TWENTIETH CONGRESS OF THE 
REPUBLIC OF THE PHILIPPINES 
First Regular Session
)
SENATE
S. No. 1163
Senate
of tl't ^ftrftar;
25 AUG “7 fS31
RECEIVED BY:
Introduced by Senator Jinggoy Ejercito Estrada
AN ACT
ESTABLISHING THE NATIONAL CYBERSECURITY AGENCY, DEFINING 
THEIR POWERS AND FUNCTIONS, AND APPROPRIATING FUNDS THEREFOR 
AND FOR OTHER PURPOSES
EXPLANATORY NOTE
In today's hyperconnected digital age, cybersecurity is not merely a technical 
concern but a matter of national security, public safety, and economic resilience. The 
Philippines, like many other countries, faces an increasingly sophisticated threat 
landscape where cyberattacks target not just individuals and businesses but vital 
sectors that comprise our Critical Information Infrastructure (CII)—including energy, 
telecommunications, banking, transportation, healthcare, and government services.
Our current cybersecurity framework, while guided by Republic Act No. 10175 
or the Cybercrime Prevention Act of 2012 and supported by existing policies under the 
Department of Information and Communications Technology (DICT), remains 
fragmented, under-resourced, and inadequately equipped to defend against advanced 
and persistent threats. The fast pace of digital transformation, proliferation of smart 
devices and networks, and increasing reliance on technology necessitate an 
institutional response that is agile, specialized, and comprehensive.
This measure seeks to address these systemic gaps by establishing the National 
Cybersecurity Agency (NCSA)—a dedicated government agency attached to the DICT


which shall serve as the primary entity responsible for the planning, coordination, 
implementation, and enforcement of the country's cybersecurity strategy. The NCSA 
will serve as the primary policy, planning, coordinating, and implementing entity for 
the nation's cybersecurity strategy, with comprehensive powers including the 
establishment of the National Computer Emergency Response Team (NCERT), 
formulation of cybersecurity standards, and coordination of government-wide 
cybersecurity efforts.
The proposed bill establishes a robust framework for protecting Critical 
Information Infrastructure (CII) through systematic identification, designation, and 
monitoring processes. CII operators will be required to comply with mandatory 
cybersecurity standards, submit regular audit reports, and report cybersecurity 
incidents to the NCERT within specified timeframes. The measure includes provisions 
for government assistance to CII operators, including access to government technical 
controls, priority co-location services, and secure cryptographic systems.
To address the critical shortage of cybersecurity professionals, the proposed 
legislation creates the National Cybersecurity College under NCSA jurisdiction. The 
College will provide specialized education, training, and research in cybersecurity, 
develop professional certification programs, and establish partnerships with academic 
institutions to create a pipeline of qualified cybersecurity experts for both public and 
private sectors.
The measure introduces the Cybersecurity Anchor of Trust System (CATS), a 
voluntary certification program for commercial entities to demonstrate cybersecurity 
trustworthiness. This system will promote cybersecurity excellence while supporting 
the development of secure digital ecosystems essential for economic growth and 
investor confidence.
To ensure sustainable funding, the proposed bill establishes the Cybersecurity 
Risk Management and Mitigation Fund (CRMMF) for risk mitigation, prevention, and 
emergency response activities. It also authorizes the NCSA to collect fees, fines, and


penalties, with a portion dedicated to enhancing cybersecurity capabilities and 
infrastructure.
The proposed legislation adopts Zero Trust Architecture principles, aligning with 
international cybersecurity best practices and positioning the Philippines as a regional 
leader in advanced cybersecurity approaches. It includes comprehensive information­
sharing mechanisms between government and private sector entities while 
maintaining strict confidentiality protections for sensitive information.
Governance provisions establish clear accountability measures, including 
mandatory annual reporting to the Office of the President, regular audits, and 
transparency requirements. The proposed bill includes appropriate penalties for non- 
compliance while providing due process protections and appeal mechanisms for 
affected entities.
This comprehensive cybersecurity framework addresses immediate security 
challenges while building institutional foundations for long-term cyber resilience. It 
balances security imperatives with privacy rights, economic considerations with 
regulatory requirements, and national interests with international cooperation, 
positioning the Philippines as a trusted and secure participant in the global digital 
economy.
In view of the foregoing, the immediate passage of this measure is earnestly
sought.
INGOpY EJERCITO ESTRADA


TWENTIETH CONGRESS OF THE 
REPUBLIC OF THE PHILIPPINES 
First Regular Session
)
SENATE
S. No. 1163
Senate
__ . . -
of tl)r f’cccrtirp
25 AUG-7 Pi 21
RECEIVED BY;
Introduced by Senator Jinggoy Ejercito Estrada
AN ACT
ESTABLISHING THE NATIONAL CYBERSECURITY AGENCY, DEFINING 
THEIR POWERS AND FUNCTIONS, AND APPROPRIATING FUNDS THEREFOR 
AND FOR OTHER PURPOSES
Be it enacted by the Senate and the House of Representatives of the Philippines in 
Congress assembled:
1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
CHAPTER 1
GENERAL PROVISIONS
Section 1. Short Title. — This Act shall be known as the "Cybersecurity AcC.
Sec. 2. Declaration of Policy. — It is hereby declared a policy of the State:
a) To recognize the vital role of communications and information in nation­
building;
b) To recognize the maintenance of peace and order, the protection of life, 
liberty, and property, and the promotion of the general welfare are 
essential for the enjoyment by all the people of the blessings of 
democracy;
c) To serve and protect the people, and as the Constitution guarantees the 
right of the people to be secure in their persons, houses, papers, and 
effects against unreasonable searches and seizure, and that the privacy 
of communication and correspondence shall be inviolable except upon 
lawful order of the court, cybersecurity and information security are 
important to the protection of the Filipino society;


