Professional Assessment of Cybersecurity Maturity in Nigerian Electricity Distribution Companies

Electricity distribution companies in Nigeria operate critical infrastructure with increasing OT-IT integration, and their cybersecurity maturity level determines the resilience of Nigeria's power sector against cyber-physical attacks. This study professionally assessed the cybersecurity maturity of three Nigerian electricity distribution companies: Eko DisCo (Lagos, SW), Enugu DisCo (SE), and Kano DisCo (NW). A maturity assessment methodology based on the Electricity Information Sharing and Analysis Centre ES-C2M2 framework was applied through structured interviews with 15 DisCo IT and OT security personnel per company, documentation reviews, and technology stack assessments. Assessment dimensions covered OT cybersecurity management, IT-OT network separation, vulnerability management, incident response, supply chain security, and workforce cybersecurity competency. Results showed average maturity scores of 1.8 (Eko), 1.4 (Enugu), and 1.2 (Kano) out of 3.0 on the ES-C2M2 scale, indicating early-stage maturity across all three. OT-specific cybersecurity management was the weakest domain across all companies (mean 0.9). IT-OT network separation was adequate in only 33.3 percent of assessed systems. The study concludes that DisCo cybersecurity maturity is critically below the level required for essential service protection and recommends NERC mandate a minimum ES-C2M2 maturity level of 2.0 within 24 months, accompanied by a federal technical assistance programme for DisCo OT security improvement.

Keywords: cybersecurity maturity, electricity distribution companies, ES-C2M2, OT security, critical infrastructure Nigeria