Frameworks · Africa
The CBN framework asks for just-in-time privileged access and vendor access that is approved, time-limited, monitored and revoked. Aspian Cloud ties each to an approved change and proves when it ended.
- Instrument
- CBN Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks (BSD/DIR/PUB/LAB/017/008, 31 May 2024); Nigeria Data Protection Act 2023; NDPC Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025
- In force
- CBN framework issued 31 May 2024, implementation by 1 July 2024; replaces the October 2018 framework. NDPA signed June 2023. GAID issued 20 March 2025; one KPMG review says effective 19 September 2025 (unconfirmed)
- For
- Deposit money banks, payment service banks and organisations processing personal data in Nigeria.
| Clause | What it requires | Evidenced by |
|---|---|---|
| CBN Appendix III 1.2(b) and 1.2(d) | Privileged accounts need just-in-time access, session monitoring, password vaulting, least privilege and segregation of duties; privileged-user logs and audit trails must be kept and reviewed.Source: cbn.gov.ng | Just-in-time production access tied to an approved change, recorded sessions, and write-only secrets that nobody can read back. |
| CBN Appendix III 1.3(a)-(b) | Vendors get no unfettered access; senior management approves each vendor access request, limited to the needed segment and duration, monitored and revoked when done.Source: cbn.gov.ng | Supplier identities approved per engagement, expiring with it, and offboarding with a check that each removal took effect. |
| CBN 2.3, Appendix III 1.6(a)-(c), 1.9, and 5.0(v) | Third-party risk framework with audit rights; security across the SDLC, secure coding and testing of open-source code; patches tested and confirmed; cyber incidents reported to CBN within 24 hours.Source: cbn.gov.ng | Supplier engagements, policy packs across the development life cycle, and incident timelines. |
| NDPA ss.39, 40, 44; GAID Arts. 7 and 9-10 | Appropriate security measures (s.39); breach notice to NDPC within 72 hours (s.40); major-importance registration (s.44); annual compliance audit, with Compliance Audit Returns filed by 31 March for UHL/EHL entities.Source: templars-law.com | Residency reports from a Lagos or Abuja cell, and change records for the systems your compliance audit covers. |
Clause references and requirements were read on 8 November 2026 from the official text. Aspian Cloud evidences these clauses; it doesn’t make you compliant, and your assessor decides.
Want the mapping for a framework we don’t list? Ask us. A new framework is a data file, not a code change.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.