Professional Evaluation of Cybersecurity Incident Response Capabilities in Nigerian State Government Institutions: Evidence from Osun State

State government institutions in Nigeria handle significant volumes of citizen data and manage critical administrative systems, yet their cybersecurity incident response capabilities are rarely subject to independent professional evaluation. This study professionally evaluates the cybersecurity incident response capabilities of selected state government institutions in Osun State, South West Nigeria. A structured capability assessment methodology aligned with the NIST Cybersecurity Framework was applied across five Osun State ministries and two parastatals, involving document analysis of incident response plans, security audit reports, and NITDA compliance documents combined with structured interviews of 35 IT security officers and management representatives. Capability dimensions assessed include incident detection mechanisms, containment procedures, eradication and recovery protocols, post-incident analysis quality, communication procedures, and training currency. Descriptive and gap analysis were applied. Available incident response literature from Nigerian state government contexts identifies absence of dedicated security operations centre capacity and inconsistent staff cybersecurity awareness training as the most prevalent institutional capability gaps. The NIST Cybersecurity Framework Five Functions and the SANS Incident Response Process provide the professional evaluation standards. Findings reveal that detection and response capabilities are significantly less developed than identification and protection functions across all assessed institutions. Recommendations include Osun State central government CSIRT establishment, mandatory annual staff cybersecurity awareness training, and NITDA-supported incident response plan development across all agencies. Keywords: cybersecurity incident response, state government, Osun State, NIST framework, South West Nigeria.