Professional Review of Information Security Policy Adequacy at the Nigerian Communications Commission, Abuja

As Nigeria's primary telecommunications regulatory authority, the Nigerian Communications Commission handles highly sensitive industry data and regulatory communications, making the adequacy of its information security policy a matter of both institutional and national strategic significance. This study professionally reviews the adequacy of information security policies at the NCC, Abuja, against the ISO/IEC 27001 standard. A professional audit methodology was applied, combining document analysis of NCC publicly available ICT governance documents, cybersecurity compliance reports, and NITDA regulatory compliance submissions with a structured questionnaire survey of 75 NCC IT security personnel and senior management, selected through purposive sampling. Policy adequacy was assessed across twelve domains of the ISO 27001 Annex A controls framework: information security policies, organisation of information security, human resource security, access control, cryptography, physical security, operations security, communications security, supplier relationships, compliance, and information security incident management. Gap analysis identified control deficiencies relative to ISO 27001 requirements. Literature on information security in Nigerian regulatory agencies identifies access control management and third-party vendor risk oversight as the most consistently underdeveloped security policy domains. The ISO 27001 Framework and the NIST Cybersecurity Framework provide the professional reference standards. Findings reveal compliance gaps in vendor risk management and cryptographic key management as the highest-risk areas. Recommendations address ISO 27001 gap remediation roadmap, mandatory security awareness training, and annual external security audit requirements. Keywords: information security policy, ISO 27001, NCC, Abuja, cybersecurity.