Developing a Cloud Security Governance Framework for Nigerian Universities

Nigerian universities are adopting cloud platforms for learning management, research collaboration, and administrative services without adequate cloud security governance, creating risks for institutional data, research integrity, and regulatory compliance. This study developed a cloud security governance framework for Nigerian universities, drawing on the cloud adoption landscape and security assessment of five universities across the South West, South East, and North Central zones. A professional framework development methodology was applied, incorporating a cloud security posture assessment at each university using the Cloud Security Alliance CCM control framework, structured consultations with 15 university IT directors and 8 cloud security specialists, and review of NUC information security guidelines and relevant NDPA cloud data processing requirements. Assessment confirmed that cloud deployment without formal data classification was present in all five institutions, multi-cloud environments lacked unified governance in 80.0 percent, and vendor due diligence was absent in 60.0 percent of cloud procurement decisions. The framework developed provides governance structures for cloud risk management, vendor assessment criteria, data classification and sovereignty requirements, identity and access management standards, and cloud incident response integration. Expert review by nine university IT governance and cloud security specialists confirmed the framework's institutional applicability. The study recommends adoption by NUC as part of a university ICT governance standard and that TETFund incentivise cloud security compliance through grant eligibility criteria for research computing funding.

Keywords: cloud security governance, Nigerian universities, CCM framework, data sovereignty, cloud risk management