I:. 
' '
TWENTIETH CONGRESS OF THE ) 
REPUBLIC OF THE PHILIPPINES )
First Regular Session 
)
,' wQitirr ol il.f • ■ • •
25 JUL15 P5 -17
SENATE 
Senate Bill No.
RKEiVtU El'
Introduced by Senator Juan Miguel "Migz" F. Zubiri
AN ACT
REQUIRING CRITICAL INFORMATION INFRASTRUCTURE INSTITUTIONS TO 
ADOPT AND IMPLEMENT ADEQUATE MEASURES TO PROTECT THEIR 
INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) SYSTEMS AND 
INFRASTRUCTURE
EXPLANATORY NOTE
The COVID-19 pandemic accelerated the country's digital transformation and 
digital economy. Filipinos now use a greater number of digital services than they did 
before the pandemic years. The Bangko Sentral ng Pilipinas (BSP) reported that digital 
payments made up 57.4% of transactions by volume and 59.0% by value in 2024, up 
from 52.8% and 55.3% in 2023. On a monthly basis, the total value of these payments 
reached up to US$136.0 billion. This development underscores a significant shift toward 
digital financial systems and reliance on digital payment infrastructure.
Everyday life in our homes, corporate boardrooms, checkout counters of digital 
carts and government offices who deal with sundry items from food to frontline services 
and welfare payments or ayuda, among others need accuracy, speed and reliability. 
Breakneck speed is what we wish digital transactions would be. Yet, we know the promise 
of speed alone cannot engender trust. We must know that the system can be trusted 
because it is well-protected.
Increased use of digital technologies, especially the Internet, is accompanied by 
cyberthreats and risks. Malicious actors—from casual scammers to highly sophisticated 
state-backed groups—hunt for vulnerabilities in ICT systems and networl^ to steal 
information, disrupt essential services, and profit from attacks. Hence, it is critically 
important to ensure that the Philippines has a national policy framework for the protection 
of digital assets, especially critical information infrastructure (CII), against threats that 
could paralyze our economy and affect the wellbeing of Filipinos.
The Philippine National Cyber Security Plan 2022 highlighted the goal of "assuring 
the continuous operation of the nation's critical information infrastructure." These digital 
systems underpin the operation of critical infrastructure, such as water, electricity, 
banking and financial networks, telecommunications, and other networks vital to the 
operation of the country.


In light of these risks, it is high time to ensure the protection of CIIs by ensuring, 
at the minimum, compliance with international standards and globally accepted best 
practices for cybersecurity.
As a proactive and institutionally cohesive response, this bill aims to protect the 
cybersecurity of CII by requiring the: (i) adoption of minimum information security 
standards, (ii) creation of a computer emergency response team and reporting of 
cybersecurity incidents, and (iii) development of a capable pool of cybersecurity 
professionals and practitioners that will be critical to the effective implementation of 
cybersecurity policy, rules, and standards.
If passed, the Critical Information Infrastructure Protection Act will provide a 
framework for ensuring the security and reliability of the country's digital ecosystem, 
which is crucial to the country's continued digitalization and growing digital economy. As 
a necessary step to improving Philippine cybersecurity, the passage of this bill is earnestly 
sought for the security and well-being of all Filipinos.
IAN MIGUEL "MIGZ" F. ZUBIRI


