1 
Republic of the Philippines 
HOUSE OF REPRESENTATIVES 
Quezon City, Metro Manila 
Twentieth Congress 
First Regular Session 
HOUSE BILL NO. _______ 
______________________________________________________________________ 
Introduced by Representatives Bryan B. Revilla, Lani Mercado-Revilla, and Ramon Jolo 
Revilla III 
______________________________________________________________________ 
EXPLANATORY NOTE 
The absence of a cybersecurity law leaves a big gap in our legal framework 
especially considering its importance in terms of national security and economic stability. 
Without a robust cybersecurity law, the country's digital infrastructure remains highly 
vulnerable to increasingly sophisticated cyber threats. 
The absence of legislation on the identification, management, and regulation of 
Critical Information Infrastructures (CIIs) creates a blind spot. We cannot protect what we 
have not formally identified. This lack of a clear framework, combined with the poor 
coordination among CIIs and government agencies, means our most essential digital 
assets are at risk from uncoordinated and fragmented defense strategies. 
Further, the lack of mandatory disclosure of cybersecurity incidents hinders our 
ability to build a comprehensive national threat intelligence picture. Without a clear 
understanding of the attacks that are happening, we cannot effectively prepare for future 
ones. This reactive posture is compounded by our current inability to proactively address 
known cyber threats, such as mitigating command and control sites, a critical defense 
measure that falls outside the scope of existing laws. 
Finally, a systemic issue of a lack of skilled workforce, standardized education, and 
consistent funding leaves our defenses critically under-resourced. A law that mandates 
standards for capacity-building and secures necessary appropriations is essential to 
develop a competent workforce and provide them with the tools and resources they need 
to protect the nation from imminent cyber threats. 
To effectively address these concerns, it is imperative that we pass a 
comprehensive cybersecurity bill that not only tackles these issues, but also further 
strengthens our cybersecurity infrastructure. 
This measure was prepared in close collaboration with the Department of 
Information and Communications Technology (DICT). As such, the passage of this bill is 
earnestly sought. 
REP. BRYAN B. REVILLA 
 REP. LANI MERCADO-REVILLA 
    Representative, AGIMAT Partylist  
          Representative, 2nd District of Cavite  
REP. RAMON JOLO B. REVILLA III 
Representative, 1st District of Cavite 
September 8, 2025
9:17 am
4381


1 
Republic of the Philippines 
HOUSE OF REPRESENTATIVES 
Quezon City, Metro Manila 
Twentieth Congress 
First Regular Session 
HOUSE BILL NO. _______ 
______________________________________________________________________ 
Introduced by Representatives Bryan B. Revilla, Lani Mercado-Revilla, and Ramon Jolo 
Revilla III 
______________________________________________________________________ 
AN ACT 
AUTHORIZING THE PROTECTION OF CRITICAL INFORMATION 
INFRASTRUCTURE AGAINST CYBERSECURITY THREATS AND INCIDENTS, AND 
CREATING THE NATIONAL CYBERSECURITY AGENCY, DEFINING ITS POWERS 
AND FUNCTIONS, AND APPROPRIATING FUNDS THEREFOR 
Be it enacted by the Senate and House of Representatives of the Philippines in 
Congress assembled: 
CHAPTER 1 
1 
GENERAL PROVISIONS 
2 
3 
 SECTION 1. Short Title. – This Act shall be known as the “Cybersecurity Act.” 
4 
5 
 SEC. 2. Declaration of Policy. – It is hereby declared a policy of the State: 
6 
7 
(a) To recognize the vital role of communications and information in nation-building;
8 
9 
(b) To recognize the maintenance of peace and order, the protection of life, liberty,
10 
and property, and the promotion of the general welfare are essential for the
11 
enjoyment by all the people of the blessings of democracy;
12 
13 
(c) To serve and protect the people, and as the Constitution guarantees the right of
14 
the people to be secure in their persons, houses, papers, and effects against
15 
unreasonable searches and seizure, and that the privacy of communication and
16 
correspondence shall be inviolable except upon lawful order of the court,
17 
cybersecurity and information security are important to the protection of the Filipino
18 
society;
19 
20 
(d) To adopt measures to effectively prevent and combat cybersecurity offenses by
21 
facilitating detection, investigation, and prosecution of offenses at both the
22 
domestic and international levels, and by providing arrangements for fast and
23 
reliable international cooperation; and
24 
25 
(e) To adopt a Zero Trust Architecture in cybersecurity, as appropriate in the Philippine
26 
context and aligned with international standards and best practices.
27 
28 
SEC. 3. Definition of Terms. – For purposes of this Act, the following terms shall mean: 
29 
30 
4381


 
2 
 
(a) Availability refers to the property of being accessible and usable upon demand by 
1 
an authorized entity. 
2 
(b) Computer Network refers to a system that connects two or more computing 
3 
devices for transmitting and sharing information. Computing devices include 
4 
everything from a mobile phone to a server. These devices are connected using 
5 
physical wires such as fiber optics, but they can also be wireless. 
6 
 
7 
(c) Computer System refers to any device or group of interconnected or related 
8 
devices, one or more of which, pursuant to a program, performs automated 
9 
processing of data. It covers any type of device with data processing capabilities 
10 
including, but not limited to, computers and mobile phones. The device consisting 
11 
of hardware and software may include input, output, and storage components 
12 
which may stand alone or be connected in a network or other similar devices. It 
13 
also includes computer data storage devices or media, both physical and virtual. 
14 
 