1 
d) To adopt measures to effectively prevent and combat cybersecurity
2 
offenses by facilitating detection, investigation, and prosecution of
3 
offenses at both the domestic and international levels, and by providing
4 
arrangements for fast and reliable international cooperation; and
5 
e) To adopt a Zero Trust Architecture in cybersecurity, as appropriate in
6 
the Philippine context and aligned with international standards and best
7 
practices.
8 
Sec. 3. Definition of Terms. — For purposes of this Act, the following terms
9 
shall mean:
10 
a) Avaiiability refers to the property of being accessible and usable upon
11 
demand by an authorized entity.
12 
b) Computer Network refers to a system that connects two or more
13 
computing devices for transmitting and sharing information. Computing
14 
devices include everything from a mobile phone to a server. These
15 
devices are connected using physical wires such as fiber optics, but they
16 
can also be wireless.
17 
c) Computer System refers to any device or group of interconnected or
18 
related devices, one or more of which, pursuant to a program, performs
19 
automated processing of data. It covers any type of device with data
20 
processing capabilities including, but not limited to, computers and
21 
mobile phones. The device consisting of hardware and software may
22 
include input, output, and storage components which may stand alone
23 
or be connected in a network or other similar devices. It also includes
24 
computer data storage devices or media, both physical and virtual.
25 
d) Confidentiaiity refers to property that information is not made available
26 
or disclosed to unauthorized individuals, entities, or processes.
27 
e) Critical Information Infrastructure (CII) refers to a computer or a
28 
computer system located wholly or partly in the Philippines, necessary
29 
for the continuous delivery of an essential service, and the loss or
30 
compromise of the computer or computer system will have a debilitating
31 
effect on the availability of the essential service in the Philippines. CIIs
32 
consist of information process and information and communications


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
31
32
technology which form part of the operation of the critical 
infrastructures.
f) Critical infrastructure (Cl) refers to any public service which owns, uses, 
or operates systems and assets, whether physical or virtual, so vital to 
the Republic of the Philippines that the incapacity or destruction of such 
systems or assets would have a detrimental impact on national security, 
including telecommunications and other such vital services as may be 
declared by the President of the Philippines.
g) cyZ7e/r/7/77e encompasses illegal activities conducted using computers or 
the web which may involve malicious intent. Involves activities violating 
laws and regulations such as the Cybercrime Prevention Act (Republic 
Act No. 10175, as amended), resulting in severe consequences such as 
privacy breaches, disruption of critical services.
h) Cybersecurity refers to the collection of tools, policies, risk management 
approaches, actions, training, best practices, assurance, and 
technologies that can be used to protect the cyber environment and 
organization and user's assets.
i) 
Cyberspace refers to a complex environment emerging from the 
interaction of people, software, and services on the internet by means 
of technology devices and networks connected to it, which does not exist 
in any physical form.
j) Information and communications technology (ICT) encompasses all 
technologies for the capture, storage, retrieval, processing, display, 
representation, organization, management, security, transfer, and 
interchange of data and information.
k) Information security refers to the protection of information and systems 
from unauthorized access, use, disclosure, disruption, modification, or 
destruction in order to provide confidentiality, integrity, and availability.
l) Integrity refers to the property of accuracy and completeness.
m) National Computer Emergency Response Team (NCERT) refers to a 
group of information security experts and practitioners responsible for 
responding to cybersecurity incidents of an organization with the aim of


1 
minimizing the impact or damage and ensuring recovery of affected
2 
systems.
3 
n) Non-Repudiation refers to the ability to prove the occurrence of a
4 
claimed event or action and its originating entities.
5 
o) Privacy refers to having the personal control over personal information.
6 
p) Security Operations Center (SOC) refers to the focal point for security
7 
operations and computer network defense of an organization. The
8 
purpose of the SOC is to defend and monitor an organization's systems
9 
and networks on an ongoing basis. The SOC is also responsible for
10 
detecting, analyzing, and responding to cybersecurity incidents in a
11 
timely manner.
12 
q) Zero Trust (ZT) refers to an evolving set of cybersecurity paradigms that
13 
move defenses from static, network-based perimeters to focus on users
14 
and resources. It is a set of security primitives rather than a particular
15 
set of technologies. Zero trust assumes that there is no implicit trust
16 
granted to user accounts based solely on their physical or network
17 
location (i.e., local area networks versus the internet) or to endpoints
18 
(devices) based on their ownership (e.g., enterprise or personally
19 
owned). Zero trust focuses on protecting resources (e.g., devices,
20 
services, workflows, network accounts) rather than network segments,
21 
as the network location is no longer seen as the prime component to the
22 
security posture of the resource.
23 
r) Zero Trust Architecture (ZTA) refers to an enterprise's cybersecurity plan
24 
that utilizes zero trust concepts 
and encompasses component
25 
relationships, workflow planning, and access policies.
26 
CHAPTER 2
27 
ORGANIZATION OF THE NATIONAL CYBERSECURITY AGENCY
28 
Sec. 4. Creation of the National Cybersecurity Agency (NCSA)—There is hereby
29 
created a National Cybersecurity Agency, which shall be an attached agency to the
30 
Department of Information and Communications Technology (DICT).
31 
Sec. 5. Mandate. — The NCSA shall be the primary policy, planning,
32 
coordinating, implementing, and administrative entity that will plan, develop.


