Developing a Cyber Risk Management Framework for Nigerian Public Hospitals

Public hospitals in Nigeria manage sensitive patient data and life-critical systems without formal cyber risk management frameworks, creating significant risks for patient safety and health data integrity that require urgent professional attention. This study developed a cyber risk management framework for Nigerian public hospitals, contextualised for the operational environment of tertiary and general hospitals in the South South and South East zones. A professional framework development methodology was applied, drawing on a cyber risk assessment at five public hospitals across Rivers, Edo, and Anambra States, structured consultations with 16 hospital IT managers and 8 health information security specialists, and benchmarking against HIPAA Security Rule, NHS Digital Cyber Security Framework, and Nigeria Health Management Information System security standards. The risk assessment identified 38 distinct risk scenarios across five risk categories: data breach, ransomware, identity and access compromise, medical device security, and insider threat. The framework developed provides risk categorisation criteria, risk appetite definitions appropriate for public hospital contexts, control mapping for each risk category, residual risk tracking, and a board-level health cybersecurity governance template. Critical controls for immediate implementation are prioritised within the framework. Expert review by nine hospital management and security specialists confirmed the framework's clinical safety relevance and governance adequacy. The study recommends adoption by the Federal Ministry of Health as the mandatory cyber risk management standard for all federal tertiary hospitals.

Keywords: cyber risk management, public hospitals, health information security, Nigeria, patient data protection