E-Business
Taking Enterprise Security to the Board
It’s that time of year, again, with many companies busying themselves in the art of budgeting and forecasting for 2018.
In some companies, this means the Chief Information Security Officer (CISO) having to communicate the importance of including enterprise security in this planning, using a language that the members of the board will understand.
“For some, this will mean being given a short amount of time to make sure a group of non-technical people understand the company’s business risks and believe that your plan to mitigate them is comprehensive, necessary and worthy of investment,” said Anton Jacobsz, managing director at Networks Unlimited.
“The keyword here is ‘business’ – we have got to translate our on-the-ground security concerns into business terms, risks and outcomes. We’re all very good at listing statistics but the ability to translate this into business outcomes, which is the language your board understands, is what will win the day.
“Your board’s time, attention span and ability to consume ‘geek speak’ is limited, but there are steps you can take to ensure the time you spend with them matters,” Jacobsz explained.
Time for a few home truths
Is your exco one of the many that thinks their organisation is not going to be of interest to cyber criminals? If yes, then it may be time to explain clearly that every single organisation, regardless of size or business focus, is likely to experience a cyber security breach at one point or another. The reason for this is data.
If your business processes payments of any kind, for example salaries or online payments, or if you transmit or store records, or if you’re developing a cure for a dread disease like cancer, then you have information that a hacker can sell.
Ryan Kearney, Executive Vice President of Product Development and Chief Technology Officer of F5 Networks, advised that telling a compelling story about a security breach, preferably in your industry or locale, will help board members understand the risks here.
“Give examples from your own company. Identify critical information assets – intellectual property, sensitive customer data – and paint a picture of what would happen and what it would cost if they were compromised,” he said.
Use statistics to convince, not just frighten
There are ways to move the statistics conversation from one that leaves exco with a feeling of dread to one where they truly understanding the real potential impact to the enterprise.
F5’s Kearney says the following types of statistics could be used to educate and surprise board members:
- 73 percent of companies suffered at least one security breach in the past year.
- About a third of employees targeted for phishing will open fraudulent e-mails.
- More than one in 10 take the bait – and it only takes one.
- Less than two minutes can elapse from the hacker hitting send to your systems being compromised.
- Hackers are inside your organisation, on average, for at least four months before they’re discovered.
- Web apps are the number one entry point for breaches.
“As the C-suite leader in charge of cyber defence, it is up to the CISO to explain the impact of this to the board,” says Jacobsz. “This is the point where you should be talking in terms of tangible and intangible losses, which are sure to resonate with them.”
Tangible costs as a result of security breaches include fines as a result of breaks in customer SLAs, revenue losses due to downtime, compliance/audit fines, potential legal fees and incident response costs, which incorporate unplanned costs for hiring third party breach experts.
Less immediately obvious damage could include issues like the impact a breach could have on your company’s brand; existing and potential customer perception/loss; the loss of your competitive advantage and even the potential for the board’s personal reputation being affected.
Introduce security awareness to the company culture
If you talk of such things around the braai, you might have heard somebody complaining about how their company doesn’t allow Dropbox or Wetransfers – how archaic, right? Wrong, said Jacobsz.
“These policies are enforced because someone, somewhere along the lines, opened a mail, clicked on a Dropbox link and downloaded a file from an unknown, untrusted source resulting in a cyber security breach. But this can be avoided. A secure business is one where everyone is educated about threats and does their part to reduce risk.”
F5’s Kearney agreed, saying it starts with rigorous and repeated training and continues with individual buy in.
Furthermore, as a key participant in creating the company culture at the outset, the board members themselves must also be challenged to champion efforts that have no received budget approval, he said.
“You have done your homework and secured funds for some of your efforts but if you have risk areas that need addressing but have no budget allocation, board members need to know this and either accept the risk or champion a solution. There’s no better way to get something accomplished than by saying the board requested it get done.”
Discuss incident response and cyber insurance
As mentioned earlier, the likelihood of organisations remaining untouched by security breaches is minimal. Being prepared is the best line of defence, and employing the services of a good incident response firm is the first step.
