Republic of the Philippines 
HOUSE OF REPRESENTATIVES 
Quezon City 
TWENTIETH CONGRESS 
First Regular Session 
HOUSE BILL NO. ____ 
Introduced by HON. MIGUEL LUIS R. VILLAFUERTE, HON. VINCENZO 
RENATO LUIGI R. VILLAFUERTE, HON. TSUYOSHI ANTHONY G. HORIBATA, AND 
HON. TERRY L. RIDON 
EXPLANATORY NOTE 
In the era of global digitalization, where information and communications technologies 
serve as the foundation for economic growth, public administration, national security, and the 
delivery of essential services, the Philippines is increasingly exposed to a broad spectrum of 
sophisticated cyber threats. These include advanced persistent threats, state-sponsored 
cyber espionage, ransomware campaigns, and systemic data breaches that exploit existing 
gaps in our cyber defense infrastructure. Such incidents not only jeopardize the confidentiality, 
integrity, and availability of critical information systems but also erode public trust in 
government institutions and digital services. 
Given the transnational and rapidly evolving nature of cyber risks, there is an urgent 
need for a more integrated and adaptive cybersecurity governance strategy. This bill seeks to 
address these challenges by unifying and strengthening the country’s national cyber 
architecture. It aims to create a coherent and future-ready cybersecurity ecosystem capable 
of responding effectively to the dynamic threat landscape. Key provisions of the proposed bill 
include: 
•
Creation of the National Cybersecurity Agency (NCSA) – The bill establishes the NCSA
as the central authority under the Department of Information and Communications
Technology. It shall standardize protocols for threat detection, information sharing, and
incident response, enhance the protection of Critical Information Infrastructure (CII),
and conduct research and development and capacity building.
•
Designation and Regulation of CII – The NCSA is empowered to identify CIIs using a
risk-based approach, enforce compliance requirements, mandate cybersecurity audits
and risk assessments, and require reporting of cybersecurity incidents. Confidentiality
of CII-related documents is assured through national security protocols. The NCSA is
also authorized to withdraw or remove the designation of any CII at any time if the
NCSA is of the opinion that the computer or computer system no longer fulfills the
criteria of a CII.
•
Minimum Cybersecurity Requirements for Government Entities – All national
government agencies, government-owned and -controlled corporations, and local
government units are mandated to adopt cybersecurity baselines and designate a
Chief Information Security Officer to ensure institutional resilience.
•
Cybersecurity Certification through the Cybersecurity Anchor of Trust System – The
NCSA shall promulgate a voluntary cybersecurity certification framework for any local
or foreign commercial entities to assess and rate digital services and technologies,
including Internet of Things technologies, thereby fostering trust in both public and
private sector offerings.
July 31, 2025
2:25 pm
2826


•
Penalties and Prohibited Acts – The bill defines offenses and provides administrative
and criminal penalties for non-compliance, unauthorized disclosure of confidential
information, and cyberattacks on CIIs. Violations with intent to intimidate the public or
destabilize national structures may be prosecuted under the Anti-Terrorism Act.
•
Cybersecurity Risk Management and Mitigation Fund – A dedicated fund is created for
the purposed of this proposed bill. The fund which shall be determined upon approval
of the President of the Philippines in accordance with the favorable recommendation
of the NCSA shall be used for cybersecurity risk mitigation, prevention, and
preparedness activities. Of the amount appropriated, 30% shall be allocated as Quick
Response Fund for immediate restoration of affected CIIs.
•
Transparency and Accountability – The bill ensures transparency through annual
reports to the Office of the President and periodic reviews every three years or as may
be necessary to meet cybersecurity standards and requirements for emerging
technologies.
•
International Cooperation and Confidentiality –   The proposed bill also recognizes the
indispensable role of international cooperation, particularly in threat intelligence
sharing, cross-border incident response, and adherence to global cybersecurity norms.
It also establishes confidentiality rules for sensitive data and information, including
trade secrets, national security information, and law enforcement data. The NCSA may
share sensitive information only under lawful or secure agreements, with foreign
partners.
In view of the foregoing, the immediate passage of this bill is earnestly sought to secure
the Philippines’ digital future and ensure that the country is adequately prepared to confront 
and overcome the complex challenges of the modern cyber environment.  
HON. MIGUEL LUIS R. VILLAFUERTE 
HON. VINCENZO RENATO LUIGI R. VILLAFUERTE 
HON. TSUYOSHI ANTHONY G. HORIBATA 
HON. TERRY L. RIDON 


