Fiji builds cyber resilience with limited resources

This story is part of GovInsider's Digital Trust & Cybersecurity Champions 2026 Special Report.

In Fiji, cybersecurity spending is weighed against schools, healthcare, infrastructure, and relocating coastal communities, says the official overseeing the country’s digital transformation and cyber resilience.

With limited funding and talent, the island-nation is building its cyber defences around existing institutions, phased security requirements, and local capacity-building partnerships.

“We have very small budgets, so every dollar for cybersecurity matters”, says Tupou'tuah Baravilala, Director-General for Digital Government Transformation, Cybersecurity and Communications within Fiji’s Ministry of Policing and Communications, to GovInsider.

Across its 110 populated islands, Fiji has 96 per cent national broadband coverage, with more than 85 per cent of its population online.

As more Fijians use technology and more government services move online, cyber resilience is becoming increasingly important, she says. 

Baravilala leads the development of Fiji’s National Digital Strategy 2025-2030 and National Cybersecurity and Resilience Strategy 2026-2031 and now oversees their implementations.

Her approach starts with making better use of the institutions and expertise available.

“We don't have the luxury of time, funds or resources to build silos,” she says. 

Establishing clear responsibilities before incidents happen 

Baravilala’s team conducts a cybersecurity capacity assessment, alongside stakeholder consultations, to identify gaps in Fiji’s incident response, critical infrastructure protection, and national coordination. 

The cybersecurity strategy’s initial “Uplift” phase, running through 2027, focuses on establishing what Baravilala calls yavutu, or foundation.

This includes clarifying how agencies work together during an incident.

The newly-established Security Operations Centre (SOC) monitors government networks around the clock and acts as their first responder.

Fiji’s Computer Emergency Response Team (Fiji CERT) coordinates the major cyber incidents and serves as a point of contact for government, businesses, critical sectors and international partners. It has been operating since 2025.

Currently, the team is working to set up a Cyber Incident Crisis Committee and agreeing on thresholds for requesting international assistance.

Baravilala emphasises on testing these arrangements, so that agencies become familiar with their responsibilities before a crisis. Sector-specific pilot drills are also taking place.

The aim is for the response to become “a reflex muscle for agencies”, she says.

Consistency remains a challenge because agencies have different systems, pressures, and levels of readiness.  

Prioritising services and phasing requirements

Fiji’s resource constraints shape how it intends to identify and protect critical infrastructure. 

Baravilala starts with the impact on people: whether a disruption would prevent them from accessing power, water, healthcare, payments, telecommunications or government services. 

The risk assessment is also consulted with the industry to prioritise the critical infrastructure and critical information infrastructure sectors. 

Since most of Fiji’s networks are privately owned and operated, security expectations must  be developed with industry and account for differences in resources and readiness, she notes. 

“We need to meet organisations where they're at and clearly articulate what does ‘good’ look like,” she says. 

For smaller businesses, the starting point is low-cost, high-impact measures drawing on international guidance, including Australia’s Essential Eight. 

National baselines will be developed through consultation before new requirements are introduced. 

For designated operators, work is already underway on incident response plans supported by Fiji CERT templates and sector drills. 

Baravilala describes participation as central to the wider approach. 

“In the Pacific we call this the spirit of talanoa: let's meet, let's sit down, let's discuss,” she says. “It is inclusive, participatory and built on dialogue.” 

Building local expertise through international partnerships 

International cooperation gives Fiji access to technical expertise, but Baravilala wants that support to strengthen the country’s institutions. 

“The question we always ask is: when this ends, what stays in Fiji?” 

Fiji builds knowledge transfer into partnerships through training, exchanges and mentoring. It is also embedding cybersecurity into development and security agreements to align cooperation with national priorities over the longer term. 

As Fiji CERT grows, it is intended to serve as a support node for other Pacific Island countries. 

Baravilala also represents Fiji in international negotiations on cybersecurity and cybercrime. For her, participation helps ensure global discussions reflect the needs and constraints of smaller states. 

She defines digital sovereignty as having the ability to make informed choices about technology, data, and infrastructure while remaining open to cooperation. 

Building the workforce to support those choices is another priority. Fiji urgently needs incident response, security operations, digital forensics, and cyber risk and governance skills. 

“But I always say you don't need to be doing coding or be technical to be in this space,” she says. “We also need lawyers, policymakers, communicators and people who understand the business.” 

Fiji plans to develop a National Cybersecurity Education and Workforce Plan covering career pathways, retention and progression.

The country is also expanding internationally recognised certifications, academic-industry partnerships and internships, alongside rotations in cybersecurity roles for civil servants. 

Building security into digital inclusion 

A lawyer by qualification, Baravilala sees safeguarding rights, security and data as part of the responsibility of putting public services online. 

“I don't see security and inclusion as competing. People will only use digital services they trust,” she says. 

Through the Beyond Connected programme, 116 communities across six provinces, comprising more than 11,000 people, were recently connected for the first time, she says. 

Fiji is building cybersecurity into digital inclusion programmes, including cyber awareness through telecentres serving rural and remote communities.  

It is also planning cybersecurity modules in school curriculums, and a Cyber Champions network that will span government, communities, and businesses. 

Baravilala says the national cybersecurity website is already in place, while a national reporting portal is being developed.  

By the end of 2027, the strategy aims to reach at least 20 per cent of the population with cyber hygiene awareness. 

Baravilala will assess progress through whether organisations detect and report incidents earlier, coordinate effectively, and keep essential services running or restore them quickly. 

She also wants to know whether Fijians feel confident using the digital services they rely on every day. 

“As long as there are digital have-nots, the inequalities will continue to exist,” she says. “Cyber resilience is how we make sure no one is left behind.” 

​