If you have read why the Sovereign Cloud rules exist, the next question is practical: how do you actually choose where your data will live before 1 January 2027, without betting on a provider that fails certification and forces you to migrate twice? You do not have to wait for the public register to be complete to start. You can vet a provider against the same standards the register will use.
What "certified" will actually mean
NITDA's National Cloud Technical Guideline sets the bar providers are measured against. You do not need to read it cover to cover, but you should know the areas it covers, because they are exactly what you should be asking your provider about: data residency, security and resilience operations, migration and deployment, and data-sovereignty compliance, plus data-centre and physical infrastructure standards. Certification applies to the same categories across the board: cloud service providers, data-centre operators, managed service providers, AI infrastructure providers, and sovereign compute providers.
One practical note. The register is launching in stages from late 2026, so some providers you talk to will be "certified," and others will be "in assessment." Do not treat an incomplete badge as an automatic no. What you are really assessing is whether a provider is on a credible path to certification on a timeline that works for yours.
The vetting checklist
Run every shortlisted provider through these. Ask for answers in writing.
- Residency. Where exactly will your data be stored and processed, including backups and disaster-recovery copies? "In Nigeria" has to cover every copy, not just the primary database.
- Certification status and path. Are they certified under NITDA's framework yet? If not, what is their assessment timeline, and will it land before your own cutover date?
- Jurisdiction. Who ultimately owns and controls the infrastructure, and could a foreign legal order reach your data through the provider's parent company? This is the exposure that started the whole policy.
- Security and resilience. What are their uptime, disaster-recovery, and incident-response commitments, and can they show you evidence rather than a brochure?
- Portability and exit. If you have to leave, or they lose certification, how do you get your data out, in what format, and how long does it take? Avoid a host you cannot leave.
- Local presence and support. Do they have in-country operations and people who can support you in your timezone, or is support offshore?
- Cost and lock-in. What are the real costs of migrating in, running, and migrating out, and are you trading one dependency for another?
Sequence it with your localisation work
This is not a separate project from your CBN data-localisation work. It is the same project, done in the right order:
- Map your data first. You cannot choose a host for data you have not located. Use the same data map the CBN deadline already requires.
- Shortlist against the checklist above, including providers still in assessment if their timeline fits.
- Pilot before you commit. Move a non-critical workload first, confirm residency and performance, then plan the full cutover.
- Cut over without stopping live service. Dual-write, reconcile, then switch. A rushed single-shot migration in December is how outages happen.
A note on who this binds
Be precise when you brief your board. NITDA's guidelines apply directly to federal public institutions and to the providers that serve regulated sectors and nationally significant data. For a private bank or fintech, the obligation to keep data in Nigeria comes mainly through the CBN rule, and the certified register is how you demonstrate your chosen host is trustworthy. The practical result is the same: choose a provider you can defend, on a certification path you can verify.
Start the map now, and the provider choice becomes a decision you make on your terms rather than one the calendar makes for you.
If you want a second pair of eyes on your shortlist or your migration plan, the first conversation is a free, no-pressure 45-minute structured call: start the conversation.
Sources: NITDA National Cloud Technical Guideline 2026 and National Cloud Computing Guideline 2026 (effective 1 January 2027); CBN Circular PSS/DIR/PUB/CIR/001/004. Companion article: why the Sovereign Cloud mandate exists.