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20
TWENTIETH CONGRESS OF THE ) 
REPUBLIC OF THE PHILIPPINES )
First Regular Session 
)
U t a. 
liOi’i itr 01 
■
25 JUL15 P5 -17
SENATE 
Senate Bill No. 662
RtCEiVEOt-.:
Introduced by Senator Juan Miguel "Migz" F. Zubiri
AN ACT
REQUIRING CRITICAL INFORMATION INFRASTRUCTURE INSTITUTIONS TO 
ADOPT AND IMPLEMENT ADEQUATE MEASURES TO PROTECT THEIR 
INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) SYSTEMS AND 
INFRASTRUCTURE
Be it enacted by the Senate and House of Representatives of the Philippines in 
Congress assembled.
Section 1. Title. - This Act shall be known as the "Critical Information 
Infrastructure Protection Act"
Sec. 2. Declaration of Policy.-The growth of Information computer technology 
is accompanied by new and serious threats and, as such, the state recognizes as vitally 
important the establishment of a more secure cyberspace and a data protection regime 
that is compliant with international standards and ensures the free flow of information.
It is the policy of the State to protect Critical Information Infrastructure ("CII") 
from cyberattacks and threats, data manipulation, cybercrimes, and activities of malicious 
actors. The State recognizes that the protection of computers, networks, electronic 
devices, and digital assets, including information, is a common objective and requires the 
combined efforts of the public and private sectors, and cooperation with local and 
international actors, in order to minimize the impact of, if not prevent, cyberattacks, 
threats, and risks on the nation's security and socio-economic well-being.
Further, the adoption and implementation of minimum information security 
standards is a globally accepted best practice to provide guidance, which would lead to 
more efficient use of resources, improved risk management, consistent delivery of critical 
and essential services, and effective protection of the confidentiality, integrity, and 
availability of information that is vital to the nation.
Sec. 3. Definition. - For the purpose of this Act and for the implementation of 
the policy contained herein, the following definitions shall apply:


1 
a) "Critical infrastructure" refers to assets, systems, and networks, whether physical
2 
or virtual, that are considered so vital that their destruction or disruption would have
3 
a debilitating impact on national security, health and safety, or economic well-being
4 
of citizens, or any combination thereof.
5 
b) "Critical Information Infrastructure (CII)" refers to computer systems, ICT
6 
information and communications technology (ICT) networks, and digital assets that
7 
are necessary for the continuous operation and delivery of the country's critical
8 
infrastructure services.
9 
c) "CII institution" refers to a government agency or a private company that owns,
10 
operates, controls, and/or maintains critical information infrastructure, and whose
11 
operation is nationwide in scope and/or covers metropolitan centers, including Metro
12 
Manila, Metro Cebu, Metro Davao, and, by 2025, Metro Cagayan de Oro, or as
13 
defined and updated by the National Economic Development Authority (NEDA) or
14 
the Philippine Statistics Authority (PSA).
15 
d) "Computer Emergency Response Team" or "CERT" refers to an organization that
16 
studies computer and network security in order to provide incident response services
17 
to victims of attacks, publish alerts concerning vulnerabilities and threats, and to
18 
offer other information to help improve computer and network security.
19 
e) "Information security" refers to the preservation of the confidentiality, integrity, and
20 
availability of information. This may also involve other properties, such as
21 
authenticity, accountability, non-repudiation, and reliability of information.
22 
f) "Information security incident" refers to an occurrence that actually or potentially
23 
jeopardizes the confidentiality, integrity, or availability of an information system or
24 
the information the system processes, stores, or transmits or that constitutes a
25 
violation or imminent threat of violation of security policies, security procedures, or
26 
acceptable use policies.
27 
g) "Information system" refers to applications, services, information technology assets,
28 
or any component handling information.
29 
Sec. 4. Coverage of Critical Information Infrastructure. - This Act covers
30 
CII, whether in the public or private sector, in industries including, but not limited to:
31 
a) Banking and finance;
32 
b) Broadcast media;
33 
c) Emergency services and disaster response;
34 
d) Energy;
35 
e) Health;
36 
f) Telecommunications;