15 
(d) Confidentiality refers to property that information is not made available or disclosed 
16 
to unauthorized individuals, entities, or processes. 
17 
 
18 
(e) Critical Information Infrastructure (CII) refers to a computer or a computer system 
19 
located wholly or partly in the Philippines, necessary for the continuous delivery of 
20 
an essential service, and the loss or compromise of the computer or computer 
21 
system will have a debilitating effect on the availability of the essential service in 
22 
the Philippines. CIIs consist of information process and information and 
23 
communications technology which form part of the operation of the critical 
24 
infrastructures. 
25 
 
26 
(f) Critical infrastructure (CI) refers to any public service which owns, uses, or 
27 
operates systems and assets, whether physical or virtual, so vital to the Republic 
28 
of the Philippines that the incapacity or destruction of such systems or assets 
29 
would 
have 
a 
detrimental 
impact 
on 
national 
security, 
including 
30 
telecommunications and other such vital services as may be declared by the 
31 
President of the Philippines. 
32 
 
33 
(g) Cryptographic primitive crypto-primitive refers to a low-level cryptographic 
34 
algorithm used as a basic building block for higher-level cryptographic algorithms. 
35 
 
36 
(h) Cybercrime encompasses illegal activities conducted within cyberspace which 
37 
may involve malicious intent. Involves activities violating laws and regulations such 
38 
as the Cybercrime Prevention Act (Republic Act No. 10175, as amended), resulting 
39 
in severe consequences such as privacy breaches, disruption of critical services. 
40 
 
41 
(i) Cybersecurity refers to the collection of tools, policies, risk management 
42 
approaches, actions, training, best practices, assurance, and technologies that 
43 
can be used to protect the cyber environment and organization and user’s assets. 
44 
 
45 
(j) Cyberspace refers to a complex environment emerging from the interaction of 
46 
people, software, and services on the internet by means of technology devices and 
47 
networks connected to it, which does not exist in any physical form.1  
48 
 
49 
(k) Information and communications technology (ICT) encompasses all technologies 
50 
for the capture, storage, retrieval, processing, display, representation, 
51 
organization, management, security, transfer, and interchange of data and 
52 
information. 
53 
 
54 
 
1National Cybersecurity Plan 2023-2028, p xii 


 
3 
 
(l) Information security refers to the protection of information and systems from 
1 
unauthorized access, use, disclosure, disruption, modification, or destruction in 
2 
order to provide confidentiality, integrity, and availability. 
3 
(m)Integrity refers to the property of accuracy and completeness.  
4 
 
5 
(n) National Computer Emergency Response Team (NCERT) refers to a group of 
6 
information security experts and practitioners responsible for responding to 
7 
cybersecurity incidents of an organization with the aim of minimizing the impact or 
8 
damage and ensuring recovery of affected systems. 
9 
 
10 
(o) Non-Repudiation refers to the ability to prove the occurrence of a claimed event or 
11 
action and its originating entities.2 
12 
 
13 
(p) Public Key Infrastructure (PKI) refers to a set of policies, processes, server 
14 
platforms, software and workstations used for the purpose of administering 
15 
certificates and public-private key pairs, including the ability to issue, maintain, and 
16 
revoke public key certificates. The PKI includes the hierarchy of certificate 
17 
authorities that allow for the deployment of digital certificates that support 
18 
encryption, digital signature and authentication to meet business and security 
19 
requirements. 
20 
 
21 
(q) Privacy refers to having the personal control over personal information.3 
22 
 
23 
(r) Protective Domain Name System (PDNS) refers to the naming database that 
24 
locates, tracks, and regulates internet domain names and IP addresses. 
25 
 
26 
(s) Security Operations Center (SOC) refers to the focal point for security operations 
27 
and computer network defense of an organization. The purpose of the SOC is to 
28 
defend and monitor an organization’s systems and networks on an ongoing basis. 
29 
The SOC is also responsible for detecting, analyzing, and responding to 
30 
cybersecurity incidents in a timely manner. 
31 
 
32 
(t) Zero Trust (ZT) refers to an evolving set of cybersecurity paradigms that move 
33 
defenses from static, network-based perimeters to focus on users and resources. 
34 
It is a set of security primitives rather than a particular set of technologies. Zero 
35 
trust assumes that there is no implicit trust granted to user accounts based solely 
36 
on their physical or network location (i.e., local area networks versus the internet) 
37 
or to endpoints (devices) based on their ownership (e.g., enterprise or personally 
38 
owned). Zero trust focuses on protecting resources (e.g., devices, services, 
39 
workflows, network accounts) rather than network segments, as the network 
40 
location is no longer seen as the prime component to the security posture of the 
41 
resource.  
42 
 
43 
(u) Zero Trust Architecture (ZTA) refers to an enterprise’s cybersecurity plan that 
44 
utilizes zero trust concepts and encompasses component relationships, workflow 
45 
planning, and access policies. 
46 
 
47 
 
48 
CHAPTER 2 
49 
ORGANIZATION OF THE NATIONAL CYBERSECURITY AGENCY 
50 
 
51 
SEC. 4. Creation of the National Cybersecurity Agency (NCSA) – There is hereby 
52 
created a National Cybersecurity Agency, which shall be an attached agency to the 
53 
Department of Information and Communications Technology (DICT).    
54 
 
2National Cybersecurity Plan 2023-2028, pp xiii 
3National Cybersecurity Plan 2023-2028, pp xiii 


