Nigeria's Telecom Regulator Set a Harder PQC Deadline Than Most of the G7

Most national PQC timelines run out to 2030 or later. Nigeria's telecom regulator gave its entire sector twelve months.

A harder deadline than the G7 gives itself

The Nigerian Communications Commission published the Cyber Resilience Framework for the Nigeria Communication Sector (CRF-NCS), version 1.0, in February 2026. Control CRM-RA.S3 states plainly:

"Service providers are required to use PQC to develop, communicate, and enforce quantum-resistant cryptography."

That's binding, compulsory language inside a regulatory framework, not a recommendation. Full compliance is mandatory by 23 February 2027 -- twelve months from the framework's release.

Put that next to the deadlines larger economies have set for their own regulated sectors: the EU's coordinated roadmap targets 2030 for high-risk use cases and 2035 for the rest. The UK's NCSC timeline runs discovery through 2028, high-priority migration through 2031, full completion by 2035. The US federal government's OMB memo spans five phases from 2026 to 2035. Canada's binding Treasury Board policy gives high-priority systems until 2031.

Nigeria's telecom sector has a year. That makes CRF-NCS one of the nearest-term binding PQC deadlines on this entire tracker, ahead of jurisdictions with far larger compliance budgets and more mature cryptographic tooling markets to draw on.

What the framework actually requires

CRM-RA.S3 sits alongside a companion control, CRM-RA.S2, which requires service providers to "conduct periodic risk assessments of its IT environment, including evaluations of Quantum cryptography and emerging cybersecurity risk (e.g., PQC - Post-Quantum Computing)." Together, the two controls ask for ongoing risk evaluation plus an operative migration requirement, rather than a one-time compliance checkbox.

The framework also names the threat model directly. Section 4.5, "Future Proofing of CRF-NCS," states that the framework "includes provisions to tackle 'harvest now – decrypt later' attacks through ongoing risk assessments and the implementation of robust data protection measures" -- the same threat model driving PQC urgency in every other jurisdiction on this tracker, explicitly acknowledged in a Sub-Saharan African regulatory document.

What it doesn't specify

Two real gaps sit underneath the mandate's speed. First, CRF-NCS names no specific post-quantum algorithm -- no ML-KEM, no ML-DSA, nothing from NIST's FIPS 203/204/205 family or any alternative. Service providers are required to deploy PQC without a government-endorsed shortlist to choose from, the same gap Israel's banking directive and Kuwait's CORF framework share.

Second, the framework never names a cryptographic inventory or CBOM as a required artifact, even though CRM-RA.S2's risk-assessment requirement is difficult to satisfy honestly without one. An organization can't evaluate quantum risk across its IT environment without first knowing where its cryptography actually runs.

Enforcement is the third open question. CRF-NCS names NCC as the administering authority and sets the compliance date, but the source document doesn't detail a specific penalty, fine, or audit mechanism for providers that miss it. Whether "mandatory by February 2027" carries real teeth depends on enforcement machinery the framework itself doesn't spell out.

Scope stops at telecom

CRF-NCS binds Nigerian Communication Sector service providers specifically -- telecom operators under NCC's jurisdiction. Nigeria's banking sector operates under a separate regulator, the Central Bank of Nigeria, whose 2024 Risk-Based Cybersecurity Framework covers general asset inventory and emerging-technology risk (AI, distributed ledger technology, cloud) but has no quantum or cryptographic-algorithm content as of this writing. SEC Nigeria's cryptography-adjacent work concerns virtual/crypto-assets -- an unrelated meaning of "crypto" -- with no engagement on cryptographic security standards. If you're outside telecom, nothing in Nigerian regulation currently reaches you the way CRF-NCS reaches NCC-regulated providers.

What to do with this

If you're an NCC-regulated service provider, February 2027 is closer than a year-plus sounds once you account for the work CRM-RA.S2's risk assessment actually requires: a real accounting of where quantum-vulnerable cryptography runs across your network and systems, which most organizations don't have today without going and building it. Waiting until closer to the deadline to start that inventory work is the single most predictable way to miss it.

The Nigeria country page tracks CRF-NCS with its primary source.