Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City
NINETEENTH CONGRESS
Second Regular session     .
HousE BILL No. Jfl3±3
Introduced  by:  Hon.  Keith Micah ``Afty.  Mike" D,L. Tan
AN Aor
INSTITUTIONALIZING  POLICIES  FOR A  SECURE,  TRUSTED,  ANE)  RELIABLE  CYBERSPACE,
STRENGTHENING   THE    GOVERNANCE    OF   CYBERSECuRITY,    ESTABLISHING    FOR   THE
PURPOSE   THE   PHILIPPINE   CYBERSECuRITY   COUNCIL,   AND   APPROPIVATING   FUNDS
THEREFOR
EXPLANATORY NOTE
I The  1987 Constitution provides that "the maintenance of peace and order, the protection of life,
liberty and  property and  the  promotion  of the  general  welfare  are  essential  for the  enjoyment of the
people of all the  blessings of democracy" (Article 11,  Section  5).
Towards this end, the  Philippine  Development Plan  (PDP) seeks to ensure peace and security of
the  Filipinos  amid  the  rapid  growth  and  increased  sophistication  of cybercrimes  and  cyberattacks that
made data, structures, and our people vulnerable. This is in the face of accelerating tempo of progress
and  technology, which  have  placed the country and the  rest of the world  at the crossroads of change
where opportunities and threats diverge.
The  Philippines,  as  it  seeks  to  position  itself  to  become  a  pivotal  player  in  this  digital  age,  is
vulnerable to attacks.
The  International  Telecommunications  Union's  2021  Global  Cybersecurity  Index  (GCI)  ranked
the  Philippines  61st out of  194  countries  in  terms  of commitment  in  adopting  cybersecurity  practices.
The  Russian  cybersecurity  firm  Kaspersky,  in  2022,  came  up  with  a  global  ranking  of countries  with
most online threats detected where the  Philippines  moved  up to 4th  place from  5th  in  2020.  A total  of
50,544,908 web threats were detected by Kaspersky in the Philippines in 2021 alone.
Kaspersky   data   also   shows   that  web  threat  attempts   against   Filipino   users   of  Kaspersky
software   grew   432.75%   from   9,487,775   in   2017   to   50,544,908   in   2021.   During   the   COVID-19
pandemic,  the  overall  cyber-attacks  versus  local  businesses  rose  by  141%  from  2019  with  2,549,698
cyberattacks to 2021 with 6,150,891.
In   order  to  enhance  our  cybersecurity  capabilities,   institutionalizing  the  existing   policies  on
cybersecurity  is  indispensable,  particularly  the  current  National  Cybersecurity  Plan,  which  echoes  the
need  to  strengthen  the  country's  policy  framework  on  cybersecurity  to  promote  peace  and  security
alongside economic growth and development.
As the  most pivotal  pillar of cybersecurity strategy,  the creation  of the  proper policy framework
in  the  face  of  misaligned  incentives,  asymmetric  information,  and  externalities  is  urgently  needed,
especially   because   certain   cybersecurity   policies   under   the   National   Cybersecurity   Plan   require
legislation.  This  will  help  set  societal  standards  and  norms  at  all  levels  of government,  lay  down  the
foundation   for  executive   action,   and   secure   the   cooperation   of  the   public.   Thus,   this   proposed
``Cybersecu rity Act''.
Among  its  salient features  include the  institutionalization  of the  Philippine  Cybersecurity Council
(PCSC),  which  shall  be  an  inter-agency  body  administratively  attached  to  the  Office  of the  President
and  headed  by  the  Director-General  of the  National  Intelligence  Coordinating  Ageney  (NICA)  and  co-
chaired   by   the   Executive   Secretary   and   the   Secretary   of   the   Department   of   Information   and


Communications Technology (DICT),  as well  as the formulation  of a  National  Cybersecurity Plan  (NCP)
to  strengthen  the  country's  institutional  capacity  to  protect  systems,  networks,  and  programs  from
digital attacks and promote security and resilience of the Philippine cyberspace.