Republic of the Philippines 
HOUSE OF REPRESENTATIVES 
Quezon City 
TWENTIETH CONGRESS 
First Regular Session 
HOUSE BILL NO. ____ 
Introduced by HON. MIGUEL LUIS R. VILLAFUERTE, HON. VINCENZO 
RENATO LUIGI R. VILLAFUERTE, HON. TSUYOSHI ANTHONY G. HORIBATA, AND 
HON. TERRY L. RIDON 
AN ACT AUTHORIZING THE PROTECTION OF CRITICAL INFORMATION 
INFRASTRUCTURE AGAINST CYBERSECURITY THREATS AND INCIDENTS, 
CREATING THE NATIONAL CYBERSECURITY AGENCY, DEFINING ITS POWERS AND 
FUNCTIONS, AND APPROPRIATING FUNDS THEREFOR 
Be it enacted by the Senate and House of Representatives of the Philippines in Congress 
assembled: 
CHAPTER 1 
GENERAL PROVISIONS 
 SECTION 1. Short Title. – This Act shall be known as the “Cybersecurity Act.” 
 SECTION 2. Declaration of Policy. – It is hereby declared a policy of the State: 
(a) To recognize the vital role of communications and information in nation-building;
(b) To recognize the maintenance of peace and order, the protection of life, liberty, and
property, and the promotion of the general welfare are essential for the enjoyment by
all the people of the blessings of democracy;
(c) To serve and protect the people, and as the Constitution guarantees the right of the
people to be secure in their persons, houses, papers, and effects against unreasonable
searches and seizure, and that the privacy of communication and correspondence
shall be inviolable except upon lawful order of the court, cybersecurity and information
security are important to the protection of the Filipino society;
(d) To adopt measures to effectively prevent and combat cybersecurity offenses by
facilitating detection, investigation, and prosecution of offenses at both the domestic
and international levels, and by providing arrangements for fast and reliable
international cooperation; and
(e) To adopt a Zero Trust Architecture in cybersecurity, as appropriate in the Philippine
context and aligned with international standards and best practices.
SECTION 3. Definition of Terms. – For purposes of this Act, the following terms shall mean: 
(a) Availability refers to the property of being accessible and usable upon demand by an
authorized entity.
2826


 
(b) Computer Network refers to a system that connects two or more computing devices 
for transmitting and sharing information. Computing devices include everything from 
a mobile phone to a server. These devices are connected using physical wires such 
as fiber optics, but they can also be wireless. 
 
(c) Computer System refers to any device or group of interconnected or related devices, 
one or more of which, pursuant to a program, performs automated processing of data. 
It covers any type of device with data processing capabilities including, but not limited 
to, computers and mobile phones. The device consisting of hardware and software 
may include input, output, and storage components which may stand alone or be 
connected in a network or other similar devices. It also includes computer data storage 
devices or media, both physical and virtual. 
 
(d) Confidentiality refers to property that information is not made available or disclosed to 
unauthorized individuals, entities, or processes. 
 
(e) Critical Information Infrastructure (CII) refers to a computer or a computer system 
located wholly or partly in the Philippines, necessary for the continuous delivery of an 
essential service, and the loss or compromise of the computer or computer system 
will have a debilitating effect on the availability of the essential service in the 
Philippines. CIIs consist of information process and information and communications 
technology which form part of the operation of the critical infrastructures. 
 
(f) Critical infrastructure (CI) refers to any public service which owns, uses, or operates 
systems and assets, whether physical or virtual, so vital to the Republic of the 
Philippines that the incapacity or destruction of such systems or assets would have a 
detrimental impact on national security, including telecommunications and other such 
vital services as may be declared by the President of the Philippines. 
 
(g) Cryptographic primitive crypto-primitive refers to a low-level cryptographic algorithm 
used as a basic building block for higher-level cryptographic algorithms. 
 
(h) Cybercrime encompasses illegal activities conducted within cyberspace which may 
involve malicious intent. Involves activities violating laws and regulations such as the 
Cybercrime Prevention Act (Republic Act No. 10175, as amended), resulting in severe 
consequences such as privacy breaches, disruption of critical services. 
 
(i) Cybersecurity refers to the collection of tools, policies, risk management approaches, 
actions, training, best practices, assurance, and technologies that can be used to 
protect the cyber environment and organization and user’s assets. 
 
(j) Cyberspace refers to a complex environment emerging from the interaction of people, 
software, and services on the internet by means of technology devices and networks 
connected to it, which does not exist in any physical form.1  
 
(k) Information and communications technology (ICT) encompasses all technologies for 
the capture, storage, retrieval, processing, display, representation, organization, 
management, security, transfer, and interchange of data and information. 
 
(l) Information security refers to the protection of information and systems from 
unauthorized access, use, disclosure, disruption, modification, or destruction in order 
to provide confidentiality, integrity, and availability. 
 
1National Cybersecurity Plan 2023-2028, p xii 


 
(m) Integrity refers to the property of accuracy and completeness.  
 
(n) National Computer Emergency Response Team (NCERT) refers to a group of 
information security experts and practitioners responsible for responding to 
cybersecurity incidents of an organization with the aim of minimizing the impact or 
damage and ensuring recovery of affected systems. 
 
(o) Non-Repudiation refers to the ability to prove the occurrence of a claimed event or 
action and its originating entities.2 
 
(p) Public Key Infrastructure (PKI) refers to a set of policies, processes, server platforms, 
software and workstations used for the purpose of administering certificates and 
public-private key pairs, including the ability to issue, maintain, and revoke public key 
certificates. The PKI includes the hierarchy of certificate authorities that allow for the 
deployment of digital certificates that support encryption, digital signature and 
authentication to meet business and security requirements. 
 
