Does Nigeria have a post-quantum cryptography (PQC) law?

Yes, in a binding form. The rule carries real enforceable weight, though its exact scope is worth checking below before assuming it applies to your organization. The issuing body is Nigerian Communications Commission (NCC).

What is Nigeria's PQC migration deadline?

2027. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from Nigerian Communications Commission (NCC).

Does Nigeria require a Cryptographic Bill of Materials (CBOM)?

Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.

NGMandated

Nigeria

Nigeria's NCC Cyber Resilience Framework (CRF-NCS) imposes a binding PQC mandate on telecom service providers with a hard compliance deadline of February 23, 2027, though it stops short of naming an explicit cryptographic inventory/CBOM requirement or detailing enforcement penalties.

Nigeria's post-quantum cryptography posture is classified as mandated, led by Nigerian Communications Commission (NCC), with a migration target of 2027. It scores 70/100 on this tracker's rubric, one of the more binding and actively enforced rules on this tracker, and that is not a measure of how secure or advanced the country actually is.

What's verified

The Nigerian Communications Commission's Cyber Resilience Framework for the Nigeria Communication Sector (CRF-NCS, v1.0, dated February 2026, full compliance effective February 23, 2027) explicitly mandates under control CRM-RA.S3 that service providers "are required to use PQC to develop, communicate, and enforce quantum-resistant cryptography," and under CRM-RA.S2 that they "conduct periodic risk assessments of its IT environment, including evaluations of Quantum cryptography and emerging cybersecurity risk (e.g., PQC - Post-Quantum Computing)." Section 4.5 (Future Proofing of CRF-NCS) explicitly states the framework "includes provisions to tackle 'harvest now – decrypt later' attacks through ongoing risk assessments and the implementation of robust data protection measures." The claim as stated is accurate and does not need correction.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	20/20	20: CRM-RA.S3 uses binding compulsory language, 'Service providers are required to use PQC to develop, communicate, and enforce quantum-resistant cryptography,' within an NCC regulatory framework with a defined compliance period, not mere guidance.
Deadline concreteness	20/20	20: the source gives a specific date, full compliance mandatory by February 23, 2027 (12 months after the February 23, 2026 release), a concrete year/date rather than directional phasing.
Scope of coverage	10/20	10: the CRF-NCS binds 'service providers' within the Nigerian Communication Sector specifically, a single regulated sector (telecom), not economy-wide critical infrastructure.
Inventory/CBOM requirement	10/20	10: no explicit CBOM/cryptographic inventory is named. CRM-RA.S2 only requires 'periodic risk assessments of its IT environment, including evaluations of Quantum cryptography,' a general risk-assessment obligation that implies but does not mandate a formal inventory.
Regulatory activity	10/20	10: the NCC is the named enforcing authority with a defined compliance period (section 8.4/10.0), but the provided evidence names no specific enforcement mechanism such as fines, audits, or certification tied to non-compliance.
Total	70/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Central Bank of Nigeria (CBN)
Not yet addressed, a gap to watch
Not yet addressed directly. CBN's 2024 Risk-Based Cybersecurity Framework covers general asset inventory and emerging-tech risk (AI, DLT, cloud) but has no quantum or cryptographic-algorithm content.
Nigeria Data Protection Commission (NDPC)
Not yet addressed, a gap to watch
Not yet addressed directly. A June 2026 announcement of an intended review of Nigeria's data protection law to cover "emerging technologies" named AI, robotics, and big data specifically, not quantum computing or cryptography.
SEC Nigeria
Not yet addressed, a gap to watch
Not yet addressed directly. SEC Nigeria's "crypto" regulatory work concerns virtual/crypto-assets exclusively, an unrelated meaning of the term, with no engagement on cryptographic security standards.

FAQ: Nigeria and PQC

Does Nigeria have a post-quantum cryptography (PQC) law?: Yes, in a binding form. The rule carries real enforceable weight, though its exact scope is worth checking below before assuming it applies to your organization. The issuing body is Nigerian Communications Commission (NCC).
What is Nigeria's PQC migration deadline?: 2027. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from Nigerian Communications Commission (NCC).
Does Nigeria require a Cryptographic Bill of Materials (CBOM)?: Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.