Analytical Assessment of the Legal Basis for Cybersecurity Governance in Nigeria: The Cybercrimes Act, NITDA, and Emerging Institutional Frameworks

Nigeria's cybersecurity governance architecture spans the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, the NITDA Act, the Central Bank of Nigeria cybersecurity guidelines for financial institutions, and the emerging National Cybersecurity Policy and Strategy 2021, creating a fragmented multi-agency regulatory framework with overlapping mandates and unclear enforcement hierarchies. As cyber threats against critical national infrastructure, financial systems, and government networks intensify, the analytical adequacy of this legal framework warrants systematic examination. This study analytically assesses the legal basis for cybersecurity governance in Nigeria, examining the Cybercrimes Act's institutional design, the role of the Office of the National Security Adviser's Cybersecurity Division, NITDA's digital security mandate, and the National Cybersecurity Policy's normative framework. A doctrinal methodology is applied, reviewing the Cybercrimes Act 2015, the National Cybersecurity Policy 2021, CBN cybersecurity circulars, selected prosecutions under the Cybercrimes Act from 2016 to 2023, and comparative legal frameworks from Estonia and Singapore. The study evaluates coordination mechanisms, attribution standards for state-sponsored attacks, and critical infrastructure protection legal obligations. Available cybersecurity law literature from Nigeria identifies the absence of a Critical Infrastructure Protection Act and fragmented agency coordination as the most analytically significant regulatory gaps. The Cybersecurity Governance Theory and the Budapest Convention on Cybercrime Framework provide the normative reference. Findings recommend a Cybersecurity Governance Act and unified incident response coordination authority. Keywords: cybersecurity governance, Cybercrimes Act, Nigeria, critical infrastructure, cybersecurity law.