 
4 
 
 
1 
SEC. 5. Mandate. – The NCSA shall be the primary policy, planning, coordinating, 
2 
implementing, and administrative entity that will plan, develop, coordinate, and implement 
3 
the overall national cybersecurity strategy of the government. 
4 
 
5 
SEC. 6. The Agency shall exercise the following powers and functions:  
6 
 
7 
I. Policy Planning and Coordination 
8 
 
9 
(a) Formulate policies and recommendations on issues concerning cybersecurity, 
10 
advise Congress and other government agencies on all aspect of cybersecurity, 
11 
and propose legislation and amendments thereto; 
12 
 
13 
(b) Formulate and implement the National Cybersecurity Plan; 
14 
 
15 
(c) Ensure the participation of all stakeholders in policy formulation and 
16 
implementation; 
17 
 
18 
(d) Lead the whole-of-government effort to formulate cybersecurity regulations, in 
19 
accordance with international standards and best practices; 
20 
 
21 
(e) Set national standards on the generation, management, use, optimization, and, if 
22 
applicable, disposal of cybersecurity products, protocols, and crypto-primitives 
23 
such as, but not limited to: Public Key Infrastructures (PKI); secure routing 
24 
protocols; secure network elements; protective Domain Name Service; encryption 
25 
and decryption protocols, and authentication protocols; 
26 
 
27 
(f) Coordinate all cybersecurity activities of the government, in partnership with the 
28 
private sector and other stakeholders; 
29 
 
30 
(g) Advise the President, Congress, Judiciary, and Constitutional bodies on all 
31 
cybersecurity-related issues and concerns; 
32 
 
33 
(h) Create the National Vulnerability Disclosure Program. The program shall be the 
34 
gateway for the security researchers to submit vulnerabilities of the online assets 
35 
of the Philippine government; 
36 
 
37 
II. CII Protection 
38 
(i) Formulate and set cybersecurity minimum standards for CIIs, in coordination with 
39 
relevant administrative agencies exercising regulatory functions over CIIs; 
40 
(j) Ensure compliance of CIIs to cybersecurity minimum standards requirements;  
41 
(k) Conduct audit and assessment of the cybersecurity posture of CIIs, all National 
42 
Government 
Agencies, 
including 
Government-Owned 
and/or 
Controlled 
43 
Corporations (GOCCs), State Universities and Colleges (SUCs), and Local 
44 
Government Units (LGUs). The Congress and the Judiciary may request the NCSA 
45 
to assist them in the conduct of cybersecurity audit and assessment; 
46 
(l) Establish a liaison network of CERTs (or CERTs Points of Contact) among CIIs to 
47 
facilitate communication and information sharing; 
48 
(m)Regulate and provide oversight over private cybersecurity service providers such 
49 
as, but not limited to Vulnerability Assessment and Penetration Testing (VAPT) 
50 
service providers, security operations center providers, etc.; 
51 


 
5 
 
(n) Upon request, provide analysis, expertise, and other technical assistance to critical 
1 
infrastructure owners and operators, and if appropriate, provide those analyses, 
2 
expertise, and other technical assistance in coordination with Sector-Specific 
3 
Agencies and other government departments and agencies; 
4 
III. Cyber Threats and Incidents Response 
5 
(o) Establish the NCERT and a robust incident response capability to promptly detect, 
6 
analyze, and mitigate cyber incidents affecting national security or public interest 
7 
and to collaborate with relevant government agencies, private sector entities, and 
8 
international partners for coordinated incident response; 
9 
 
10 
(p) Enhance cyber threat intelligence and situational awareness; 
11 
 
12 
(q) Establish a liaison network of CERTs (or CERTs Points of Contact) among 
13 
government agencies to support the implementation of the mandate of NCERT; 
14 
 
15 
(r) Perform vulnerability assessment and penetration testing initiatives to detect, 
16 
identify, and analyze cyber threats and to properly attribute cyber-attacks against 
17 
CIIs; 
18 
 
19 
(s) Initiate legal proceedings for the collection of computer data and summon 
20 
witnesses to appear in any proceedings, investigation, or inquiry of the NCSA 
21 
regarding cybersecurity incidents of national government agencies (NGAs) and 
22 
instrumentalities, and CII; 
23 
 
24 
(t) Collect open-source data and conduct data analysis for proactive cybersecurity 
25 
measures against misinformation, deceptive content, and other forms of attacks 
26 
on integrity of information; 
27 
 
28 
IV. Research and Development 
29 
(u) Lead in the development of cybersecurity technologies, tools, and standards, in 
30 
partnership with the academe, other government research institutions, and 
31 
international partners; 
32 
 
33 
V. Capacity Building 
34 
(v) Develop and implement training programs to build and maintain a highly skilled 
35 
cyber workforce in the government; 
36 
 
37 
(w) Partner with academic institutions, industry stakeholders, and foreign counterparts 
38 
to promote knowledge sharing, resource sharing, and skills development in 
39 
cybersecurity; 
40 
 
41 
(x) Prescribe personnel qualifications and other qualification standards essential to 
42 
the effective development on cybersecurity field of expertise; 
43 
 
44 
(y) Co-develop with the Civil Service Commission (CSC) the cybersecurity 
45 
qualification standards; 
46 
 
47 
VI. Information Sharing 
48 
(z) Gather, assess, and distribute actionable intelligence regarding cyber threats, 
49 
emerging patterns, and potential vulnerabilities, thereby bolstering the nation's 
50 
cyber situational awareness and facilitating informed decision-making processes; 
51 
 