1 
coordinate, and implement the overall national cybersecurity strategy of the
2 
government.
3 
Sec. 6. Powers and Functions. — The Agency shall exercise the following
4 
powers and functions:
5 
1) Policy Planning and Coordination
6 
a) Formulate policies and recommendations on issues concerning
7 
cybersecurity, advise Congress and other government agencies on
8 
all aspect of cybersecurity, and propose legislation and amendments
9 
thereto;
10 
b) Formulate and implement the National Cybersecurity Plan;
11 
c) Ensure the participation of all stakeholders in policy formulation and
12 
implementation;
13 
d) Lead the whole-of-government effort to formulate cybersecurity
14 
regulations, in accordance with international standards and best
15 
practices;
16 
e) Set national standards on the generation, management, use,
17 
optimization, and, if applicable, disposal of cybersecurity products,
18 
protocols, and crypto-primitives such as, but not limited to: Public
19 
Key Infrastructures (PKI); secure routing protocols; secure network
20 
elements; protective Domain 
Name Service; encryption and
21 
decryption protocols, and authentication protocols;
22 
f) Coordinate all cybersecurity activities of the government, in
23 
partnership with the private sector and other stakeholders;
24 
g) Advise the President, Congress, Judiciary, and Constitutional bodies
25 
on all cybersecurity-related issues and concerns;
26 
h) Create the National Vulnerability Disclosure Program. The program
27 
shall be the gateway for the 
security researchers to submit
28 
vulnerabilities of the online assets of the Philippine government;
29 
2) CII Protection
30 
a) Formulate and set cybersecurity minimum standards for CIIs, in
31 
coordination with relevant administrative agencies exercising
32 
regulatory functions over CIIs;


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
31
32
3)
b) Ensure compliance of CIIs to cybersecurity minimum standards 
requirements;
c) Conduct audit and assessment of the cybersecurity posture of CIIs, 
all National Government Agencies, including Government-Owned 
and/or Controlled Corporations (GOCCs), State Universities and 
Colleges (SUCs), and Local Government Units (LGUs). The Congress 
and the Judiciary may request the NCSA to assist them in the conduct 
of cybersecurity audit and assessment;
d) Establish a liaison network of CERTs (or CERTs Points of Contact) 
among CIIs to facilitate communication and information sharing;
e) Regulate and provide oversight over private cybersecurity service 
providers such as, but not limited to Vulnerability Assessment and 
Penetration Testing (VAPT) service providers, security operations 
center providers, etc.;
f) Upon request, provide analysis, expertise, and other technical 
assistance to critical infrastructure owners and operators, and if 
appropriate, provide those analyses, expertise, and other technical 
assistance in coordination with Sector-Specific Agencies and other 
government departments and agencies;
Cyber Threats and Incidents Response
a) Establish the NCERT and a robust incident response capability to 
promptly detect, analyze, and mitigate cyber incidents affecting 
national security or public interest and to collaborate with relevant 
government agencies, private sector entities, and international 
partners for coordinated incident response;
b) Enhance cyber threat intelligence and situational awareness;
c) Establish a liaison network of CERTs (or CERTs Points of Contact) 
among government agencies to support the implementation of the 
mandate of NCERT;
d) Perform vulnerability assessment and penetration testing initiatives 
to detect, identify, and analyze cyber threats and to properly 
attribute cyber-attacks against CIIs;


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
31
e) Initiate legal proceedings for the collection of computer data and 
summon witnesses to appear in any proceedings, investigation, or 
inquiry of the NCSA regarding cybersecurity incidents of national 
government agencies (NGAs) and instrumentalities, and CII;
f) Collect open source data and conduct data analysis for proactive 
cybersecurity measures against misinformation, deceptive content, 
and other forms of attacks on integrity of information;
4) Research and Development
a) Lead in the development of cybersecurity technologies, tools, and 
standards, in partnership with the academe, other government 
research institutions, and international partners;
5) Capacity Building
a) Develop and implement training programs to build and maintain a 
highly skilled cyber workforce in the government;
b) Partner with academic institutions, industry stakeholders, and foreign 
counterparts to promote knowledge sharing, resource sharing, and 
skills development in cybersecurity;
c) Prescribe personnel qualifications and other qualification standards 
essential to the effective development on cybersecurity field of 
expertise;
d) Co-develop with the Civil Service Commission (CSC) the cybersecurity 
qualification standards;
6) Information Sharing
a) Gather, assess, and distribute actionable intelligence regarding cyber 
threats, emerging patterns, and potential vulnerabilities, thereby 
bolstering the nation's cyber situational awareness and facilitating 
informed decision-making processes;
b) Develop a mechanism for information-sharing between the 
government (or public) and the private sector;
c) Issue cybersecurity advisories or guidelines regularly or as needed;
7) 
International Cooperation


1 
a) Foster international collaboration and cooperation for the promotion
2 
of cybersecurity;
3 
b) Support the government's efforts to establish the Philippines as a
4 
regional digital hub;
5 
c) Represent the Republic of the Philippines, in coordination with other
6 
relevant agencies in international cybersecurity cooperation;
7 
8) Regulatory
8 
a) In any investigation under Chapter 6: Prohibited Acts, after due
9 
notice and hearing, the NCSA may impose sanctions, collect fees,
10 
fines, and penalties for the violation of laws, rules, regulations,
11 
orders, and issuances on CIIs; and
12 
b) Exercise such other powers as may be provided by law, as well as
13 
those which may be implied from, or which are necessary or
14 
incidental to the carrying out of the express powers granted the
15 
NCSA to achieve the objectives and purposes of this law.
16 
Sec. 7. Composition. — The NCSA shall be headed by a Director-General with
17 
the rank of Undersecretary and shall be assisted by two Deputy Directors-General with
18 
the rank of Assistant Secretaries.
19 
Sec. 8. Qualifications. — The following are the minimum qualifications of the
20 
Director-General and Deputy Directors-General of the NCSA:
21 
a) Director-General — The Director-General shall be appointed by the
22 
President. No individual shall be appointed as Director-General of the
23 
NCSA unless he or she is a citizen residing in the Philippines for the past
24 
10 years, of good moral character, has at least five (5) years of
25 
government experience and ten (10) years cumulative experience as a
26 
cybersecurity, information privacy, or information security professional,
27 
and has at least a Master's Degree in Cybersecurity, Information
28 
Security, or any other related master's degree.
29 
b) Deputy Directors-General—Jhe Deputy Directors-General of the NCSA
30 
shall be appointed by the President. No individual shall be appointed
31 
Deputy Directors-General of the NCSA unless they are citizens residing
32 
in the Philippines for the past 10 years, of good moral character.


