Cybersecurity Checklist for Nigerian SMEs Under NDPA

SMEs Are Targets, Not Too Small to Matter

Nigerian small and medium enterprises often assume attackers focus only on banks and telcos. In practice, SMEs hold customer phone numbers, bank details, payroll files, and email credentials valuable for fraud chains. Weak passwords, unpatched laptops, and informal WhatsApp data sharing create entry points ransomware groups and business email compromise scammers exploit daily.

The Nigeria Data Protection Act (NDPA) raises the stakes: processing personal data carries duties around security, breach notification, and accountability. Cybersecurity and NDPA compliance overlap heavily for SMEs. This checklist prioritises controls that reduce real risk without enterprise budgets.

Use it with cybersecurity services when you need hands-on remediation or policy drafting reviewed by legal counsel.

1. Know Your Data

Data Inventory

List systems holding personal data: CRM, HR spreadsheets, website forms, POS, email, backup drives. Note data categories (contact info, financial, health if applicable) and who accesses each.

Lawful Basis and Notices

Ensure privacy policies explain why you collect data, retention periods, and contact for data subject requests. Forms should not pre-tick marketing consent.

Minimisation

Collect only fields you use. Extra data increases breach impact and NDPA scrutiny.

2. Access Control and Identity

• Enforce MFA on email, cloud admin, and financial systems.
• Unique accounts per employee; ban shared info@ passwords for admin consoles.
• Remove access same day staff depart.
• Privileged admin accounts separate from daily browsing accounts.
• Role-based access in apps; finance should not browse full customer database by default.

3. Endpoint and Device Security

• Full-disk encryption on laptops and phones holding work data.
• Automatic OS and browser updates enabled.
• Screen lock with short timeout.
• MDM for company devices where affordable.
• Policy prohibiting storage of sensitive exports on personal WhatsApp without approval.

4. Email and Phishing Defences

Business email compromise targets Nigerian finance teams with fake vendor bank changes.

• SPF, DKIM, DMARC configured on your domain.
• Finance staff trained to verify payment detail changes via known phone numbers, not reply email threads.
• External email banners warning on messages from outside organisation.
• Report-phish button or clear reporting channel to IT or consultant.

5. Backup and Recovery

• Automated backups for critical data (accounting, CRM, custom app databases).
• Offsite or immutable copy protected from ransomware encryption of primary backups.
• Quarterly restore test documented with date and result.
• Backup access restricted and logged.

Operational platforms like DawaHQ handling health data demand stricter backup and access policies than brochure websites.

6. Application and Website Security

• HTTPS everywhere; no mixed content.
• Patch CMS plugins and dependencies promptly.
• WAF or rate limiting on public forms to reduce spam and credential stuffing.
• Secure coding practices for custom apps: input validation, parameterized queries, secrets not in Git repos.
• Separate staging from production; no real customer data in dev without masking.

Coordinate with your web development partner on security acceptance criteria before launch.

7. Vendor and Subprocessor Management

SaaS tools process data on your behalf. Maintain register of vendors, their data locations, and whether DPAs signed. Review annually.

Questions for vendors:

• Where is data hosted?
• Do they notify you of breaches?
• Can you export and delete data on contract exit?

Payment gateways, email providers, and cloud hosts belong on this register.

8. Logging and Monitoring

Minimum viable monitoring for SMEs:

• Failed login alerts on cloud consoles.
• Antivirus or EDR alerts reviewed weekly.
• Uptime monitoring on customer-facing sites.
• Forward logs where budget allows; at least retain auth logs 90 days.

9. Incident Response Basics

Prepare one-page plan:

• Who declares incident (name, backup)?
• Contact list: hosting provider, legal counsel, PR if customer-facing breach.
• Steps: contain (disable compromised accounts), assess scope, preserve logs, notify NDPC and data subjects when thresholds met (legal advice required for specifics).
• Template customer communication holding facts until confirmed.

Run tabletop exercise annually. Panic without plan worsens NDPA exposure.

10. Staff Training and Culture

• Onboarding security module (15 minutes acceptable if repeated quarterly).
• Clear rules on password sharing, USB use, and working from cybercafés on sensitive tasks.
• Reward reporting of suspicious messages.

Executives must follow same rules; phishing targets CFOs specifically.

11. Physical and Environmental

• Lock server closets and restrict keys.
• UPS for on-prem equipment where power unstable.
• Clean desk policy for printed customer lists.
• Secure disposal of old drives and paper files.

12. NDPA Documentation Trail

Maintain evidence regulators or enterprise clients may request:

• Records of processing activities (ROPA lite version acceptable for SMEs).
• Training attendance logs.
• Risk assessments for high-risk processing (children's data, large-scale health data).
• Data processing agreements with vendors.
• Breach register even if empty.

Consult qualified legal professionals for binding interpretations; this checklist is operational, not legal advice.

Prioritised 30-Day Sprint for Resource-Tight SMEs

Week 1: MFA everywhere, password manager rollout, disable ex-staff accounts. Week 2: Backup verification and restore test; patch critical systems. Week 3: SPF/DKIM/DMARC; phishing training for finance. Week 4: Vendor inventory and privacy policy update on website.

When to Escalate to Professional Assessment

Engage specialists before handling health, financial, or large-scale consumer data at scale, before enterprise RFP security questionnaires, or after any suspected breach.

Our team provides cybersecurity assessments aligned to SME budgets and connects findings to cloud hardening where needed.

Conclusion

Cybersecurity for Nigerian SMEs under NDPA is achievable through consistent basics: identity control, backups, vendor discipline, and incident preparedness. Perfection is not the goal; documented improvement is.

For a baseline assessment and prioritised remediation plan, contact Techzoid Innovation. We focus on controls that reduce your real exposure first.