52 


 
6 
 
(aa) 
Develop a mechanism for information-sharing between the government (or 
1 
public) and the private sector; 
2 
 
3 
(bb) 
Issue cybersecurity advisories or guidelines regularly or as needed; 
4 
 
5 
VII. International Cooperation 
6 
(cc) 
Foster international collaboration and cooperation for the promotion of 
7 
cybersecurity; 
8 
 
9 
(dd) 
Support the government’s efforts to establish the Philippines as a regional 
10 
digital hub; 
11 
 
12 
(ee) 
Represent the Republic of the Philippines, in coordination with other 
13 
relevant agencies in international cybersecurity cooperation; 
14 
 
15 
VIII. Regulatory 
16 
(ff) In any investigation under Chapter 6: Prohibited Acts, after due notice and hearing, 
17 
the NCSA may impose sanctions, collect fees, fines, and penalties for the violation 
18 
of laws, rules, regulations, orders, and issuances on CIIs; and 
19 
 
20 
(gg) 
Exercise such other powers as may be provided by law, as well as those 
21 
which may be implied from, or which are necessary or incidental to the carrying 
22 
out of the express powers granted the NCSA to achieve the objectives and 
23 
purposes of this law. 
24 
 
25 
SEC. 7. Composition. – The NCSA shall be headed by a Director-General with the rank 
26 
of Undersecretary and shall be assisted by two Deputy Directors-General with the rank 
27 
of Assistant Secretaries.   
28 
 
29 
SEC. 8. Qualifications. – The following are the minimum qualifications of the Director-
30 
General and Deputy Directors-General of the NCSA:  
31 
 
32 
(a) 
Director-General – The Director-General shall be appointed by the 
33 
President. No individual shall be appointed as Director-General of the NCSA 
34 
unless he or she is a citizen residing in the Philippines for the past 10 years, of 
35 
good moral character, has at least five (5) years of government experience and 
36 
ten (10) years cumulative experience as a cybersecurity, information privacy, or 
37 
information security professional, and has at least a Master’s Degree in 
38 
Cybersecurity, Information Security, or any other related master’s degree. 
39 
  
40 
(b) 
Deputy Directors-General – The Deputy Directors-General of the NCSA 
41 
shall be appointed by the President. No individual shall be appointed Deputy 
42 
Directors-General of the NCSA unless they are citizens residing in the Philippines 
43 
for the past 10 years, of good moral character, possessing proven integrity, and 
44 
having unquestionable integrity, with a track record of leadership, recognized 
45 
competence with the appropriate educational background in cybersecurity or any 
46 
related field, with at least six (6) years of supervisory or management experience 
47 
in the field of cybersecurity, data privacy, information technology (IT), IT risk 
48 
management, or any combination thereof. 
49 
 
50 
SEC. 9. Separation and Retirement from Service. – Employees who are separated 
51 
from service within six (6) months from the effectivity of this Act as a result of the 
52 
consolidation and/or reorganization under the provisions of this Act shall receive 
53 
separation benefits to which they may be entitled under Executive Order No. 366, s. 2004. 
54 
Those who are qualified to retire under existing retirement laws shall be allowed to retire 
55 


 
7 
 
and receive retirement benefits to which they may be entitled under applicable laws and 
1 
issuances. 
2 
 
3 
SEC. 10. Structure and Staffing Pattern. – Subject to the approval of the Department 
4 
of Budget and Management (DBM), NCSA shall determine its organizational structure 
5 
and create new divisions or units as it may deem necessary. The NCSA shall appoint 
6 
officers and employees in accordance with the civil service law, rules, and regulations. 
7 
 
8 
(a) 
Considering the highly technical nature of the personnel required for the 
9 
NCSA, the NCSA may promulgate a separate set of qualification and competency 
10 
standards for eligibility as career officers in NCSA. The NCSA qualification and 
11 
competency standards shall only be applicable to NCSA unless adopted by the 
12 
CSC as applicable for the entire Philippine government; and 
13 
 
14 
(b) 
The NCSA may request detail of personnel from other government 
15 
departments, agencies, bureaus, offices, and institutions, subject to the approval 
16 
of the head of office and availability of personnel, to ensure the effective 
17 
coordination, integration, and fusion of activities relative to cybersecurity. 
18 
 
19 
SEC. 11. Transfer of Agencies and Personnel to the NCSA – The Department of 
20 
Information and Communications Technology - Cybersecurity Bureau (DICT-CSB) and 
21 
its corresponding Divisions along with their powers and functions, applicable funds and 
22 
appropriations, records, equipment, property, and personnel, are hereby transferred to 
23 
the NCSA. 
24 
 
25 
All offices, services, divisions, units, and personnel not otherwise covered by this Act for 
26 
transfer to NCSA shall be retained under the DICT, which shall continue to operate under 
27 
its current name and functions. 
28 
 
29 
The NCSA is hereby attached to the DICT for policy and program coordination, and shall 
30 
continue to operate and function laterally and in accordance with prevailing laws.  
31 
 
32 
(a) 
All powers and functions related to cybersecurity, including but not limited 
33 
to the formulation of the National Cybersecurity Plan, establishment of the NCERT, 
34 
and the facilitation of international cooperation on intelligence regarding 
35 
cybersecurity matters, are hereby transferred to NCSA; and 
36 
 
