Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City
17% CONGRESS
Second Regular Session

House Bill No, 7135

Introduced by Representative Wes Gatchalian

EXPLANATORY NOTE,

Itisa landmark of this century that commerce now resides in the cloud, Through the
internet, transactions between parties continents apart can be consummated real time.
‘Through the internet a holder of an account on the other side of the globe can manipulate his
affairs at the click of a button. Through this connectivity corporations are able to manage
their affairs with greater fluidity and efficiency. We have well and truly left the medieval age
of notes and bills of exchanges. As is usually the case however, men with malicious designs
attempt to exploit this system. Just as how commerce has changed its face, so has the
criminal. Gone are the days where the bandit is armed with a mask and a revolver sinisterly
awaiting his victim. In today’s connected world, robbers are armed with keyboards and
codes exploiting vulnerabilities in a network system which was never designed to handle the
flow of wealth it now facilitates. The aim of this bill is to protect against these vulnerabilities
by establishing rules and standards of corporate cyber-security.

According to the World Economic Forum (WEF) companies lose an estimate of four-
hundred billion dollars ($ 400 B) each year due to hacking and cyber-attacks. These figures
grow more and more each year, as in fact Forbes estimates that by 2019 this figure could
shoot up to two-trillion doliars ($ 2T). In 2017, here in our own country, we have seen this
threat as throughout the year our banking institutions had to answer investigations
regarding loss deposits and changes in balances of their account holders. The BSP itself has
recognized that more and more cybercrime is becoming the leading threat to Philippine
Banks.

This law mandates our financial and security entities to adopt cybersecurity
programs based on their individual vulnerabilities. it requires a regular check up of their
information systems. It mandates the appointment of an Information Security Officer who
shall be the person in charge and accountable in focusing on the security of the entity's
information system. In addition it mandates transparency in the event of an attack so that
the government is able to take steps to protect its citizens.

It is there high time to implement and adopt measures that will protect our hard
earned money. We have seen in other jurisdictions what vulnerabilities in their networks
have led to. We should learn from their errors and adopt their effective practices.



Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City
17% CONGRESS
Second Regular Session

7135

House Bill No.

Introduced by Representative Wes Gatchalian

AN ACT
ESTABLISHING CORPORATE CYBERSECURITY STANDARDS FOR BANKS,
FINANCIAL INSTITUTIONS AND SECURITIES

Section 1. Short Title -

This Act shall be known as the “Corporate Cybersecurity Act of 2018.”
Section 2 Definitions -
The following definitions shall apply:

(a) Affiliate means any Person that controls, is controlled by or is under common
control with another Person. For purposes of this subsection, control means the
Possession, direct or indirect, of the power to direct or cause the direction of the
management and policies of a Person, whether through the ownership of stock of
such Person or otherwise.

(b) Authorized User means any employee, contractor, agent or other Person that
participates in the business operations of a Covered Entity and is authorized to
access and use any Information Systems and data of the Covered Entity,

(©) Covered Entity means any Person operating under or required to operate
under a license, registration, charter, certificate, permit, accreditation or similar
authorization under the General Banking Law, the Insurance Code, the Financing
Company Act or the Revised Securities Act.

(A) Cybersecurity Event means any act or attempt, successful or unsuccessful, to
gain unauthorized access to, disrupt or misuse an Information System or
information stored on such Information System.

(e) Information System means a discrete set of electronic information resources


organized for the collection, processing, maintenance, use, sharing
dissemination or disposition of electronic information, as well as any specialized
system such as industrial/process controls systems, telephone switching and
private branch exchange systems, and environmental control systems.

() Multi-Factor Authentication means authentication through verification of at
least two of the following types of authentication factors:

(1) Knowledge factors, such as a password; orfi(2) Possession factors, such as a
token or text message on a mobile phone; or (3) Inherence factors, such as a
biometric characteristic.