(q) Privacy refers to having the personal control over personal information.3 
 
(r) Protective Domain Name System (PDNS) refers to the naming database that locates, 
tracks, and regulates internet domain names and IP addresses. 
 
(s) Security Operations Center (SOC) refers to the focal point for security operations and 
computer network defense of an organization. The purpose of the SOC is to defend 
and monitor an organization’s systems and networks on an ongoing basis. The SOC 
is also responsible for detecting, analyzing, and responding to cybersecurity incidents 
in a timely manner. 
 
(t) Zero Trust (ZT) refers to an evolving set of cybersecurity paradigms that move 
defenses from static, network-based perimeters to focus on users and resources. It is 
a set of security primitives rather than a particular set of technologies. Zero trust 
assumes that there is no implicit trust granted to user accounts based solely on their 
physical or network location (i.e., local area networks versus the internet) or to 
endpoints (devices) based on their ownership (e.g., enterprise or personally owned). 
Zero trust focuses on protecting resources (e.g., devices, services, workflows, 
network accounts) rather than network segments, as the network location is no longer 
seen as the prime component to the security posture of the resource.  
 
(u) Zero Trust Architecture (ZTA) refers to an enterprise’s cybersecurity plan that utilizes 
zero trust concepts and encompasses component relationships, workflow planning, 
and access policies. 
 
CHAPTER 2 
ORGANIZATION OF THE NATIONAL CYBERSECURITY AGENCY 
 
SECTION 4. Creation of the National Cybersecurity Agency (NCSA). – There is hereby 
created a National Cybersecurity Agency, which shall be an attached agency to the 
Department of Information and Communications Technology (DICT).    
 
 
2National Cybersecurity Plan 2023-2028, pp xiii 
3National Cybersecurity Plan 2023-2028, pp xiii 


SECTION 5. Mandate. – The NCSA shall be the primary policy, planning, coordinating, 
implementing, and administrative entity that will plan, develop, coordinate, and implement the 
overall national cybersecurity strategy of the government. 
 
SECTION 6. Powers and Functions.  – The Agency shall exercise the following powers and 
functions:  
 
I. 
Policy Planning and Coordination 
 
(a) Formulate policies and recommendations on issues concerning cybersecurity, advise 
Congress and other government agencies on all aspect of cybersecurity, and propose 
legislation and amendments thereto; 
 
(b) Formulate and implement the National Cybersecurity Plan; 
 
(c) Ensure the participation of all stakeholders in policy formulation and implementation; 
 
(d) Lead the whole-of-government effort to formulate cybersecurity regulations, in 
accordance with international standards and best practices; 
 
(e) Set national standards on the generation, management, use, optimization, and, if 
applicable, disposal of cybersecurity products, protocols, and crypto-primitives such 
as, but not limited to: Public Key Infrastructures (PKI); secure routing protocols; secure 
network elements; protective Domain Name Service; encryption and decryption 
protocols, and authentication protocols; 
 
(f) Coordinate all cybersecurity activities of the government, in partnership with the 
private sector and other stakeholders; 
 
(g) Advise the President, Congress, Judiciary, and Constitutional bodies on all 
cybersecurity-related issues and concerns; and 
 
(h) Create the National Vulnerability Disclosure Program. The program shall be the 
gateway for the security researchers to submit vulnerabilities of the online assets of 
the Philippine government. 
 
II. 
CII Protection 
 
(a) Formulate and set cybersecurity minimum standards for CIIs, in coordination with 
relevant administrative agencies exercising regulatory functions over CIIs; 
 
(b) Ensure compliance of CIIs to cybersecurity minimum standards requirements;  
 
(c) Conduct audit and assessment of the cybersecurity posture of CIIs, all National 
Government 
Agencies, 
including 
Government-Owned 
and/or 
Controlled 
Corporations (GOCCs), State Universities and Colleges (SUCs), and Local 
Government Units (LGUs). The Congress and the Judiciary may request the NCSA 
to assist them in the conduct of cybersecurity audit and assessment; 
 
(d) Establish a liaison network of CERTs (or CERTs Points of Contact) among CIIs to 
facilitate communication and information sharing; 
 
(e) Regulate and provide oversight over private cybersecurity service providers such as, 
but not limited to Vulnerability Assessment and Penetration Testing (VAPT) service 
providers, security operations center providers, etc.; and 


(f) Upon request, provide analysis, expertise, and other technical assistance to critical 
infrastructure owners and operators, and if appropriate, provide those analyses, 
expertise, and other technical assistance in coordination with Sector-Specific 
Agencies and other government departments and agencies. 
 
