- AMLAnti-money laundering
- The laws, rules and controls that organisations use to detect and prevent money laundering, including customer checks, transaction monitoring and reporting suspicious activity.
- Attack surface
- Every point where an attacker could try to get into a system or extract data, such as internet-facing services, user accounts, devices and third-party connections.
- CAASMCyber asset attack surface management
- Tools and practices that combine asset data from many sources into one current view of what an organisation owns and where it is exposed.
- CBNCentral Bank of Nigeria
- Nigeria's central bank and the primary regulator of banks and other financial institutions in the country.
- CMDBConfiguration management database
- A database of an organisation's IT assets and the relationships between them. It is often incomplete or out of date.
- CTRCurrency transaction report
- A report of a cash transaction above a regulatory threshold, filed with the national financial intelligence unit.
- DevSecOps
- A way of building software in which security checks are part of the automated delivery pipeline rather than a separate step at the end.
- goAML
- The software platform developed by the United Nations Office on Drugs and Crime that many financial intelligence units, including Nigeria's, use to receive reports from regulated institutions.
- IAMIdentity and access management
- The processes and tools that decide who or what can access which systems and data, and prove that they are who they claim to be.
- IT and OTInformation technology and operational technology
- IT covers business systems such as email and databases. OT covers the systems that run physical processes such as pipelines, plant and sensors.
- KYCKnow your customer
- The checks a financial institution performs to verify a customer's identity and understand the risk they present.
- NDPANigeria Data Protection Act
- The 2023 Nigerian law governing how organisations collect, use and protect personal data. It is overseen by the Nigeria Data Protection Commission.
- NDPRNigeria Data Protection Regulation
- A data protection regulation issued in 2019 by Nigeria's National Information Technology Development Agency, which preceded the NDPA.
- NFIUNigerian Financial Intelligence Unit
- The national agency that receives and analyses financial intelligence, including suspicious transaction reports, from regulated institutions.
- Penetration testing
- An authorised, simulated attack on a system to find weaknesses before real attackers do.
- PEPPolitically exposed person
- A person who holds or has held a prominent public position. Financial institutions apply extra scrutiny to them because of higher exposure to corruption risk.
- SBOMSoftware bill of materials
- A list of the components and libraries inside a piece of software, used to find out whether a newly discovered vulnerability affects it.
- SIEMSecurity information and event management
- A system that collects and correlates security logs from across an organisation so analysts can spot and investigate threats.
- SOARSecurity orchestration, automation and response
- Tools that automate parts of security response, such as enriching alerts and carrying out routine containment steps.
- SOCSecurity operations centre
- The team and tooling that monitor an organisation's systems for threats and respond to incidents.
- STRSuspicious transaction report
- A report that a financial institution files with the national financial intelligence unit when it suspects a transaction is linked to crime.
- Vulnerability assessment
- A systematic review that finds and ranks known weaknesses in systems and software. It is broader and less adversarial than a penetration test.
- ZTNAZero trust network access
- An access model that verifies each user and device for each request rather than trusting anything simply because it is inside the network.