(g) Nonpublic Information shall mean all electronic information that is not
Publicly Available Information and is:

(1) Business related information of a Covered Entity the tampering with which,
or unauthorized disclosure, access or use of which, would cause a material
adverse impact to the business, operations or security of the Covered Entity;

(2) Any information concerning an individual which because of name, number,
personal mark, or other identifier can be used to identify such individual, in
combination with any one or more of the following data elements: (i) social
security number, (ii) drivers’ license number or non-driver identification card
number, (Iii) account number, credit or debit card number, (iv) any security
code, access code or password that would permit access to an individual's
financial account, or (v) biometric records;

(3) Any information or data, except age or gender, in any form or medium
created by or derived from a health care provider or an individual and that
relates to (i) the past, present or future physical, mental or behavioral health or
condition of any individual or a member of the individual's family, (ii) the
provision of health care to any individual, or (iii) payment for the provision of
health care to any individual.

(h) Penetration Testing means a test methodology in which assessors attempt to
circumvent or defeat the security features of an Information System by
attempting penetration of databases or controls from outside or inside the
Covered Entity’s Information Systems.

(i) Person means any individual or any non-governmental entity, including but
not limited to any non- governmental partnership, corporation, branch, agency


or association.

(i) Publicly Available Information means any information that a Covered Entity
has a reasonable basis to believe is lawfully made available to the general public
from: federal, state or local government records; widely distributed media; or
disclosures to the general public that are required to be made by federal, state or
local law.

(1) For the purposes of this subsection, a Covered Entity has a reasonable basis
to believe that information is lawfully made available to the general public if the
Covered Entity has taken steps to determine:

(i) That the information is of the type that is available to the general public; and

(ii) Whether an individual can direct that the information not be made available
to the general public and, if so, that such individual has not done so.

(k) Risk Assessment means the risk assessment that each Covered Entity is
required to conduct under section 9 of this law.

(I) Risk-Based Authentication means any risk-based system of authentication that
detects anomalies or changes in the normal use patterns of a Person and requires
additional verification of the Person's identity when such deviations or changes
are detected, such as through the use of challenge questions.

(m) Senior Officer(s) means the senior individual or individuals (acting
collectively or as a committee) responsible for the management, operations,
security, information systems, compliance and/or risk of a Covered Entity,
including a branch or agency of a foreign banking organization subject to this
Part.

(n) Third Party Service Provider(s) means a Person that (i) is not an Affiliate of
the Covered Entity, (ii) provides services to the Covered Entity, and (iii)
maintains, processes or otherwise is permitted access to Nonpublic Information
through its provision of services to the Covered Entity.

(0) Department. Refers to the Department of Information and Communications
Technology (DICT) or any of its authorized officer or agent.

Section 3. Cybersecurity Program -

(a) Cybersecurity Program. Each Covered Entity shall maintain a cybersecurity


Program designed to protect the confidentiality, integrity and availability of the
Covered Entity’s Information Systems.

(b) The cybersecurity program shall be based on the Covered Entity’s Risk
Assessment and designed to perform the following core cybersecurity functions:

(1) identify and assess internal and external cybersecurity risks that may
threaten the security or integrity of Nonpublic Information stored on the
Covered Entity's Information Systems;

(2) use defensive infrastructure and the implementation of policies and
procedures to protect the Covered Entity’s Information Systems, and the
Nonpublic Information stored on those Information Systems, from unauthorized
access, use or other malicious acts;

(3) detect Cybersecurity Events;2(4) respond to identified or detected
Cybersecurity Events to mitigate any negative effects; (5) recover from
Cybersecurity Events and restore normal operations and services; and2i(6) fulfill
applicable regulatory reporting obligations.

(©) A Covered Entity may meet the requirement(s) of this Part by adopting the
relevant and applicable provisions of a cybersecurity program maintained by an
Affiliate, provided that such provisions satisfy the requirements of this Part, as
applicable to the Covered Entity.

(4) All documentation and information relevant to the Covered Entity’s
cybersecurity program shall be made available to the superintendent upon
request.