III.  Cyber Threats and Incidents Response 
 
(a) Establish the NCERT and a robust incident response capability to promptly detect, 
analyze, and mitigate cyber incidents affecting national security or public interest and 
to collaborate with relevant government agencies, private sector entities, and 
international partners for coordinated incident response; 
 
(b) Enhance cyber threat intelligence and situational awareness; 
 
(c) Establish a liaison network of CERTs (or CERTs Points of Contact) among 
government agencies to support the implementation of the mandate of NCERT; 
 
(d) Perform vulnerability assessment and penetration testing initiatives to detect, identify, 
and analyze cyber threats and to properly attribute cyber-attacks against CIIs; 
 
(e) Initiate legal proceedings for the collection of computer data and summon witnesses 
to appear in any proceedings, investigation, or inquiry of the NCSA regarding 
cybersecurity 
incidents 
of 
national 
government 
agencies 
(NGAs) 
and 
instrumentalities, and CII; and 
 
(f) Collect opensource data and conduct data analysis for proactive cybersecurity 
measures against misinformation, deceptive content, and other forms of attacks on 
integrity of information. 
 
IV.  Research and Development 
 
Lead in the development of cybersecurity technologies, tools, and standards, 
in partnership with the academe, other government research institutions, and 
international partners. 
 
V. Capacity Building 
 
(a) Develop and implement training programs to build and maintain a highly skilled cyber 
workforce in the government; 
 
(b) Partner with academic institutions, industry stakeholders, and foreign counterparts to 
promote knowledge sharing, resource sharing, and skills development in 
cybersecurity; 
 
(c) Prescribe personnel qualifications and other qualification standards essential to the 
effective development on cybersecurity field of expertise; and 
 
(d) Co-develop with the Civil Service Commission (CSC) the cybersecurity qualification 
standards. 
 
VI. Information Sharing 
 
(a) Gather, assess, and distribute actionable intelligence regarding cyber threats, 
emerging patterns, and potential vulnerabilities, thereby bolstering the nation's cyber 
situational awareness and facilitating informed decision-making processes; 
 


(b) Develop a mechanism for information-sharing between the government (or public) and 
the private sector; and 
 
(c) Issue cybersecurity advisories or guidelines regularly or as needed. 
 
VII. International Cooperation 
 
(a) Foster international collaboration and cooperation for the promotion of cybersecurity; 
 
(b) Support the government’s efforts to establish the Philippines as a regional digital hub; 
and 
 
(c) Represent the Republic of the Philippines, in coordination with other relevant agencies 
in international cybersecurity cooperation. 
 
VIII. Regulatory 
 
(a) In any investigation under Chapter 6: Prohibited Acts, after due notice and hearing, 
the NCSA may impose sanctions, collect fees, fines, and penalties for the violation of 
laws, rules, regulations, orders, and issuances on CIIs; and 
 
(b) Exercise such other powers as may be provided by law, as well as those which may 
be implied from, or which are necessary or incidental to the carrying out of the express 
powers granted the NCSA to achieve the objectives and purposes of this law. 
 
 
SECTION 7. Composition. – The NCSA shall be headed by a Director-General with the rank 
of Undersecretary and shall be assisted by two Deputy Directors-General with the rank of 
Assistant Secretaries.   
 
SECTION 8. Qualifications. – The following are the minimum qualifications of the Director-
General and Deputy Directors-General of the NCSA:  
 
(a) Director-General – The Director-General shall be appointed by the President. No 
individual shall be appointed as Director-General of the NCSA unless he or she is a 
citizen residing in the Philippines for the past 10 years, of good moral character, has 
at least five (5) years of government experience and ten (10) years cumulative 
experience as a cybersecurity, information privacy, or information security 
professional, and has at least a Master’s Degree in Cybersecurity, Information 
Security, or any other related master’s degree. 
 
(b) Deputy Directors-General – The Deputy Directors-General of the NCSA shall be 
appointed by the President. No individual shall be appointed Deputy Directors-General 
of the NCSA unless they are citizens residing in the Philippines for the past 10 years, 
of good moral character, possessing proven integrity, and having unquestionable 
integrity, with a track record of leadership, recognized competence with the appropriate 
educational background in cybersecurity or any related field, with at least six (6) years 
of supervisory or management experience in the field of cybersecurity, data privacy, 
information technology (IT), IT risk management, or any combination thereof. 
 
SECTION 9. Separation and Retirement from Service. – Employees who are separated 
from service within six (6) months from the effectivity of this Act as a result of the consolidation 
and/or reorganization under the provisions of this Act shall receive separation benefits to which 
they may be entitled under Executive Order No. 366, s. 2004. Those who are qualified to retire 


under existing retirement laws shall be allowed to retire and receive retirement benefits to 
which they may be entitled under applicable laws and issuances. 
 
SECTION 10. Structure and Staffing Pattern. – Subject to the approval of the Department 
of Budget and Management (DBM), NCSA shall determine its organizational structure and 
create new divisions or units as it may deem necessary. The NCSA shall appoint officers and 
employees in accordance with the civil service law, rules, and regulations. 
 
(a) Considering the highly technical nature of the personnel required for the NCSA, the 
NCSA may promulgate a separate set of qualification and competency standards for 
eligibility as career officers in NCSA. The NCSA qualification and competency 
standards shall only be applicable to NCSA unless adopted by the CSC as applicable 
for the entire Philippine government; and 
 
(b) The NCSA may request detail of personnel from other government departments, 
agencies, bureaus, offices, and institutions, subject to the approval of the head of office 
and availability of personnel, to ensure the effective coordination, integration, and 
fusion of activities relative to cybersecurity. 
 