1 
possessing proven integrity, and having unquestionable integrity, with a
2 
track record of leadership, recognized competence with the appropriate
3 
educational background in cybersecurity or any related field, with at
4 
least six (6) years of supervisory or management experience in the field
5 
of cybersecurity, data privacy, information technology (IT), IT risk
6 
management, or any combination thereof.
7 
Sec. 9. Transfer of Agencies and Personnel to the NCSA — The Department of
8 
Information and Communications Technology - Cybersecurity Bureau (DICT-CSB) and
9 
its corresponding Divisions along with their powers and functions, applicable funds
10 
and appropriations, records, equipment, property, and personnel, are hereby
11 
transferred to the NCSA.
12 
All offices, services, divisions, units, and personnel not otherwise covered by
13 
this Act for transfer to NCSA shall be retained under the DICT, which shall continue to
14 
operate under its current name and functions. The NCSA is hereby attached to the
15 
DICT for policy and program coordination, and shall continue to operate and function
16 
laterally and in accordance with prevailing laws.
17 
a) All powers and functions related to cybersecurity, including but not
18 
limited to the formulation of the National Cybersecurity Plan,
19 
establishment of the NCERT, and the facilitation of international
20 
cooperation on intelligence regarding cybersecurity matters, are hereby
21 
transferred to NCSA; and
22 
b) The laws and rules on government reorganization as provided for in
23 
Republic Act No. 6656, otherwise known as the Reorganization Law,
24 
shall govern the reorganization process of NCSA.
25 
Sec. 10. Separation and Retirement from Service. - Employees who are
26 
separated from service within six (6) months from the effectivity of this Act as a result
27 
of the consolidation and/or reorganization under the provisions of this Act shall receive
28 
separation benefits to which they may be entitled under Executive Order No. 366, s.
29 
2004. Those who are qualified to retire under existing retirement laws shall be allowed
30 
to retire and receive retirement benefits to which they may be entitled under
31 
applicable laws and issuances.


1 
Sec. 11. Structure and Staffing Pattern. - Subject to the approval of the
2 
Department of Budget and Management (DBM), NCSA shall determine its
3 
organizational structure and create new divisions or units as it may deem necessary.
4 
The NCSA shall appoint officers and employees in accordance with the civil service
5 
law, rules, and regulations.
6 
a) Considering the highly technical nature of the personnel required for the
7 
NCSA, the NCSA may promulgate a separate set of qualification and
8 
competency standards for eligibility as career officers in NCSA. The NCSA
9 
qualification and competency standards shall only be applicable to NCSA
10 
unless adopted by the CSC as applicable for the entire Philippine
11 
government; and
12 
b) The NCSA may request detail of personnel from other government
13 
departments, agencies, bureaus, offices, and institutions, subject to the
14 
approval of the head of office and availability of personnel, to ensure the
15 
effective coordination, integration, and fusion of activities relative to
16 
cybersecurity.
17 
Sec. 12. Magna Carta. - All of the NCSA, including personnel providing technical
18 
support to the implementation of the program, services, and projects, shall be entitled
19 
to the benefits outlined in Republic Act No. 3439, as amended by Republic Act No.
20 
11312, known as the Magna Carta for Scientists, Engineers, Researchers, and other
21 
Science and Technology Personnel in Government Service.
22 
Sec. 13. Transition Period. - The transfer of functions, assets, funds,
23 
equipment, properties, transactions, and personnel of the affected agencies to NCSA
24 
shall be completed within six (6) months from the effectivity of this Act. During this
25 
transition period, existing personnel shall continue to assume their posts in holdover
26 
capacities until new appointments are issued. After the transfer of the agencies
27 
specified in Section 9 of this Act, NCSA, in coordination with DBM, shall determine and
28 
create new positions, the funding requirements of which shall not exceed twenty-five
29 
percent (25%) of the equivalent cost of positions abolished.
30 
CHAPTER 3
31 
CRITICAL INFORMATION INFRASTRUCTURES (CII)
10


