Virtual CISO in Nigeria

A senior security lead in your business for the days you need each month, owning strategy, risk and board reporting, without the cost of a full-time CISO.

  • CISSP, CISM, CISA and ISO 27001 Lead Auditor certified
  • Built around CBN frameworks and the Nigeria Data Protection Act
  • Nigeria team based in Lagos, on West Africa Time

Talk to your future CISO for 30 minutes.

Free, no obligation, with Ziyaad Ramdianee, CISSP, CISM. You'll know which level of support fits your situation.

You'll hear back within one business day. We only use your details to contact you. Privacy notice.

Request received.

We'll get back to you within one business day to schedule your 30-minute call.

When a part-time CISO works in Nigeria, and when it doesn't.

It depends on who regulates you. For some institutions a virtual CISO can hold the role. For others it should support the person who does.

Small OFIs The CBN's framework for Other Financial Institutions requires every OFI to appoint a CISO. Published summaries of the framework say small OFIs, such as Unit Tier 2 microfinance banks, may appoint the head of IT or a part-time consultant.
Larger OFIs The CISO requirement still applies, with more demanding governance expectations. We check your category before suggesting a format.
Banks and payment service banks The 2024 framework for deposit money banks and payment service banks sets specific governance, experience and reporting requirements for the CISO. Here, a virtual CISO supports your appointed CISO or board rather than replacing the role.
Companies under the NDPA The Nigeria Data Protection Act deals with personal data, and major data controllers need a data protection officer. That role is different from a CISO, but the two programmes overlap, so your virtual CISO runs the security side alongside it.
Everyone else Often the question comes from a client, an insurer, a bank partner or an investor's diligence pack. What they want is a named owner and a programme to point to.

Sources: CBN framework for DMBs and PSBs (2024) and a legal summary of the OFI framework. This page is not legal advice.

What your virtual CISO takes off your desk.

One accountable person, with work your board, your auditors and your bank partners can actually review.

  • 01A map of your obligations. What the CBN, the NDPC and your clients expect from you, in plain terms.
  • 02A security strategy and a costed 12-month roadmap, approved by your executive team, with a budget finance can sign off.
  • 03A risk register with named owners and agreed treatment decisions, including the risks you choose to accept.
  • 04A board reporting pack you can reuse every quarter, written in language directors understand.
  • 05Vendor oversight, including of us. If a tool is not earning its licence, you will hear it.
  • 06Incident leadership at the command level when something happens.

Virtual CISO or full-time hire?

The real question is how many CISO days your business needs each month.

CriteriaFull-time CISOnexaya virtual CISO
What you pay forSalary, statutory costs, benefits and recruitment feesA set number of days a month, agreed in the contract
CommitmentPermanent employmentThree-month minimum
Vendor independenceDepends on your internal setupReviews every vendor, including us

If your regulator or your operations call for a full-time CISO, hire one. We'll tell you on the call, and a virtual CISO can cover the gap while you recruit.

Four levels of commitment. A three-month minimum.

LevelCommitmentSuited to
Advisory2 days per monthStrategy, board reporting, and oversight of an existing team
Embedded5 days per monthBuilding the programme from a standing start, with hands on the work
Programme10 days per monthCertification, multi-market expansion, or post-incident rebuild
CustomThe number of days you needA need that doesn't fit any of the other three levels

Book my free call →

Ziyaad Ramdianee

Who you'll talk to: Ziyaad Ramdianee

Ziyaad Ramdianee specialises in security governance and IT audit. His career is built around compliance, internal controls and protecting enterprise digital assets.

He designs risk frameworks aligned with SOC, ISO and NIST, and secures hybrid working environments. He also teaches IT as a faculty lecturer, including at Polytechnics Mauritius.

CISSP CISM CISA ISO 27001 Lead Auditor CEH PMP

What Nigerian companies ask about a virtual CISO.

Can a virtual CISO satisfy the CBN's CISO requirement?

It depends on your institution. Summaries of the OFI framework say small OFIs may appoint a part-time consultant as CISO. Banks and payment service banks face stricter requirements, so there a virtual CISO supports the appointed CISO or the board. We check your category on the call, and you should confirm the final position with your compliance lead.

Is a CISO the same as a data protection officer?

No. A data protection officer focuses on personal data duties under the Nigeria Data Protection Act. A CISO owns information security across the business. The two work closely together, and we run the security side so it supports your NDPA obligations.

How much does a virtual CISO cost in Nigeria?

It depends on the level you choose: 2, 5 or 10 days a month, or a custom number of days. You pay for those days rather than a full-time post. We'll quote after the call, once we understand your situation.

How long is the minimum engagement?

Three months minimum.

Do you only work in Lagos?

No. Our Nigerian office is at 12 Landbridge Avenue, Victoria Island, Lagos, and we work with companies across the country. Most of the work is done remotely and we travel when it's needed.

Do you work with fintechs and startups?

Yes. A common trigger is a bank partner's questionnaire or an investor's diligence pack with a security section nobody owns. The Advisory or Embedded level usually fits that stage.

Put a name against security accountability.

In 30 minutes, you'll know whether a virtual CISO fits your business in Nigeria, and at what level.

Book my free call

Related: our virtual CISO service · cybersecurity in Nigeria