TongaCybersecurity Act 2025, Critical Infrastructure Operator Obligations
Act 14 of 2025, ss. 11-14, 16-17
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0037/CybersecurityAct2025_1.pdfA sector security regimes rule binding public and private bodies.
What it requires
- It reaches you only once the Minister responsible for cybersecurity policy and regulation (Minister CPR) has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 and published that designation in the Government Gazette; grounds for designation include infrastructure necessary for electronic communications, banking or other financial services, electrical energy, public transportation, other public utilities, or public safety and public health including emergency services.
- Once designated, register with the Minister CPR, notify the Minister CPR of any change in your legal ownership or in the person or entity operating the infrastructure, and conduct and submit periodic cybersecurity self-assessments to the Ministry CPR in the form and manner it prescribes.NIST CSF 2.0GV.OC-03NIST CSF 2.0ID.IM-01
- Comply with any minimum standards the Minister CPR issues for critical infrastructure, submit to the Minister CPR's periodic and ad hoc audits and inspections of your compliance, and comply with any order the Minister CPR makes to take remedial, protective or preventative action following an audit, an assessment, or a reported incident.NIST CSF 2.0GV.OC-03
- Develop, maintain and implement policies, practices and procedures to detect, share information about, mitigate and respond to cybersecurity threats and incidents, communicate them to your staff, and keep records evidencing your compliance available to the Minister CPR on request.NIST CSF 2.0ID.IM-04
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- ID.IM-01Improvements are identified from evaluations
- ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
- CIS Controls
- 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 8.2Turning on and gathering logs from the enterprise's systems.
1 more
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
- 1.1Policy on the security of network and information systems
- 1.2Roles, responsibilities and authorities
- 2.1Risk management framework
- 2.2Compliance monitoring
- 3.1Incident handling policy
- 3.2Monitoring and logging
11 more
- 3.4Event assessment and classification
- 3.5Incident response
- 3.6Post-incident reviews
- 4.1Business continuity and disaster recovery plan
- 4.3Crisis management
- 6.2Secure development life cycle
- 6.5Security testing
- 6.10Vulnerability handling and disclosure
- 9.1Cryptography
- 11.2Management of access rights
- 12.4Asset inventory
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Section 19(3) sets two separate fixed ceilings by class of contravener: not exceeding $500,000 for an individual and not exceeding $1,000,000 for a body corporate. The Act does not define the currency the bare "$" denotes; Tonga's legal tender is the Pa'anga (ISO 4217: TOP), confirmed on the National Reserve Bank of Tonga's own site (reservebank.to); that currency is recorded here in the absence of an express definition in the Act itself. The amount is a court-ordered civil pecuniary penalty recovered through a civil action the Attorney General institutes under section 18, not a fixed administrative fine or a criminal sentence: section 19(2) directs the court to set the amount for each contravention having regard to its nature and extent, any resulting loss or damage, the circumstances, and any prior finding of similar conduct by the same operator, up to the applicable ceiling.
- Rule
- Fixed only
- As of
- Currency
- TOP
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
The Attorney General, who may institute civil proceedings in a court of competent jurisdiction against an operator of critical infrastructure for a pecuniary penalty; the Minister responsible for cybersecurity policy and regulation (Minister CPR) administers registration, standards, audits, and remedial-action orders under Part V.
Settledness
- As of
- Open questions
- Has Cabinet proclaimed a commencement date for the Cybersecurity Act 2025 under section 1(2), and if so what is it?
- Which infrastructure assets, systems or networks, if any, has the Minister responsible for cybersecurity policy and regulation designated as critical infrastructure under section 11, since every duty in this instrument binds only an operator so designated?
- Does the pecuniary-penalty cap in section 19(3), stated only as "$500,000" and "$1,000,000", denote the Tongan Pa'anga or another currency?
What it reaches
Obligation class
Governance, Reporting, Security
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- The Minister responsible for cybersecurity policy and regulation has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 of the Cybersecurity Act 2025, and published that designation in the Government Gazette.
What this law does
Sections 11 to 14, 16 and 17 of the Cybersecurity Act 2025 let the Minister responsible for cybersecurity policy and regulation designate any physical, electronic or virtual infrastructure asset, system or network as critical infrastructure by publication in the Government Gazette, on grounds that include electronic communications, banking or other financial services, electrical energy, public transportation, other public utilities, and public safety or public health including emergency services.
A designated operator must register and keep the register current, comply with the Minister's minimum standards and submit to periodic or ad hoc audits, conduct and submit periodic cybersecurity self-assessments, comply with any order to take remedial, protective or preventative action, and develop, implement, communicate to staff, and keep records of policies and procedures for detecting, sharing information about, mitigating and responding to cybersecurity threats and incidents.
Section 1(2) provides that the Act comes into force on a date proclaimed by Cabinet. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, provides telecom services or handles health records.
Back to the example · Lint your app
Page updated .