NINETEENTH CONGRESS OF THE 
)
REPUBLIC OF THE PHILIPPINES 
)
First Regular Session 
)
Senate
of tljp S'l (u‘t<irf
23 FEB 27 P2:10
SENATE
1923
S. No.
Rl-CEIVEDGV,
Introduced by SENATOR RAMON BONG REVILLA, JR>
AN ACT
REQUIRING CRITICAL INFORMATION INFRASTRUCTURE INSTITUTIONS 
TO ADOPT AND IMPLEMENT ADEQUATE MEASURES TO PROTECT THEIR 
INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) SYSTEMS AND 
INFRASTRUCTURE
EXPLANATORY NOTE
The latest Digital 2022 report of social media management firm Hootsuite and 
creative agency We Are Social revealed that internet users in the Philippines from ages 
16 to 64 spend an average of 10 hours and 27 minutes on the internet per day. The 
same report showed that Filipino internet users enjoy activities online, such as 
watching educational videos, streaming TV content, listening to podcasts, playing 
video games, while others maximize online surfing for investment, insurance 
applications, and online banking each week1.
In a country like ours where people are heavily reliant online, response to 
everyday needs will most likely evolve using technology and the internet. The 
exponential proliferation of E-commerce paved the way to accelerated use of 
information and communications technology (ICT) in critical infrastructure (Cl). 
Unfortunately, our country has limited data protection mechanisms in place - making 
us enormously susceptible to various cybersecurity threats and risks.
Cyberattacks worldwide has already taken a toll to several countries' operation 
of Cl - such as water, electricity, banking and financial networks, telecommunications, 
and other networks. In 2020, a cyber-attack in a German hospital caused disruption 
in the operations of its emergency facility - triggering the death of a patient being
1 Social media, internet craze keep PH on top 2 of world list (April 29, 2022). Data accessed on 22 
November 2022, from https: // r'lewsinfo.inoi rirer. net/1 S89845/social-media-internet-craze-keep-ph-on- 
top-Z of world- list.ix2z7alh02QMW


transported to another hospital 32 kilometers away which resulted to her death2. Just 
last year in Ukraine, the war shifted to cyberspace as their government and critical 
infrastructure were bombarded with cyber-attacks. Since cyber criminals are 
increasingly targeting critical information infrastructure (CII), it is said that in the years 
to come, cyberspace will inevitably be exploited more by criminals, terrorists, and even 
governments to push their agenda3.
Cyberattacks on Cl evidently opens debilitating effects on national security, 
health and safety, and economy of any country. Admittedly, the Philippines lacks a 
national policy directive requiring Cl agencies to comply with standards, adopt 
measures to ensure information security of ICT networks and systems.
Owing to this unfortunate risks exposure, it is but urgent for Congress to pass 
a law that comprehensively adopts and implements minimum information security 
standards to improve risk management and effectively protect the confidentiality, 
integrity, and availability of information that is vital to our nation.
This proposed measure seeks to safeguard the cybersecurity of CII primarily 
through the adoption of minimum information security standards, and adherence to 
globally accepted best practices for cybersecurity. Moreover, this bill addresses our 
country's need for a national policy framework for the protection of digital assets, 
especially CII, against serious cyberthreats. The same move is considered crucial to 
the Philippines' continued digitalization and growing digital economy.
In view of the foregoing, the immediate approval of this bill is earnestly 
requested.
RAMOr^ONG REVILLA, JR. ,
n
2 Cybersecurity standards and a country's cyber resilience (July 13, 2022). Data accessed on 28 
November 2022, from ?!itps://mb.corn.p;i/zO./A,u/i/i.j/;:ybersecunt:y sianc;ciru,> dna-d-coui^i.rvrrcyDer- 
resiiience/
3 Ibid.


NINETEENTH CONGRESS OF THE 
REPUBLIC OF THE PHILIPPINES 
First Regular Session
SENATE 
S. No.
Senate
23 FEB 27 P2:10
Rb'CEIV/CO Bv
Introduced by SENATOR RAMON BONG REVILLA, JR.
AN ACT
REQUIRING CRITICAL INFORMATION INFRASTRUCTURE INSTITUTIONS 
TO ADOPT AND IMPLEMENT ADEQUATE MEASURES TO PROTECT THEIR 
INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) SYSTEMS AND 
INFRASTRUCTURE
Be it enacted by the Senate and House of Representatives of the Philippines in 
Congress assembled.
1 
Section 1. Title. - This Act shall be known as the "Critical Information
2 
Infrastructure Protection Act of2023."
3 
Sec. 2. Declaration of Policy. - The growth of information computer technology
4 
is accompanied by new and serious threats and, as such, the state recognizes as vitally
5 
important the establishment of a more secure cyberspace and a data protection
6 
regime that is compliant with international standards and ensures the free flow of
7 
information.
8 
It Is the policy of the State to protect Critical Information Infrastructure C'CII")
9 
from cyberattacks and threats, data manipulation, cybercrimes, and activities of
10 
malicious actors. The State recognizes that the protection of computers, networks,
11 
electronic devices, and digital assets, including information, is a common objective
12 
and requires the combined efforts of the public and private sectors, and cooperation
13 
with local and international actors, in order to minimize the impact of, if not prevent,
14 
cyberattacks, threats, and risks on the nation's security and socio-economic well-
15 
being.