Section 4 Cybersecurity Policy -

Cybersecurity Policy. Each Covered Entity shall implement and maintain a
written policy or policies, approved by a Senior Officer or the Covered Entity’s
board of directors (or an appropriate committee thereof) or equivalent
Boverning body, setting forth the Covered Entity's policies and procedures for
the protection of its Information Systems and Nonpublic Information stored on
those Information Systems. The cybersecurity policy shall be based on the
Covered Entity’s Risk Assessment and address the following areas to the extent
applicable to the Covered Entity’s operations:

(@) information security;0(b) data governance and classification;ti(c) asset


inventory and device management;fi(d) access controls and identity
management;@(e) business continuity and disaster recovery planning and
resources; (f) systems operations and availability concerns;{i(g) systems and
network security;@(h) systems and network monitoring;@(i) systems and
application development and quality assurance; (j) physical security and
environmental controls;(k) customer data privacy;{i(I) vendor and Third Party
Service Provider management; (m) risk assessment; and®\(n) incident response.

Section 5 Chief Information Security Officer -

(a) Chief Information Security Officer. Each Covered Entity shall designate a
qualified individual responsible for overseeing and implementing the Covered
Entity’s cybersecurity program and enforcing its cybersecurity policy (for
purposes of this Part, “Chief Information Security Officer” or “CISO"). The CISO
may be employed by the Covered Entity, one of its Affiliates or a Third Party
Service Provider. To the extent this requirement is met using a Third Party
Service Provider or an Affiliate, the Covered Entity shall:

(2) retain responsibility for compliance with this Law;

(2) designate a senior member of the Covered Entity’s personnel responsible for
direction and oversight of the Third Party Service Provider; and

(3) require the Third Party Service Provider to maintain a cybersecurity program
that protects the Covered Entity in accordance with the requirements of this
Part.

(b) Report. The CISO of each Covered Entity shall report in writing at least
annually to the Covered Entity’s board of directors or equivalent governing body.
If no such board of directors or equivalent governing body exists, such report
shall be timely presented to a Senior Officer of the Covered Entity responsible for
the Covered Entity's cybersecurity program. The CISO shall report on the
Covered Entity’s cybersecurity program and material cybersecurity risks. The
CISO shall consider to the extent applicable

(1) the confidentiality of Nonpublic Information and the integrity and security of
the Covered Entity's Information Systems;

(2) the Covered Entity’s cybersecurity policies and procedures;

(3) material cybersecurity risks to the Covered Entity;


(4) overall effectiveness of the Covered Entity’s cybersecurity program; and

(5) material Cybersecurity Events involving the Covered Entity during the time
period addressed by the report.

Section 6 Penetration Testing and Vulnerability Assessments -

The cybersecurity program for each Covered Entity shall include monitoring and
testing, developed in accordance with the Covered Entity’s Risk Assessment,
designed to assess the effectiveness of the Covered Entity’s cybersecurity
program. The monitoring and testing shall include continuous monitoring or
periodic Penetration Testing and vulnerability assessments. Absent effective
continuous monitoring, or other systems to detect, on an ongoing basis, changes
in Information Systems that may create or indicate vulnerabilities, Covered
Entities shall conduct:

(a) annual Penetration Testing of the Covered Entity's Information Systems
determined each given year based on relevant identified risks in accordance with
the Risk Assessment; and

(b) bi-annual vulnerability assessments, including any systematic scans or
reviews of Information Systems reasonably designed to identify publicly known
cybersecurity vulnerabilities in the Covered Entity’s Information Systems based
on the Risk Assessment.

Section 7 Audit Trail -

(a) Each Covered Entity shall securely maintain systems that, to the extent
applicable and based on its Risk Assessment:

(1) are designed to reconstruct material financial transactions sufficient to
support normal operations and obligations of the Covered Entity; and

(2) include audit trails designed to detect and respond to Cybersecurity Events
that have a reasonable likelihood of materially harming any material part of the
normal operations of the Covered Entity.

(b) Each Covered Entity shall maintain records required by section 7(a)(1) of
this Part for not fewer than five years and shall maintain records required by
section 7(a)(2) of this law for not fewer than three years.