1 
g) Transportation (land, sea, air); and
2 
h) Water.
3 
An entity, whether public or private, that owns, operates, and maintains CII in the
4 
industries mentioned above, and as updated by the Department of Information and
5 
Communications Technology (DICT), shall be covered by this Act.
6 
The DICT shall institute a consultation process to update the definition of a CII,
7 
the list of CII institutions, and the sector or industry covered as CII every three (3) years
8 
from the effectivity of this Act.
9 
Sec. 5. Adoption of Minimum Information Security Standards. - All
10 
covered CII institutions shall adopt and implement adequate measures to protect their
11 
ICT systems and infrastructure, and respond to and recover from any information security
12 
incident, in compliance with existing laws, rules and regulations, including the following:
13 
a) adopt the Code of Practice stipulated in the Philippine National Standard (PNS) on
14 
ISO/IEC 27001 Information Security Management 
System 
(ISMS) (series of
15 
standards) and PNS ISO 22301 Security 
and resilience 
- Business continuity
16 
management systems (BCMS). They shall also adopt the ISO/IEC 27701 Privacy
17 
Information Management Systems, as applicable;
18 
b) submit to the DICT a copy of their formal certification as proof of adoption of the
19 
PNS ISO/IEC 27000 (series of standards), PNS ISO 22301, and ISO/IEC 27701, as
20 
applicable; and
21 
c) ensure that their certificates are up-to-date and shall submit the latest annual audit
22 
confirmation to the DICT.
23 
In lieu of the submission of formal certification above, covered CII institutions shall
24 
subject themselves to an annual information security self-assessment using standards,
25 
such as but not limited to, the Center for Internet Security (CIS) Controls or the National
26 
Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, during the
27 
first quarter of each year. The concerned institution shall submit this self-declaration and
28 
attest to its validity to the DICT on or before the 31st of March. The self-declaration shall
29 
be signed off by the respective head of the department directly in charge of the agency's
30 
information security systems.
31 
Each CII institution shall adopt programs, guidelines, and written procedures for
32 
the implementation of its chosen information security standard, which shall be included
33 
In their annual submission.
34 
The DICT shall have the authority to determine and update information security
35 
standards, and require CII institutions to comply with such standards, as it deems it
36 
necessary and appropriate.


1 
Nothing in this Act shall prevent a government agency or a sector regulator from
2 
imposing additional or more stringent information security standards for compliance by
3 
industry players under its jurisdiction, as it deems necessary.
4 
Sec. 6. National Computer Emergency Response Team ("NCERT") as the
5 
Centralized Information Security Incident Reporting Mechanism. - All covered
6 
CII Institutions shall:
7 
a) report all information security incidents affecting their institutions to the DICT's
8 
Philippine National Computer Emergency Response Team, which shall be the
9 
central authority for all Sectoral and Organizational CERTs in the country;
10 
b) submit an information security incident detection report to the NCERT within
11 
twenty-four (24) hours upon detection of the incident(s). The report shall contain
12 
basic information about the incident, such as: (1) date when the incident was first
13 
detected, (ii) nature of the information security incident, (iii) possible business
14 
processes and functions compromised, and (iv) agency's initial response and next
15 
steps;
16 
c) submit an incident progress report, upon request of the NCERT, in order to help
17 
assess and provide the necessary support in responding to an incident;
18 
d) submit a post-incident report, which contains the following information: (i)
19 
magnitude of business operations compromised, (ii) risk assessment, 
and (iii) the
20 
agency's response. They shall also provide the necessary additional information
21 
about the incident, as requested by the NCERT;
22 
e) compile on an annual basis a summary of all information security incident reports
23 
and submit an annual report to the DICT Cybersecurity Bureau every 30th of June;
24 
f) comply with the reporting mechanism and template prescribed by the DICT, in the
25 
submission of all the reporting requirements described above: Provided, that
26 
information-sharing shall be done using established communication protocol, using
27 
at the minimum, the Traffic Light Protocol (TLP) as established by the DICT MC
28 
2017-005 or succeeding policies; and
29 
g) participate in activities that help promote awareness, capacity building, and
30 
improve an organization's information security readiness, protection, and incident
31 
response capabilities, such as but not limited to cyber drills.
32 
Sec. 7. Designation of Personnel with Information Security Credentials.
33 
- All government agencies shall have at least one personnel with sufficient information
34 
security training and credentials. Such personnel shall, preferably, hold at least Division
35 
Chief plantilla position (or equivalent) and perform decision making or management
36 
functions. The DICT shall identify and release a list of credentials that meet this


