NINETEENTH CONGRESS OF THE 
REPUBLIC OF THE PHILIPPINES 
First Regular Session
)
ti'iF iB 
.-Jy
of the f:>- cTiavp
SENATE
s. No. 863
'22 JUL25 P2:14
Introduced by Senator Grace Poe
RlTEiVcjO.
AN ACT
REQUIRING CRITICAL INFORMATION INFRASTRUCTURE INSTITUTIONS 
TO ADOPT AND IMPLEMENT ADEQUATE MEASURES TO PROTECT THEIR 
INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) SYSTEMS 
AND INFRASTRUCTURE
EXPLANATORY NOTE
The COVID-19 pandemic accelerated the country's digital transformation and 
digital economy. Filipinos now use 4.3 more new digital services on average 
compared to pre-pandemic years.1 E-commerce grew significantly, and sales are 
expected to be valued at US$10.3 billion by 2025.2 The Bangko Sentral ng Pilipinas 
reported that 53% of adult Filipinos had electronic money accounts in 2021, up from 
29% in 2019.3 According to the World Bank's assessment, online education and 
remote work are here to stay.4
Increased use of digital technologies, especially the Internet, is accompanied 
by cyberthreats and risks. Malicious actors—from casual scammers to highly 
sophisticated state-backed groups—hunt for vulnerabilities in ICT systems and 
networks to steal information, disrupt essential services, and profit from attacks. 
Hence, it Is critically important to ensure that the Philippines has a national policy 
framework for the protection of digital assets, especially critical information 
infrastructure (CII), against threats that could paralyze our economy and affect the 
wellbeing of Filipinos.
1 Google, Temasek, & Bain & Company (2021). e-Conomy SEA 2021: Roaring 20s: The SEA digital 
divide, https://services.google.com/fh/files/misc/philippines_e_conomy_sea_2021_report.pdf
2 GlobalData (9 Dec 2021). Online shopping and rising internet penetration to lead Philippines e- 
commerce at 17% CAGR through 2025, forecasts GlobalData. https://www.globaldata.com/online-shopping- 
rising-internet-penetration-lead-philippines-e-commerce-17-cagr-2025-forecasts-globaidata/
3 Villanueva, J. (24 Jan 2022). PH digital transactions to grow despite challenges: BSP chief. 
https://www.pna.gov.ph/articles/1166236; GCash alone grew 200% between 2020 and May 2022, now boasting 
60 million users. See Cueto, F.E. (25 May 2022). Gcash claims 60 million users in PH. 
https://www.manilatimes.net/2022/05/25/business/top-business/gcash-claims-60-million-users-in-ph/1844877
4 World Bank (2020). Building a resilient recovery. Philippines Economic Update: December 2020 
edition. https://openknowledge.worldbank.org/bitstream/handle/10986/34899/Philippines-Economic-Update- 
Building-a-Resilient-Recovery.pdf


The Philippine National Cyber Security Plan 2022 highlighted the goal of 
"assuring the continuous operation of the nation's critical information infrastructure." 
These digital systems underpin the operation of critical infrastructure, such as water, 
electricity, banking and financial networks, telecommunications, and other networks 
vital to the operation of the country.
In light of these risks, it is high time to ensure the protection of CIIs by 
ensuring, at the minimum, compliance with international standards and globally 
accepted best practices for cybersecurity.
As a proactive and Institutionally cohesive response, this bill aims to protect 
the cybersecurity of CII by requiring the: (i) adoption of minimum Information 
security standards, (ii) creation of a computer emergency response team and 
reporting of cybersecurity incidents, and (ill) development of a capable pool of 
cybersecurity professionals and practitioners that will be critical to the effective 
implementation of cybersecurity policy, rules, and standards.
If passed, the Critical Information Infrastructure Protection Act will provide a 
framework for ensuring the security and reliability of the country's digital ecosystem, 
which is crucial to the country's continued digitalization and growing digital 
economy.
As a necessary step to Improving Philippine cybersecurity, the passage of this 
bill is earnestly sought for the security and well-being of all Filipinos.
GRACE POE


