Eight checks to keep your public portal secure and recoverable

The registration window opens on Monday. The adverts are out, the link is circulating on WhatsApp, and thousands of people will try to submit forms in the first few hours. If you are accountable for that portal, a quiet question probably sits at the back of your mind: what happens if it goes down, gets defaced or leaks applicants' data on the busiest day of the year?

You do not need to be a security specialist to answer it well. You need to know which checks matter most, what to ask your team or vendor, and who does what if something goes wrong. October is Cybersecurity Awareness Month, which makes this a good moment to ask. The checks are just as useful in any month before a busy window.

Secure matters. Recoverable matters just as much.

No team can promise that a service will never be attacked. What you can control is how hard you make it, how quickly you notice, and how fast you can return to a state you trust. The US National Institute of Standards and Technology's Cybersecurity Framework 2.0 organises this into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Half of them concern what happens after something has gone wrong.

The checks below are ordered roughly by how much risk they remove for the effort involved.

Eight checks to run or ask about

1. Who has admin access, and is MFA switched on?

Ask for a list of every account that can change content, settings or data. Include vendor accounts, former staff and shared logins such as "admin@". Each account should belong to a named person who still needs it, and each should use multi-factor authentication (MFA). The US Cybersecurity and Infrastructure Security Agency (CISA) encourages phishing-resistant MFA but is clear that "any MFA is better than no MFA". Broken access control is first on the OWASP Top 10:2025, the widely used list of web application risks.

Hypothetical example: a programme portal still has an active admin login for a contractor who left eighteen months ago, with no second factor. Nobody was negligent; nobody was asked to check. A ten-minute review closes the gap.

Ask: "Please send me the list of admin accounts and confirm MFA is enforced on each one."

2. Is the software, and everything it depends on, up to date?

Portals are assembled from frameworks, content management systems, plugins and libraries. A weakness in any of them becomes a weakness in your service, which is why OWASP lists software supply chain failures third in 2025.

Ask: "Who watches for security updates to our platform and plugins, and how quickly are critical fixes applied?" Update before a peak period, not during it.

3. Do the backups actually restore?

A backup you have never restored is a hope, not a plan. The UK National Cyber Security Centre's (NCSC) guidance on preparing technical recovery advises storing backups separately from primary systems, making them immutable where possible because attackers target them, and regularly testing restoration "to ensure they function as expected".

Hypothetical example: a team runs nightly backups for a year. The first real restore shows that the backup holds the database but not the uploaded files: the ID scans and certificates applicants submitted. Every applicant would need to upload again.

Ask: "When did we last restore from backup, how long did it take, and did it include uploaded documents?"

4. Does someone read the alerts?

Unread logs protect nobody. OWASP's 2025 list includes "Security Logging and Alerting Failures" for this reason. Agree a short list of events that should reach a person: repeated failed admin logins, a new admin account, changes to public pages, sudden traffic spikes and the site going offline. A simple uptime alert that reaches two named phones is worth more than a sophisticated dashboard nobody opens.

Ask: "Who receives our alerts, including at weekends during a registration window, and what do they do next?"

5. Collect only the personal data you need, and protect what you keep

Registration forms often gather names, phone numbers, identity numbers, bank details and uploaded documents. Ask whether each field is needed, who can export applicant data, whether data is encrypted in transit and at rest, and when it will be deleted.

In Nigeria, the stakes are also legal. Under section 40 of the Nigeria Data Protection Act 2023, a data controller must notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of a breach that is likely to result in a risk to people's rights and freedoms. Where the risk to individuals is high, they must be told immediately, in plain language. A vendor processing data on your behalf must notify you when it becomes aware of a breach. The clock starts when your organisation becomes aware, not when the investigation ends, so the people who would make that call need to know in advance who they are. Your data protection officer or legal adviser should confirm how these duties apply to your service.

6. What can your vendors reach?

Your hosting provider, developer, SMS gateway, payment provider and analytics tools may all touch the service or its data.

Ask: "Which vendors have access, through which accounts, and with MFA? Does each contract require prompt notice of a breach? Is access removed when an engagement ends?"

7. Write a one-page incident plan

Without a plan, the first hour of an incident goes on working out who is in charge. A one-page plan answers three questions:

• Who decides? For example, who can take the portal offline or extend a deadline.
• Who communicates? With applicants, leadership, partners and, where required, regulators.
• How do we restore? Which backup, who carries out the restore, and roughly how long it takes.

Add contact details for your vendor, hosting provider, data protection officer and legal adviser. Nigeria's national computer emergency response team, ngCERT, receives reports of cyber incidents; ask your legal adviser which reporting routes apply to you. Then rehearse the plan once, around a table, for thirty minutes. The NCSC's free Exercise in a Box shows how simple such an exercise can be.

8. Will it hold on the busiest day?

The NCSC's denial of service guidance begins with four practices: understand your service, understand your defences, create a response plan and test your response. The same thinking applies to the ordinary rush of genuine users.

Hypothetical example: a scholarship portal closes at midnight on Friday, and many applicants arrive in the final hours. Pages slow down, people resubmit, and duplicate records pile up. An honest status message and a deadline extension agreed in advance would have helped as much as extra servers.

Ask: "What peak load do we expect, have we tested at that level, and what does a user see if the site is slow?"

A short list for this week

Before your next busy window, confirm that:

• Every admin account is named, needed and protected by MFA.
• Critical updates are applied and a change freeze is agreed for the peak.
• A restore has been tested recently and included uploaded files.
• Alerts reach a named person, including at weekends.
• Someone owns breach notification and understands the 72-hour rule.
• Vendor access is listed and reviewed.
• A one-page incident plan exists and has been rehearsed.
• The portal has been tested at the expected peak load.

None of this needs a large budget. It needs someone to ask, and someone to own each answer.

Where VIS can help

At Vorbtech Innovative Solutions (VIS), we design, build and secure digital services. Our work includes the portal and workflow design for the Nigeria Youth Investment Fund application journey, connecting submissions, supporting documents and reviewer activity, and responsive registration and engagement for delegates, exhibitors, sponsors and media at the Niger State Green Economy Summit.

Our cybersecurity work covers security audits, penetration testing, compliance implementation support, secure authentication and data protection, always within an agreed scope and with written authorisation. When a defined part of the work needs specialist depth, we work with our cybersecurity partner, CyberPlural.

If you would like a second pair of eyes before your next busy window, discuss your service with us. We will start with how the service works and who relies on it, then agree what to check first.

• Cybersecurity
• Public sector
• Data protection
• Incident response
• Backups
• Nigeria