37 
(b) 
The laws and rules on government reorganization as provided for in 
38 
Republic Act No. 6656, otherwise known as the Reorganization Law, shall govern 
39 
the reorganization process of NCSA. 
40 
 
41 
(c) 
The transfer of functions, assets, funds, equipment, properties, 
42 
transactions, and personnel of the affected agencies to NCSA shall be completed 
43 
within six (6) months from the effectivity of this Act. During this transition period, 
44 
existing personnel shall continue to assume their posts in holdover capacities until 
45 
new appointments are issued. After the transfer of the agencies specified in 
46 
Section 11 of this Act, NCSA, in coordination with DBM, shall determine and create 
47 
new positions, the funding requirements of which shall not exceed twenty-five 
48 
percent (25%) of the equivalent cost of positions abolished. 
49 
 
50 
CHAPTER 3 
51 
CRITICAL INFORMATION INFRASTRUCTURES (CII) 
52 
 
53 
SEC. 12. Designation of Critical Information Infrastructure (CII). – The NCSA will 
54 
have the duty and power to oversee the CIIs in the Philippines.  
55 


 
8 
 
I. 
 The NCSA shall identify entities that own, operate or maintain CII (“CII entities” 
1 
from hereon), using a risk-based approach, as prescribed by the NCSP and shall 
2 
adopt a set of criteria for identifying CIIs. 
3 
II. 
 After the confirmation of the CII designation, the NCSA will issue a written notice 
4 
to the owner of the computer or computer system, designating said system as a 
5 
CII for the purposes of this Act. 
6 
III. 
A notice issued under subparagraph I must: 
7 
(a) Identify the computer or computer system that is being designated as a CII; 
8 
(b) Identify the owner of the computer or computer system so designated as a CII; 
9 
(c) Inform the owner of the computer or computer system, regarding the owner’s 
10 
duties and responsibilities under this Act that arise from the designation; 
11 
(d) Inform the owner of the computer or computer system that any representations 
12 
against the designation are to be made to the NCSA by a specified date, being a 
13 
date not earlier than fourteen (14) days after the date of the notice; and 
14 
(e) Inform the owner of the computer or computer system that the owner may appeal 
15 
to the NCSA against the designation, and provide information on the applicable 
16 
procedure. 
17 
IV. 
Any designation under Subsection I shall be in effect for a period of five (5) years, 
18 
unless it is withdrawn by the NCSA before the expiration of the period. 
19 
SEC. 13. Regulation of providers of essential services who rely on third-party 
20 
owned CII. - Providers remain responsible for the cybersecurity and resilience of the 
21 
computer systems they rely on to deliver essential services, even if those systems are 
22 
managed by a third party. Providers who depend on third-party-owned CII must secure 
23 
legally binding commitments from these vendors ensuring that the third party meets the 
24 
cybersecurity standards and requirements applicable to CII, including incident reporting, 
25 
auditing, and risk assessment. 
26 
SEC. 14. Compliance requirements for organizations and the CIIs. –  The NCSA, in 
27 
coordination with concerned government regulatory agencies, shall create a list of 
28 
compliance requirements for CIIs. In determining the compliance requirements for 
29 
organizations and CIIs, due consideration shall be given to minimizing their impact on the 
30 
cost of services provided by the organizations and/or CIIs. These shall include at least 
31 
the following:  
32 
(a) List of authorized personnel and their level of access to the computer system labeled 
33 
as CII; 
34 
(b) List of supply chain service providers of the CII including foreign service providers, if 
35 
any; 
36 
(c) The cybersecurity or information security framework used for risk assessment and 
37 
adoption of technical and procedural controls; 
38 
(d) Initial audit report; 
39 


 
9 
 
(e) Cybersecurity incident handling organization and protocol being implemented by the 
1 
CII operator; and 
2 
(f) Organization and technical contact persons of the CII operators.  
3 
SEC. 15. Cybersecurity Audit and Risk Assessment of CIIs. -  All CII operators shall 
4 
take the necessary steps to identify, assess, and institute technical or procedural controls 
5 
to mitigate cybersecurity risks related to the CII at least once every three (3) years.  
6 
At least once every two (2) years (or at such higher frequency as may be directed by the 
7 
NCSA in any particular case), all CII operators must submit an authenticated 
8 
cybersecurity audit and risk assessment report performed by a NCSA recognized auditing 
9 
firm that specializes in cybersecurity. Cybersecurity audit and risk assessment reports 
10 
shall be submitted to NCSA and shall be kept in record for a period of not less than five 
11 
(5) years.  
12 
SEC. 16. Mandatory Disclosure of Cybersecurity Incidents on CIIs. –  
13 
(a) Organizations operating CIIs shall notify the government regulator and NCSA 
14 
through the NCERT upon discovery of a critical or high-risk cybersecurity incident. 
15 
NCSA shall define the taxonomy, including classification and categorization of 
16 
which cybersecurity incidents are considered “critical”, “high risk” and “moderate”. 
17 
For moderate risk cybersecurity incidents, the CII operator shall inform NCSA or 
18 
NCERT of the incident; 
19 
(b) In the event of ransomware or extortion attacks, the affected CII entities are 
20 
required to disclose in their report whether they have made any payments or 
21 
complied with the demands of the threat actor; and 
22 
(c) CERTs shall coordinate with law enforcement agencies in filing of cybercrime 
23 
cases.  
24 
SEC. 17. Assistance extended by the government to CII operators. – Operators of 
25 
CII may request assistance for NCSA to provide the following:  
26 
(a) Use of government technical controls and systems for the defense and protection 
27 
of the CII; 
28 
(b) Priority co-location with government data centers subject to availability; and 
29 
(c) Use of government secure crypto-primitives such as digital certificates, etc.; and 
30 
(d) Knowledge management platform to facilitate faster sharing of information 
31 
between the industry, NCSA, government regulators, and other concerned 
32 
organizations. 
33 
SEC. 18. Confidentiality of CII Related Documents. -  The official list of CIIs, including 
34 
their assessment, evaluation, audit, and technical reports shall be considered documents 
35 
related to National Security and thus, are considered confidential and classified. The 
36 
President, upon the recommendation of NCSA, may declassify these documents.  
37 
If a subpoena duces tecum is issued for any of these classified documents, NCSA shall 
38 
inform the body who ordered the subpoena that the document can only be opened or 
39 
scrutinized in executive session, and/or shall be disclosed only to a limited number of 
40 
people on a strict need-to-know basis.     
41 


