Papua New GuineaCybersecurity Bill 2026, Protection of Financial Systems
Cybersecurity Bill 2026 (Papua New Guinea consultation draft), Part V, ss. 40 and 41
A published draft that has not reached a legislature, dated , as of .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
Where it has got to
The text described here is Proposed Cybersecurity Bill 2026, fourth draft for external consultation, published .
Locally, this stage is fourth draft of the Cybersecurity Bill 2026 released for external consultation by the Department of Information and Communications Technology.
The stage above is recorded at www.ict.gov.pg.
The Department of Information and Communications Technology lists the consultation as open from and closing on ; the bill carries no number, and its certification date is blank.
What it requires
- This is a bill in public consultation (the fourth draft, opened for comment on ) and binds no one unless Parliament passes it and it is certified; the lines below describe what it would require if passed as drafted. It would bind a financial institution, meaning a bank, insurance company, savings and loan society, micro-finance institution, payment service provider or other entity licensed by the Bank of Papua New Guinea to conduct financial services (s. 3(1)(v)); all computer systems and networks it operates are taken to be designated critical information infrastructure (s. 40(1)) (reached by declaring that you provide financial services).
- Implement the minimum cybersecurity controls the Authority prescribes for financial institutions in consultation with the Bank of Papua New Guinea (s. 41(a)).
- Maintain an incident response plan specifically addressing financial cybercrime, conduct regular penetration testing of your systems, and train staff in cybersecurity awareness and fraud prevention (s. 41(c) to (e)).
- Meet the obligations the draft puts on a CII operator in Part IV as well, because Part V applies in addition to them (s. 40(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The National Information and Communications Technology Authority, which the draft deems the National Cybersecurity Authority until a separate National Cybersecurity Authority is established.
What this law does
Section 3 of the Cybersecurity Bill 2026 would define a financial institution as a bank, insurance company, savings and loan society, micro-finance institution, payment service provider or other entity licensed by the Bank of Papua New Guinea to conduct financial services.
Section 40 of the draft would take all computer systems and networks operated by financial institutions to be designated critical information infrastructure, and subject financial institutions to the obligations of Part V in addition to those of Part IV.
Section 41 of the draft would require a financial institution to implement the minimum cybersecurity controls the Authority prescribes in consultation with the Bank of Papua New Guinea, report incidents to the Authority and the Bank within 24 hours of detection, maintain an incident response plan addressing financial cybercrime, conduct regular penetration testing and train staff in cybersecurity awareness and fraud prevention.
When LexLint raises it
When your app profile says your app provides financial services.