SECTION 11. Transfer of Agencies and Personnel to the NCSA. – The Department of 
Information and Communications Technology-Cybersecurity Bureau (DICT-CSB) and its 
corresponding Divisions along with their powers and functions, applicable funds and 
appropriations, records, equipment, property, and personnel, are hereby transferred to the 
NCSA. 
 
 
All offices, services, divisions, units, and personnel not otherwise covered by this Act 
for transfer to NCSA shall be retained under the DICT, which shall continue to operate under 
its current name and functions. 
 
 
The NCSA is hereby attached to the DICT for policy and program coordination, and 
shall continue to operate and function laterally and in accordance with prevailing laws: 
 
(a) All powers and functions related to cybersecurity, including but not limited to the 
formulation of the National Cybersecurity Plan, establishment of the NCERT, and the 
facilitation of international cooperation on intelligence regarding cybersecurity matters, 
are hereby transferred to NCSA;  
 
(b) The laws and rules on government reorganization as provided for in Republic Act No. 
6656, otherwise known as the Reorganization Law, shall govern the reorganization 
process of NCSA; and 
 
(c) The transfer of functions, assets, funds, equipment, properties, transactions, and 
personnel of the affected agencies to NCSA shall be completed within six (6) months 
from the effectivity of this Act. During this transition period, existing personnel shall 
continue to assume their posts in holdover capacities until new appointments are 
issued. After the transfer of the agencies specified in SECTION 11 of this Act, NCSA, 
in coordination with DBM, shall determine and create new positions, the funding 
requirements of which shall not exceed twenty-five percent (25%) of the equivalent 
cost of positions abolished. 
 
CHAPTER 3 
CRITICAL INFORMATION INFRASTRUCTURES (CII) 
 
SECTION 12. Designation of Critical Information Infrastructure (CII). – The NCSA will 
have the duty and power to oversee the CIIs in the Philippines.  


 
I. 
The NCSA shall identify entities that own, operate or maintain CII (“CII entities” from 
hereon), using a risk-based approach, as prescribed by the NCSP and shall adopt a 
set of criteria for identifying CIIs. 
 
II. 
After the confirmation of the CII designation, the NCSA will issue a written notice to the 
owner of the computer or computer system, designating said system as a CII for the 
purposes of this Act. 
 
III. 
A notice issued under Subparagraph I must: 
 
(a) Identify the computer or computer system that is being designated as a CII; 
 
(b) Identify the owner of the computer or computer system so designated as a CII; 
 
(c) Inform the owner of the computer or computer system, regarding the owner’s duties 
and responsibilities under this Act that arise from the designation; 
 
(d) Inform the owner of the computer or computer system that any representations against 
the designation are to be made to the NCSA by a specified date, being a date not 
earlier than fourteen (14) days after the date of the notice; and 
 
(e) Inform the owner of the computer or computer system that the owner may appeal to 
the NCSA against the designation, and provide information on the applicable 
procedure. 
 
IV. 
Any designation under Subparagraph I shall be in effect for a period of five (5) years, 
unless it is withdrawn by the NCSA before the expiration of the period. 
 
SECTION 13. Regulation of Providers of Essential Services who Rely on Third-party 
Owned CII. – Providers remain responsible for the cybersecurity and resilience of the 
computer systems they rely on to deliver essential services, even if those systems are 
managed by a third party. Providers who depend on third-party-owned CII must secure legally 
binding commitments from these vendors ensuring that the third party meets the cybersecurity 
standards and requirements applicable to CII, including incident reporting, auditing, and risk 
assessment. 
 
SECTION 14. Compliance Requirements for Organizations and the CIIs. –  The NCSA, in 
coordination with concerned government regulatory agencies, shall create a list of compliance 
requirements for CIIs. In determining the compliance requirements for organizations and CIIs, 
due consideration shall be given to minimizing their impact on the cost of services provided 
by the organizations and/or CIIs. These shall include at least the following:  
 
(a) 
List of authorized personnel and their level of access to the computer system labeled 
as CII; 
 
(b) 
List of supply chain service providers of the CII including foreign service providers, if 
any; 
 
(c) 
The cybersecurity or information security framework used for risk assessment and 
adoption of technical and procedural controls; 
 
(d) 
Initial audit report; 
 


(e) 
Cybersecurity incident handling organization and protocol being implemented by the 
CII operator; and 
 
(f) 
Organization and technical contact persons of the CII operators.  
 
SECTION 15. Cybersecurity Audit and Risk Assessment of CIIs. – All CII operators shall 
take the necessary steps to identify, assess, and institute technical or procedural controls to 
mitigate cybersecurity risks related to the CII at least once every three (3) years.  
 
 
At least once every two (2) years (or at such higher frequency as may be directed by 
the NCSA in any particular case), all CII operators must submit an authenticated cybersecurity 
audit and risk assessment report performed by a NCSA recognized auditing firm that 
specializes in cybersecurity. Cybersecurity audit and risk assessment reports shall be 
submitted to NCSA and shall be kept in record for a period of not less than five (5) years.  
 