 
10 
 
SEC. 19. Withdrawal or Removal of CII Designation. - The NCSA, through a written 
1 
resolution, may withdraw or remove the designation of any CII at any time if the NCSA is 
2 
of the opinion that the computer or computer system no longer fulfills the criteria of a CII. 
3 
The NCSA shall notify in writing the CII operator of the withdrawal or removal of their 
4 
designation within 14 days upon the issuance of the resolution. 
5 
SEC. 20. Motion for Reconsideration of CII Certification. - CIIs may file for motion for 
6 
reconsideration of the scoring or rating, and revocation of certificate to NCSA within thirty 
7 
(30) days from the receipt of the decision.  
8 
CHAPTER 4 
9 
MINIMUM CYBERSECURITY REQUIREMENTS 
10 
 
11 
National Government Agencies (NGA) and instrumentalities, Government-Owned and -
12 
Controlled Agencies (GOCC), and Local Government Units (LGU) are hereby directed to 
13 
adopt and implement minimum cybersecurity requirements to enhance their resilience 
14 
against cyber threats.  
15 
 
16 
SEC. 21. Prescribing Minimum Cybersecurity Requirements. - The NCSA, in 
17 
consultation with relevant stakeholders, shall prescribe a baseline for security practices, 
18 
ensuring a consistent level of protection across government agencies. As may be 
19 
necessary, the NCSA, in cooperation with the private sector, shall provide technical 
20 
assistance to other government agencies and offices relative to this provision.  
21 
 
22 
SEC. 22. Creation of a Chief Information Security Officer (CISO). Each NGA, GOCC, 
23 
and LGU shall create a CISO position within the agency to lead the Government 
24 
Computer Emergency Response Team (GCERT). The CISO shall be the official 
25 
responsible for carrying out the Chief Information Officer responsibilities and serve as the 
26 
primary liaison to the agency’s authorizing officials, information system owners, 
27 
information system security officers, and the SCERT and the NCERT. 
28 
 
29 
The CISO ensures that information resources and technologies are effectively protected. 
30 
CISOs oversee the development, implementation, and enforcement of security policies. 
31 
The CISO might also work alongside the chief information officer in procuring 
32 
cybersecurity products and services, and managing disaster recovery and business 
33 
continuity plans. 
34 
 
35 
CHAPTER 5 
36 
CYBERSECURITY IOT CERTIFICATION 
37 
 
38 
SEC. 23. Cybersecurity Anchor of Trust System (CATS). – NCSA shall promulgate 
39 
rules and procedures for certifying cybersecurity trustworthiness of service, suppliers, or 
40 
technologies.  Towards this end, the Agency in consultation with other government 
41 
agencies and the private sector shall devise a rating or scoring system for assessing 
42 
information security and cybersecurity standards considering various criteria. Such 
43 
scoring system shall be reviewed periodically at least once every two (2) years or as may 
44 
be deemed necessary by the Agency. 
45 
 
46 
The Agency may charge reasonable fees to defray the administrative cost of the services 
47 
rendered, subject to existing laws and regulations. 
48 
  
49 
SEC. 24. Voluntary Rating System. - Any local or foreign commercial entities may 
50 
voluntarily submit themselves for certification.    
51 
 
52 


 
11 
 
SEC. 25. Validity of Certification. - The certification issued by NCSA shall be valid  for 
1 
a maximum period of two (2) years; Provided,  that NCSA, may impose a shorter validity 
2 
period depending on the criticality of the business or the cybersecurity risks relevant to 
3 
the business of the person; and provided further, that the Agency, upon recommendation 
4 
by NCERT, may require re-certification prior to the expiration of the certification due to 
5 
factors increasing the cybersecurity risks relevant to the business of the person.   
6 
 
7 
SEC. 26. Cybersecurity IoT Certification Appeal. - Agencies with cybersecurity IoT 
8 
certification may file for an appeal of the scoring or rating, and revocation of certificate to 
9 
NCSA within thirty (30) days from receipt of the decision.  
10 
 
11 
CHAPTER 6 
12 
PROHIBITED ACTS AND PENALTIES 
13 
SEC. 27. Non-compliance of CII operators. – In the event that a CII operator fails 
14 
willfully or negligently to comply with the orders, directive, mandate, remediation, and any 
15 
other regulations of NCSA, the same shall incur penalties as provided for this Act. This 
16 
includes submission of documentary requirements, and providing NCSA access to 
17 
necessary computer data during investigations of cyber-attacks.   
18 
SEC. 28. Disclosure of Confidential Information. – Any individual who has access to 
19 
CII and information is prohibited to disclose them. The unauthorized disclosure of these 
20 
confidential information, either willfully or through negligence, shall be penalized.  
21 
SEC. 29. Penalties. - The following penalties shall be applied for violations of this Act:  
22 
 
