NINETEENTH CONGRESS OF THE ) 
REPUBLIC OF THE PHILIPPINES ) 
First Regular Session 
)
SENATE
S.B. No. 1365
Senate
of tlif ^''crrfnrp
’22 QCT-5 P5 SO
RECEIVED BV:
Introduced by SENATOR IMEE R. MARCOS
AN ACT
INSTITUTIONALIZING AND STRENGTHENING THE NATIONAL
CYBERSECURITY INTER-AGENCY COMMITTEE CREATED UNDER 
EXECUTIVE ORDER NO. 95 (S. 2019), RENAMING IT TO NATIONAL 
CYBERSECURITY COUNCIL, AND FOR OTHER PURPOSES
EXPLANATORY NOTE
Article 2, Section 5 of the Constitution provides that "the maintenance of peace 
and order, the protection of life, liberty and property and the promotion of the general 
welfare are essential for the enjoyment of the people of all the blessings of democracy. 
The evolution of Information Computer Technology (ICT) has brought tremendous 
advantages to the growth of our economy, as well as to the success of businesses in 
the country. Our countrymen, from all walks of life, are equally benefiting from the said 
advancement of technology. However, there is an urgent need to step-up and ensure 
the country's readiness against deliberate cyber-attacks which has become a serious 
national security threat.
The International Telecommunications Union's 2021 Global Cybersecurity Index 
(GCI) ranked the Philippines 61st out of 194 countries in terms of commitment in 
adopting cybersecurity practices. In July 2022, Russian cybersecurity firm Kaspersky 
came up with a global ranking of countries with most online threats detected in 2021 
where the Philippines moved up to 4th place from 5th in the past year. A total of 
50,544,908 web threats were detected by Kaspersky in the Philippines in 2021 alone.
Kaspersky data further show that web threat attempts against Filipino users of 
Kaspersky software grew 432.75% from 9,487,775 in 2017 to 50,544,908 in 2021. With 
the pandemic-borne shift towards remote working, the overall cyber-attacks versus 
local businesses rose by 141% from 2019 (2,549,698) to 2021 (6,150,891). Yeo Siang 
Tiong, General Manager for Southeast Asia at Kaspersky, stated that "Cyber threats are 
here to stay as it is parallel with the digitalization drive in the Philippines."


In order to enhance our cybersecurity capabilities, this bill seeks to 
institutionalize and strengthen the National Cybersecurity Inter-Agency Committee 
(NCIAC) and empower it to be the main authority that will address all cybersecurity 
related matter. It shall assess the vulnerabilities and risks of the country's cybersecurity 
and issue updated protocols to all government employees for the proper handling, 
distribution and storage of all forms of documents and communications as well as to 
enhance public-private partnership in promoting cybersecurity.
The National Cybersecurity Inter-Agency Committee shall be transformed into a 
council with more powers and functions. It shall be reorganized by designating the 
Secretary of DICT as its Chairperson, adding other secretaries of government agencies 
as its members, and the appointing permanent personnel as its secretariat to be headed 
by an Executive Director in order to ensure its continuous and focused performance. 
Thus, it shall be renamed the "National Cybersecurity Council."
For the abovementioned reasons, the passage of this bill is earnestly sought.
IMEE R. MARCO^/-


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20
NINETEENTH CONGRESS OF THE ) 
REPUBLIC OF THE PHILIPPINES ) 
First Regular Session 
)
of tlif fe'i’fvttnrp
72 OCT-5 P5 50
SENATE
S.B. No. 1365
received BY.
Introduced by SENATOR IMEE R. MARCOS
AN ACT
INSTITUTIONALIZING AND STRENGTHENING THE NATIONAL
CYBERSECURITY INTER-AGENCY COMMITTEE CREATED UNDER 
EXECUTIVE ORDER NO. 95 (S. 2019), RENAMING IT TO NATIONAL 
CYBERSECURITY COUNCIL, AND FOR OTHER PURPOSES
Be it enacted by the Senate and House of Representatives of the Philippines in Congress 
assembled:
SECTION 1. Short Title. - This Act shall be known as the "CybersecurityAct."
SEC 2. Declaration of Policy. - The growth of information computer technology 
is accompanied by new and serious threats and, as such, the state recognizes as vitally 
important the establishment of a more secure cyberspace and a data protection regime 
that is compliant with international standards and ensures the free flow of information. 
Towards this end, there is a need to institutionalize and strengthen the National Inter- 
Agency Cybersecurity Committee (NIAC) to enhance the protection of the nation's 
critical information structures especially government, public and military networks and 
infrastructure, ensuring their continuous operations even during crises and 
emergencies
SEC. 3. Cybersecurity Council. - The National Cybersecurity Inter-Agency 
Committee created under executive order no. 95 (s. 2019) is hereby institutionalized 
and reorganized and rename it to National Cybersecurity Council (NCC) under the 
administrative supervision of the Office the President.
SEC. 4. Reorganization of the Council. - The Council is chaired by the Secretary 
of the Department of Information and Communications Technology (DICT) and co­
chaired by the Executive Secretary and the National Security Adviser and Director-