The  bill  seeks to  transform  key  policy  reforms  recommended  under the  National  Cybersecurity
Plan  into laws e.g.,  information sharing and  mandatory disclosure of cybersecurity incidents, mandatory
notification  by  internet  service  providers  (ISPs)  for  malware  infection  and  Internet  of  Things  (IOT)
botnets, and  adoption  and  implementation of standards to protect inter-domain  internet protocols (IP)
routing  protocols, among others.
In  line  with  the  directive  of  President  Ferdinand  R.  Marcos  Jr.  to  adopt  and  implement  the
National   Cybersecurity   Plan   2023-2028   to   strengthen   the   security   and    resilience   of   Philippine
cyberspace  under  Executive  Order  (EO)  No.  58 and  in  light of the  imperative to  legislate  measures to
strengthen cybersecurity,  immediate approval of this bill is earnestly sought.
.F---{=--
Keith Micah ``Atty. Mike" D.I. Tan
4th District, Quezon


Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City
NINETEENTH CONGRESS
Second  Regular Session
HOUSE BILL NO. gil
Introduced  by:  Hon.  Keith  Micah ``Atty.  Mike" D.L. Tan
AN ACT
INSTITUTIONALIZING  POLICIES  FOR A  SECURE,  TRUSTED,  AND  RELIABLE  CYBERSPACE,
STRENGTHENING    THE    GOVERNANCE    OF    CYBERSECURITY,    ESTABLISHING    FOR   THE
puRpOsE   THE   pHILlpplNE   cyBERSEcuRIrv   couNclL,   AND   AppROpRIATING   FUNDs
THEREFOR
Be   it  enacted   by  the   Senate  and   the   House   of  Representatives  of  the   Philippines   in   Congress
assemb/ed:
SECTION  1.  5horf 77Z/e.  -This Act shall  be  known  as the "Cybersecurity Act."
SEC   2.   Oec/anaf7.an  of Po//.ay.   -  The  State   recognizes  the  vital   role  of  communication   and
information  in  nation  building.  The  State also  recognizes  its  inherent obligation  to  ensure that personal
data  information  and  communications  systems  in  the  government  and  the  private  sector  are  secured
and   protected.  Towards  this  end,   the  State  shall   provide   Filipinos  a   secure,   reliable,   and   trusted
cyberspace   through    the   formulation    and    enforcement   of   effective    cybersecurity   policies,    and
establishment  of  a  governance  framework  that  shall  efficiently  coordinate  government  agencies  and
relevant sectors in the  preparation  of proactive, timely, and appropriate  response against cybersecurity
threats.
S;HC. 3 .  Definition of Terms. -
(a)   Gofr7ef or  "/obof netwon4"refers  to  a  network  of computers  infected  by  malware that  is
under the control of a single attacking  party;
(b)   C)¢ersecwr/fy  refers   to   the   organization   and   collection   of   resources,   processes,   and
structures  to  preserve  Confidentiality,  Integrity,  Availability,  Non-Repudiation,  Authenticity,
Privacy and Safety (CIANA-PS)  in  cyberspace;
(c)    Cj/bersecurtfy goiiemance refers to the strategic approach that governs the implementation
and  maintenance of cybersecurity measures, which are intended to protect information and
digital  assets from cyber threats and  unauthorized access;
(d)   C)¢erspace  refers  to  complex  environment  resulting  from  the  interaction   of  people  or
software   and   services  on  the   internet  by   means  of  technology  devices  and   networks
connected to it, which does not exist in any physical form;
(e)   Oisfrt.bwfec/ c/en/a/ of seri+T'ce /I)Oof/ attack refers to a variant of a  denial  of service  (Dos)
attack that  employs  very  large  numbers  of attacking  computers  to  overwhelm  the  target
with  bogus traffic;
(f)    /„fer77ef of 771/.ng5 /7o7lJ 4of77ets refer to a  network of compromised  or infected Internet of
Things devices that can  be remotely controlled  by cybercriminals for malicious  purposes;
(g)   Wa/wane  refers  a  file  or  code,  typically  delivered  over  a  network,  that  infects,  explores,
steals or conducts virtually any behavior an attacker wants; and
(h)   Ivaf/.one/ c/bersecu//fyp/an refers to the security policies,  procedures, and controls required
to protect the country against threats and risk.
