Developing an Original Theoretical Framework for Cyber Resilience in Critical National Infrastructure in Nigeria

Critical national infrastructure protection in Nigeria requires cyber resilience frameworks that account for the specific threat environment, institutional capabilities, and geopolitical context of a transitioning economy with diverse infrastructure ownership models. This study developed an original Cyber Resilience Framework for Critical National Infrastructure in Nigeria, drawing on theoretical analysis and empirical grounding across five infrastructure sectors. A multi-stage theory-building methodology was employed: systematic review of 78 cyber resilience frameworks from 2018 to 2024, empirical assessment of resilience capabilities across 20 critical infrastructure organisations in the energy, telecoms, banking, health, and government sectors through structured interviews with CISOs and security directors, and expert validation through a two-round Delphi consultation with 22 cybersecurity and infrastructure specialists. The systematic review confirmed that existing frameworks inadequately theorise the threat intelligence ecosystem dependencies of low-income economies, the hybrid state-private infrastructure ownership model, and the political economy of cybersecurity investment in Nigeria. The original Nigerian CNIR Framework proposes five resilience dimensions: anticipate (threat intelligence and vulnerability prediction), withstand (protective and detective controls), recover (incident response and continuity), adapt (learning and improvement), and coordinate (inter-sector and government-industry collaboration). Each dimension includes maturity indicators and implementation pathways adapted for public and private sector infrastructure owners. Expert consensus confirmed the framework's theoretical originality and operational utility. The study recommends NITDA adopt the framework as the national cyber resilience standard and develop sector-specific implementation guides for each CNIR dimension.

Keywords: cyber resilience, critical national infrastructure, Nigeria, theoretical framework, original contribution