Papua New GuineaCybersecurity Bill 2026, Critical Information Infrastructure Protection
Cybersecurity Bill 2026 (Papua New Guinea consultation draft), Part IV, ss. 31 to 34, 36, 37 and 39
A published draft that has not reached a legislature, dated , as of .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
Where it has got to
The text described here is Proposed Cybersecurity Bill 2026, fourth draft for external consultation, published .
Locally, this stage is fourth draft of the Cybersecurity Bill 2026 released for external consultation by the Department of Information and Communications Technology.
The stage above is recorded at www.ict.gov.pg.
The Department of Information and Communications Technology lists the consultation as open from and closing on ; the bill carries no number, and its certification date is blank.
What it requires
- This is a bill in public consultation (the fourth draft, opened for comment on ) and binds no one unless Parliament passes it and it is certified; the lines below describe what it would require if passed as drafted. It would bind a CII operator, meaning a person or entity that owns, manages or controls a facility, system or service the Minister designates as critical information infrastructure by notice in the National Gazette (s. 31(1)); banking and financial systems, telecommunications networks, energy and power systems, transportation systems, water and sanitation systems, public health and hospital systems, government information and communications systems, extractive industry operational technology systems and educational institutions are taken to be designated unless the Minister specifies otherwise (s. 31(3)) (reached by declaring that you operate an essential service, provide financial services, provide telecom services or handle health records).
- Implement the minimum cybersecurity controls the Authority prescribes, appoint a Cybersecurity Officer for each CII facility or system and notify the Authority of the appointment within 30 days (ss. 32(a) and (b) and 33).
- Conduct a comprehensive cybersecurity risk assessment of each designated CII facility or system at least once in each calendar year, and submit a summary to the Authority within 30 days of its completion (s. 34).
- Submit to compliance audits by the Authority, which may enter and inspect your premises, inspect and copy your records and systems, and require you or any employee to answer questions and produce documents (s. 36).
- Do not procure or deploy ICT products or services in a CII facility or system unless you are satisfied that they meet the prescribed cybersecurity requirements (s. 37(1)).
- Comply with any minimum cybersecurity standard the Authority issues by notice in the National Gazette for designated CII operators (s. 32, Cybersecurity standards, subsection (3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 39(1) makes a CII operator's failure without reasonable excuse to comply with a requirement of Part IV an offence, with a fine not exceeding K200,000 or imprisonment for a term not exceeding 5 years, or both; section 39(2) sets a fine not exceeding K1,000,000 for a body corporate.
Penalty structure
A CII operator that fails without reasonable excuse to comply with a requirement of Part IV is liable to a fine of up to K200,000, or in the case of a body corporate up to K1,000,000 (s. 39).
- Rule
- Fixed only
- As of
- Currency
- PGK
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
The National Information and Communications Technology Authority, which the draft deems the National Cybersecurity Authority until a separate National Cybersecurity Authority is established.
What this law does
Section 31 of the Cybersecurity Bill 2026 would let the Minister, on the advice of the Authority, designate any computer system, network, facility or service as critical information infrastructure by notice published in the National Gazette.
Section 31(3) of the draft would take banking and financial systems, telecommunications networks, energy and power systems, transportation systems, water and sanitation systems, public health and hospital systems, government information and communications systems, extractive industry operational technology systems and educational institutions to be designated unless the Minister specifies otherwise.
Section 32 of the draft would require a CII operator to implement the minimum cybersecurity controls the Authority prescribes, appoint a Cybersecurity Officer, conduct annual risk assessments, report incidents, submit to compliance audits, comply with ICT supply chain security requirements and cooperate with the Authority.
Section 34 of the draft would require a CII operator to conduct a comprehensive cybersecurity risk assessment of each designated facility or system at least once in each calendar year. Section 39 of the draft would make a CII operator's failure without reasonable excuse to comply with a requirement of the Part an offence, with a fine of up to K200,000 or imprisonment of up to 5 years, or both, and for a body corporate a fine of up to K1,000,000. The draft states that the Act comes into operation on the date of certification.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, provides telecom services or handles health records.