CBN Orders Banks to be Security Certified By 2015

The Central Bank of Nigeria (CBN) has mandated all commercial banks to be information security-certified by 2015.

Tunde Lemo, deputy governor (Operations), stated this during conferment of ISO 27001 certificate to the CBN by the British Standards Institution (BSI).

Also showing great admiration for the CBN attainment, Dr. Andrew Peacock, the UK High Commissioner described the achievement as one of the highest standards of information security management in the world. He also noted that it is a confidence building measure as well as a remarkable achievement.

The High Commissioner stated that the British government plans to double trade volume with Nigeria to about £8 billion in 2014 provided British investors were convinced the Nigerian economy was adequately regulated. He also said the CBN information security certification would open doors for such investment opportunities in the country.

The acquisition of the coveted certification puts the CBN at par with the institutions like the World Bank and International Monetary Fund (IMF) that had adopted the standard. The central bank also becomes the first organisation in the country to attain such level of certification.

Essentially, the information security and management system allows the CBN to install processes including controls, technology and people awareness to ensure that particularly classified information held in custody on behalf of its stakeholders and clients is properly protected.

Lemo said: “CBN regulates banks and other financial institutions. For those ones we regulate particularly commercial banks, we have made it mandatory for them to be so certified before the end of 2015.”

The CBN Governor, Mallam Sanusi Lamido Sanusi, also said information security had become critical to the central bank’s operations, adding that going forward, any unauthorised disclosure or compromise would be have consequences.
 
Represented at the occasion by Alhaji Suleman Barau, CBN Deputy Governor, Corporate Services, Sanusi said all its stakeholders and partners would now have more confidence in the bank’s ability to protect the data in its possession.

He said the CBN would do all within its powers to sustain controls and retain the certification.

However, the certification which is for an initial period of three years is presently limited to the CBN headquarters but with the possibility of extension to its branch offices in future.

Mark Basham, managing director of BSI, Europe, Middle East and Africa (EMEA), said follow-up audit would be conducted every six months to ensure the CBN standards and controls are still intact and within the requirements for which the standard was awarded.

The certificate could either be withdrawn or re-issued at expiration.

Elsewhere, Dr. Sarah Alade, CBN deputy governor, Economic Policy, congratulated some of the banks which had already adopted the standards.

She however noted “the Central Bank of Nigeria has taken the lead by certifying to a much wider scope and achieving this in less than one calendar year.” She said the driving force for the adoption was the need to have formalised processes to protect the organisation’s key  information assets as some of them are information of national relevance.

Afolabi Oke, executive director, Global InfoSwift (the consulting firm which prepared the CBN for the award) said he proud of the apex bank’s reposition.

“We are indeed very proud to be part of the Central Bank of Nigeria’s success story. This is an affirmation that the CBN has adopted and complied with one of the most reputable international information security management system standards in the world.”