SECTION 16. Mandatory Disclosure of Cybersecurity Incidents on CIIs. –  
 
(a) Organizations operating CIIs shall notify the government regulator and NCSA through 
the NCERT upon discovery of a critical or high-risk cybersecurity incident. NCSA shall 
define the taxonomy, including classification and categorization of which cybersecurity 
incidents are considered “critical”, “high risk” and “moderate”. For moderate risk 
cybersecurity incidents, the CII operator shall inform NCSA or NCERT of the incident; 
 
(b) In the event of ransomware or extortion attacks, the affected CII entities are required to 
disclose in their report whether they have made any payments or complied with the 
demands of the threat actor; and 
 
(c) CERTs shall coordinate with law enforcement agencies in filing of cybercrime cases.  
 
SECTION 17. Assistance Extended by the Government to CII Operators. – Operators of 
CII may request assistance for NCSA to provide the following:  
 
(a) Use of government technical controls and systems for the defense and protection of 
the CII; 
 
(b) Priority co-location with government data centers subject to availability; 
 
(c) Use of government secure crypto-primitives such as digital certificates, etc.; and 
 
(d) Knowledge management platform to facilitate faster sharing of information between 
the industry, NCSA, government regulators, and other concerned organizations. 
 
SECTION 18. Confidentiality of CII Related Documents. –  The official list of CIIs, including 
their assessment, evaluation, audit, and technical reports shall be considered documents 
related to National Security and thus, are considered confidential and classified. The 
President, upon the recommendation of NCSA, may declassify these documents.  
 
 
If a subpoena duces tecum is issued for any of these classified documents, NCSA 
shall inform the body who ordered the subpoena that the document can only be opened or 
scrutinized in executive session, and/or shall be disclosed only to a limited number of people 
on a strict need-to-know basis.     
 
SECTION 19. Withdrawal or Removal of CII Designation. – The NCSA, through a written 
resolution, may withdraw or remove the designation of any CII at any time if the NCSA is of 
the opinion that the computer or computer system no longer fulfills the criteria of a CII. The 


NCSA shall notify in writing the CII operator of the withdrawal or removal of their designation 
within 14 days upon the issuance of the resolution. 
 
SECTION 20. Motion for Reconsideration of CII Certification. – CIIs may file for motion for 
reconsideration of the scoring or rating, and revocation of certificate to NCSA within thirty (30) 
days from the receipt of the decision.  
 
CHAPTER 4  
MINIMUM CYBERSECURITY REQUIREMENTS 
 
 
National Government Agencies (NGA) and instrumentalities, Government-Owned and 
-Controlled Agencies (GOCC), and Local Government Units (LGU) are hereby directed to 
adopt and implement minimum cybersecurity requirements to enhance their resilience against 
cyber threats.  
 
SECTION 21. Prescribing Minimum Cybersecurity Requirements. – The NCSA, in 
consultation with relevant stakeholders, shall prescribe a baseline for security practices, 
ensuring a consistent level of protection across government agencies. As may be necessary, 
the NCSA, in cooperation with the private sector, shall provide technical assistance to other 
government agencies and offices relative to this provision.  
 
SECTION 22. Creation of a Chief Information Security Officer (CISO). – Each NGA, 
GOCC, and LGU shall create a CISO position within the agency to lead the Government 
Computer Emergency Response Team (GCERT). The CISO shall be the official responsible 
for carrying out the Chief Information Officer responsibilities and serve as the primary liaison 
to the agency’s authorizing officials, information system owners, information system security 
officers, and the SCERT and the NCERT. 
 
 
The CISO ensures that information resources and technologies are effectively 
protected. CISOs oversee the development, implementation, and enforcement of security 
policies. The CISO might also work alongside the chief information officer in procuring 
cybersecurity products and services, and managing disaster recovery and business continuity 
plans. 
 
CHAPTER 5 
CYBERSECURITY IOT CERTIFICATION 
 
SECTION 23.  Cybersecurity Anchor of Trust System (CATS). – NCSA shall promulgate 
rules and procedures for certifying cybersecurity trustworthiness of service, suppliers, or 
technologies.  Towards this end, the Agency in consultation with other government agencies 
and the private sector shall devise a rating or scoring system for assessing information security 
and cybersecurity standards considering various criteria. Such scoring system shall be 
reviewed periodically at least once every two (2) years or as may be deemed necessary by 
the Agency. 
 
 
The Agency may charge reasonable fees to defray the administrative cost of the 
services rendered, subject to existing laws and regulations. 
  
SECTION 24. Voluntary Rating System. – Any local or foreign commercial entities may 
voluntarily submit themselves for certification.    
 
SECTION 25. Validity of Certification. – The certification issued by NCSA shall be valid  for 
a maximum period of two (2) years; Provided,  that NCSA, may impose a shorter validity period 
depending on the criticality of the business or the cybersecurity risks relevant to the business 
of the person; and provided further, that the Agency, upon recommendation by NCERT, may 


require re-certification prior to the expiration of the certification due to factors increasing the 
cybersecurity risks relevant to the business of the person.   
 
