Apply scaled cybersecurity actions for your business size and see Nigeria’s $500 million annual cybercrime loss.
The Lagos Cybersecurity Guidelines, released on April 19, 2026, are a voluntary framework that asks every business in Lagos to strengthen four areas: access controls, data protection, staff awareness, and risk management. They are not regulations on their own, but they reinforce existing federal laws, the Nigeria Data Protection Act 2023 and the Cybercrime Act, that do carry fines and prison terms.
The guidelines were officially released on April 19, 2026. They are effective from that date, but because they are not regulatory mandates, there is no formal grace period or registration deadline attached. Businesses are expected to begin reviewing and applying the recommendations immediately.
Nigeria loses an estimated $500 million every year to cybercrime, a figure cited by the National Information Technology Development Agency (NITDA) and referenced in the state's announcement. Lagos carries a large share of that exposure because it runs the country's biggest digital economy. Fintech, e-commerce, logistics, and public services all sit here, which makes the city a natural target for business email compromise, ransomware, and phishing.
Commissioner Omotoso put it plainly in the announcement: the same growth that turned Lagos into the continent's leading technology hub has also expanded its vulnerability to cyber threats. The guidelines are the state's formal response.
Three stakeholder groups are named in the document. Each gets guidance scaled to its size and context.
| Stakeholder group | Priority focus | Minimum action | Recommended action |
|---|---|---|---|
| Small and medium enterprises | Practical basics | Multi-factor authentication, password hygiene, regular backups | Quarterly staff training, written data inventory, basic incident response plan |
| Large corporations and multinationals | Formalised governance | Documented security policies, identity and access management, risk assessments | Dedicated security team, third-party audits, board-level reporting |
| Ministries, Departments, and Agencies (MDAs) | Public trust and citizen data | Formal access controls, encryption of citizen records, breach notification process | Cross-agency coordination, regular penetration testing, public transparency reports |
A five-person agency in Surulere is not expected to build the same security posture as a commercial bank. What matters is that both take the basics seriously.
Who has access to what, and how is that access managed? Weak access controls are still the most common way attackers get in. Turn on multi-factor authentication for every business email account and financial system. Remove access the moment someone leaves the team. Give each person only the permissions they need to do their job, no more.
For most Lagos businesses, the practical starting tools are free or low-cost: Google Workspace's built-in 2-Step Verification, Microsoft Authenticator, or a hardware key such as YubiKey for higher-risk accounts. Larger organisations should run a full identity and access management programme, with documented quarterly reviews.
This is where the Lagos guidelines and national law overlap most directly. The Nigeria Data Protection Act already requires organisations that process personal data to apply appropriate safeguards. The Lagos framework pushes you to formalise the process: classify your data, encrypt sensitive records, write down your retention rules, and know exactly how data moves in and out of your systems.
Most breaches start with a person, not a hacker. An employee clicks a link in a convincing email, enters their password on a fake login page, and the attacker is in. Regular training is the cheapest and most effective defence you can put in place. Run quarterly 45-minute sessions on phishing, password practices, and how to report suspicious activity. Free phishing simulation tools such as Hook Security and KnowBe4's free tier are good starting points for SMEs.
Risk management is about knowing what you are defending before you spend money defending it. The guidelines ask organisations to identify their most valuable digital assets, map the threats to those assets, and build a response plan before an incident happens. If your business has never completed a risk assessment, the first one will expose gaps you did not know existed.
Not sure where your gaps are? A free 30-minute technical audit will give you a clear list of priorities specific to your business.
The Lagos framework sits on top of three national instruments that already apply to your business. Here is how they compare.
| Instrument | Scope | Who enforces it | Penalties |
|---|---|---|---|
| Lagos Cybersecurity Guidelines (2026) | Voluntary cyber best practices for Lagos-based businesses and agencies | None directly | None directly |
| Nigeria Data Protection Act (2023) and GAID (Sept 2025) | Mandatory rules for processing personal data | Nigeria Data Protection Commission (NDPC) | Up to ₦10 million or 2% of annual gross revenue, whichever is higher, for major data controllers |
| Cybercrime Act (as amended in 2024) | Criminal offences such as unauthorised access, identity theft, attacks on critical infrastructure | Police, EFCC, courts | Fines and prison sentences depending on the offence |
| National Cybersecurity Policy and Strategy (2021) | Federal cybersecurity priorities across sectors | Office of the National Security Adviser | None directly, sets policy direction |
The NDPA has real teeth. The Nigeria Data Protection Commission has already fined Multichoice Nigeria ₦766.2 million and Meta Platforms $220 million for violations. If you already meet your NDPA obligations, you are partway to meeting the Lagos guidelines too.
