What is the CBN CSAT?
The Cybersecurity Self-Assessment Tool (CSAT) is the operational enforcement arm of the CBN's Risk-Based Cybersecurity Framework. Historically, the CBN issued cybersecurity guidelines, but assessing compliance was difficult. The CSAT solves this by forcing institutions to systematically evaluate their own security controls, score their maturity, and submit the evidence to the regulator.
If you are a licensed MMO, PSSP, PTSP, or bank operating in Nigeria, completing and maintaining the CSAT is a non-negotiable operational requirement.
The Six Domains of the CSAT
The assessment is not a simple checklist. It is divided into six core domains that evaluate both technical depth and corporate governance. You cannot pass by simply buying a firewall; you must prove the firewall is actively monitored and governed by policy.
1. Cybersecurity Governance
Does the Board of Directors actively review cybersecurity risks? You must provide documented evidence of a dedicated CISO reporting line, approved security policies, and allocated security budgets.
2. Protection and Defense
This covers your technical controls: Data encryption at rest and in transit, Multi-Factor Authentication (MFA), network segmentation, and endpoint protection (EDR) deployed across the company.
3. Cybersecurity Operations
Do you know when you are being attacked? This domain assesses your Security Operations Center (SOC), centralized logging, threat intelligence integration, and continuous vulnerability monitoring.
4. Incident Response & Recovery
If ransomware hits your database tomorrow, what happens? You must document your Incident Response Plan (IRP), show proof of regular, immutable backups, and demonstrate testing of your disaster recovery protocols.
The biggest gaps we find in CSAT readiness
When Simpa Labs conducts CSAT readiness reviews for Nigerian fintechs, we consistently identify the same critical failures:
Lack of Independent Penetration Testing
The CSAT explicitly requires regular, independent penetration testing of both your external infrastructure and your internal applications. Running an automated Nessus scan internally does not satisfy this requirement. The CBN wants to see reports from qualified external engineers testing your business logic, APIs, and mobile applications.
Third-Party Risk Management Blind Spots
Fintechs often secure their own code but fail to audit their vendors. If you use a third-party KYC provider or a core banking integration API, the CSAT requires you to prove that you have assessed their security posture. A breach in your supply chain is legally treated as your breach.
Unenforced "Paper Policies"
Many startups copy-paste an Information Security Policy from the internet to satisfy an auditor. However, the CSAT demands evidence of enforcement. If your policy says "All databases must be encrypted," but your AWS RDS instances are running in plaintext, submitting a passing score for that control is a material misrepresentation to the CBN.
Are you unsure if your fintech's infrastructure will pass a CBN CSAT audit?
Book a CSAT Readiness AssessmentHow to prepare for your CSAT submission
Do not wait until the submission deadline to start your assessment. A proper CSAT review takes weeks of cross-departmental coordination.
- Conduct a Gap Analysis: Download the framework and honestly assess your current state. Highlight controls where you have zero evidence of compliance.
- Commission an Architecture Review: Before spending money on new tools, have engineers conduct a secure architecture review to identify structural flaws in how your microservices or cloud environments are deployed.
- Run a Full Penetration Test: Engage an offensive security firm to test your web apps, mobile apps, and APIs. Remediate the critical findings and include the clean retest report in your CSAT evidence locker.
- Formalize Your Incident Response: Document exactly who is called, what is isolated, and how the CBN is notified (within 24 hours) if a breach occurs. Run a tabletop exercise with your executive team to prove the plan works.
The cost of misrepresentation
The CBN conducts unannounced spot checks to verify CSAT submissions. Submitting a highly mature score while running unpatched servers and lacking MFA is incredibly dangerous. It is far better to submit an honest, lower score accompanied by a strict, funded remediation roadmap than to falsify your compliance posture to the regulator.
Frequently asked questions
What is the CBN CSAT?
The Cybersecurity Self-Assessment Tool (CSAT) is a mandatory framework issued by the Central Bank of Nigeria. It requires licensed financial institutions to evaluate and formally report their cybersecurity maturity, identifying gaps in their defenses against CBN's Risk-Based Cybersecurity Framework.
Which fintech companies must submit a CSAT report?
Any entity holding a CBN license that processes financial transactions. This includes Mobile Money Operators (MMOs), Payment Solution Service Providers (PSSPs), Payment Terminal Service Providers (PTSPs), Microfinance Banks (MFBs), and primary Commercial Banks.
What happens if a fintech fails the CSAT or submits false information?
Submitting a CSAT with material misrepresentations is a severe regulatory violation. The CBN can issue hefty financial penalties, impose operational sanctions (such as halting new customer onboarding), or in extreme cases, suspend the operating license.
Can we use an automated scanner to pass the CSAT requirements?
No. While vulnerability scanners are part of the process, the CSAT requires proof of manual penetration testing, documented incident response plans, architecture reviews, and board-level security governance policies that automated tools cannot generate.
Related reading
Blog: NDPA vs NDPR for Fintechs · Top Vulnerabilities in Nigeria
Guides: CBN Compliance Guide · Fintech Security Checklist
Services: Penetration Testing · Vulnerability Assessment