Section 8 Access Privileges -


As part of its cybersecurity program, based on the Covered Entity’s Risk
Assessment each Covered Entity shall limit user access privileges to Information
Systems that provide access to Nonpublic Information and shall periodically
review such access privileges.

Section 9 Application Security -

(a) Each Covered Entity’s cybersecurity program shall include written
procedures, guidelines and standards designed to ensure the use of secure
development practices for in-house developed applications utilized by the
Covered Entity, and procedures for evaluating, assessing or testing the security
of externally developed applications utilized by the Covered Entity within the
context of the Covered Entity’s technology environment.

(b) All such procedures, guidelines and standards shall be periodically reviewed,
assessed and updated as necessary by the CISO (or a qualified designee) of the
Covered Entity.

Section 10 Risk Assessment -

(a) Each Covered Entity shall conduct a periodic Risk Assessment of the Covered
Entity’s Information Systems sufficient to inform the design of the cybersecurity
program as required by this law. Such Risk Assessment shall be updated as
reasonably necessary to address changes to the Covered Entity’s Information
Systems, Nonpublic Information or business operations. The Covered Entity's
Risk Assessment shall allow for revision of controls to respond to technological
developments and evolving threats and shall consider the particular risks of the
Covered Entity’s business operations related to cybersecurity, Nonpublic
Information collected or stored, Information Systems utilized and the availability
and effectiveness of controls to protect Nonpublic Information and Information
Systems.

(b) The Risk Assessment shall be carried out in accordance with written policies
and procedures and shall be documented. Such policies and procedures shall
include:

(1) criteria for the evaluation and categorization of identified cybersecurity risks
or threats facing the Covered Entit

(2) criteria for the assessment of the confidentiality, integrity, security and
availability of the Covered Entity's Information Systems and Nonpublic


Information, including the adequacy of existing controls in the context of
identified risks; and

(3) requirements describing how identified risks will be mitigated or accepted
based on the Risk Assessment and how the cybersecurity program will address
the risks,

Section 11 Cybersecurity Personnel and Intelligence -

(a) Cybersecurity Personnel and Intelligence. In addition to the requirements set
forth in section 5(a) of this law, each Covered Entity shall

(1) utilize qualified cybersecurity personnel of the Covered Entity, an Affiliate or
a Third Party Service Provider sufficient to manage the Covered Entity’s
cybersecurity risks and to perform or oversee the performance of the core
cybersecurity functions specified in section 3(b)(1)-(6) of this Law;

(2) provide cybersecurity personnel with cybersecurity updates and training
sufficient to address relevant cybersecurity risks; and

(3) verify that key cybersecurity personnel take steps to maintain current
knowledge of changing cybersecurity threats and countermeasures.

(b) A Covered Entity may choose to utilize an Affiliate or qualified Third Party
Service Provider to assist in complying with the requirements set forth in this
Law, subject to the requirements set forth in section 12 of this Law.

Section 12. Third Party Service Provider Security Policy -

(a) Third Party Service Provider Policy. Each Covered Entity shall implement
written policies and procedures designed to ensure the security of Information
Systems and Nonpublic Information that are accessible to, or held by, Third Party
Service Providers. Such policies and procedures shall be based on the Risk
Assessment of the Covered Entity and shall address to the extent applicable:

(1) the identification and risk assessment of Third Party Service Providers;

(2) minimum cybersecurity practices required to be met by such Third Party
Service Providers in order for them to do business with the Covered Entity;

(3) due diligence processes used to evaluate the adequacy of cybersecurity
practices of such Third Party Service Providers; and


(4) periodic assessment of such Third Party Service Providers based on the risk
they present and the continued adequacy of their cybersecurity practices.

(b) Such policies and procedures shall include relevant guidelines for due
diligence and/or contractual protections relating to Third Party Service
Providers including to the extent applicable guidelines addressing:

(1) the Third Party Service Provider's policies and procedures for access
controls, including its use of Multi-Factor Authentication as required by section
13 of this Part, to limit access to relevant Information Systems and Nonpublic
Information;

(2) the Third Party Service Provider's policies and procedures for use of
encryption as required by section 6 of this Part to protect Nonpublic Information
in transit and at rest;

(3) notice to be provided to the Covered Entity in the event of a Cybersecurity
Event directly impacting the Covered Entity’s Information Systems or the
Covered Entity's Nonpublic Information being held by the Third Party Service
Provider; and

(4) representations and warranties addressing the Third Party Service
Provider's cybersecurity policies and procedures that relate to the security of the
Covered Entity's Information Systems or Nonpublic Information.