SEC.  4.  Ivaf7.ona/ C)¢ersecu"'fy A/a".  - A National  Cybersecurity Plan  (NCSP) shall  be formulated
to  strengthen  the  country's  institutional  capacity  to  protect  systems,  networks,  and  programs  from
digital  attacks and  promote security and  resilience of the  Philippine cyberspace.
SEC.  5.  AA/.//Z7p/.ne C/bersecur/fy Councy./.  -The Philippine Cybersecurity Council  (PCSC)  is hereby


established,   which   shall   be   an   inter-agency   body   administratively   attached   to   the   Office   of  the
President.
The  Council  shall  be  headed  by  the  Director-General  of the  National  Intelligence  Coordinating
Agency  (NICA)  and  co-chaired  by  the  Executive  Secretary  and  the  Secretary  of  the  Department  of
Information  and  Communications Technology  (DICT).  It shall  be  composed  of the following  officials as
members:
Secretary of the Department of Foreign Affairs (DFA);
Secretary of the Department of Finance (DOF);
Secretary of the
Secretary of the
Secretary of the
Secretary of the
Secretary of the
Secretary of the
Department of Science and Technology (DOST);
Department of Interior and  Local  Government (DILG);
Department of Justice (DOJ);
Department of Energy (DOE);
Department of National  Defense (DND);
Department of Transportation  (DOTr);
Secretary of the Presidential Communication Operations Office (PCOO);
Secretary  of  the  Presidential  Communications  Development  and  Strategic  Planning  Office
(PCDSPO)
(k)  Commissioner of the  National Telecommunications Commission  (NTC);
(I)   Director of the  National  Bureau of Investigation  (NBI);
(in)Chief of the  Philippine  National  Police  (PNP);
(n) Chief of Staff of the Armed  Forces of the  Philippines;
(o)  Chairman of the  National  Privacy Commission  (NPC);
(p)  Executive  Director of the Anti-Terrorism Council-Program  Management Center
(ATM-PMC);
(q)  Executive Director of the Cybercrime Investigation and Coordinating Center
(CICC);  and
(r) Governor of the  Bangko Sentral  ng  Pilipinas (BSP) as members.
The  Office  of the  Deputy  Director General  (ODDG) for Cyber and  Emerging Threats established
under NICA shall  serve as Secretariat to the Council.
The   Council   may   invite   concerned   public   and   private   agencies   or   entities   to   participate,
complement, and assist in the performance of its functions.
The Council  shall  collaborate with  the Anti-Terrorism  Council  (ATC) on  matters relating to cyber-
terrorism .
SEC.  6.  Powe/i and F4+„cf7.ons.  -  The  Council  shall  be  the  primary authority to  exercise  powers
and  functions  that  would   address  all   cybersecurity  related   matters.   It  shall   perform  the  following
functions:
(a)  Assess the vulnerabilities of the country's cybersecurity;
(b)  Capacity building for the purpose of responding to cybersecurity threats and emergencies;
(c)  Issue  updated  security  protocols to  all  government employees  in  the storage,  handling  and
distribution  of all forms of documents and  communications based  on  the  best practices and
update the same as necessary;
(d)  Enhance   the    public-private    partnership    in    the   field    of   information    sharing    involving
cyberattacks, threats and vulnerabilities to cyber threats;
(e)  Conduct  periodic  strategic  planning  and  workshop  activities  that  will  reduce  the  country's
vulnerabilities to cyber threats;
(f)   Direct its  member agencies and  appropriate agencies to  implement cybersecurity  measures
as may be required by the situation;
(g)  Serve as the country's coordinating arm on domestic,  international, and transnational efforts
pertaining to cybersecurity;
(h)  Make  such  recommendations and/or  such  other  reports  as the  president  may from  time to
time require;  and
(i)   Perform such other functions as may be necessary.


SEC.  7.   Weef/-„g5  of 44e  Cow„cy./.  -The  Council  shall  hold  regular  meeting  every  quarter  and
such special  meetings as may be necessary upon the request of the chairman or upon the request of at
least two (2) of its members.
SEC.  8.  Aaporfori.a/ Aeq4;t7ieme„f -The Council  shall  submit quarterly report,  or as often  as  may
be  necessary,  to the  President of the  Philippines and  to Congress on  the  state  of cybersecurity threats
and other related  information.
