CBN CSAT Compliance Guide

1. What is the CBN CSAT?

The Central Bank of Nigeria (CBN) Risk-Based Cybersecurity Framework mandates that all regulated financial institutions conduct periodic cybersecurity self-assessments (CSAT). The goal is to ensure institutions maintain a baseline security posture to protect the financial ecosystem from cyber threats.

2. Who Must File?

The mandate covers a wide spectrum of institutions, including:

• Commercial Banks (Tier 1 & Tier 2)
• Merchant Banks
• Payment Service Banks (PSBs)
• Microfinance Banks (MFBs)
• Primary Mortgage Institutions (PMIs)
• Fintechs and other Other Financial Institutions (OFIs)

3. When is it Due?

Historically, the CBN requires the submission of the completed CSAT assessment by March 31st of the following year. However, boards of directors are usually required to review and sign off on the findings prior to submission, meaning internal deadlines often fall much earlier in Q1.

4. What Evidence is Typically Needed?

The CSAT is not a simple checklist; it requires demonstrable evidence across multiple domains (Governance, Protection, Detection, Response, and Recovery). Institutions typically must provide:

• Board-approved Information Security Policies.
• Proof of multi-factor authentication (MFA) and access control logs.
• Vulnerability Assessment and Penetration Testing (VAPT) reports.
• Incident response playbooks and disaster recovery plans.
• Evidence of employee security awareness training.

Gathering this evidence manually across disparate departments is often the most time-consuming part of the assessment, which is why AutoCSAT provides a centralized Evidence Library.