Not directly. The document itself states the recommendations are practical tools rather than regulatory mandates. There is no Lagos-specific penalty for ignoring them.
That does not mean you can safely skip them. Three reasons compliance is still worth the effort.
First, if you are ever investigated under the NDPA or the Cybercrime Act, documented alignment with the Lagos guidelines gives you something concrete to show. Businesses that have not tried at all have no cover.
Second, commercial pressure is already here. Investors, enterprise clients, and international partners increasingly ask for proof of cybersecurity practices before they sign a contract. A state-endorsed framework gives you a clean baseline to cite.
Third, the guidelines will be updated as threats change. Starting now means your next review will be a 30-minute check, not a six-month project.
For a small business with fewer than 20 staff, baseline compliance can usually be reached for between ₦150,000 and ₦500,000 in the first year. That covers a basic technical audit, multi-factor authentication setup, secure backup configuration, an SSL certificate, a written privacy policy, and one round of staff training.
For a mid-sized company with 20 to 100 staff, expect ₦800,000 to ₦3,000,000 in the first year. The extra cost goes into formal access management, encrypted backups, vendor reviews, and quarterly training.
For larger enterprises and regulated sectors such as fintech and healthcare, costs run from ₦5,000,000 upwards, depending on existing infrastructure, the appointment of a Data Protection Officer, and the scope of audits required.
Year-two costs are typically 40 to 60 percent of year one, since the heaviest work happens upfront.
You do not need a six-month project to take this seriously. Here is what a realistic first month looks like.
Week 1: See where you stand. Read the guidelines at lagosstate.gov.ng/cybersecguide. List every system that holds customer or staff data, including your website, email, accounting tool, and CRM. Note who has access to each.
Week 2: Close the obvious gaps. Turn on multi-factor authentication everywhere. Reset shared passwords. Remove old user accounts. Confirm that your website has a valid SSL certificate. Take a full backup and test that the restore actually works.
Week 3: Train your team. Run a 45-minute session on phishing, safe password practices, and what to do if something looks wrong. Send a simulated phishing email a week later to see who clicks. The point is not to punish; it is to identify who needs more support.
Week 4: Write it down. Document your data inventory, your incident response steps, and your backup schedule. A two-page document is enough to start. The goal is something you can show an investor, a client, or a regulator.
By the end of the month, you will not be perfectly secure. No business is. But you will be measurably ahead of where you started, with documented evidence of reasonable practice.
Nexoris Technologies is a Lagos-based digital studio that builds and maintains websites, apps, and custom software for Nigerian businesses. As part of our web development and custom software solutions, we already handle SSL, daily backups, and security monitoring for our clients. For businesses that want a structured starting point, we run technical audits that map current practices against both the Lagos Guidelines and NDPA requirements.
Ready to get started? Request a free technical audit or get a proposal for a complete review of your website and infrastructure.
Chinedu Nwogu is the Founder and CEO of Nexoris Technologies and an SEO, GEO and AEO specialist with expertise in software and digital products. His background in digital product development and cybersecurity alignment makes him well placed to explain the practical steps businesses must take under the Lagos Cybersecurity Guidelines 2026.
Chinedu Nwogu is a fact-checker with 7 years of expertise as the Founder and CEO of Nexoris Technologies, specialising in SEO, GEO and AEO, software and digital products. His background in digital security and product development directly informs his analysis of the Lagos Cybersecurity Guidelines 2026 and their implications for businesses.
Decide whether to invest in pre-built systems like SAP or a custom solution built by Nexoris Technologies. This guide compares setup costs ranging from 500,000 to 40 million Naira to help you choose the right path for your business growth.
Chinedu NwoguKey Facts at a Glance SaaS HMS: ₦150K to ₦5M+ per year. Custom build: ₦4M to ₦25M. Annual maintenance: 15 to 20% of build cost. Payback period: 18 to 30 months.
Chinedu Nwogu
