CERT Tonga: Pioneers in the Pacific

By Hadyn Green (FIRST.org CCB)
July 15, 2026 07:00 TOT (+13:00)

Pioneers in cybersecurity don’t have to be big players with all the money. Sometimes it’s a dedicated team that sees a need in the community. Tonga was the first Pacific nation to build their own CERT, and in doing so they completely changed the narrative.

A Pacific CERT had previously been created in line with the traditional model that assumed CERTs need large teams, giant budgets and complex plans. This CERT did not last..

While there can be a full checklist of recommended actions and software requirements, all you really need to be a CERT is an email address. Even if all you do is pass on CVEs and other threat intel to your constituents, you’ve increased the security profile for your country.

Once Tonga’s CERT was established, every other Pacific nation needed to have one and it needed to be better than Tonga’s. As in many regions around the globe, there is a friendly rivalry between nations in the Pacific – in this case, each country wanted to have the best cyber defense, this is the type of competition FIRST likes to see. Even New Zealand used Tonga as an example to prove they needed a CERT.

The story behind Tonga’s CERT is special, with the at the time, Deputy Prime Minister pushing through the idea and helping to speed up the process that was planned to be run over many months and instead doing it in just one.

Today, July 15, is the 10th anniversary of CERT Tonga, a remarkable achievement and one that needs to be celebrated.

‘Esau Tupou joined CERT Tonga in late 2022. He knows how tough the early days were for the Pacific’s first CERT and wanted to ensure that those who started the project were saluted.

“They started out small, not many staff and not many resources, but it’s a little flame that's still burning.”

Along with Otukolo “Kolo” Tokai, who is still at CERT Tonga doing the good work after 10 years, the original team is known as the “three musketeers”: Former Director Siosaia CEO Vaipuna, – Director (2016 –- 2022); Dr. Paula Latapu, – Senior Engagement Officer (2016 –- 2018); Mrs. Pelenita (Brenda) ‘Atoa, – Senior Engagement Officer (2018 –- 2026). And of course, the founder Hon. Siaosi Sovaleni (Hu’akavameiliku), – founder, former Prime Minister and Minister for Health and Public Enterprise.

“We are going to have a cyber week to commemorate the 10th anniversary of CERT Tonga. We were planning to do it in July when we were created, but since there's lots of other events happening, we decided to postpone it to maybe October, so we can commemorate it properly with a Cyber Week.”

A full week of activities is planned, with partners and international friends invited to co-host capture the flag sessions, trainings, or tabletop exercises.

“We're also planning to do a national cyber drill. We haven't had one in Tonga yet, but it would be good since we've been experiencing a few cyberattacks at the national level. For example, we had two major ransomware attacks. And we know there's still a few that's not reported, or they get reported a few months or a year late. We’re thinking a national cyber drill will help to get everyone aware of who to contact and where they can get support and assistance during an incident.”

The drill is designed to be a continuation of previous work and to fill the gap in the coordination aspects that were missing. Being part of their community helps CERT Tonga in that effort. While the team isn't big, they are fully part of their community. And they are constantly talking about their work online across social media and with colleagues in the Pacific and beyond.

CERT Tonga is currently a member of PaCSON, APCERT, GFCE and the ultimate goal from its 10th Anniversary is to become a member of FIRST.

This is what we can learn from Tonga. There isn’t a prescription for creating a CERT. You don’t need dozens of staff and piles of cash, just a determination to create a more secure environment.