The second is considering options in cyber insurance, which is the fastest growing insurance in the world and is projected to grow by 300 percent from $2.5 billion today in annual premiums by 2020. Here, show your work and do the maths for your board – calculate how much your business can absorb and insure the rest.
“Use your board-facing time wisely,” said Jacobsz.
“Make sure you prioritise and focus on the top cyber risks bringing solutions to the table. Above all, demonstrate your burning issues in small, easy to digest chunks. Do this and you and your boards will soon be singing in harmony and protecting the company at the same time.”
Uche Chigbo, coordinating director of Operations, National Identity Management Commission, (NIMC), has said the newly enacted NIMC Act strengthens data protection and privacy, expands identity coverage to include everyone in Nigeria and Nigerians in the diaspora, and provides the legal framework for a secure and trusted digital identity ecosystem.
She said the new law replaces the 2007 NIMC Act, which had become outdated due to rapid technological advancements, evolving cybersecurity threats, the growth of the digital economy, and the enactment of the Nigeria Data Protection Act.
According to her, the updated legislation better positions the Commission to deliver Nigeria’s digital identity agenda and improve access to government and private sector services.
“The Act itself has taken in a whole lot of things to make sure that NIMC is well-positioned to be able to deliver on the identity agenda and program of Nigeria. The area of universal coverage was expanded within the Act so that NIMC can enroll everybody that is within the soil of Nigeria—male, female, children, whether they are IDPs or orphans or whatever it is, and even Nigerians in diaspora.
“There is quite a lot within the Act that over the few days and weeks, even with my Director-General’s courtesy visit, we are trying to sensitize and educate the general public, and also bring awareness to this new Act so that people will know what are the rights that exist within it, what are the obligations, what are the stronger enforcement and penalties that has also been expanded within the Act, and then what are also the regulatory autonomy that has been given to NIMC to make sure that they drive the digital identity ecosystem in Nigeria,” she explained.
“There’s a lot of provisions and changes with the new Act. Um, the NIMC 2007 Act has been operating for close to 19 years now. So, we can see that, um, you can actually say it’s almost obsolete. And then with a lot of technological advancements in the world now, with the enactment of the Nigeria Data Protection Act, and then with also a lot of evolving security challenges, cybersecurity challenges, as well as the ever-growing digital economy, it became very necessary that a comprehensive review of the NIMC Act should be done.
So, that 2007 Act has been repealed and a new NIMC 2026 Act is in place,” she explained.
Chigbo clarified that the National Identification Number (NIN) is Nigeria’s unique identifier and the only valid means of identification for accessing government services.
She added that it enables secure identity verification and improves access to services.
“NIN has been designated as the unique identifier in Nigeria and then by the government of Nigeria establishing it as the only valid means of identification for assessing government services. So, NIN, it’s positioned to be a valuable tool for empowering citizens and legal residents to facilitate access to service delivery in Nigeria. And it’s also a tool for people to be able to prove their identity as they go about their daily businesses,” she said.
Speaking on identity harmonisation across government agencies, Chigbo said NIMC is integrating identity databases to enable Nigerians to access services seamlessly using the National Identification Number (NIN), while other agencies continue to issue functional identities for specific purposes.
“There’s a distinction between a foundational identity and a functional identity. NIMC provides the foundational identity, which answers the question, ‘Who are you?’ Are you a Nigerian or a legal resident? Who are you? That’s what NIMC is providing. All these other agencies that you have mentioned, they provide functional ID, which is an ID that relies on the foundational ID, where they have established who you are and then they are now trying to answer the question, ‘Are you now eligible to have these services? Are you now eligible to benefit from this transaction or scheme?’ So, those are two different distinctions.”
However, Chigbo said NIMC’s mandate is to harmonise and integrate identity systems across government, with the amended Act designating the Commission as the sole repository for biometric data.