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
General of the National Security Council (NSC), and shall further be composed of the 
following officials as members:
Secretary of the Department of Foreign Affairs (DFA);
Secretary of the Department of Finance (DOF);
Secretary of the Department of Science and Technology (DOST);
Secretary of the Department of Interior and Local Government (DILG); 
Secretary of the Department of Justice (DOJ);
Secretary of the Department of Energy (DOE);
Secretary of the Department of National Defense (DND);
Secretary of the Department of Transportation (DOTr);
Secretary of the Presidential Communication Operations Office (PCOO); 
Commissioner of the National Telecommunications Commission (NTC); 
Director-General of the National Intelligence Coordinating Agency (NICA); 
Director of the National Bureau of Investigation (NBI);
Chief of the Philippine National Police (PNP);
Chief of Staff of the Armed Forces of the Philippines;
Chairman of the National Privacy Commission (NPC);
Executive Director of the Anti-Terrorism Council-Program Management Center 
(ATM-PMC);
Executive Director of the Cybercrime Investigation and Coordinating Center 
(CICC); and
Governor of the Bangko Sentral ng Pilipinas (BSP) as members.
The National Cybersecurity Council shall have a secretariat to be headed by an 
Executive Director. The organizational structure and staffing pattern of the secretariat 
shall be formulated by the Secretary of the Department Information and 
Communication Technology (DICT), subject to the approval of the Department of 
Budget and Management (DBM) in accordance with executive order no. 292, otherwise 
known as the "Administrative code of 1987".
The National Cybersecurity Council may invite concerned public and private 
agencies or entities to participate, complement, and assist in the performance of its 
functions.
The Council shall collaborate with the Anti-Terrorism Council (ATC) on matters 
relating to cyber-terrorism.


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
SEC. 5. Powers and Functions. - The National Cybersecurity Council shall be the 
main authority to exercise powers and functions that would address all cybersecurity 
related matter. It shall perform the following functions:
a. Assess the vulnerabilities of the country's cybersecurity;
b. Capacity building for the purpose of responding to Cybersecurity threats and 
emergencies;
c. Issue updated security protocols to all government employees in the storage, 
handling and distribution of all forms (digital, electronic, snail mail, etc.) of 
documents and communications, following best practices, these protocols shall 
be updated periodically and, as necessary, in light of the rapid developments in 
information and communications technology.
d. Enhance the public-private partnership in the field of information sharing involving 
cyberattacks, threats and vulnerabilities to cyber threats;
e. Conduct periodic strategic planning and workshop activities that will reduce the 
country's vulnerabilities to cyber threats;
f. 
Direct its member agencies and appropriate agencies to implement cybersecurity 
measures as may be required by the situation;
g. Serve as the country's coordinating arm on domestic, international, and 
transnational efforts pertaining to cybersecurity;
h. Make such recommendations and/or such other reports as the president may from 
time to time direct; and
i. 
Perform such other functions as may be necessary.
SEC. 6. Meetings of the Council. - The Council shall hold regular meeting every 
quarter and such special meetings as may be necessary upon the request of the 
chairman or upon the request of at least two (2) of its members.
SEC. 7. Report of Data Breach. - Government institutions, agencies, 
instrumentalities, including government owned and controlled corporations, all private 
corporations, companies and business establishments, operating wholly or partly in the 
Philippines, are required to report to the National Cybersecurity Council, within a 
reasonable period of time, all kinds of data breach occurring in their jurisdiction. The


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
31
32
33
Council shall conduct trainings on cybersecurity to all stakeholders for the effective 
implementation of this proviso.
Failure to make the required report shall be penalized with imprisonment of not 
less than six (6) months but not more than two (2) years or a fine of not more than 
One (1) million pesos, or both at the discretion of the court. In case of penalty of 
imprisonment, the same shall be imposed on the officials or persons who are 
responsible to make the report to be determined in the Implementing Rules and 
Regulations;
SEC. 8. Reportorial Requirement - The National Cybersecurity Council shall 
submit quarterly report, or as often as may be necessary, to the President of the 
Philippines and to Congress on the state of cybersecurity threats and other related 
information. The Council may request for an executive session from Congress if it may 
deem necessary.
SEC. 9. Appropriations. - The amount of necessary to carry out its functions 
shall be included in the annual General Appropriations Act.
SEC. 10. Implementing Rules and Regulations. - The DICT, the DOJ, the DILG 
and the NSC shall jointly formulate the necessary rules and regulations within ninety 
(90) days from approval of this Act, for its effective implementation.
SEC. 11. Separability Clause. - If any provision of this Act is held invalid, the 
other provisions not affected shall remain in full force and effect.
SEC. 12. Repealing Clause. - All laws, decrees, orders, rules and regulations or 
other issuances or parts thereof inconsistent with the provisions of this Act are hereby 
repealed or modified accordingly.
SEC. 15. Effectivity. - This Act shall take effect fifteen (15) days after its 
publication in the Official Gazette or in any two (2) newspapers of general circulation 
in the Philippines.
Approved,