SECTION 26. Cybersecurity IoT Certification Appeal. – Agencies with cybersecurity IoT 
certification may file for an appeal of the scoring or rating, and revocation of certificate to NCSA 
within thirty (30) days from receipt of the decision.  
 
CHAPTER 6 
PROHIBITED ACTS AND PENALTIES 
 
SECTION 27. Non-compliance of CII Operators. – In the event that a CII operator fails 
willfully or negligently to comply with the orders, directive, mandate, remediation, and any 
other regulations of NCSA, the same shall incur penalties as provided for this Act. This 
includes submission of documentary requirements, and providing NCSA access to necessary 
computer data during investigations of cyber-attacks.   
 
SECTION 28. Disclosure of Confidential Information. – Any individual who has access to 
CII and information is prohibited to disclose them. The unauthorized disclosure of these 
confidential information, either willfully or through negligence, shall be penalized.  
 
SECTION 29. Penalties. – The following penalties shall be applied for violations of this Act:  
 
(a) Any individual who either willfully, or through negligence causes the unauthorized 
disclosure of confidential or sensitive information shall be penalized by imprisonment 
ranging from six (6) years to twelve (12) years or a fine of not less than Five hundred 
thousand pesos (P 500,000.00), or both; 
 
(b) Any unauthorized disclosure of confidential or sensitive information affecting national 
defense or national security, with intent or reason to believe that the same is to be used to 
the injury of the Philippines or to the advantage of any foreign nation or enemy of the State, 
whether domestic or foreign, shall suffer the penalty of life imprisonment or by a fine of not 
less than One million pesos (P 1,000,000.00), or both;  
 
(c) Any employee who leaves or severs employment with the CII operator/owner, willfully or 
negligently discloses, damages, disposes of, or destroys critical, sensitive, or classified 
information in violation of this Act and other existing laws, rules, and regulations, 
contravenes or fails to comply with any provision of this Act shall be held liable without 
prejudice to any criminal prosecution; 
 
(d) Upon violation of any enumerated prohibited acts, the CII operator shall receive a formal 
written warning from the NCSA ordering the CII to show cause within seven (7) days from 
receipt thereof; 
 
(e) If the CII operator fails to comply with the written warning, NCSA shall impose a fine equal 
to half of one percent (0.5%) of the CII operator’s average gross annual income for a period 
of five years. An additional half of one percent (0.5%) shall be added for each subsequent 
infraction, with the penalty resetting after the CII operator finally complies with the 
directives; 
 
(f) A CII operator‘s willful disregard of a lawful order given by NCSA to comply with this Act 
and its implementing rules and regulations within a reasonable time frame will result in the 
CII operator’s license being revoked on grounds of non-compliance to a regulatory 
requirement; 
 


(g) The CII operator has the right to appeal any penalties imposed under this SECTION. To 
initiate an appeal, the CII operator must submit a written notice of appeal to the NCSA 
within fifteen (15) days from the receipt of the penalty notice or the revocation order. The 
appeal must include a detailed statement of the grounds for contesting the penalty and 
any supporting evidence. Upon receipt of the appeal, the NCSA shall review the case and 
may hold a hearing if deemed necessary. The CII operator will be notified of the hearing 
date and will have the opportunity to present their case. Following the review or hearing, 
the NCSA will issue a written decision on the appeal. The decision of the NCSA shall be 
final and may be challenged only through appropriate judicial review, as provided by 
applicable law. 
 
SECTION 30. Liability under the Anti-Terrorism Act (ATA) of 2020. – Any person who, 
within or outside the Philippines, regardless of the stage of execution, engages in acts 
intended to cause extensive interference with, damage, or destruction to Critical Infrastructure, 
as defined under SECTION 3 (f) of this Act or SECTION 3 (a) of  Republic Act No. 11479, 
SECTION 2 (e) of Republic Act No. 11659, or SECTION 3 (j) of Republic Act No. 10175, or to 
CIIs designated under Chapter 3 of this Act, or under other applicable laws on Critical 
Infrastructure and CIIs, whether committed by, through and with the use of information and 
communications technologies or otherwise, when the purpose of such act, by its nature and 
context is to intimidate the general public or a segment thereof, create an atmosphere or 
spread a message of fear, to provoke or influence by intimidation the government or any 
international organization, or seriously destabilize or destroy the fundamental  political, 
economic, or social structures of the country, or create a public emergency or seriously 
undermine public safety, shall be liable under SECTION 4 (c) of  Republic Act No. 11479, 
otherwise known as the Anti-Terrorism Act of 2020. 
 
CHAPTER 7 
MISCELLANEOUS PROVISIONS 
 
SECTION 31. Authority to Accept Assistance and/or Donations. – The NCSA is authorized 
to accept donations, contributions, grants, bequests or gifts from domestic or foreign sources, 
for purposes relevant to its mandates and functions, subject to existing laws, rules and 
regulations. 
 
SECTION 32. Appropriations. – The amount necessary for the initial implementation of this 
Act shall be charged against the current and available appropriations of concerned agencies. 
Thereafter, the amount needed for the implementation of this Act shall be included in the 
annual General Appropriations Act. 
 
