Developing a Ransomware Preparedness and Recovery Framework for Nigerian State Secondary Schools

The increasing digitalisation of student records, examination results, and administrative data in Nigerian state secondary schools has created ransomware exposure without commensurate preparedness, and a professionally designed framework addresses this protection gap for educational institutions. This study developed a ransomware preparedness and recovery framework for state secondary schools, drawing on current state of preparedness assessment across 40 schools in Ogun (SW), Benue (NC), and Adamawa (NE) States. A professional framework development methodology was applied, incorporating security infrastructure assessments at 10 schools per state, structured consultations with 12 state education ICT officers and 8 cybersecurity specialists, and benchmarking against UK Cyber Essentials for Schools, MS-ISAC K-12 Cyber Incident Response Guide, and NITDA SME cybersecurity guidelines. Assessment confirmed that 87.5 percent of schools lacked any backup policy, 75.0 percent had no antivirus on school computers, 95.0 percent had no incident response plan, and 100 percent had no staff ransomware awareness training. The framework developed specifies preventive controls (backup, patch management, endpoint protection, user training), detection mechanisms, containment and eradication procedures, recovery protocols for student and examination data, and school administration communication templates for parent and ministry notification. Expert review by nine school IT security and education technology specialists confirmed the framework's practical implementability within state government resource constraints. The study recommends the framework be adopted by all three state Ministries of Education and piloted in 15 schools across the three states.

Keywords: ransomware preparedness, secondary schools, recovery framework, Nigeria, school cybersecurity