1 
Sec. 14. Designation of Critical Information Infrastructure (CII). - The NCSA
2 
will have the duty and power to oversee the Clls in the Philippines.
3 
1) The NCSA shall identify entities that own, operate or maintain CII ("CII
4 
entities" from hereon), using a risk-based approach, as prescribed by
5 
the NCSP and shall adopt a set of criteria for identifying CIIs.
6 
2) After the confirmation of the CII designation, the NCSA will issue a
7 
written notice to the owner of the computer or computer system,
8 
designating said system as a CII for the purposes of this Act.
9 
3) A notice issued under subparagraph I must:
10 
a) Identify the computer or computer system that is being
11 
designated as a CII;
12 
b) Identify the owner of the computer or computer system so
13 
designated as a CII;
14 
c) Inform the owner of the computer or computer system,
15 
regarding the owner's duties and responsibilities under this
16 
Act that arise from the designation;
17 
d) Inform the owner of the computer or computer system that
18 
any representations against the designation are to be made
19 
to the NCSA by a specified date, being a date not earlier than
20 
fourteen (14) days after the date of the notice; and
21 
e) Inform the owner of the computer or computer system that
22 
the owner may appeal to the NCSA against the designation,
23 
and provide information on the applicable procedure.
24 
4) Any designation under Subsection I shall be in effect for a period of
25 
five (5) years, unless it is withdrawn by the NCSA before the expiration
26 
of the period.
27 
Sec. 15. Regulation of Providers of Essential Services Who Reiy on Third-Party
28 
Owned CII - Providers remain responsible for the cybersecurity and resilience of the
29 
computer systems they rely on to deliver essential services, even if those systems are
30 
managed by a third party. Providers who depend on third-party-owned CII must
31 
secure legally binding commitments from these vendors ensuring that the third party
11


1 
meets the cybersecurity standards and requirements applicable to CII, including
2 
incident reporting, auditing, and risk assessment.
3 
Sec. 16. Compliance requirements for organizations and the CIIs. - The NCSA,
4 
in coordination with concerned government regulatory agencies, shall create a list of
5 
compliance requirements for CIIs. In determining the compliance requirements for
6 
organizations and CIIs, due consideration shall be given to minimizing their impact on
7 
the cost of services provided by the organizations and/or CIIs. These shall include at
8 
least the following:
9 
a) List of authorized personnel and their level of access to the computer
10 
system labeled as CII;
11 
b) List of suppiy chain service providers of the CII including foreign service
12 
providers, if any;
13 
c) Brand, make, model, and other particulars (including operating system)
14 
of any computer or computing system of the CII;
15 
d) Network diagrams showing the network segmentation of the CII
16 
components;
17 
e) Technical and procedural controls being implemented to mitigate
18 
cybersecurity risks;
19 
f) The cybersecurity or information security framework used for risk
20 
assessment and adoption of technical and procedural controls;
21 
g) Initial audit report;
22 
h) Cybersecurity incident handling organization and protocol being
23 
implemented by the CII operator; and
24 
i) Organization and technical contact persons of the CII operators.
25 
Sec. 17. Internal Review and Audit of CIIs. - All CII operators shall take the
26 
necessary steps to identify, assess, and institute technical or procedural controls to
27 
mitigate cybersecurity risks reiated to the CII at least once every three (3) years.
28 
At least once every two (2) years (or at such higher frequency as may be
29 
directed by the NCSA in any particular case), all CII operators must submit an
30 
authenticated audit report performed by a NCSA recognized auditing firm that
31 
specializes in cybersecurity. Audit reports shall be submitted to NCSA and shall be kept
32 
in record for a period of not less than five (5) years.
12


1 
Sec. 18. Mandatory Disclosure of Cybersecurity Incidents on CIIs. -
2 
a) Organizations operating CIIs shall notify the government regulator and
3 
NCSA through the NCERT within four (4) hours upon discovery of a
4 
critical or high-risk cybersecurity incident. NCSA shall define the
5 
taxonomy, including classification and categorization of which
6 
cybersecurity incidents are considered "critical", "high risk" and
7 
"moderate". For moderate risk cybersecurity incidents, the CII operator
8 
shall inform NCSA or NCERT of the incident within twenty-four (24)
9 
hours;
10 
b) In the event of ransomware or extortion attacks, the affected CII entities
11 
are required to disclose in their report whether they have made any
12 
payments or complied with the demands of the threat actor; and
13 
c) CERTs shall coordinate with law enforcement agencies in filing of
14 
cybercrime cases.
15 
Sec. 19. Assistance extended by the government to CII operators. - Operators
16 
of CII may request assistance for NCSA to provide the following:
17 
a) Use of government technical controls and systems for the defense and
18 
protection of the CII;
19 
b) Priority co-location with government data centers subject to availability;
20 
and
21 
c) Use of government secure crypto-primitives such as digital certificates,
22 
etc.; and
23 
d) Knowledge management platform to facilitate faster sharing of
24 
information between the industry, NCSA, government regulators, and
25 
other concerned organizations.
26 
Sec. 20. Confidentiality of CII Related Documents. - The official list of CIIs,
27 
including their assessment, evaluation, audit, and technical reports shall be considered
28 
documents related to National Security and thus, are considered confidential and
29 
classified. The President, upon the recommendation of NCSA, may declassify these
30 
documents.
31 
If a subpoena duces tecum is issued for any of these classified documents,
32 
NCSA shall inform the body who ordered the subpoena that the document can only
13


1 
be opened or scrutinized in executive session, and/or shall be disclosed only to a
2 
limited number of people on a strict need-to-know basis.
3 
Sec. 21. Withdrawal or Removal of CII Designation. - The NCSA, through a
4 
written resolution, may withdraw or remove the designation of any CII at any time if
5 
the NCSA is of the opinion that the computer or computer system no longer fulfills the
6 
criteria of a CII. The NCSA shall notify in writing the CII operator of the withdrawal or
7 
removal of their designation within 14 days upon the issuance of the resolution.
8 
Sec. 22. Motion for Reconsideration of CII Certification. - CIIs may file for
9 
motion for reconsideration of the scoring or rating, and revocation of certificate to
10 
NCSA within thirty (30) days from the receipt of the decision.
11 
CHAPTER 4
12 
CYBERSECURITY lOT CERTIFICATION
13 
Sec 23. Cybersecurity Anchor of Trust System (CATS). - NCSA shall promulgate
14 
rules and procedures for certifying cybersecurity trustworthiness of service, suppliers,
15 
or technologies. Towards this end, the Agency in consultation with other government
16 
agencies and the private sector shall devise a rating or scoring system for assessing
17 
information security and cybersecurity standards considering various criteria. Such
18 
scoring system shall be reviewed periodically at least once every two (2) years or as
19 
may be deemed necessary by the Agency.
20 
The Agency may charge reasonable fees to defray the administrative cost of
21 
the services rendered.
22 
Sec. 24. Voluntary Rating System. - Any local or foreign commercial entities
23 
may voluntarily submit themselves for certification.
24 
Sec. 25. Validity of Certification. - The certification issued by NCSA shall be
25 
valid for a maximum period of two (2) years: Provided, That NCSA, may impose a
26 
shorter validity period depending on the criticality of the business or the cybersecurity
27 
risks relevant to the business of the person: Provided, further, That the Agency, upon
28 
recommendation by NCERT, may require re-certification prior to the expiration of the
29 
certification due to factors increasing the cybersecurity risks relevant to the business
30 
of the person.
14


