How African Governments Can Prepare for Cyber Incidents

Cyber incident preparedness for African governments is no longer optional. The question is not whether government systems will be attacked—it is when, by whom, and with what consequences. Governments that have prepared systematically will manage incidents as contained problems. Those that have not will experience them as organisational crises that damage public services, erode citizen trust, and generate media and political fallout that lasts far longer than the technical incident itself.

The Components of Cyber Incident Preparedness

A Documented Incident Response Plan

Every government agency with significant digital infrastructure needs a written incident response plan: who is responsible for what, in what sequence, when a cyber incident is suspected or confirmed. The plan should cover detection and initial assessment, containment measures, evidence preservation, stakeholder notification (internal, regulatory, public), service restoration, and post-incident review. The plan must be reviewed and updated at least annually and after any significant infrastructure change.

Established Communication Protocols

One of the costliest failures in cyber incident response is communication breakdown—agencies that do not know who to call, what to tell the public, or how to coordinate with law enforcement and regulators. Establishing communication protocols in advance—including pre-approved messaging templates for citizen notification—dramatically reduces the chaos of real incident response.

Pre-Established Partner Relationships

During a cyber incident is not the time to introduce yourself to the Nigeria Police Force Cybercrime Unit, the Computer Emergency Response Team (ngCERT), or your cloud provider’s security team. These relationships should be established, tested, and documented before incidents occur. Pre-authorised engagement arrangements—where external forensics or response support can be activated quickly without lengthy procurement—are a valuable preparedness investment.

Regular Tabletop Exercises

Tabletop exercises simulate a cyber incident in a safe environment, walking leadership and technical teams through the decisions and communications that a real incident would require. These exercises reveal gaps in plans, identify decision-making bottlenecks, and build the muscle memory that makes real incident response faster and more effective. Annual exercises are a minimum; semi-annual exercises for high-risk systems are strongly advisable.

Leadership Briefing and Empowerment

Cyber incidents require rapid decisions from senior officials: whether to take systems offline (disrupting service but limiting damage), what to communicate publicly and when, whether to engage law enforcement, and how to allocate emergency response resources. Leaders who have been briefed on these decisions in advance and empowered to make them quickly—without extended approval chains—will respond far more effectively than those encountering these choices for the first time during an incident.

Key Takeaways

• Preparedness determines outcomes far more than response quality during an incident—invest before incidents occur, not after.
• A written, tested, regularly updated incident response plan is the foundational preparedness requirement.
• Pre-established relationships with law enforcement, regulators, and technical partners enable faster, more effective response.
• Tabletop exercises build decision-making muscle memory that makes real incident response faster and less chaotic.
• Leadership briefing and pre-authorised decision frameworks remove the approval bottlenecks that slow real-time incident response.

Frequently Asked Questions

What is ngCERT and how should Nigerian government agencies engage with it?

ngCERT—Nigeria’s National Computer Emergency Response Team—provides cybersecurity incident response support and coordination for Nigerian government and critical infrastructure. Government agencies should register with ngCERT, establish a point of contact, and understand the reporting requirements and support that ngCERT provides before an incident makes this knowledge urgent.

How quickly should government agencies notify citizens about a data breach?

Nigeria’s Data Protection Act 2023 requires notification to the NDPB within 72 hours of becoming aware of a breach that poses risk to individuals’ rights and freedoms. Citizen notification should follow as soon as the agency has reliable information about the nature and scope of the breach—early, honest communication significantly reduces long-term reputational damage compared to delayed disclosure.

About the Author

Suleiman Isah is the Director General of NSITDEA and an information security professional with expertise in government cyber resilience. Read more.

Related: Cybersecurity and Digital Trust | Current State of Cybersecurity in Nigeria