Small businesses depend on email, messaging, cloud files, online banking, websites and connected devices, yet access is often shared informally and recovery is assumed rather than tested. Practical cybersecurity for Nigerian SMEs starts with a few high-impact controls: secure accounts, supported software, limited access, protected data, verified payments and a rehearsed response.
This guide is a baseline, not a full technical assessment. A business handling high-risk personal, financial, health or regulated data should obtain specialist advice and test controls in its real environment. Nigeria’s NITDA Computer Emergency Readiness and Response Team (CERRT) publishes advisories and provides an incident-reporting channel.
Know what the business must protect
Create a short inventory of critical accounts, devices, applications, data, websites, vendors and processes. Identify the owner, administrator, recovery method, information held and the impact if each item is unavailable or compromised.
Prioritise email, domain and hosting, banking and payment, cloud storage, customer records, finance, payroll and backups. Email compromise can lead to password resets and payment fraud across other services.
1. Secure accounts with strong MFA
Give every user a named account. Stop sharing administrator passwords. Use a reputable password manager to create unique passwords and enable multifactor authentication for email, cloud, finance, remote access and administrative accounts.
CISA recommends requiring MFA wherever possible, beginning with remote and privileged access. Prefer phishing-resistant security keys or strong authenticator methods where supported; text or email codes are weaker fallbacks.
2. Use least privilege and review access
Employees and vendors should receive only the access needed for their role. Keep routine work separate from administrative accounts. Review access quarterly and immediately after role change, contract completion or departure.
Maintain more than one controlled administrator to avoid lockout, but limit the number. Protect recovery email, phone numbers and backup codes as carefully as the password.
3. Update supported software
Inventory operating systems, phones, browsers, routers, website platforms, plugins and business applications. Remove abandoned tools and replace unsupported versions. Apply security updates promptly, using a tested maintenance process for critical systems.
Automatic updates help user devices, but important websites and integrations still need monitoring, compatibility checks and a recovery plan.
4. Build backups that survive the same incident
Back up critical data automatically, keep more than one copy and ensure at least one recovery copy cannot be altered through the ordinary network or administrator account. Encrypt sensitive backups and control who can restore them.
Test a sample restore on a schedule. A successful backup notification does not prove that files are complete, clean or recoverable within the required time.
5. Reduce email and payment fraud
- Train staff to inspect sender, domain, link and unexpected attachment.
- Verify new bank details through a known contact method, not the message requesting the change.
- Use two-person approval for material payments and changes to beneficiaries.
- Do not bypass controls because a message claims urgency or executive authority.
- Configure domain email authentication with qualified support.
- Create an easy internal channel for reporting suspicious messages without blame.
6. Protect devices and networks
Use device encryption, screen lock, anti-malware where appropriate and remote management for business devices. Separate guest Wi-Fi from business systems, change default router credentials, update firmware and remove unnecessary remote access.
Define what may be stored on personal devices and how business data is removed when an employee leaves. Avoid copying customer or finance records into uncontrolled messaging groups.
7. Review websites, cloud and vendors
Keep the website platform and extensions current, delete unused accounts and components, restrict file editing, protect administrative access and monitor unexpected changes. Choose providers with clear security, backup, incident, export and support practices.
Document every vendor with privileged or data access. Set an expiry date, require named accounts and revoke access when work ends.
8. Prepare a cyber incident plan
Define how staff report a suspected incident, who leads, which specialist or provider is contacted, how systems are isolated safely, where evidence and decisions are recorded, how clean recovery occurs and who communicates with customers, banks, regulators or law enforcement.
Do not erase a compromised device or reconnect it hastily. Preserve relevant logs and seek qualified help. For data breaches, assess obligations under the Nigeria Data Protection Act and current NDPC guidance.
A practical 30-day security plan
- Days 1–7: inventory critical accounts, remove stale users, secure email and administrators with strong MFA.
- Days 8–14: update systems, fix shared access, confirm device encryption and set payment-verification rules.
- Days 15–21: create protected backups and complete a sample restore.
- Days 22–30: run a phishing and payment-fraud exercise, review vendors and test the incident contact path.
Questions leaders should ask monthly
- Which critical accounts still lack strong MFA?
- Which employees or vendors have access they no longer need?
- Are any devices, plugins or systems unsupported?
- When was the last successful independent backup restore?
- Can staff verify a bank-detail change without using the requesting message?
- Who leads if email or the website is compromised today?
Cybersecurity is also a people and process capability. G-Consulting supports digital operations, management systems and workforce development. See our training programmes or discuss an organisational security-awareness programme.
Frequently asked questions
What security control should an SME implement first?
Secure email and administrator accounts with unique passwords and strong MFA, then remove unnecessary access and confirm recoverable backups.
Is antivirus enough?
No. It is one layer. Account security, updates, least privilege, backups, payment verification, staff awareness and response planning are also essential.
Can cloud services still be compromised?
Yes. Weak credentials, unsafe recovery, excessive permissions, misconfiguration and compromised vendors can expose cloud data. Configure and monitor them carefully.
Where can a Nigerian organisation report an incident?
Use the current official incident channel published by NITDA CERRT and contact relevant providers, banks, regulators or law enforcement as the situation requires.