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
requirement. Such personnel shall be the point person for (i) compliance with prescribed 
standards, (ii) building information security capability within the agency, and (iii) 
compliance with the agency's and NCERT's reporting requirements.
Section 8. Compliance by all covered CII Institutions.
a) 
Government compliance: The Department of Budget and Management (DBM) shall 
review the submission by a CII Institution to the DICT of a formal certification or 
self-declaration of compliance with any of the prescribed information security 
standards, whichever submission applies, as a prerequisite to budgetary approval. 
A government institution or sector regulator, which itself operates or has 
jurisdiction over CII, shall comply with the requirements set forth in this Act.
b) 
Non-government or private company compliance: Compliance with this Act, 
specifically of Sections 5 (standards) and 6 (reporting), shall be a prerequisite for 
the granting of any regulatory approval, permit, and/or license to a private 
company covered under Section 4 of this Act.
Sec. 9. Implementing Agency. - The DICT, through its Cybersecurity Bureau, 
shall be the implementing agency of this Act, in accordance with the National 
Cybersecurity Plan and relevant DICT policies. The DICT shall:
a) 
create and maintain a database of all certifications, self-declaration, and 
attestations of all covered CII institutions;
b) 
prescribe minimum information security standards for compliance by all CII 
institutions;
c) 
serve as the custodian for information security standards and incident reports;
d) 
collect and analyze all pertinent information about an information security incident, 
and provide to government institutions, sectoral CERTs, and to the public a 
technical report of information security incidents for purposes of policy, regulation, 
and providing guidance to all stakeholders on local information security issues.
e) 
prescribe a mechanism and template for the reporting of information security 
incidents to the NCERT; and
f) 
institute a consultation process and hold consultations to update the coverage and 
definition of CII, minimum information security standards, and recognize individual 
information security certifications every three (3) years from the effectivity of this 
Act.
Sec. 10. - Responsibilities of the Department Heads and Sector 
Regulators with jurisdiction over CII Institutions. The heads of departments and 
sector regulators who have a mandate over covered CII Institutions, including Sectoral 
CERT Leads as identified in DICT DC 003-2020, in coordination with the DICT, shall be


1 
responsible for issuing the necessary policy and regulation that promote information
2 
security and require compliance of CII institutions with the prevailing standards to ensure
3 
information security and business continuity.
4 
Sec. 11. Appropriations. - The initial funding requirements for the
5 
implementation of this Act shall be charged against the existing appropriations of the
6 
covered CII institutions and such other appropriate funding sources as the DBM may
7 
identify, subject to relevant laws, rules, and regulations.
8 
Sec. 12. Penalty. - Non-compliance with the provisions of this Act, whether or
9 
not it results in data loss, breaches, hacking, or similar incidents, may result in
10 
administrative, civil, or criminal liability under applicable laws, including but not limited to
11 
Republic Act No. 10175 also known as the Cybercrime Prevention Act of 2012 and
12 
Republic Act No. 10173 or the Data Privacy Act of 2012.
13 
Sec. 13. Annual Report. - Every 30th of April of every year, the DICT shall report
14 
to the Office of the President the status of the implementation of this Act.
15 
Sec. 14. Separability Clause. - If any provision of this Act is declared invalid or
16 
unconstitutional, the remaining provisions not affected thereby shall continue to be in full
17 
force and effect.
18 
Sec. 15. Repealing Clause. - All laws, rules, and regulations inconsistent with
19 
this Act are hereby repealed or modified accordingly.
20 
Sec. 16. Effectivity. - This Act shall take effect fifteen (15) days after its
21 
publication in the Official Gazette or in a newspaper of general circulation.
Approved,