A practical, no-jargon security briefing built for small business owners across Nigeria — what to watch for, and exactly what to do about it.
Understand the common tactics cybercriminals use to target growing businesses across Nigeria.
Fake messages tricking you into giving up passwords or money.
Fraudulent payment notifications sent before the money actually arrives.
Criminals hijacking your phone number to access your bank accounts.
Harmful software stealing data or locking your devices for ransom.
Hackers taking over your business accounts to scam your customers.
Easily guessed passwords that give attackers instant access.
Three numbers that explain why cybersecurity is a business issue, not just an IT one.
Over 74% of all data breaches involve a human element — such as clicking a phishing link, using a weak password, or falling for a social engineering attack. Awareness training is the single highest-return investment any business can make.
Source: Verizon DBIR 2025Small businesses pay an average of $164 per compromised record in a data breach — often more than large enterprises — because they lack the insurance coverage, legal teams, and recovery infrastructure that larger companies have.
Source: IBM Cost of a Data Breach 2024Enabling Two-Factor Authentication on your accounts blocks more than 99% of automated credential attacks, according to Microsoft research. It is free, takes under two minutes to set up, and is the single most effective account protection step available.
Source: Microsoft Security ResearchActionable, step-by-step guidance to safeguard your operational data and customer trust.
Each section below covers a specific protection area. Click to expand and read the step-by-step guidance. Start with Password Safety if you are new to cybersecurity.
Use passwords at least 12 characters long. Include uppercase, lowercase, numbers and symbols. Never reuse passwords. Enable Two-Factor Authentication (2FA) on every account. Use a password manager.
Check the sender's email carefully. Look for urgent language designed to panic you. Hover over links before clicking. Never share OTPs or passwords over chat. When in doubt, call the sender directly to verify.
Lock your screen with a PIN or biometrics. Only install apps from Google Play Store or Apple App Store. Keep your apps and operating system updated. Enable Find My Device. Back up your data every week.
Disconnect affected devices from the internet immediately. Change all compromised passwords. Contact your bank if financial accounts are affected. Restore from your most recent clean backup. Report to ngCERT at cert.gov.ng.
A short audio explanation of the key cybersecurity steps every Nigerian SME owner needs to know — prepared by the CyberSafe SME Nigeria team.
Not a reader? That is fine. Listen to our 3-minute audio briefing covering the most important security steps for your business.
CyberSafe SME Nigeria exists to equip Nigerian small and medium enterprises with practical cybersecurity knowledge, trusted resources, and simple tools that help businesses protect themselves against evolving cyber threats. We believe cybersecurity should not be the exclusive domain of large corporations — every business, regardless of size, deserves access to clear, actionable guidance.
This platform is developed in phases. Future releases will introduce expanded learning resources, threat intelligence feeds, interactive self-assessments, business security tools, and sector-specific guides designed specifically for the Nigerian business environment.
Use this checklist to assess how secure your business is right now.
Work through this list to find your security gaps. Every item you complete reduces your business's exposure to cyber threats. Download your completed checklist as a PDF to share with your team.
Official Nigerian cybersecurity bodies and practical guides for small businesses.
Official cybersecurity standards and safety frameworks for organizations and MSMEs in Nigeria.
Visit NITDA PortalGuidance on Nigeria Data Protection Act (NDPA) compliance for businesses handling customer data.
Visit NDPC PortalCentral Bank of Nigeria directives on e-payment security, fraud prevention, and financial safety.
Visit CBN PortalNational Computer Emergency Response Team advisory portal for reporting cybersecurity incidents.
Report Incident to ngCERTStraight answers to the security questions Nigerian business owners ask us most.
Phishing is when a criminal sends a fake message — by email, SMS, or WhatsApp — designed to look like it came from a trusted source such as your bank, NIMC, or a delivery company. Red flags include urgent language ("Your account will be suspended"), requests for your password or OTP, links with unusual domain names, and messages asking you to act immediately. When in doubt, call the organisation directly using a number from their official website.
Yes. Ransomware does not discriminate by business size. It typically enters through a malicious email attachment, an infected USB drive, or an unpatched software vulnerability. Once inside, it encrypts your files and demands payment — usually in cryptocurrency — to restore access. The most effective protection is regular offline backups, updated software, and staff training.
Use a passphrase — three or four unrelated words joined together with numbers and symbols. For example: Coffee#Lagos7Bridge! is both strong and memorable. Alternatively, use a free password manager like Bitwarden to generate and store complex passwords automatically, so you only need to remember one master password.
Act immediately: (1) Open WhatsApp on your phone, go to Settings → Linked Devices, and log out all active sessions. (2) Re-enable Two-Factor Authentication in WhatsApp Settings → Account → Two-Step Verification. (3) Notify your customers through another channel that your account was compromised and that they should ignore any messages sent from it during the period. (4) Report to ngCERT at cert.gov.ng.
Never trust an alert until you verify it in your banking app directly. Open your official banking app — not from a link in the message — and check your actual account balance and transaction history. Fake alerts can look identical to real ones. The only reliable confirmation is your bank's app or a call to your bank's official number.
Smartphones are not immune to malware. While iOS and Android have built-in protections, they can still be compromised through malicious apps, phishing links, and unsecured Wi-Fi. On Android, install a reputable antivirus app from the Google Play Store. On both platforms, always keep your operating system updated — most mobile security patches arrive through system updates.
The 3-2-1 rule means: keep 3 copies of your important data, stored on 2 different types of media (such as your laptop and an external drive), with 1 copy stored offsite or in the cloud (such as Google Drive or Dropbox). For a small business, this could be as simple as: your working files on your laptop, a weekly copy on an external drive, and an automatic sync to Google Drive.
You have three official channels: (1) ngCERT — Nigeria's national cyber emergency response team — at cert.gov.ng handles cyber incidents. (2) The Economic and Financial Crimes Commission (EFCC) handles online fraud and financial cybercrime at efcc.gov.ng. (3) The Nigeria Police Force Cybercrime Unit can be reached through your nearest police station. Always preserve evidence — screenshots, messages, transaction records — before reporting.
Practical, detailed guides for common business security scenarios. New guides added with each platform release.
Learn how to protect your business email from phishing, spoofing, and account takeovers. Covers Gmail, Microsoft 365, and common Nigerian business email setups.
A complete guide to securing the smartphone you use for business — app permissions, network safety, SIM protection, and what to do if your phone is lost or stolen.
Practical steps to secure your business banking — confirming payments, avoiding fraud, protecting your BVN, and responding to suspicious transactions.
The people behind CyberSafe SME Nigeria