(c) Limited Exception. An agent, employee, representative or designee of a
Covered Entity who is itself a Covered Entity need not develop its own Third
Party Information Security Policy pursuant to this section if the agent, employee,
representative or designee follows the policy of the Covered Entity that is
required to comply with this Part.

Section 13 Multi-Factor Authentication -

(a) Multi-Factor Authentication. Based on its Risk Assessment, each Covered
Entity shall use effective controls, which may include Multi-Factor
Authentication or Risk-Based Authentication, to protect against unauthorized
access to Nonpublic Information or Information Systems.

(b) Multi-Factor Authentication shall be utilized for any individual accessing the
Covered Entity’s internal networks from an external network, unless the Covered
Entity’s CISO has approved in writing the use of reasonably equivalent or more


secure access controls.
Section 14 Limitations on Data Retention -

As part of its cybersecurity program, each Covered Entity shall include policies
and procedures for the secure disposal on a periodic basis of any Nonpublic
Information identified in section 2(g)(2)-(3) of this law that is no longer
necessary for business operations or for other legitimate business purposes of
the Covered Entity, except where such information is otherwise required to be
retained by law or regulation, or where targeted disposal is not reasonably
feasible due to the manner in which the information is maintained,

Section 15 Training and Monitoring -
As part of its cybersecurity program, each Covered Entity shall:

(a) implement risk-based policies, procedures and controls designed to monitor
the activity of Authorized Users and detect unauthorized access or use of, or
tampering with, Nonpublic Information by such Authorized Users; and

(b) provide regular cybersecurity awareness training for all personnel that is
updated to reflect risks identified by the Covered Entity in its Risk Assessment,

Section 16 Encryption of Nonpublic Information -

(a) As part of its cybersecurity program, based on its Risk Assessment, each
Covered Entity shall implement controls, including encryption, to protect
Nonpublic Information held or transmitted by the Covered Entity both in transit
over external networks and at rest.

() To the extent a Covered Entity determines that encryption of Nonpublic
Information in transit over external networks is infeasible, the Covered Entity
may instead secure such Nonpublic Information using effective alternative
compensating controls reviewed and approved by the Covered Entity's CISO,

(2) To the extent a Covered Entity determines that encryption of Nonpublic
Information at rest is infeasible, the Covered Entity may instead secure such
Nonpublic Information using effective alternative compensating controls
reviewed and approved by the Covered Entity's CISO.

(b) To the extent that a Covered Entity is utilizing compensating controls under
(a) above, the feasibility of encryption and effectiveness of the compensating


controls shall be reviewed by the CISO at least annually.
Section 17 Incident Response Plan -

(a) As part of its cybersecurity program, each Covered Entity shall establish a
written incident response plan designed to promptly respond to, and recover
from, any Cybersecurity Event materially affecting the confidentiality, integrity
or availability of the Covered Entity’s Information Systems or the continuing
functionality of any aspect of the Covered Entity’s business or operations.

(b) Such incident response plan shall address the following areas: (1) the
internal processes for responding to a Cybersecurity Event;

(2) the goals of the incident response plan;

(3) the definition of clear roles, responsibilities and levels of decision-making
authority;

(4) external and internal communications and information sharing;

(5) identification of requirements for the remediation of any identified
weaknesses in Information Systems and associated controls;

(6) documentation and reporting regarding Cybersecurity Events and related
incident response activities; and

(7) the evaluation and revision as necessary of the incident response plan
following a Cybersecurity Event.