1 
Sec. 26. Cybersecurity !oT Certification Appeai. - Agencies with cybersecurity
2 
loT certification may file for an appeal of the scoring or rating, and revocation of
3 
certificate to NCSA within thirty (30) days from receipt of the decision.
4 
CHAPTER 5
5 
NATIONAL CYBERSECURITY COLLEGE
6 
Sec. 27. Estabiishment of the National Cybersecurity College. - There shall be
7 
established a National Cybersecurity College under the jurisdiction of the NCSA which
8 
shall be responsible for providing specialized education, training, and research in the
9 
field of cybersecurity.
10 
Sec. 28. Board of Trustees. - The College shall be under the direction, control,
11 
and supervision of a Board of Trustees, which shall be composed of seven (7)
12 
members, as follows:
13 
a) A representative from the DICT with the rank of at least Assistant
14 
Secretary;
15 
b) A representative from NCSA with the rank of at least a Deputy Director-
16 
General;
17 
c) A representative from the Department of Science and Technology
18 
(DOST) with the rank of at least an Assistant Secretary;
19 
d) A Commissioner of the Commission on Higher Education (CHED);
20 
e) A representative from the Department of Justice with the rank of at least
21 
Assistant Secretary;
22 
f) A representative from the Department of the Interior and Local
23 
Government with the rank of at least Assistant Secretary;
24 
g) One representative from the Private Sector, to be appointed for a term
25 
of three (3) years by the aforementioned Trustees.
26 
The Board of Trustees shall elect among themselves the Chairman and the Vice-
27 
chairman of the Board.
28 
Sec. 29. Powers and Functions of the Board of Trustees. - The Board of
29 
Trustees is vested with the following powers and functions:
30 
a) Preparation and adoption of rules and regulations deemed necessary for
31 
the effective discharge of its responsibilities;
15


1 
b) Authorization of the fields of human resource development,
2 
investigation, and major studies, allocating available funds without
3 
influencing specific methodologies or conclusions;
4 
c) Constitution of the Executive Committee, as hereinafter defined;
5 
d) Appointment of the President and one or more Vice-Presidents to assist
6 
the President in the administration of the College;
7 
e) Periodic review of the administration and programs of the College;
8 
f) Cause the development of academic programs and courses designed for
9 
different educational levels addressing the varied requirements of
10 
cybersecurity professionals, to be offered at the College;
11 
g) Design curricula for professional training and certifications in
12 
cybersecurity catering to individuals and organizations in the public and
13 
private sectors, fostering a competent workforce equipped to tackle
14 
evolving cyber threats, to be provided at the College;
15 
h) Conduct research and development activities aimed at advancing
16 
knowledge and technologies in the field of cybersecurity, contributing to
17 
the nation's cyber resilience and innovation;
18 
i) Cause the collection of fees as applicable, in accordance with established
19 
guidelines, regulations, and laws.
20 
Sec. 30. Executive Committee. - An Executive Committee shall be established,
21 
consisting of the President of the College and not fewer than three nor more than five
22 
other members nominated by the Board of Trustees and approved by the President of
23 
the Republic of the Philippines.
24 
Sec. 31. Functions of the Executive Committee. - The Executive Committee
25 
shall administer the affairs of the College in accordance with functions, powers, and
26 
responsibilities delegated by the Board of Trustees, excluding the power to fill
27 
vacancies on the Board and to amend the rules and regulations of the College.
28 
Sec. 32. President of the College. - The President of the College shall be its
29 
chief executive officer, appointed by the Board of Trustees. The President's powers
30 
and duties include submitting policies and measures for consideration, recommending,
31 
coordinating, and administering programs and projects, directing and supervising
16


