Developing a Cybersecurity Incident Response Plan for Nigerian Fintech Companies

Nigerian fintech companies operate in a high-threat financial cybercrime environment and are subject to CBN cybersecurity requirements, yet many lack professionally designed incident response plans that enable structured, rapid response to security breaches. This study developed a cybersecurity incident response plan template for Nigerian fintech companies, contextualised for Lagos-based fintech operators as the primary regulatory environment under CBN and NITDA oversight. A professional plan development methodology was applied, drawing on review of CBN Cybersecurity Framework for Payment Service Providers, ISO/IEC 27035 incident management standards, and structured consultations with 12 fintech security managers and 6 regulatory compliance officers. Assessment of current incident response maturity across eight fintech companies confirmed that only two had formal incident response plans, average detection-to-containment time exceeded 48 hours, and CBN 24-hour breach notification compliance was met by only 37.5 percent of assessed incidents. The plan developed covers six phases: preparation, identification, containment, eradication, recovery, and post-incident review. Specific provisions for fintech contexts include mobile payment incident escalation trees, customer notification templates, regulatory filing procedures, and media response guidelines. Expert review by eight fintech security and regulatory specialists confirmed the plan's CBN compliance alignment. The study recommends the plan template be made available through the Fintech Association of Nigeria and that CBN mandate biannual incident response simulation exercises for all licensed fintech operators.

Keywords: incident response plan, fintech companies, CBN cybersecurity framework, Lagos, breach notification