NINETEENTH CONGRESS OF THE 
REPUBLIC OF THE PHILIPPINES 
First Regular Session
)
SENATE
s. No. 863
i©ffinp of Ill? S5)i a ctai'f'
*22 JUL25 P2.14
Introduced by Senator Grace Poe
RliCElVrO sv
AN ACT
REQUIRING CRITICAL INFORMATION INFRASTRUCTURE INSTITUTIONS 
TO ADOPT AND IMPLEMENT ADEQUATE MEASURES TO PROTECT THEIR 
INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) SYSTEMS 
AND INFRASTRUCTURE
Be it enacted by the Senate and House of Representatives of the Phiiippines in 
Congress assembled,
1 
Section 1. Title. - This Act shall be known as the Critical Information
2 
Infrastructure Protection Act of2022."
3 
Sec. 2. Declaration of Policy. - The growth of Information computer
4 
technology is accompanied by new and serious threats and, as such, the state
5 
recognizes as vitally Important the establishment of a more secure cyberspace and a
6 
data protection regime that is compliant with international standards and ensures
7 
the free flow of information.
8 
It is the policy of the State to protect Critical Information Infrastructure
9 
C'CII") from cyberattacks and threats, data manipulation, cybercrimes, and activities
10 
of malicious actors. The State recognizes that the protection of computers,
11 
networks, electronic devices, and digital assets, including information, is a common
12 
objective and requires the combined efforts of the public and private sectors, and
13 
cooperation with local and international actors, in order to minimize the Impact of, if
14 
not prevent, cyberattacks, threats, and risks on the nation's security and socio-
15 
economic well-being.
16 
Further, the adoption and implementation of minimum information security
17 
standards is a globally accepted best practice to provide guidance, which would lead
18 
to more efficient use of resources, improved risk management, consistent delivery of


1 
critical and essential services, and effective protection of the confidentiality,
2 
integrity, and availability of information that is vital to the nation.
3 
Sec. 3. Definition. - For the purpose of this Act and for the implementation of
4 
the policy contained herein, the following definitions shall apply:
5 
a. "Critical infrastructure" refers to assets, systems, and networks, whether
6 
physical or virtual, that are considered so vital that their destruction or
7 
disruption would have a debilitating impact on national security, health
8 
and safety, or economic well-being of citizens, or any combination thereof.
9 
b. "Critical Information Infrastructure (CII)" refers to computer systems, ICT
10 
information and communications technology (ICT) networks, and digital
11 
assets that are necessary for the continuous operation and delivery of the
12 
country's critical infrastructure services.
13 
c. "CII institution" refers to a government agency or a private company that
14 
owns, operates, controls, and/or maintains critical information
15 
infrastructure, and whose operation is nationwide in scope and/or covers
16 
metropolitan centers, including Metro Manila, Metro Cebu, Metro Davao,
17 
and, by 2025, Metro Cagayan de Oro, or as defined and updated by the
18 
National Economic Development Authority (NEDA) or the Philippine
19 
Statistics Authority (PSA).
20 
d. "Computer Emergency Response Team" or "CERT" refers to an
21 
organization that studies computer and network security in order to
22 
provide incident response services to victims of attacks, publish alerts
23 
concerning vulnerabilities and threats, and to offer other information to
24 
help improve computer and network security.
25 
e. "Information security" refers to the preservation of the confidentiality,
26 
integrity, and availability of information. This may also involve other
27 
properties, such as authenticity, accountability, non-repudiation, and
28 
reliability of information.
29 
f. "Information security incident" refers to an occurrence that actually or
30 
potentially jeopardizes the confidentiality, integrity, or availability of an
31 
information system or the information the system processes, stores, or


