KiribatiCybersecurity Act 2026, Duty to Report a Cybersecurity Incident
Cybersecurity Act 2026 (Act No. 7 of 2026), s. 21 (Part VI)
A vulnerability and incident reporting rule binding public and private bodies.
What it requires
- It reaches you only once the Minister has designated your physical, electronic or virtual infrastructure asset, network or information system as critical infrastructure under section 12; see this jurisdiction's companion critical-infrastructure operator-obligations row for the designation criteria.
- When you are the subject of a cybersecurity incident or threat of one, gather information about it, assess the risk to your critical infrastructure, customers, suppliers and other stakeholders, take appropriate preventative, mitigating and remedial measures to limit that risk, and report all material information about a significant cybersecurity incident to the National CERT and any relevant Sectoral CERT within 24 hours after you detect it, in the form or manner the CERT prescribes.NIST CSF 2.0RS.CO-02NIST CSF 2.0RS.MI-01
- Provide any further information the National CERT or a Sectoral CERT requests about the incident, and allow either CERT to access your network and information infrastructure to analyse the incident, detect other threats, identify vulnerabilities, and advise on preventative, mitigating or remedial measures.NIST CSF 2.0RS.CO-03
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 25(1) makes it an offence for an operator of critical infrastructure to fail to carry out its obligations under Parts IV or V without a granted exemption or modification from the DTO under section 23, which reaches the section 21 reporting duty as one of Part VI's obligations. Section 25(2) sets the operative penalty: a fine not exceeding $100,000 for a first offence or $200,000 for a subsequent offence, and a further fine not exceeding $200 for each day a continuing offence persists. The Act's own Explanatory Memorandum states a lower penalty for the identical offence ($10,000, $20,000 and $100 respectively), a discrepancy that is not resolved here.
Penalty structure
Section 25(2)'s own operative text sets a graduated fixed structure: a fine not exceeding $100,000 for a first offence, not exceeding $200,000 for a subsequent offence, and a further fine not exceeding $200 for each day a continuing offence persists. The Act does not define the currency the bare "$" denotes; Kiribati's legal tender is the Australian dollar (ISO 4217: AUD). The Act's own Explanatory Memorandum states a different, lower set of figures for the same offence: $10,000, $20,000 and $100 per continuing day, exactly one-tenth the operative section's figures; both are recorded here, and which one governs is not resolved.
- Rule
- Fixed only
- As of
- Currency
- AUD
- Fixed cap
- 200,000
Who enforces it
Enforcement body
The National CERT and any relevant Sectoral CERT, which receive the section 21 report and may request further information or access to the operator's network and information infrastructure; a failure to report is enforced through the same section 25 offence as this jurisdiction's companion critical-infrastructure operator-obligations row, whose own text names a failure of obligations under "Parts IV or V" rather than the Part VI reporting duty it appears intended to enforce.
Settledness
- As of
- Open questions
- Which infrastructure assets, networks or information systems, if any, has the Minister designated as critical infrastructure under section 12, since the reporting duty binds only an operator so designated?
- How does the National CERT classify a cybersecurity incident as "significant" for the purpose of triggering the section 21(1)(d) reporting duty, and has it prescribed the "form or manner" the subsection contemplates?
What it reaches
Obligation class
Reporting, Security
Applicability criteria
Section 2 provides that the Act commences on a date the Minister may by notice appoint, and this criterion depends on a designation the Minister makes under section 12.
- As of
- Combinator
- All of
- Criteria
- The Minister, on the advice of the Director of the Digital Transformation Office, has designated your physical, electronic or virtual infrastructure asset, network or information system as critical infrastructure under section 12 of the Cybersecurity Act 2026.
What this law does
Section 21 requires an operator of critical infrastructure that is the subject of a cybersecurity incident or threat of one to gather information about it, including its nature and impact, and to assess the risk it poses to the critical infrastructure, customers, suppliers and other stakeholders.
The operator must take appropriate preventative, mitigating and remedial measures to limit that risk, and must report all material information about a significant cybersecurity incident to the National CERT and any relevant Sectoral CERT within 24 hours after the incident is detected, in a form or manner the CERT may prescribe.
The operator must provide any further information the National CERT or a Sectoral CERT requests about the incident, and must allow either CERT to access its network and information infrastructure to analyse the incident, detect other potential threats, identify vulnerabilities, and advise on preventative, mitigating or remedial measures.
A failure to report is enforced through the same section 25 offence as this jurisdiction's companion critical-infrastructure operator-obligations row, punishable on summary conviction by a fine of up to $100,000 for a first offence, up to $200,000 for a subsequent offence, and up to $200 for each day a continuing offence persists, though the Act's own Explanatory Memorandum states a materially lower set of figures for the identical offence. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, provides telecom services or handles health records.
Back to the example · Lint your app
Page updated .