23 
(a) 
Any individual who either willfully, or through negligence causes the 
24 
unauthorized disclosure of confidential or sensitive information shall be penalized 
25 
by imprisonment ranging from six (6) years to twelve (12) years or a fine of not less 
26 
than Five hundred thousand pesos (P 500,000.00), or both; 
27 
 
28 
(b) 
Any unauthorized disclosure of confidential or sensitive information 
29 
affecting national defense or national security, with intent or reason to believe that 
30 
the same is to be used to the injury of the Philippines or to the advantage of any 
31 
foreign nation or enemy of the State, whether domestic or foreign, shall suffer the 
32 
penalty of life imprisonment or by a fine of not less than One million pesos (P 
33 
1,000,000.00), or both;  
34 
 
35 
(c) 
Any employee who leaves or severs employment with the CII 
36 
operator/owner, willfully or negligently discloses, damages, disposes of, or 
37 
destroys critical, sensitive, or classified information in violation of this Act and other 
38 
existing laws, rules, and regulations, contravenes or fails to comply with any 
39 
provision of this Act shall be held liable without prejudice to any criminal 
40 
prosecution; 
41 
 
42 
(d) 
Upon violation of any enumerated prohibited acts, the CII operator shall 
43 
receive a formal written warning from the NCSA ordering the CII to show cause 
44 
within seven (7) days from receipt thereof; 
45 
 
46 
(e) 
If the CII operator fails to comply with the written warning, NCSA shall 
47 
impose a fine equal to half of one percent (0.5%) of the CII operator’s average 
48 
gross annual income for a period of five years. An additional half of one percent 
49 


 
12 
 
(0.5%) shall be added for each subsequent infraction, with the penalty resetting 
1 
after the CII operator finally complies with the directives; 
2 
 
3 
(f) 
A CII operator’s willful disregard of a lawful order given by NCSA to comply 
4 
with this Act and its implementing rules and regulations within a reasonable time 
5 
frame will result in the CII operator’s license being revoked on grounds of non-
6 
compliance to a regulatory requirement; 
7 
 
8 
(g) 
The CII operator has the right to appeal any penalties imposed under this 
9 
section. To initiate an appeal, the CII operator must submit a written notice of 
10 
appeal to the NCSA within fifteen (15) days from the receipt of the penalty notice 
11 
or the revocation order. The appeal must include a detailed statement of the 
12 
grounds for contesting the penalty and any supporting evidence. Upon receipt of 
13 
the appeal, the NCSA shall review the case and may hold a hearing if deemed 
14 
necessary. The CII operator will be notified of the hearing date and will have the 
15 
opportunity to present their case. Following the review or hearing, the NCSA will 
16 
issue a written decision on the appeal. The decision of the NCSA shall be final and 
17 
may be challenged only through appropriate judicial review, as provided by 
18 
applicable law. 
19 
 
20 
SEC. 30. Liability under the Anti-Terrorism Act (ATA) of 2020. - Any person who, 
21 
within or outside the Philippines, regardless of the stage of execution, engages in acts 
22 
intended to cause extensive interference with, damage, or destruction to Critical 
23 
Infrastructure, as defined under Section 3 (f) of this Act or Section 3 (a) of  Republic Act 
24 
No. 11479, Section 2 (e) of Republic Act No. 11659, or Section 3 (j) of Republic Act No. 
25 
10175, or to CIIs designated under Chapter 3 of this Act, or under other applicable laws 
26 
on Critical Infrastructure and CIIs, whether committed by, through and with the use of 
27 
information and communications technologies or otherwise, when the purpose of such 
28 
act, by its nature and context is to intimidate the general public or a segment thereof, 
29 
create an atmosphere or spread a message of fear, to provoke or influence by intimidation 
30 
the government or any international organization, or seriously destabilize or destroy the 
31 
fundamental  political, economic, or social structures of the country, or create a public 
32 
emergency or seriously undermine public safety, shall be liable under Section 4 (c) of  
33 
Republic Act No. 11479, otherwise known as the Anti-Terrorism Act of 2020. 
34 
 
35 
CHAPTER 7 
36 
MISCELLANEOUS PROVISIONS 
37 
 
38 
SEC. 31. Authority to Accept Assistance and/or Donations. - The NCSA is authorized 
39 
to accept donations, contributions, grants, bequests or gifts from domestic or foreign 
40 
sources, for purposes relevant to its mandates and functions, subject to existing laws, 
41 
rules and regulations. 
42 
 
43 
SEC. 32. Appropriations. – The amount necessary for the initial implementation of this 
44 
Act shall be charged against the current and available appropriations of concerned 
45 
agencies. Thereafter, the amount needed for the implementation of this Act shall be 
46 
included in the annual General Appropriations Act. 
47 
 
48 
SEC. 33. Cybersecurity Risk Management and Mitigation Fund. - There is hereby 
49 
created a Cybersecurity Risk Management and Mitigation Fund (CRMMF). 
50 