1 
transmits or that constitutes a violation or imminent threat of violation of
2 
security policies, security procedures, or acceptable use policies.
3 
g. "Information system" refers to applications, services, information
4 
technology assets, or any component handling information.
5 
Sec. 4. Coverage of Critical Information Infrastructure. - This Act covers CII,
6 
whether in the public or private sector, in industries including, but not limited to:
7 
a. Banking and finance;
8 
b. Broadcast media;
9 
c. Emergency services and disaster response;
10 
d. Energy;
11 
e. Health;
12 
f. 
Telecommunications;
13 
g. Transportation (land, sea, air); and
14 
h. Water.
15 
An entity, whether public or private, that owns, operates, and maintains CII in
16 
the industries mentioned above, and as updated by the Department of Information
17 
and Communications Technology (DICT), shall be covered by this Act.
18 
The DICT shall institute a consultation process to update the definition of a
19 
CII, the list of CII institutions, and the sector or industry covered as CII every three
20 
(3) years from the effectivity of this Act.
21 
Sec. 5. Adoption of Minimum Information Security Standards. - All covered
22 
CII institutions shall adopt and implement adequate measures to protect their ICT
23 
systems and infrastructure, and respond to and recover from any information
24 
security incident, in compliance with existing laws, rules and regulations.
25 
They shall be required to:
26 
a. adopt the Code of Practice stipulated In the Philippine National Standard
27 
(PNS) on ISO/IEC27001 Information Security Management System (ISMS)
28 
(series of standards) and PNS ISO 22301 Security and resilience -
29 
Business continuity management systems (BCMS). They shall also adopt
30 
the ISO/IEC 27701 Privacy Information Management Systems, as
31 
applicable;


1 
b. submit to the DICT a copy of their formal certification as proof of adoption
2 
of the PNS ISO/IEC 27000 (series of standards), PNS ISO 22301, and
3 
ISO/IEC 27701, as applicable; and
4 
c. ensure that their certificates are up-to-date and shall submit the latest
5 
annual audit confirmation to the DICT.
6 
In lieu of the submission of formal certification above, covered CII institutions
7 
shall subject themselves to an annual information security self-assessment using
8 
standards, such as but not limited to, the Center for Internet Security (CIS) Controls
9 
or the National Institute of Standards and Technology (NIST) Special Publication
10 
(SP) 800-53, during the first quarter of each year. The concerned institution shall
11 
submit this self-declaration and attest to its validity to the DICT on or before the 31st
12 
of March. The self-declaration shall be signed off by the respective head of the
13 
department directly in charge of the agency's information security systems.
14 
Each CII institution shall adopt programs, guidelines, and written procedures
15 
for the implementation of its chosen information security standard, which shall be
16 
included in their annual submission.
17 
The DICT shall have the authority to determine and update information
18 
security standards, and require CII institutions to comply with such standards, as it
19 
deems it necessary and appropriate.
20 
Nothing in this Act shall prevent a government agency or a sector regulator
21 
from imposing additional or more stringent information security standards for
22 
compliance by Industry players under its jurisdiction, as it deems necessary.
23 
Sec. 6. National Computer Emergency Response Team C'NCERT") as the
24 
Centralized Information Security Incident Reporting Mechanism. - All covered CII
25 
Institutions shall:
26 
a. report all information security incidents affecting their institutions to the
27 
DICT's Philippine National Computer Emergency Response Team, which
28 
shall be the central authority for all Sectoral and Organizational CERTs in
29 
the country;
30 
b. submit an information security incident detection report to the NCERT
31 
within twenty-four (24) hours upon detection of the incident(s). The report
32 
shall contain basic information about the incident, such as: (1) date when


1 
the incident was first detected, 
(ii) nature of the information security
2 
incident, (iii) possible business processes and 
functions compromised, and
3 
(iv) agency's initial response and next steps;
4 
c. submit an incident progress report, upon request of the NCERT, in order
5 
to help assess and provide the necessary support in responding to an
6 
incident;
7 
d. submit a post-incident report, which contains the following information: (i)
8 
magnitude of business operations compromised, (ii) risk assessment, and
i
9 
(iii) the agency's response. They shall also provide the necessary
10 
additional information about the incident, as requested by the NCERT;
11 
e. compile on an annual basis a summary of all information security incident
12 
reports and submit an annual report to the DICT Cybersecurity Bureau
13 
every 30th of June;
14 
f. comply with the reporting mechanism and template prescribed by the
15 
DICT, in the submission of all the reporting requirements described above:
16 
Provided, that information-sharing shall be done using established
17 
communication protocol, using at the minimum, the Traffic Light Protocol
18 
(TLP) as established by the DICT MC 2017-005 or succeeding policies.
19 
g. participate in activities that help promote awareness, capacity building,
20 
and improve an organization's information security readiness, protection,
21 
and incident response capabilities, such as but not limited to cyber drills.
22 
Sec. 7. Designation of Personnel with Information Security Credentials. - All
23 
government agencies shall have at least one personnel with sufficient information
24 
security training and credentials. Such personnel shall, preferably, hold at least
25 
Division Chief plantilla position (or equivalent) and perform decision making or
26 
management functions. The DICT shall Identify and release a list of credentials that
27 
meet this requirement. Such personnel shall be the point person for (i) compliance
28 
with prescribed standards, (ii) building information security capability within the
29 
agency, and (iii) compliance with the agency's and NCERT's reporting requirements.
30 
Section 8. Compliance by all covered CII Institutions.
31 
a. Government compliance: The Department of Budget and Management
32 
(DBM) shall review the submission by a CII Institution to the DICT of a


