
Loading

Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.

An audit of Papua New Guinea's Civil and Identity Registry has recommended upgrades to the country's foundational identity infrastructure as the government pursues its digital transformation agenda.
Summary
The final report of the audit conducted by the Department of Information and Communication Technology (DICT) was handed over on November 4 to the Registrar General, Leslie Simon, by DICT Acting Deputy Secretary for Digital Government Delivery and Coordination, Jessy Sekere. The report was approved by DICT Secretary Steven Matainaho. According to DICT, the 10-day audit will help guide improvements to the registry's ICT infrastructure as the government accelerates its digital identity and digital government initiatives.
The officials confirmed that the audit covered several aspects, including ICT systems and infrastructure, ICT compliance, cybersecurity, data governance, government cloud services, core database management, and disaster recovery and resilience. Although details of the audit have not been made public, the Registrar General said the exercise became necessary after his team identified several legacy ICT problems within the Civil and Identity Registry. He cited concerns related to the age of existing infrastructure and the possibility of losing critical government data if an upgrade was not undertaken.
The audit recommends improvements to disaster recovery and core database management, among other areas. DICT also emphasized the need to improve birth registration and access to identity documents as part of PNG's digital transformation. PNG is developing its digital public infrastructure ecosystem, including the legal framework needed to support its national digital identity services.
The country launched its SevisPass digital ID and SevisWallet in November 2025, built by Swiss firm Tech5. The government has since introduced a Bill for Digital Identity and Verifiable Credentials to provide the legal framework for SevisPass, SevisWallet, SevisDEx, and other verifiable credentials. The draft legislation includes a non-exclusion guarantee, which means no person may be denied access to an essential government service solely because they do not hold SevisPass.
Simon welcomed the audit and committed to implementing its recommendations and developing proposals for further ICT improvements. He noted that the partnership with the DICT will help build a strong digital trust system, which is vital in realising the government's digital identity and broader digital transformation ambitions. The audit highlights the importance of reliable civil registration systems as countries expand digital identity and other digital public infrastructure services.
KazaSec's take
Most public cloud incidents trace back to a misconfiguration, an overly permissive IAM role, a storage bucket left open, a default setting nobody revisited, rather than a flaw in the cloud provider itself. A cloud security review is built to catch exactly that class of mistake before it's found the hard way.
Coverage details
We've archived 16 other articles touching the same topic (papua new guinea, id for all, government services) , see the full security news archive.
Relevant from KazaSec
More coverage on this topic
We help organizations find and fix the gaps before they make headlines.