What the SEC cybersecurity framework covers
SEC's cybersecurity framework is structured around six domains: governance, risk management, access control, data protection, incident management, and technical security testing. Each domain has minimum requirements that capital market operators must implement and document. SEC examiners assess compliance against these requirements during routine and targeted examinations of registered operators.
The framework is principle-based in governance and prescriptive in technical controls. For example, on governance it requires that every operator designate a Chief Information Security Officer (or equivalent) with board-level reporting access. On technical controls, it is specific: annual independent penetration testing is required, quarterly vulnerability scanning is required, and security logs must be retained for a minimum of 12 months in an tamper-evident format.
Governance requirements
SEC requires that every capital market operator have a documented cybersecurity policy approved by the board of directors, a cybersecurity committee or equivalent governance structure, a designated CISO with clearly defined responsibilities, an annual cybersecurity risk assessment, and a documented incident response plan that is tested at least annually through a tabletop exercise or simulation.
For digital investment platforms that operate with a smaller team, "CISO" does not necessarily mean a full-time dedicated hire — SEC accepts that a senior technical leader can hold this responsibility alongside other roles, provided the accountability is clearly documented and the person has the security knowledge to discharge the responsibility.
Access control requirements
The framework requires implementation of multi-factor authentication for all administrative access to systems that hold investor data, privileged access management controls for database and infrastructure administrators, a defined joiner-mover-leaver process that ensures access is revoked within 24 hours of an employee departure, and quarterly access reviews to confirm that access levels match current job roles.
Data protection requirements
Investor personal data (names, NIN, BVN, bank details, portfolio values) must be encrypted at rest and in transit. The framework specifies that encryption must use AES-256 or equivalent for data at rest and TLS 1.2 or higher for data in transit. Data classification is required — investor data must be labeled and treated differently from internal administrative data. Data retention policies must be documented and enforced, and investor data must be deletable on request in compliance with the NDPA 2023.
Technical security testing requirements
The framework requires: annual independent penetration testing of all internet-facing systems, quarterly automated vulnerability scanning, and penetration testing after every significant system change. The penetration test report must be retained and available for SEC examination. The report must include findings with severity ratings, remediation actions, and re-test confirmation for critical and high findings.
Testing must be performed by an independent third party. "Independent" is defined as a party that has no financial interest in the outcome and is not part of the operator's own staff. The testing firm does not need to be specifically accredited by SEC, but the operator should be able to demonstrate that the testing firm has relevant qualifications (OSCP, CREST, or equivalent) and experience in financial services security testing.
Incident reporting obligations
SEC requires that capital market operators notify the Commission of material cybersecurity incidents within 24 hours of discovery. A material incident is defined as any breach that affects investor data, disrupts trading operations, or causes financial loss to investors or the firm. The initial notification can be brief and factual. A full incident report must follow within 72 hours. Failure to report a material incident within the required timeframe is an independent regulatory violation separate from the underlying security failure.
Platform had not tested its mobile trading app since launch
A Nigerian digital investment platform operating under a SEC-registered dealership engaged us for compliance support. The platform had launched its mobile trading app two years earlier and had never conducted an independent penetration test. During our assessment, we identified that the app's portfolio API returned position data for all accounts when called with a valid session token but a different account ID — a classic BOLA vulnerability. Any authenticated user could view the portfolio holdings and trade history of any other user on the platform. We also found that administrator accounts on the platform did not require MFA — a specific requirement of the SEC cybersecurity framework. Both findings were classified as critical. The platform completed remediation within six weeks and engaged us for a re-test to document compliance before the next SEC examination cycle.
Operating a SEC-registered investment platform in Nigeria? Book a penetration test that satisfies the SEC cybersecurity framework documentation requirement.
Book an SEC Compliance PentestFrequently asked questions
Who does the SEC Nigeria cybersecurity framework apply to?
The framework applies to all SEC-registered capital market operators including stockbroking firms, fund managers, investment advisors, custodians, exchanges, and digital investment platforms. Technology companies that operate investment apps as SEC-registered dealers or through partnerships with SEC-registered firms are covered.
What are the consequences of non-compliance with the SEC cybersecurity framework?
SEC has the authority to issue compliance directives, impose fines, suspend registration, or revoke the licence of a capital market operator that fails to meet the cybersecurity framework requirements. Beyond regulatory consequences, a security breach that exposes investor data can trigger civil liability under the NDPA 2023 in addition to SEC enforcement action.
Does a company operating a robo-advisor or mutual fund platform need SEC registration?
Yes. Any platform that manages investments, provides investment advice, or executes securities transactions on behalf of retail investors requires SEC registration. The form of registration depends on the specific activities. Penetration testing and cybersecurity compliance requirements follow from the registration.
Related reading
Blog: Investment app penetration testing · CBN PSP licence security requirements · PENCOM cybersecurity compliance
Services: Penetration testing · Secure architecture review