The FPI stays ultimately accountable for its data, but the operational reporting duty sits with the contracted SI and the underlying CSP: a breach or significant security incident that touches government or regulated sector data or infrastructure is reported as soon as it is discovered, and once an incident is verified after triage the responsible SI or CSP notifies the affected FPI, the Nigeria Data Protection Commission where personal data is involved, any sector regulator concerned, and NITDA, without undue delay and within 24 hours of becoming aware that the incident is verified; the NDPA 72-hour timeline governs personal data breaches, the 24-hour timeline non-personal government and regulated data, and where a breach is likely to pose high risk to individuals the FPI ensures data subjects are notified immediately.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.