CYBERSECURITY GOVERNANCE AND THE PROTECTION OF CRITICAL DATA INFRASTRUCTURE IN NIGERIA: A POLICY ANALYSIS OF INSTITUTIONAL CAPACITY AND REGIONAL HARMONIZATION

Abstract

Nigeria's digital economy has expanded faster than the regulatory apparatus built to secure it. This study examines how Nigeria's legal-institutional architecture for cyber-security coordinates across agencies, aligns with regional and continental instruments, and compares with peer states in West Africa and the wider continent. Institutional isomorphism and policy diffusion theory jointly frame the analysis, explaining why states converge on similar cyber-security structures under coercive, mimetic, and normative pressures, and why implementation nonetheless varies with domestic institutional capacity. The study adopts a qualitative, comparative, desk-based design, applying content analysis to primary legal instruments alongside secondary institutional and scholarly data. Three findings emerge; First, Nigeria's cyber-security architecture is legally dense but organizationally dispersed across at least six institutions, with coordination between them left to informal collaboration rather than binding protocols. Second, domestic instruments draw on globally recognized principles, yet Nigeria has not ratified the African Union's Malabo Convention, and sub-regional harmonization through ECOWAS stays underdeveloped. Third, the Global Cyber-security Index 2024 places Nigeria in Tier 3, combining near-maximum legal scores with persistent weakness in capacity building and cooperation relative to regional leaders such as Mauritius, Rwanda, Kenya, Ghana, and Tanzania. Nigeria's institutional fragmentation, rather than a shortage of legislation, accounts for this gap. The study recommends consolidating institutional coordination, ratifying continental instruments, and prioritizing sustained capacity-building investment over further legislation.