SECTION 33. Cybersecurity Risk Management and Mitigation Fund. – There is hereby 
created a Cybersecurity Risk Management and Mitigation Fund (CRMMF). 
  
(a)  CRMMF shall be used for cybersecurity risk mitigation, prevention, and preparedness 
activities such as but not limited to training of personnel, procurement of equipment, 
and capital expenditures. It can also be utilized for the management of imminent or 
actual cybersecurity threats which may occur during the current fiscal year or those that 
occurred in the past two (2) years from the current fiscal year. Risk management 
activities include threat identification and detection, incident response, system recovery 
and protection, and other related works or services; 
 
(b) The specific amount of the CRMMF and the appropriate recipient agencies shall be 
determined upon approval of the President of the Philippines in accordance with the 
favorable recommendation of the NCSA; 
 


(c) Of the amount appropriated for the CRMMF, thirty percent (30%) shall be allocated as 
Quick Response Fund (QRF) or a contingent fund for response and recovery activities 
in order to immediately bring affected CII systems to normal operation; and 
 
(d) All departments/agencies that are allocated with the CRMMF shall submit to the NCSA 
their monthly statements on the utilization of CRMMF and make an accounting thereof 
in accordance with existing accounting and auditing rules. 
  
SECTION 34. Report. – The NCSA shall submit an annual report to the Office of the President 
on the implementation of this Act, as well as the operations of the Agency. The NCSA shall 
also include in its report disclosures of cybersecurity vulnerabilities, actionable protocols to 
mitigate cybersecurity vulnerabilities to information systems and industrial control systems. 
 
SECTION 35.  Confidentiality. – 
 
I. 
All parties involved in the application of this Act shall respect the confidentiality of 
information and data obtained in carrying out their tasks and activities in such a manner 
as to protect, in particular: 
 
(a) Intellectual property rights, and confidential business information or trade secrets of 
a natural or juridical person, including source code, except in cases where the 
disclosure and access is necessary to protect the legitimate interest recognized by 
existing laws, rules, and regulations; 
 
(b) Public and national security interests;  
 
(c) Data of security agencies, ensuring that they will not be migrated into the private 
domain; and 
 
(d)  Integrity of criminal or administrative proceedings. 
  
II. 
Without prejudice to paragraph I, information exchanged on a confidential basis 
between government departments, agencies, bureaus, offices, and institutions and 
the NCSA shall not be disclosed without the prior agreement of the originating 
government departments, agencies, bureaus, offices, and institutions. 
 
III. 
Adequate protection shall be set in place between the information shared by the 
private sector and government agencies, particularly security and law enforcement 
agencies. 
 
IV. 
Paragraphs I and II shall not affect the rights and obligations of the NCSA and 
notified bodies with regard to the exchange of information and the dissemination 
of warnings, nor the obligations of the persons concerned to provide information 
under existing laws, rules, and regulations. 
 
V. 
The NCSA may exchange, when necessary, sensitive information with relevant 
authorities of third countries with which they have concluded bilateral or multilateral 
confidentiality arrangements guaranteeing an adequate level of protection. 
  
SECTION 36. Periodic Review. – The NCSA, in consultation with the DICT, the DOST, and 
other concerned agencies shall conduct a review of the Act every three years, or more 
frequently as may be necessary, to ensure that certifications, regulations, standards, 
penalties, and other provisions of the Act, with the end in view of meeting the cybersecurity 
standards and requirements for emerging technologies. 
 


SECTION 37. Utilization of the Collected Fees, Fines, and Penalties. – The NCSA is 
hereby authorized to utilize the fees and penalties collected for programs and projects aimed 
at enhancing cybersecurity capabilities and infrastructure within the jurisdiction. These funds 
shall be allocated towards initiatives such as cybersecurity awareness campaigns, capacity-
building programs, research and development efforts, and the procurement of advanced 
cybersecurity technologies and tools, provided that at no circumstance shall the funds be used 
to augment salaries and personnel benefits.  
  
 
The utilization of the aforementioned fund shall be subject to government accounting 
manual and audit procedures, ensuring transparency, accountability, and proper fiscal 
management in accordance with the objectives and mandates of NCSA. Regular audits and 
reporting requirements shall be conducted to ensure the effective and efficient utilization of 
funds. 
 
SECTION 38. Implementing Rules and Regulations. – Within one hundred twenty (120) 
days from the effectivity of this Act, the DICT, the DBM, the CSC, and upon consultation with 
relevant stakeholders, shall promulgate the rules and regulations to effectively implement the 
provisions of this Act. 
 
SECTION 39. Separability Clause. –  If any provision of this Act is declared invalid or 
unconstitutional, the remainder thereof not otherwise affected shall remain in full force and 
effect. 
  
SECTION 40. Repealing Clause. – All laws, presidential decrees, executive orders, letters of 
instructions, proclamations, or administrative regulations that are inconsistent with the 
provisions of this Act are hereby repealed, amended, or modified accordingly. 
  
SECTION 41. Effectivity Clause. – This Act shall take effect fifteen (15) days following its 
publication in the Official Gazette or at least two national newspapers of general circulation.  
  
 
Approved,