“However, NIMC mandate is to make sure that we harmonize and integrate with all these agencies so that you’re one and the same person in any of the databases or registries that you have. The Act that has been expanded and amended also positions NIMC as the only repository for biometric data capture so that we can have effective identity management and coordination in Nigeria.
“So, that harmonization is already happening, the integration is already happening,” she stated.
She also disclosed that NIMC has introduced an online modification portal that allows Nigerians to begin the process of correcting or updating their personal information from the comfort of their homes or offices.
“But also, NIMC we have a modification portal that enables you to sit in the comfort of your home or office to be able to start the process of correction or updates of your data. We already have a self-service modification portal that allows you to make corrections,” she disclosed.
On the cost of obtaining a NIN, Chigbo clarified that enrolment and issuance of the National Identification Number are free.
She, however, noted that some other identity-related services attract approved fees, which are published on the NIMC website and paid electronically through the government Remita platform.
“Enrollment for the issuance of the National Identification Number, NIN, is free. There are other services, identity services that NIMC provide. Those ones have their charges, and those fees and charges are publicized on the NIMC website so that people can see what those charges are. And NIMC does not collect cash. Our transactions and the charges are paid electronically through the government Remita platform,” she said.
Nigeria’s data protection industry has grown into a N16.3 billion ecosystem within three years of formal regulation, according to the Nigeria Data Protection Commission (NDPC).
Olufemi Ibitayo, head of Finance Management and Control, NDPC, announced the milestone at the Regional Data Governance Exchange in Nairobi, Kenya, where he represented Dr Vincent Olatunji, national commissioner and chief executive officer, NDPC.
Presenting Nigeria’s progress, Ibitayo said the country’s strong regulatory framework and the establishment of an independent data protection authority have strengthened confidence in the digital economy and enhanced Nigeria’s reputation as a destination for foreign investment.
The Regional Data Governance Exchange, organised by the Data Governance in Africa Initiative and hosted by the Office of the Data Protection Commissioner in Nairobi, brought together African data protection authorities to strengthen institutional capacity, deepen collaboration and promote peer learning on data governance. Photo: NDPC
He said the Commission’s “Compliance First, Not Punishment” approach encourages organisations to meet their obligations through dialogue and voluntary compliance, while ensuring effective regulatory oversight.
Ibitayo added that the NDPC is developing regulatory technology solutions, a regulatory sandbox and a data privacy innovation laboratory to further strengthen Nigeria’s data governance ecosystem and support future growth.
United Nations Commission on International Trade Law (UNCITRAL)
The ongoing UNCITRAL session has brought together delegates from Nigeria, Australia, China, Ghana, France, the United States and other member states to develop harmonised legal frameworks aimed at facilitating secure, trusted and efficient cross-border digital commerce. Photo: NDPC
Meanwhile, Olatunji reaffirmed Nigeria’s commitment to global data governance during a meeting with Nigeria’s Permanent Representative to the United Nations, Ambassador Jimoh Ibrahim.
He made the remark on the sidelines of the ongoing United Nations Commission on International Trade Law (UNCITRAL), where Nigeria is participating alongside delegates from several member states to advance harmonised legal frameworks for secure and trusted cross-border digital commerce.
The NDPC boss highlighted the Commission’s achievements since its establishment, noting that strategic institutional reforms have positioned Nigeria as a leading voice in the global data protection ecosystem.
He said the country’s data protection framework has continued to earn international recognition, adding that the Commission remains committed to promoting trusted data governance as a driver of digital transformation, economic growth, innovation and sustainable development in line with the Renewed Hope Agenda of President Bola Ahmed Tinubu.
During the meeting, Ambassador Ibrahim commended the Commission’s progress since the enactment of the Nigeria Data Protection Act 2023 and called for the establishment of a comprehensive national data bank to support evidence-based policymaking, research and national development.
National Identity Management Commission (NIMC) has said thet more than 136 million Nigerians and legal residents have been enrolled in the National Identity Database (NIDB).
