Cloud Security for Nigerian Critical Infrastructure: A Five-Pillar Implementation Framework and Synthetic-Data Demonstration

Abstract

Cloud-supported critical services require coordinated technical controls, accountable governance, and demonstrable recovery arrangements. This article proposes a Nigeria-focused cloud-security implementation framework and evaluates the behaviour of an accompanying implementation-gap index using synthetic data. The framework organises existing practices into five pillars: technical and operational controls, policy and governance, capacity building, collaboration, and threat intelligence. It links these pillars to control ownership and auditable evidence, with reference to international guidance and Nigerian policy instruments. The computational demonstration uses 100 fictional organisational profiles per replication, nine indicators with fixed marginal distributions, and 1,000 replications at each of three latent dependence settings. No professionals were surveyed, no experts were interviewed, and no incident records were analysed. Although the equal-pillar mean index remains 58.625 under every setting by construction, the simulated mean number of profiles with co-existing unsupported-software and authentication gaps increases from 32.42 to 47.99 as latent dependence increases. The corresponding number with an index of at least 75 increases from 20.67 to 48.02. Median overlap between alternative weighting schemes and the equal-pillar top-20 selection ranges from 13 to 20 profiles. These results demonstrate that fixed headline percentages do not identify the concentration of implementation gaps, and that review priorities depend on joint structure and weighting choices. The contribution is a transparent implementation and evaluation approach, not evidence of Nigerian incident prevalence, terrorist attribution, regulatory non-compliance, or intervention effectiveness. Independent field evaluation is required before operational adoption.