NITDA’s New Software Rules Put Quality, Compliance Under Scrutiny

The National Information Technology Development Agency (NITDA) is moving to tighten software quality controls in Nigeria, but industry stakeholders are calling for a risk-based approach to enforcement to prevent the new regime from becoming a bottleneck for digital projects.

The debate follows NITDA’s National Software Testing Guideline, which requires software developed, modified, integrated or deployed for use in Nigeria to undergo appropriate functional and non-functional testing before operational deployment.

Under the guideline, testing covers areas including functionality, security, performance, usability, compatibility, reliability, maintainability and portability. Software that passes the required assessment is to receive certification from a licensed testing organisation recognised by NITDA.

However, the Nigerian Software Testing Qualifications Board (NGSTQB) has argued that enforcement should reflect the potential consequences of software failure rather than impose the same compliance burden on every application.

The body said that while it supports NITDA’s objective of improving software quality, systems supporting critical functions such as financial transactions, digital identity, healthcare and public infrastructure require a significantly higher level of assurance than low-risk applications.

NGSTQB president, Boye Dare, said software had become critical infrastructure for the economy, warning that defects in systems supporting payments, health records and public services could translate into financial losses, data exposure and disruption of essential services.

He stressed that a defect in a low-risk website should not attract the same regulatory treatment as a failure in a payment switch or national identity platform, while the position is consistent with NITDA’s own risk-based framework, which categorises software according to its potential impact. High-risk and critical systems are subject to more rigorous requirements, while lower-risk applications face proportionately less stringent scrutiny.

The regulatory shift is significant because software testing is moving beyond an internal quality-control function to become a formal requirement linked to government technology deployment.

NITDA’s guideline provides that compliance with the software testing framework will form part of the requirements for IT Project Clearance for government software systems. It also provides for reassessment where significant modifications are made and requires NITDA to maintain a register of licensed testing organisations and certified software systems.

The requirement is expected to become particularly important from the second quarter of 2027, when independent testing and certification will be mandatory for Federal Government software projects seeking IT Project Clearance.

This has raised a second concern: whether Nigeria will have enough qualified and independent testing organisations to handle the expected demand.

NITDA has commenced the process of developing a regulated market for Licensed Software Testing Organisations (LSTOs), with the agency expected to accredit firms capable of carrying out independent testing and certification.

Meanwhile, industry experts have warned that if accreditation is slower than demand, the testing requirement could create queues for government technology projects, increase compliance costs and delay deployment of digital services.

They cautioned that the framework should strengthen software quality without excluding smaller Nigerian technology companies that may possess the technical capability but lack the financial resources of larger firms.

NITDA’s broader regulatory mandate gives the agency responsibility for establishing standards and guidelines for information technology development and for monitoring compliance with its regulatory instruments. The agency describes these instruments as minimum benchmarks for IT development and implementation.

The agency already operates a software testing and certification function, aimed at improving software quality, reducing the use of substandard software and supporting the adoption of indigenous solutions. Its existing certification records include applications used for education, healthcare, taxation, e-learning and other services.

The new framework therefore represents a move from a largely agency-led testing function towards a broader ecosystem in which independent licensed organisations will play a central role, as the policy comes against the backdrop of persistent concerns about the performance and value of government technology projects.

NITDA has previously raised concerns over failures in Federal Public Institution IT projects, while industry observers have pointed to weak project specifications, procurement problems, inadequate testing and poor maintenance as recurring challenges in public-sector technology deployment.

For government agencies, the implication is that software procurement will increasingly have to factor testing, certification, security and lifecycle compliance into project planning rather than treating them as final-stage requirements.

Meanwhile, for developers, especially smaller firms, the cost implications could be significant where projects require specialised security testing, performance testing, interoperability assessment and repeated certification following major modifications.

This is why stakeholders are pushing for proportional enforcement. Rather than weakening the standard, they argue that NITDA should apply the deepest scrutiny to systems where failure could affect large numbers of citizens, expose sensitive information, threaten financial stability or disrupt critical infrastructure.

Similarly, the approach could reduce the risk that mandatory certification becomes a procedural exercise in which developers focus on obtaining certificates rather than resolving the underlying technical weaknesses in their systems.

Stakeholders argue that the framework’s success should ultimately be measured by whether it produces more reliable software and better public services, rather than simply by the number of accredited testing organisations or certificates issued.

NITDA’s implementation challenge will therefore be to build a credible testing market, maintain independence among testing organisations, ensure transparent accreditation, and apply requirements based on the actual risk each system poses.

However, with the 2027 deadline approaching, the agency faces a delicate balancing act: raising the quality and security of software deployed in Nigeria without creating another layer of regulation that slows innovation, increases project costs or delays essential digital services.