Duty LXD-7171
Runs an essential service, in Tonga
Cybersecurity Act 2025, Duty to Report a Cybersecurity Incidentfrom a date not yet set3 lines
Act 14 of 2025, s. 15 · Read the law's page
- It reaches you only once the Minister responsible for cybersecurity policy and regulation (Minister CPR) has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 and published that designation in the Government Gazette.
- Within 24 hours of becoming aware of it, report to the Computer Emergency Response Team (CERT) a cybersecurity incident relating to the information systems of your designated critical infrastructure, an incident relating to any information system interconnected with or communicating with those systems, or any other cybersecurity incident or occurrence the Minister CPR has designated as requiring notification.
- File that report in the form the Minister CPR prescribes.
Cybersecurity Act 2025, Critical Infrastructure Operator Obligationsfrom a date not yet set4 lines
Act 14 of 2025, ss. 11-14, 16-17 · Read the law's page
- It reaches you only once the Minister responsible for cybersecurity policy and regulation (Minister CPR) has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 and published that designation in the Government Gazette; grounds for designation include infrastructure necessary for electronic communications, banking or other financial services, electrical energy, public transportation, other public utilities, or public safety and public health including emergency services.
- Once designated, register with the Minister CPR, notify the Minister CPR of any change in your legal ownership or in the person or entity operating the infrastructure, and conduct and submit periodic cybersecurity self-assessments to the Ministry CPR in the form and manner it prescribes.
- Comply with any minimum standards the Minister CPR issues for critical infrastructure, submit to the Minister CPR's periodic and ad hoc audits and inspections of your compliance, and comply with any order the Minister CPR makes to take remedial, protective or preventative action following an audit, an assessment, or a reported incident.
- Develop, maintain and implement policies, practices and procedures to detect, share information about, mitigate and respond to cybersecurity threats and incidents, communicate them to your staff, and keep records evidencing your compliance available to the Minister CPR on request.