1 
operations, submitting annual reports, and exercising other powers vested by the
2 
Board.
3 
Sec. 33. Financial Support. - Until the College achieves financial self-sufficiency,
4 
its operations shall be financed through contributions from founding institutions. An
5 
endowment fund shall be created from appropriations from the national government,
6 
grants, donations, and other sources of funding as may be approved by law, up until
7 
the College attains self-support capability, administered by the Board of Trustees.
8 
Sec. 34. Expenditures and Disbursements. - Expenditures and disbursements
9 
made by the College shall not be subject to procurement requirements and restrictions
10 
imposed by existing laws upon government agencies.
11 
Sec. 35. Staff Appointments. - Appointments to the administrative, academic,
12 
or research staff of the College may be on a part-time basis and shall be exempt from
13 
certain requirements and restrictions, ensuring flexibility in staffing arrangements.
14 
Sec. 36. Exemption from Taxes. - The College, its assets, acquisitions, income,
15 
operations, and transactions shall be exempt from taxes, fees, charges, imports,
16 
licenses, and assessments, except import taxes, duties, and fees.
17 
Sec. 37. Collaboration. - The National Cybersecurity College shall collaborate
18 
with other educational institutions, government agencies, industry partners, and
19 
international organizations to enhance cybersecurity education, training, and research
20 
efforts in the Philippines.
21 
Sec. 38. Partnership. - The College may partner with State Universities and
22 
Colleges (SUCs), public and private academic institutions to accredit and establish
23 
them as Institutions of Cybersecurity Excellence.
24 
Sec. 39. Reporting. - The Board of Trustees shall submit an annual report to
25 
the NCSA, detailing its activities, accomplishments, and financial status.
26 
CHAPTER 6
27 
PROHIBITED ACTS AND PENALTIES
28 
Sec. 40. Non-compliance of CII operators. - In the event that a CII operator
29 
fails willfully or negligently to comply with the orders, directive, mandate, remediation,
30 
and any other regulations of NCSA, the same shall incur penalties as provided for this
31 
Act. This includes submission of documentary requirements, and providing NCSA
32 
access to necessary computer data during investigations of cyber-attacks.
17


1 
Sec. 41. Disclosure of Confidential Information. - Any individual who has access
2 
to CII and information is prohibited to disclose them. The unauthorized disclosure of
3 
these confidential information, either willfully or through negligence, shall be
4 
penalized.
5 
Sec. 42. Penalties. - The following penalties shall be applied for violations of
6 
this Act:
7 
a) Any individual who either willfully, or through negligence causes the
8 
unauthorized disclosure of confidential or sensitive information shall be
9 
penalized by imprisonment ranging from six (6) years to twelve (12)
10 
years or a fine of not less than Five hundred thousand pesos
11 
(P500,000.00), or both;
12 
b) Any unauthorized disclosure of confidential or sensitive information
13 
affecting national defense or national security, with intent or reason to
14 
believe that the same is to be used to the injury of the Philippines or to
15 
the advantage of any foreign nation or enemy of the State, whether
16 
domestic or foreign, shall suffer the penalty of life imprisonment or by a
17 
fine of not less than One million pesos (P 1,000,000.00), or both;
18 
c) Any employee who leaves or severs employment with the CII
19 
operator/owner, willfully or negligently discloses, damages, disposes of,
20 
or destroys critical, sensitive, or classified information in violation of this
21 
Act and other existing laws, rules, and regulations, contravenes or fails
22 
to comply with any provision of this Act shall be held liable without
23 
prejudice to any criminal prosecution;
24 
d) Upon violation of any enumerated prohibited acts, the CII operator shall
25 
receive a formal written warning from the NCSA ordering the CII to show
26 
cause within seven (7) days from receipt thereof;
27 
e) If the CII operator fails to comply with the written warning, NCSA shall
28 
impose a fine equal to half of one percent (0.5%) of the CII operator's
29 
average gross annual income for a period of five years. An additional
30 
half of one percent (0.5%) shall be added for each subsequent
31 
infraction, with the penalty resetting after the CII operator finally
32 
complies with the directives;
18


1 
f) A CII operator's willful disregard of a lawful order given by NCSA to
2 
comply with this Act and its implementing rules and regulations within a
3 
reasonable time frame will result in the CII operator's license being
4 
revoked on grounds of non-compliance to a regulatory requirement;
5 
g) The CII operator has the right to appeal any penalties imposed under
6 
this section. To initiate an appeal, the CII operator must submit a written
7 
notice of appeal to the NCSA within fifteen (15) days from the receipt of
8 
the penalty notice or the revocation order. The appeal must include a
9 
detailed statement of the grounds for contesting the penalty and any
10 
supporting evidence. Upon receipt of the appeal, the NCSA shall review
11 
the case and may hold a hearing if deemed necessary. The CII operator
12 
will be notified of the hearing date and will have the opportunity to
13 
present their case. Following the review or hearing, the NCSA will issue
14 
a written decision on the appeal. The decision of the NCSA shall be final
15 
and may be challenged only through appropriate judicial review, as
16 
provided by applicable law.
17 
Sec. 43. Liability under the Anti-Terrorism Act (ATA) of 2020. - Any person
18 
who, within or outside the Philippines, regardless of the stage of execution, engages
19 
in acts intended to cause extensive interference with, damage, or destruction to
20 
Critical Infrastructure, as defined under Section 3 (f) of this Act or Section 3 (a) of
21 
Republic Act No. 11479, or to CIIs designated under Chapter 3 of this Act, committed
22 
by, through and with the use of information and communications technologies or
23 
otherwise, when the purpose of such act, by its nature and context is to intimidate
24 
the general public or a segment thereof, create an atmosphere or spread a message
25 
of fear, to provoke or influence by intimidation the government or any international
26 
organization, or seriously destabilize or destroy the fundamental political, economic,
27 
or social structures of the country, or create a public emergency or seriously
28 
undermine public safety, shall be liable under Section 4 (c) of Republic Act No. 11479,
29 
otherwise known as the Anti-Terrorism Act of 2020.
30 
CHAPTER 7
31 
MISCELLANEOUS PROVISIONS
19


