01A self-assessment grades itself
Self-attestation cannot be self-checked
Nigeria's Risk-Based Cybersecurity Framework took effect 1 July 2024. The Cybersecurity Self-Assessment Tool was deployed 30 March 2026, with deposit money banks given three weeks to return it. Self-scoring has no external yardstick.
The check is already possible
Anyone with a browser can observe a licensed bank's public surface. The open question is whether the regulator sees it first.
Validating every return is a workload nobody has
Returns arrive from several classes of institution on tight deadlines. The Bank has warned that a false submission is a breach under BOFIA 2020.
02Someone already ran this experiment
Five points from the US defense-contractor cybersecurity standard:
- 2017: a 110-control standard required implementation and attestation.
- 2020: contractors had to self-score against all 110 controls and post the number, still self-sourced.
- Penalties: False Claims Act exposure. Cyber matters were about 0.76% of FY2025 FCA recoveries, with 15 cases in four years, mostly started by insiders.
- March 2025: a contractor settled for USD 4.6 million after an independent assessment returned a lower score than its self-assessment, and the posted figure was never corrected.
- February 2026: the self-assessment clause was deleted and replaced by government or accredited third-party assessment, eight weeks before Nigeria's tool deployment.
The US framed that deletion as consolidation, not as an admission of failure. Every fact above is drawn from primary sources.
03Outside-in, and nothing a customer could not see
Public web server responses and public reporting only. No authenticated access, scanning, exploitation or penetration testing. Testing begins only after a signed engagement letter and written rules of engagement.
Comparable
One published methodology, applied identically to every institution reviewed.
Corroborating
A complement to self-assessment, and a triage layer for scarce supervisory capacity.
Instrument-aware
Results can vary by how edge protection treats the caller, so the method records what was asked, by whom and from where.
04Five components, each adoptable on its own
Offered as a partnership proposal, not a tender response.
- Sector posture baseline
- CSAT corroboration, cross-referencing returns against observable evidence
- Minimum technical baseline for customer-facing endpoints
- Continuous sector monitoring
- Capacity building for the Bank's own supervisors, with no lock-in
05What this does not do
Not a risk score
It checks the return, not the bank.
Not predictive
It does not claim to predict breaches, and cited ratings-industry figures elsewhere in the market lack independent validation.
Not the whole picture
Governance, third-party risk and internal fraud are invisible from outside. Of ₦52.26 billion in 2024 reported fraud losses, roughly ₦30 billion is attributed to a single internal case.
Not an assessment
It is triage. The US certification regime has fewer than a hundred authorised assessors for a base in the tens of thousands, phased to 2028.
A proposed first step: a no-cost pilot on a Bank-nominated sample, with raw recorded responses supplied.
06We never assure an institution that pays us
Syndik8 also sells security and remediation work to banks. The safeguard is a partition, not a disclosure: no assurance work on institutions Syndik8 serves commercially, and a full client register disclosed to the Bank on appointment and on any change.
Reproducible
No black-box scoring.
No enforcement role
Evidence only. The Bank decides consequences.
Disclosure first
Each institution hears its own findings first, privately, with no commercial ask attached.
Open to competition
No exclusivity sought.
07If you own this problem
Bank staff or supervised institutions can test the method before it is run anywhere else. Syndik8 runs Security Operations and Government & Public Sector as monthly, fixed-price practices.