SEC.  9.  C)¢ersecwr/fy Gwreaw.  - The  DICT shall  develop  an  effective  and  efficient cybersecurity
organization  and structure to strengthen  its Cybersecurity Bureau  (CSB).  It shall  expand the operations
of the  National  Computer  Emergency  Response  Team  (NCERT),  which  shall  be  tasked  to  respond  on
cybersecurity   incidents   and   conduct   investigations;   and   the   National   Security   Operations   Center
(NSOC),  which  shall   be  primarily  responsible  in  monitoring  critical   information  assets  in  cyberspace,
perform   vulnerability   assessment   and   penetration   testing   (VAPT)   services,   and   conduct   baseline
assessment of cybersecurity posture of agencies of government.
The  NCERT and the NSOC shall  be operated and staffed on a twenty-four (24)  hour basis under
the CSB.
SEC.  10.  Woc/em{2af7.ar Program.  - The Council  shall,  in  consultation with the  relevant agencies
of government,  develop  a  modernization  program  that will  strengthen  the  monitoring  of cybersecurity
of national  government agencies  and  local  government units  (LGUs).  The  modernization  program  shall
include   the   provision   of  a   centralized   incident   response   system   for   government  that   allows   the
delegation  of incident tickets to government agencies and  LGUs to monitor their progress and ensure a
single view of all  cybersecurity incidents.
SEC.   11.   Aeporf7."g  of Oafa  GrieacA,   -   Government   institutions,   agencies,   instrumentalities,
including   government   owned   and   controlled   corporations,    private   corporations,   companies   and
business  establishments,  operating  wholly  or  partly  in  the  Philippines,  are  required  to  report  to  the
Council,  within  a  reasonable  period  of time,  all  kinds  of data  breach  occurring  in  their jurisdiction.  The
Council  shall  conduct trainings  on  cybersecurity to  all  stakeholders  for the  effective  implementation  of
this  provision.
SHC.  T2.   Mandatory   Notification   by   Internet   Service   Providers   for   Malware   Infection   and
/nferr7ef of 771;`„g5 /7o7lJ Bof77cts.  - To  mitigate the threat of malware  and  botnets  in  the  country,  all
internet   service   providers   (ISPs)   shall   be   required   to   implement   a   malware   notification   scheme,
including   internet  of  things   (IOT)   Botnets,   and   immediate   performance   of  a   cleanup  of  malwares
detected.
ISPs  are   mandated  to  conduct  effective  countermeasures  including,   but  not  limited,  to  the
following:
(a)  Performing   cybersecurity   hygiene   in   their   Customer   Premise   Equipment   (CPE)   such   as
changing  the CPE default password,  disabling  unused  ports,  and  other hardening  measures
for CPE;
(b)  Notifying  those  infected  by  malware  and  providing  clear but concise  instructions on  how to
clean their devices;  and
(c)  Complying   with   requests   for   quarantining   network   segments   which   are   attempting   a
distributed  denial  of service  (DDoS) attack or  identified  as  part  of a  command  and  control
structure of a ransomware, malware, or botnet.
S;HC. T3.  Threats  and  Base/ine  Assessments  of Government Cyberspace  Assets.  -True Council
shall   develop  capability  to  automatically  scan  all   government  and  critical   information   infrastructure
assets  exposed   in  the  internet  for  their  vulnerabilities,  and   provide  a   risk  score  to  these  scanned
threats.  The  scores and vulnerabilities scanned  shall  be  kept confidentially and  shall  be  provided to the
owners  of the  scanned  cybersecurity  assets.  Owners  of these  compromised  assets  shall  report to the
Council  how vulnerabilities were  mitigated.
The  Council  shall  develop  and/or  acquire  the  necessary  tools  to  ensure  that  the  assessments


are stored and disseminated to all government agencies.
Private  security  research  shall  be allowed  to  report their own  findings subject to the  necessary
guidelines that the  Council  shall  issue for  responsible  disclosure  of vulnerabilities.  Legal  protection  shall
be provided to any security researcher disclosing any vulnerability found in any cyberspace asset.