1 
formal certification or self-declaration of compliance with any of the
2 
prescribed information security standards, whichever submission applies,
3 
as a prerequisite to budgetary approval. A government institution or sector
4 
regulator, which itself operates or has jurisdiction over CII, shall comply
5 
with the requirements set forth in this Act.
6 
b. Non-government or private company compliance: Compliance with this
7 
Act, specifically of Sections 5 (standards) and 6 (reporting), shall be a
8 
prerequisite for the granting of any regulatory approval, permit, and/or
9 
license to a private company covered under Section 4 of this Act.
10 
Sec. 9. Implementing Agency. - The DICT, through its Cybersecurity Bureau,
11 
shall be the implementing agency of this Act, in accordance with the National
12 
Cybersecurity Plan and relevant DICT policies. The DICT shall:
13 
a. create and maintain a database of all certifications, self-declaration, and
14 
attestations of all covered CII institutions;
15 
b. prescribe minimum information security standards for compliance by all
16 
CII institutions;
17 
c. serve as the custodian for information security standards and incident
18 
reports;
19 
d. collect and analyze all pertinent information about an information security
20 
incident, and provide to government institutions, sectoral CERTs, and to
21 
the public a technical report of information security incidents for purposes
22 
of policy, regulation, and providing guidance to all stakeholders on local
23 
information security issues.
24 
e. prescribe a mechanism and template for the reporting of information
25 
security Incidents to the NCERT; and
26 
f. institute a consultation process and hold consultations to update the
27 
coverage and definition of CII, minimum information security standards,
28 
and recognize Individual information security certifications every three (3)
29 
years from the effectivity of this Act.
30 
Sec. 10. -- Responsibilities of the Department Heads and Sector Regulators
31 
with jurisdiction over CII Institutions. The heads of departments and sector
32 
regulators who have a mandate over covered CII Institutions, including Sectoral


1 
CERT Leads as identified in DICT DC 003-2020, in coordination with the DICT, shall
2 
be responsible for issuing the necessary policy and regulation that promote
3 
information security and require compliance of CII Institutions to the prevailing
4 
standards to ensure information security and business continuity.
5 
Sec. 11. Administrative Liability. - The respective heads of departments,
6 
agencies, bureaus, offices, GOCCs, GFIs, and SUCs shall be administratively liable for
7 
non-compliance with this Act pursuant to existing laws, rules, and regulations.
8 
Sec. 12. Funding. - The initial funding requirements for the implementation of
9 
this Act shall be charged against the existing budget of the covered CII institutions
10 
and such other appropriate funding sources as the DBM may Identify, subject to
11 
relevant laws, rules, and regulations.
12 
Sec. 13. Penalty. - Non-compliance with the provisions of this Act, whether or
13 
not it results in data loss, breaches, hacking, or similar incidents, may result in
14 
administrative, civil, or criminal liability under applicable laws, including but not
15 
limited to Republic Act No. 10175 also known as the Cybercrime Prevention Act of
16 
2012 and Republic Act No. 10173 or the Data Privacy Act of 2012.
17 
Sec. 14. Annual Report. - Every 30th of April of every year, the DICT shall
18 
report to the Office of the President the status of the implementation of this Act.
19 
Sec. 15. Separability Clause. - If any provision of this Act is declared invalid
20 
or unconstitutional, the remaining provisions not affected thereby shall continue to
21 
be in full force and effect.
22 
Sec. 16. Repealing Clause. - All laws, rules, and regulations inconsistent with
23 
this Act are hereby repealed or modified accordingly.
24 
Sec. 17. Effectivity. -This Act shall take effect fifteen (15) days following the
25 
completion of its publication in two (2) newspapers of general circulation.
Approved,
7