1 
Sec. 44. Authority to Accept Assistance and/or Donations. - The NCSA is
2 
authorized to accept donations, contributions, grants, bequests or gifts from domestic
3 
or foreign sources, for purposes relevant to its mandates and functions, subject to
4 
existing laws, rules and regulations.
5 
Sec. 45. Appropriations. - The amount necessary for the initial implementation
6 
of this Act shall be charged against the current and available appropriations of
7 
concerned agencies. Thereafter, the amount needed for the implementation of this
8 
Act shall be included in the annual General Appropriations Act.
9 
The State shall prioritize allocation of all available resources to ensure the
10 
effective implementation of its mandates specified under this Act. All departments,
11 
bureaus, offices, and agencies of the government are hereby authorized to use at
12 
least five percent (5%) of their total budgetary allocation for the programs, activities,
13 
and projects to implement this Act. Funds to be allocated for this purpose shall not be
14 
used for intelligence, surveillance, or other similar activities and shall be subject to
15 
relevant government accounting and audit laws, rules, and procedures.
16 
Sec. 46. Cybersecurity Risk Management and Mitigation Fund. - There is hereby
17 
created a Cybersecurity Risk Management and Mitigation Fund (CRMMF).
18 
a) CRMMF shall be used for cybersecurity risk mitigation, prevention, and
19 
preparedness activities such as but not limited to training of personnel,
20 
procurement of equipment, and capital expenditures. It can also be
21 
utilized for the management of imminent or actual cybersecurity threats
22 
which may occur during the current fiscal year or those that occurred in
23 
the past two (2) years from the current fiscal year. Risk management
24 
activities include threat identification and detection, incident response,
25 
system recovery and protection, and other related works or services;
26 
b) The specific amount of the CRMMF and the appropriate recipient
27 
agencies shall be determined upon approval of the President of the
28 
Philippines in accordance with the favorable recommendation of the
29 
NCSA;
30 
c) Of the amount appropriated for the CRMMF, thirty percent (30%) shall
31 
be allocated as Quick Response Fund (QRF) or a contingent fund for
20


1 
response and recovery activities in order to immediately bring affected
2 
CII systems to normal operation; and
3 
d) All departments/agencies that are allocated with the CRMMF shall submit
4 
to the NCSA their monthly statements on the utilization of CRMMF and
5 
make an accounting thereof in accordance with existing accounting and
6 
auditing rules.
7 
Sec. 47. Report. - The NCSA shall submit an annual report to the Office of the
8 
President on the implementation of this Act, as well as the operations of the Agency.
9 
The NCSA shall also include in its report disclosures of cybersecurity vulnerabilities,
10 
actionable protocols to mitigate cybersecurity vulnerabilities to information systems
11 
and industrial control systems.
12 
Sec 48. Confidentiality. -
13 
1) All parties involved in the application of this Act shall respect the
14 
confidentiality of information and data obtained in carrying out their tasks
15 
and activities in such a manner as to protect, in particular:
16 
a) Intellectual property rights, and confidential business
17 
information or trade secrets of a natural or juridical person,
18 
including source code, except in cases where the disclosure
19 
and access is necessary to protect the legitimate interest
20 
recognized by existing laws, rules, and regulations;
21 
b) Public and national security interests;
22 
c) Data of security agencies, ensuring that they will not be
23 
migrated into the private domain; and
24 
d) Integrity of criminal or administrative proceedings.
25 
2) Without prejudice to paragraph I, information exchanged on a
26 
confidential basis between government departments, agencies,
27 
bureaus, offices, and institutions and the NCSA shall not be disclosed
28 
without the prior agreement of the originating government
29 
departments, agencies, bureaus, offices, and institutions.
30 
3) Adequate protection shall be set in place between the information shared
31 
by the private sector and government agencies, particularly security and
32 
law enforcement agencies.
21


1 
4) Paragraphs I and II shall not affect the rights and obligations of the NCSA
2 
and notified bodies with regard to the exchange of information and the
3 
dissemination of warnings, nor the obligations of the persons concerned
4 
to provide information under existing laws, rules, and regulations.
5 
5) The NCSA may exchange, when necessary, sensitive information with
6 
relevant authorities of third countries with which they have concluded
7 
bilateral or multilateral confidentiality arrangements guaranteeing an
8 
adequate level of protection.
9 
Sec. 49. Utilization of the collected fees, fines, and penalties. - The NCSA is
10 
hereby authorized to utilize at most forty percent (40%) of the fees and penalties
11 
collected for programs and projects aimed at enhancing cybersecurity capabilities and
12 
infrastructure within the jurisdiction. These funds shall be allocated towards initiatives
13 
such as cybersecurity awareness campaigns, capacity- building programs, research
14 
and development efforts, and the procurement of advanced cybersecurity
15 
technologies and tools: Provided, That at no circumstance shall the funds be used to
16 
augment salaries and personnel benefits.
17 
The utilization of the aforementioned fund shall be subject to government
18 
accounting manual and audit procedures, ensuring transparency, accountability, and
19 
proper fiscal management in accordance with the objectives and mandates of NCSA.
20 
Regular audits and reporting requirements shall be conducted to ensure the effective
21 
and efficient utilization of funds.
22 
Sec. 50. Implementing Rules and Regulations. - Within one hundred twenty
23 
(120) days from the effectivity of this Act, the DICT, the DBM, the CSC, and upon
24 
consultation with relevant stakeholders, shall promulgate the rules and regulations to
25 
effectively implement the provisions of this Act.
26 
Sec. 51. Separability Clause. - If any provision of this Act is declared invalid or
27 
unconstitutional, the remainder thereof not otherwise affected shall remain in full force
28 
and effect.
29 
Sec. 52. Repealing Clause. - All laws, presidential decrees, executive orders,
30 
letters of instructions, proclamations, or administrative regulations that are
31 
inconsistent with the provisions of this Act are hereby repealed, amended, or modified
32 
accordingly.
22


1
2
3
Sec. 53. Effectivity Clause. - This Act shall take effect after fifteen (15) days 
following the completion of its publication in the Official Gazette or in any newspaper 
of general circulation.
Approved,
23