner Portal & Database
  2. Employees Management System
  3. WAEC Records Management System
• National Examination Council (NECO): 3
  1. NECO Recruitment/Examiner Portal and Database
  2. NECO Result Management System
  3. Personnel Management System
• Tertiary Education Trust Fund (TetFund): 3
  1. TetFund Portal and Database
  2. Employees Management System
  3. TetFund Records Management System
• Universal Basic Education: 3
  1. Portal & Database
  2. Employees Management System
  3. Records Management System

Total for Education: 18

8. Defence and Security

• Nigerian Army: 7
  1. Personnel Management System
  2. NA Portal & Database
  3. Deep Blue Project (Land Warfare Component)
  4. Nigerian Army Wide Area Network
  5. Computerized Weapons and Missile Systems
  6. Other Critical ICT Computerized Munition Systems
  7. Cybersecurity Platforms, Systems, and Data Centres
• Nigerian Navy: 6
  1. Falcon Eye Project
  2. NN Portal & Websites
  3. NN Personnel Management System
  4. NN Fleet Management System
  5. Deep Blue Systems (Maritime Component)
  6. Other Critical ICT Computerized Munition Systems
• Nigerian Air Force (NAF): 6
  1. NAF Stock Management System
  2. NAF Personnel Management System
  3. Intelligence Surveillance & Reconnaissance Sensor Datalink Downstream
  4. Geospatial Intelligence and Data Analysis Network
  5. NAF Portal & Websites
  6. Other Critical ICT Computerized Munition Systems
• Defence Space Administration (DSA): 5
  1. DSA Surveillance and Reconnaissance System
  2. Satellites Systems (military component)
  3. Tactical Fibre Optical Communication System
  4. DSA Portal & Websites
  5. DSA Database Management Systems
• Office of the National Security Adviser: 8
  1. Nigerian Cybercrime Advisory Council (NCAC)
  2. National Computer Emergency Response Team (CERT)
  3. Cybercrime Forensics Laboratory
  4. Defence Headquarters (DHQ)
  5. Critical National Infrastructure Protection Centre (CNIPC)
  6. Nigerian Computer Emergency Response Team
  7. Nigerian Critical Infrastructure Defence Centre
  8. Sectoral CERT
• Defence Intelligence Agency (DIA): 4
  1. DIA Network
  2. Communications Platforms
  3. Surveillance Platforms
  4. Cybersecurity Systems
• Department of State Service (DSS): 5
  1. DSS Portal & Websites
  2. DSS Database Management Systems
  3. Critical ICT Infrastructure
  4. Surveillance Systems
  5. Cybersecurity Platforms
• National Intelligence Agency (NIA): 4
  1. NIA Communication Platforms
  2. NIA Network Systems
  3. NIA Surveillance Platforms
  4. NIA Cybersecurity Platforms
• Nigeria Police Force (NPF): 7
  1. Police National ICT Policy and Database
  2. NPF Forensics System
  3. NPF Network Management System
  4. Surveillance Management Systems
  5. Police Portal & Websites
  6. Cybersecurity Systems
  7. Crime Investigation and Analysis System
• Nigeria Security and Civil Defence Corps (NSCDC): 3
  1. NSCDC Communication Platforms
  2. NSCDC Critical Infrastructure Protection Database
  3. Surveillance Systems
• Nigerian Custom Service (NCS): 4
  1. NICIS System
  2. NCS Database Management System
  3. Asycuda System
  4. NCS Portal & Websites
• National Drug Law Enforcement Agency (NDLEA): 4
  1. NDLEA Communication Platforms
  2. NDLEA Surveillance Systems
  3. NDLEA Database Management System
  4. NDLEA Portal & Websites
• Critical Defence Establishments: 3
  1. Strategic Military Sites
  2. High-Value Security Installations
  3. Security Operations Centres

