Governance and Regulatory Gaps in IoT Security Deployment in Nigeria: A Risk-Oriented Framework

Abstract

Recent advisories from the Nigerian Communications Commission Computer Security Incident Response Team (NCC-CSIRT) show that malware families such as Mirai, GRIDTIDE and COLDEYE target Internet of Things (IoT) devices and telecommunications infrastructures in Nigeria. These warnings are important because infected routers, cameras, and other connected devices can be converted into botnets for distributed DOS attacks, data theft and persistent intrusion. The problem is technical and reflects a wider governance weakness: security controls for IoT devices are known, but institutional arrangements needed to make those controls routine, enforceable and auditable remain uneven in many emerging economies. This paper examines governance and regulatory gaps in IoT security deployment through risk-oriented synthesis of official advisories, international standards and peer-reviewed literature. The analysis shows that global standards often assume enforcement capacity, skilled cybersecurity personnel, supply-chain visibility and sustainable funding. These assumptions do not always fit the institutional realities of emerging digital environments. The paper therefore proposes a four-stage IoT governance maturity framework: AdHoc Deployment, Policy-Aware Governance, Structured Governance, and Resilient Adaptive Governance. Each stage identifies indicators, transition requirements and risk-reduction outcomes. The framework provides policymakers, service providers and researchers with a practical roadmap for moving from reactive incident handling to proactive and adaptive IoT security governance.