Section 18 Notices to Department -

(a) Notice of Cybersecurity Event. Each Covered Entity shall notify the
Department as promptly as possible but in no event later than 72 hours from a
determination that a Cybersecurity Event has occurred that is either of the
following:

(2) Cybersecurity Events impacting the Covered Entity of which notice is
required to be provided to any government body, self-regulatory agency or any
other supervisory body; or

(2) Cybersecurity Events that have a reasonable likelihood of materially harming
any material part of the normal operation(s) of the Covered Entity.


(b) Annually each Covered Entity shall submit to the department a written
statement covering the prior calendar year. This statement shall be submitted by
February 15 in such form set forth as Appendix A, certifying that the Covered
Entity is in compliance with the requirements set forth in this Law. Each Covered
Entity shall maintain for examination by the Department all records, schedules
and data supporting this certificate for a period of five years. To the extent a
Covered Entity has identified areas, systems or processes that require material
improvement, updating or redesign, the Covered Entity shall document the
identification and the remedial efforts planned and underway to address such
areas, systems or processes. Such documentation must be available for
inspection by the superintendent.

Section 19 Confidentiality -

Information provided by a Covered Entity pursuant to this Part is subject to
exemptions from disclosure under the Banking Law, Insurance Law, Financial
Services Law, Public Officers Law or any other applicable statutes.

Section 20 Exemptions -
(a) Limited Exemption. Each Covered Entity with:

(1) fewer than 10 employees, including any independent contractors, of the
Covered Entity or its Affiliates located in New York or responsible for business of
the Covered Entity, or

(2) less than P 5,000,000 in gross annual revenue in each of the last three fiscal
years from domestic business operations of the Covered Entity and its Affiliates,
or

(3) less than P10,000,000 in year-end total assets, calculated in accordance with
generally accepted accounting principles, including assets of all Affiliates, shall
be exempt from the requirements of sections 5, 6, 7, 9, 11, 13, 15, 16, and 17 of
this Law.

(b) An employee, agent, representative or designee of a Covered Entity, who is
itself a Covered Entity, is exempt from this Part and need not develop its own
cybersecurity program to the extent that the employee, agent, representative or
designee is covered by the cybersecurity program of the Covered Entity.

(0) A Covered Entity that does not directly or indirectly operate, maintain, utilize


or control any Information Systems, and that does not, and is not required to,
directly or indirectly control, own, access, generate, receive or possess Nonpublic
Information shall be exempt from the requirements of sections 3, 4, 5, 6, 7, 8, 9,
11, 13, 15, 16, and 17 of this Law.

(d) A Covered Entity that qualifies for any of the above exemptions pursuant to
this section shall file a Notice of Exemption in the form set forth as Appendix B
within 30 days of the determination that the Covered Entity is exempt.

(€) In the event that a Covered Entity, as of its most recent fiscal year end, ceases
to qualify for an exemption, such Covered Entity shall have 180 days from such
fiscal year end to comply with all applicable requirements of this Part.

Section 20. Implementing Rules -
The Department of Information and Communications Technology (DICT) in
coordination with the Securities and Exchange Commission (SEC), the Banko
Sental ng Pilipinas (BSP), and the Insurance Commission are hereby mandated to
promulgate rules and regulation for the effective implementation of this Act.

Section 21 Effective Date -

This Act shall take effect fifteen (15) days after its publication in the Official
Gazette or in a newspaper of general circulation.

Section 22 Transitional Periods -

(a) Transitional Period. Covered Entities shall have 180 days from the effective
date of this Part to comply with the requirements set forth in this Part, except as
otherwise specified.

(b) The following provisions shall include additional transitional periods.
Covered Entities shall have:

(1) One year from the effective date of this law to comply with the requirements
of sections 5 (b), 6, 10, 13, and 15(b) of this law.

(2) Eighteen months from the effective date of this law to comply with the
requirements of sections 7, 9, 14, 15 (a) and 16 of this law.

(3) Two years from the effective date of this law to comply with the
requirements of section 11 of this law.

Section 23. Separability Clause -


If any portion or provision of this A
remaining portions or
declaration.

ct is declared void or unconstitutional, the
Provisions thereof shall not be affected by such