Total for Defence and Security: 66

9. Transport

• Federal Airport Authority of Nigeria (FAAN): 7
  1. National Aviation Database
  2. Airport Runway Management System
  3. Airport Security System
  4. FAAN Passenger Screening Systems
  5. Cargo Screening Systems
  6. FAAN CCTV Systems
  7. Airport Communication Systems
• Nigerian Civil Aviation Authority (NCAA): 5
  1. Aviation Security Systems
  2. NCAA Critical Infrastructure Database
  3. NCAA Management System
  4. NCAA ICT Systems
  5. NCAA Database Systems
• Nigerian Airspace Management System (NAMA): 4
  1. Aeronautical Information Service (AIS)
  2. Air Traffic Control (ATC) System
  3. Air Navigation System
  4. Surveillance and Monitoring System
• Nigerian College of Aviation Technology (NCAT): 3
  1. NCAT Network Infrastructure
  2. NCAT Aviation Training Systems
  3. NCAT Database Systems
• Nigerian Meteorological Agency (NIMET): 3
  1. NIMET Weather Monitoring System
  2. NIMET Satellite Observation Systems
  3. NIMET Database Systems
• Accident Investigation Bureau (AIB): 3
  1. AIB Data Analysis System
  2. AIB Communication Systems
  3. AIB Database Systems
• Nigeria Railway Corporation (NRC): 4
  1. Railway Traffic Management System
  2. NRC Communication System
  3. NRC Database Systems
  4. NRC Surveillance Systems
• Nigeria Ports Authority: 4
  1. Port Communication System
  2. Port Security System
  3. NPA Database Systems
  4. NPA ICT Systems
• Nigerian Maritime Administration and Safety Agency (NIMASA): 5
  1. Vessel Traffic Management System (VTMS)
  2. NIMASA Portal & Database Systems
  3. NIMASA Communication Systems
  4. NIMASA Surveillance Systems
  5. NIMASA ICT Systems

Total for Transport: 38

10. Food and Agriculture

• Nigeria Incentive-Based Risk Sharing System for Agricultural Lending: 3
  1. NIRSAL Payment Systems
  2. NIRSAL Risk Management Systems
  3. NIRSAL ICT Systems

Total for Food and Agriculture: 3

11. Emergency Services

• National Emergency Management Agency (NEMA): 5
  1. NEMA Communication Platforms
  2. NEMA Early Warning Systems
  3. NEMA Database Systems
  4. NEMA Surveillance Systems
  5. NEMA ICT Systems
• Federal Road Safety Corps (FRSC): 5
  1. FRSC Database Systems
  2. FRSC ICT Systems
  3. FRSC Communication Systems
  4. FRSC Surveillance Systems
  5. FRSC Traffic Management Systems

Total for Emergency Services: 10

12. Industrial and Manufacturing

• Textiles, Automobiles, and other Critical Industrial Sectors: 3
  1. Industry Supply Chain Management System
  2. Industry ICT Systems
  3. Industry Database Systems

Total for Industrial and Manufacturing: 3

13. Mines and Steel

• Ajaokuta Steel Company: 3
  1. Ajaokuta Steel Database Systems
  2. Ajaokuta Steel Communication Systems
  3. Ajaokuta Steel ICT Systems

Total for Mines and Steel: 3

Critical National Information Infrastructure: Regulatory Agencies in Nigeria

• Power and Energy: 3 (Nigerian Upstream Petroleum Regulation Commission, Nigerian Midstream and Downstream Petroleum Regulatory Authority, Ministry of Power)
• Water: 1 (Ministry of Water Resources)
• Information, Communications, Communications Science and Technology: 3 (Ministry of Communication and Digital Economy, Nigerian Communications Commission, Galaxy Backbone)
• Banking/Finance & Insurance: 4 (Central Bank of Nigeria, Office of Accountant General of the Federation, Nigeria Stock Exchange)
• Health: 4 (Ministry of Health, National Agency for Food and Drugs Administration and Control, National Institute for Medical Research, National Primary Healthcare Development Agency)
• Public Administration: 6 (Ministry of Communications, Nigeria Immigration Service, Secretary to the Government of the Federation, Nigerian Correctional Service, INEC)
• Education: 5 (Ministry of Education, West African Examination Council, National Examination Council, Tertiary Education Trust Fund, Universal Basic Education)
• Defence and Security: 13 (Ministry of Defence, Office of the National Security Adviser, Defence Intelligence Agency, Department of State Service, National Intelligence Agency, National Centre for the Control of Small arms and Light Weapons, Nigeria Police Force, Nigeria Security and Civil Defence Corps, Nigerian Custom Service, National Drug Law Enforcement Agency, EFCC, NFIU)
• Transport: 8 (Ministry of Aviation, Ministry of Transportation, Nigeria Ports Authority)
• Food and Agriculture: 1 (Ministry of Agriculture)
• Emergency Services: 2 (Ministry of Interior)
• Industrial and Manufacturing: 1 (Ministry of Industry, Trade and Investment)
• Mines and Steel: 1 (Ministry of Mines and Steel Development)