Lagos Releases Cybersecurity Guidelines To Tackle Digital Risks

By Ayo Susan

The Commissioner for Information and Strategy, Mr. Gbenga Omotoso, has announced in Lagos that the Lagos State Government released cybersecurity guidelines developed with the Lagos State Cybersecurity Advisory Council chaired by Fene Osakwe. This, according to him, is to help businesses, public institutions, and residents mitigate cyber risks through standardised practices aligned with national regulations and mandatory breach reporting protocols.

DECISION HIGHLIGHT
Lagos State has introduced a non-binding but structured cybersecurity framework to standardise risk management practices across its digital economy.

DECISION MEMO
The Lagos State Government is responding to escalating cyber risk exposure by formalising a baseline security architecture across public and private sectors. Omotoso noted that the guidelines provide “clear, practical, and scalable cybersecurity best practices,” indicating a shift towards codified risk management in a rapidly digitising economy.

The framework aligns with existing national instruments, including the Cybercrime Act 2024 and the Nigeria Data Protection Act 2023, integrating state-level execution with federal regulatory standards. This layered approach reduces regulatory fragmentation while reinforcing compliance pathways.

A central feature is the emphasis on operational accountability. Organisations are required to implement data minimisation, encryption, incident response frameworks, and breach reporting within 72 hours to relevant authorities. This introduces time-bound compliance expectations, strengthening system responsiveness to cyber incidents.

The guidelines also extend risk management to third-party ecosystems, requiring due diligence on vendors and cloud providers. This reflects recognition that vulnerabilities increasingly originate outside core organisational systems.

However, the framework’s non-mandatory status limits enforceability, positioning it as a capacity-building instrument rather than a regulatory mandate. Its effectiveness will therefore depend on voluntary adoption and institutional discipline.

DATA BOX

• Annual cybercrime losses in Nigeria: $500 million
• Three-year losses: Over N1.1 trillion
• 2024 losses: N53.4 billion
• Global average cost per data breach: $4.45 million
• Lagos digital footprint: Over 22 million active digital users
• Startup ecosystem valuation: $15.3 billion
• Reporting requirement: 72-hour breach notification

WHO WINS / WHO LOSES
Businesses gain structured guidance to mitigate cyber risks. Government institutions strengthen digital resilience. Consumers benefit from improved data protection. Organisations with weak compliance capacity face higher operational adjustment costs.

POLICY SIGNALS
There is a clear move towards proactive cyber risk governance at subnational level. Authorities are aligning digital economy growth with security infrastructure to sustain competitiveness.

INVESTOR SIGNAL
The framework signals improving digital risk management standards, enhancing Lagos’ attractiveness as a technology and investment hub. Investors are likely to view stronger cybersecurity posture as supportive of long-term ecosystem stability.

RISK RADAR
Adoption risk is significant due to non-binding status. Compliance risk persists among smaller firms with limited capacity. Cyber threat evolution may outpace guideline implementation. Coordination risk exists between state frameworks and federal enforcement mechanisms.