SEC,   14.   Ivaf7.o„a/  C/4ber:5ecur/fy   77}neaf  Oafa4E7se.   -   The   Council   shall   develop   a   national
cybersecurity  threat  database,  which  shall   be  accessible  to  the  public.  The  list  of  threats  shall   be
curated  based  on  the  category  of  the  threat  and  the  type  of  the  threat  based  on  their  common
vulnerability scoring system  (CVSS), category and type. The threat database shall  be updated  regularly.
The  Council  shall  develop  and  maintain  a  website  to  inform  the  public  of the  latest  trends  in
cybersecurity and to issue advisories.
S;HC`  T5.   Standards  to  Protect  Inter-Domain  Internet  Protoco/  (IP)  Routing  Protocol.  -True
Council  shall,  in  consultation  with  the  NTC,  DICT,  DOST,  and  telecommunications  providers,  adopt and
implement  standards  for  securing   inter-domain   internet   protocol   (IP)   routing   protocol,   particularly
Border Gateway Protocol  (BGP) to attain  national compliance for securing  inter-domain  routing.
SEC.   16.   Parf77ersiA;P   i4+tz;A  Orgy.fa/  On/r.ne  A/afrorms.   -  The   Council   shall   initiate   robust  and
meaningful  partnerships  with  digital  online  and  social  media  platforms to  create  a  mutually  acceptable
protocol  for reporting,  correcting  and  mitigating  misinformation,  and  online  harms in  line with  the  need
to  regulate  digital  online  platforms,  including  social  media  platforms,
SEC.17.  „u/Z7.-O/sc/P//.„ary Approach.  -All  government agencies,  including  LGUs,  are  enjoined
to  improve  and  develop  their  own  cybersecurity  strategies,  sub-plans,  and  teams  consistent  with  the
provisions of this Act.
S;HC, T8.  Declaring  the  Month  of October  as  Cybersecurity Awareness  Month.  -The morth Of
October of every year is hereby declared as ``National Cybersecurity Awareness Month''.
Pursuant to  the  observance  of National  Cybersecurity Awareness  Month,  an  annual  program  of
activi`ties  shall  be  prepared  and  implemented,  with  the  NICA  and  the  DICT as  lead  agencies.  They  are
authorized  to call  upon  any department,  bureau,  office,  agency,  or instrumentality of the  government,
including government-owned or -controlled corporations, for any assistance as may be needed.
The  Philippine Information Agency,  in  coordination with  the  NICA and the  DICT shall  ensure the
effective  information  dissemination  pursuant to this provision.
All  LGUs  and  private  organizations  including  the  civil  society  organizations,  private  enterprises,
and   non-government   organizations,   civic,   and   people's   organizations,   are   encouraged   to   observe
National  Cybersecurity Awareness Month  in  simple rites and  participate in the activities.
SEC,  19.  Pens/ Prow/5/.ons,  -Any violation  under Sections  11  and  12 of this Act, after due notice
and  hearing,  shall  be  penalized  with  imprisonment of not  less than  six  (6)  months  but  not  more  than
two (2) years or a fine of not more than One (1)  million pesos, or both at the discretion of the court.
SEC.  20.  AApnopr/.af7.o„s,  - The  amount of necessary to carry out  its functions shall  be  included
in the annual  General Appropriations Act.
SEC.   21.   /mp/emenf/.„g  Au/es  a„c/  Aegw/af/.ars.  -  The  NICA  and  DICT,  in  consultation  with
relevant  agencies,  shall  jointly  formulate  the  necessary  rules  and  regulations  within  ninety  (90)  days
from approval of this Act.
SEC.  22.  5epGn?4/.//.fy C7a4/se.  -  If any  provision  of this  Act  is  held  invalid,  the  other  provisions
not affected shall  remain  in full force and effect.
SEC.  23.  Aapea/y.„g Cyaw5e.  -All  laws,  decrees,  orders,  rules and  regulations or other issuances
or   parts   thereof   inconsistent   with   the   provisions   of   this   Act   are   hereby   repealed   or   modified


accordingly.
SEC.  24.   £ffgct7.I//fy,  -  This  Act  shall  take  effect  fifteen  (15)  days  after  its  publication  in  the
Official  Gazette or in  any two (2)  newspapers of general circulation  in the Philippines.
Approved,