Is a payment provider, in Kiribati

Cybersecurity Act 2026 (Act No. 7 of 2026), s. 21 (Part VI) · Read the law's page

• When you are the subject of a cybersecurity incident or threat of one, gather information about it, assess the risk to your critical infrastructure, customers, suppliers and other stakeholders, take appropriate preventative, mitigating and remedial measures to limit that risk, and report all material information about a significant cybersecurity incident to the National CERT and any relevant Sectoral CERT within 24 hours after you detect it, in the form or manner the CERT prescribes.
• Provide any further information the National CERT or a Sectoral CERT requests about the incident, and allow either CERT to access your network and information infrastructure to analyse the incident, detect other threats, identify vulnerabilities, and advise on preventative, mitigating or remedial measures.
• It reaches you only once the Minister has designated your physical, electronic or virtual infrastructure asset, network or information system as critical infrastructure under section 12; see this jurisdiction's companion critical-infrastructure operator-obligations row for the designation criteria.

Cybersecurity Act 2026 (Act No. 7 of 2026), ss. 12-20, 22-23 (Parts V-VI) · Read the law's page

• Once designated and entered on the DTO's register, notify the DTO of any change in ownership of the infrastructure or in the person or entity operating it within 30 days; furnish the DTO whatever information it requires by written notice to assess the infrastructure's security and cybersecurity measures; and, once you have furnished information under such a notice, report to the DTO within 30 days after it is implemented any later material change to the infrastructure's design, configuration, security or operation, meaning one that affects or is likely to affect your ability to respond to a cybersecurity incident.
• Comply with cybersecurity standards the DTO issues, submit to its periodic or ad hoc audits, inspections and penetration testing, and conduct and submit periodic cybersecurity assessments of the infrastructure's risk, vulnerability and preparedness.
• Appoint a member of senior management as Chief Information Security Officer, and develop, implement, communicate to staff and keep records of technical and organisational policies, practices and processes to manage risk to your network and information infrastructure and to prevent, mitigate and remedy a cybersecurity incident.
• Establish, implement and maintain a cybersecurity risk-management framework, and take reasonable contractual, technical and organisational measures to manage cybersecurity risk arising from your third-party suppliers, service providers and contractors.
• Comply with any order the DTO, a Sectoral CERT, the Minister or your sector's regulatory authority makes to take preventative, mitigating or remedial action, and tell the DTO where you cannot meet an obligation under this framework for financial, legal or technical reasons, which lets the Director grant an exception or modify a prescribed standard.
• It reaches you only once the Minister, on the Director's advice, has designated your physical, electronic or virtual infrastructure asset, network or information system as critical infrastructure under section 12, on grounds including electronic communications, banking or other financial services, electric power, water and wastewater, healthcare and public health, agriculture and food distribution, emergency services, fisheries, tourism, or public transportation; the definition of an "operator" reaches an individual, a private entity, a public body, a state-owned enterprise or any other body, not only a company.