In a statement on Tuesday, Kayode Adegoke, head of corporate communications, NIMC, said Abisoye Coker-Odusote, chief executive officer (CEO) of the commission, announced the milestone during a courtesy visit to the ministry of budget and economic planning.
In April 2025, NIMC said over 117.36 million Nigerians had been enrolled as of February 28, 2025.
The visit was part of the commission’s ongoing stakeholder engagements with ministries, departments and agencies (MDAs) on the implementation of the NIMC Act 2026.
Presenting the new Act, Coker-Odusote said the legislation repeals and replaces the 2007 NIMC Act, modernising Nigeria’s digital identity ecosystem by positioning the national identification number (NIN) as the country’s foundational identity under the “one person, one identity” policy.
She said the law also establishes NIMC as the root certificate authority for the national digital infrastructure and introduces stronger data protection and cybersecurity measures, as well as digital credentials.
“The Federal Government remains committed to enrolling and issuing NINs to all Nigerians and legal residents within the shortest possible time,” Coker-Odusote said.
She added that NIMC is ready to collaborate with the ministry of budget and economic planning to leverage the NIN for economic planning and national development initiatives.
Speaking during the visit, Abubakar Atiku Bagudu, the minister of budget and economic planning, reaffirmed the federal government’s commitment to the implementation of the NIMC Act 2026.
Bagudu described the legislation as “a transformative milestone” that would strengthen Nigeria’s digital identity ecosystem and accelerate national planning and development.
He commended the NIMC director-general and the commission’s leadership for their efforts in securing the passage of the legislation, noting that it provides “a solid legal foundation for a trusted, secure, and inclusive national identity management system”.
The minister, however, said the true measure of the Act’s success would lie in its implementation and the benefits it delivers to Nigerians.
“The true measure of the Act’s success will lie in its effective implementation and the tangible benefits delivered to citizens,” he said.
Bagudu also called for stronger collaboration across the federal, state and local governments to build public confidence in the national identity system and eliminate the duplication of identity databases across government institutions.
He said the NIN should serve as Nigeria’s single, universally accepted identity standard, supporting efficient service delivery and good governance.
On June 26, President Bola Tinubu signed the NIMC Act 2026 into law, repealing the commission’s 2007 establishing Act.
At the time, Olubunmi Tunji-Ojo, minister of interior, said the legislation would strengthen Nigeria’s legal framework for digital identity management, cybersecurity and secure digital authentication, while reinforcing the NIN as the country’s foundational identity credential under the “one person, one identity” principle.
Court Adjourns Alleged Binance Tax Evasion Case over Settlement Talks
Fixed Wired Internet Market Lags as Mobile Gains Ground
Xenophobic Attacks: OYC Threatens to Picket MTN Nigeria Offices
New NIMC Act Strengthens Data Protection, Privacy – Director
BON Establishes Six Ad Hoc Committees to Modernize Broadcasting
NASENI Moves to Digitize CCB’s 5m Assets Declaration and Operations
Mobile Internet Gender Gap Widest in Africa – GSMA
Nigeria Launches FreeTV Nationwide
CANAL+ Partners Samsung to Pre-Load DStv Stream on New Samsung TVs In Nigeria, Other African Countries
Lebara Nigeria Launches Lebara Play, Africa’s First Telecom-Owned Micro-Drama Platform
News2 days agoNRC, Ponzi Scheme Collapses Resulting Loss of Billions of Naira
News2 days agoNSITF Partners South African Insurer on Digital Transformation
E-Financial2 days agoFCT-IRS Unveils New Digital Platform, Taxporta
General News2 days agoKPMG Urges Africa’s Most Innovative Tech Entrepreneurs to Enter the Global Tech Innovator 2026 Competition
E-Business2 days agoFG Suspends New Internet Regulations to Prevent Overlapping Rules
E-Business2 days agoNIN Enrollment Hits over 136m as New ID Law Takes Effect
E-Business2 days agoPlateau PCC Collects Nigerians’ Data without Privacy Policy – FIJ
General News2 days agoCourt Declares ARCON’s N60Bn Fine against Facebook Nigeria Illegal