 
13 
 
  
1 
(a) CRMMF shall be used for cybersecurity risk mitigation, prevention, and 
2 
preparedness activities such as but not limited to training of personnel, 
3 
procurement of equipment, and capital expenditures. It can also be utilized for the 
4 
management of imminent or actual cybersecurity threats which may occur during 
5 
the current fiscal year or those that occurred in the past two (2) years from the 
6 
current fiscal year. Risk management activities include threat identification and 
7 
detection, incident response, system recovery and protection, and other related 
8 
works or services; 
9 
 
10 
(b) The specific amount of the CRMMF and the appropriate recipient agencies shall 
11 
be determined upon approval of the President of the Philippines in accordance 
12 
with the favorable recommendation of the NCSA; 
13 
 
14 
(c) Of the amount appropriated for the CRMMF, thirty percent (30%) shall be allocated 
15 
as Quick Response Fund (QRF) or a contingent fund for response and recovery 
16 
activities in order to immediately bring affected CII systems to normal operation; 
17 
and 
18 
 
19 
(d) All departments/agencies that are allocated with the CRMMF shall submit to the 
20 
NCSA their monthly statements on the utilization of CRMMF and make an 
21 
accounting thereof in accordance with existing accounting and auditing rules. 
22 
  
23 
SEC. 34. Report. - The NCSA shall submit an annual report to the Office of the President 
24 
on the implementation of this Act, as well as the operations of the Agency. The NCSA 
25 
shall also include in its report disclosures of cybersecurity vulnerabilities, actionable 
26 
protocols to mitigate cybersecurity vulnerabilities to information systems and industrial 
27 
control systems. 
28 
 
29 
SEC. 35. - Confidentiality.  
30 
 
31 
I. All parties involved in the application of this Act shall respect the confidentiality of 
32 
information and data obtained in carrying out their tasks and activities in such a manner 
33 
as to protect, in particular: 
34 
 
35 
(a)   Intellectual property rights, and confidential business information or trade 
36 
secrets of a natural or juridical person, including source code, except in cases 
37 
where the disclosure and access is necessary to protect the legitimate interest 
38 
recognized by existing laws, rules, and regulations; 
39 
 
40 
(b)   Public and national security interests;  
41 
 
42 
(c) Data of security agencies, ensuring that they will not be migrated into the private 
43 
domain; and 
44 
 
45 
(d)   Integrity of criminal or administrative proceedings. 
46 
  
47 
II. Without prejudice to paragraph I, information exchanged on a confidential basis 
48 
between government departments, agencies, bureaus, offices, and institutions and the 
49 
NCSA shall not be disclosed without the prior agreement of the originating government 
50 
departments, agencies, bureaus, offices, and institutions. 
51 


 
14 
 
III. Adequate protection shall be set in place between the information shared by the private 
1 
sector and government agencies, particularly security and law enforcement agencies. 
2 
 
3 
IV. Paragraphs I and II shall not affect the rights and obligations of the NCSA and notified 
4 
bodies with regard to the exchange of information and the dissemination of warnings, 
5 
nor the obligations of the persons concerned to provide information under existing laws, 
6 
rules, and regulations. 
7 
 
8 
V. The NCSA may exchange, when necessary, sensitive information with relevant 
9 
authorities of third countries with which they have concluded bilateral or multilateral 
10 
confidentiality arrangements guaranteeing an adequate level of protection. 
11 
  
12 
SEC. 36. Periodic review. - The NCSA, in consultation with the DICT, the DOST, and 
13 
other concerned agencies shall conduct a review of the Act every three years, or more 
14 
frequently as may be necessary, to ensure that certifications, regulations, standards, 
15 
penalties, and other provisions of the Act, with the end in view of meeting the 
16 
cybersecurity standards and requirements for emerging technologies. 
17 
 
18 
SEC. 37. Utilization of the collected fees, fines, and penalties. - The NCSA is hereby 
19 
authorized to utilize the fees and penalties collected for programs and projects aimed at 
20 
enhancing cybersecurity capabilities and infrastructure within the jurisdiction. These 
21 
funds shall be allocated towards initiatives such as cybersecurity awareness campaigns, 
22 
capacity-building programs, research and development efforts, and the procurement of 
23 
advanced cybersecurity technologies and tools, provided that at no circumstance shall 
24 
the funds be used to augment salaries and personnel benefits.  
25 
  
26 
The utilization of the aforementioned fund shall be subject to government accounting 
27 
manual and audit procedures, ensuring transparency, accountability, and proper fiscal 
28 
management in accordance with the objectives and mandates of NCSA. Regular audits 
29 
and reporting requirements shall be conducted to ensure the effective and efficient 
30 
utilization of funds. 
31 
 
32 
SEC. 38. Implementing Rules and Regulations (IRR). - Within one hundred twenty 
33 
(120) days from the effectivity of this Act, the DICT, the DBM, the CSC, and upon 
34 
consultation with relevant stakeholders, shall promulgate the rules and regulations to 
35 
effectively implement the provisions of this Act. 
36 
 
37 
SEC. 39. Separability clause. -  If any provision of this Act is declared invalid or 
38 
unconstitutional, the remainder thereof not otherwise affected shall remain in full force 
39 
and effect. 
40 
  
41 
SEC. 40. Repealing clause. - All laws, presidential decrees, executive orders, letters of 
42 
instructions, proclamations, or administrative regulations that are inconsistent with the 
43 
provisions of this Act are hereby repealed, amended, or modified accordingly. 
44 
  
45 
SEC. 41. Effectivity clause. - This Act shall take effect fifteen (15) days following its 
46 
publication in the Official Gazette or at least two national newspapers of general 
47 
circulation.  
48 
 
49 
Approved, 
50