3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
31
32
Further, the adoption and implementation of minimum information security 
stdiidards is a ylobally accepted best pfactice to pr ovide guidance, whicii would lead 
to more efficient use of resources, improved risk management, consistent deiivery of 
criticai and essential services, and effective protection of the confidentiaiity, integrity, 
and availability of information that is vital to the nation.
Sec. 3. Definition. - For the purpose of this Act and for the implementation of 
the policy contained herein, the following definitions shall apply:
a. "Critical infrastructure" refers to extremely vital assets, systems, and 
networks, witeltter ptiySicai or virtuai, wlriclr deslfUCtiOrl Or disruptiOrr would 
have a debilitating impact on national security, health and safety, or 
economic well-being of citizens, or any combination thereof.
b. "Critical Information Infrastructure (CQ)" refers to computer systems, 
information and communications technology (ICT) networks, and digital 
assets that are necessary for the continuous operation and delivery of the 
critical infrastructure services of the country.
L. tiibuiuuuii iciefb Lu d yuveiiiiiieiii dyeiicy ur d piivdit^ Lumpdiiy umi 
owns, operates, controls, and/or maintains critical information 
infrastructure, and whose operation is nationwide in scope and/or covers 
metropolitan centers, including Metro Manila, .Metro Cebu, Metro Davao, 
and, by 2025, Metro Cagayan de Oro, or as defined and updated by the 
National Economic Development Authority (NEDA) or the Philippine 
Statistics Authority (PSA).
. curitpuler ciiit:iyuiiLy KUbpuiibu ludiii ur v>ct\.t reiurb lu dii urydui/iduun 
that studies computer and network security in order to;
i. 
provide incident response services to victims of attacks;
ii. 
publish alerts concerning vulnerabilities and threats, and;
iii. 
offer other information that aids in the improvement of computer and 
network security.
e. "Information security" refers to the preservation of the confidentiality, 
inteytity, and dvdilability of infoirriduon. Tliis may also Involve otlier 
properties, such as authenticity, accountability, non-repudiation, and 
reliability of information.


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
31
f. "Information security incident" refers to an occurrence that actually or 
pOieilUally jeopdtuizes tlie CoririCleiiLidiily, irileyrily, or dVdildbiliLy Of dfl 
information system or the information the system processes, stores, or 
transmits or that constitutes a violation or imminent threat of violation of 
security policies, security procedures, or acceptable use policies.
g. "Information system" refers to applications, services, information 
technology assets, or any component handling information.
h. "International Electrotechnical Commission" or "lEC" refers to international 
standards Ural are essential for quality arid risk rnanagement, wliich lielp
researchers understand the value of innovation and allow manufacturers to 
produce products of consistent quality and performance.
i. "International Organization for Standardization" or "ISO" refers to an 
independent, non-governmental organization that develops and publishes 
international standards to ensure the quality, safety and efficiency of 
products, services and systems.
4^___ .< 
/*' ................ ...................... c 
___5 T__^_______ 4.:____ t.._£________~4..___________ -r*;- : _ 
- ______
oec. n. v^uveidye ui ^iiuLcn iiiiuitiicaiun iiiiidbuuLLUit:. — iiiib mll cuveib uii,
whether in the public or private sector, in industries including, but not limited to:
a. Government and Emergency Services;
b. Business Process Outsourcing;
c. 
Healthcare;
d. 
Media;
e. 
Banking
f. 
Fiudiicidi,
g. Energy;
h. Water;
I. Telecommunications;
j. 
Transport and logistics.
An entity, whether public or private, that owns, operates, and maintains CII in 
tlie inuusti ies menuoneu above, and as updated by tlie Depaitment of Infoi rnation 
and Communications Technology (DICTO, shall be covered by this Act.


1 
The DICr shall institute a consultation process to update the definition of a CII,
2 
the list of CII institutions, and the sector or industry covered as CII every three (3)
3 
years from the effectivity of this Act.
4 
Sec. 5. Adoption of Minimum Information Security Standards. - All covered QI
5 
institutions shall adopt and implement adequate measures to protect their ICT systems
6 
and infrastructure, and respond to and recover from any information security incident,
7 
in compliance with existing laws, rules and regulations. These covered institutions
8 
shall be required to:
9 
a. adopt the Code of Practice stipulated in the following:
10 
i. Philippine National Standard (PNS) on ISO/IEC 27001 Information
11 
Security Management System (ISMS) series of standards;
12 
ii. PNS ISO 22301 Security and Resilience - Business Continuity
13 
Management Systems (BCMS); and
14 
Hi. ISO/IEC 27701 Privacy Information Management Systems, as
15 
applicable; or
16 
iv. the latest standards adopted as PNS.
17 
b. submit to the DICT a copy of their formal certification as proof of adoption
18 
of the PNS ISO/IEC 27000 series of standards, PNS ISO 22301, and ISO/IEC
19 
27701, as applicable; and
20 
c. ensure that their certificates are up-to-date and shall submit the latest
21 
annual audit confirmation to the DICT.
22 
In lieu of the submission of formal certification above, covered CII institutions
23 
shall subject themselves to an annual information security self-assessment using
24 
standards, such as but not limited to, the Center for Internet Security (CIS) Controls
25 
or the National Institute of Standards and Technology (NIST) Special Publication (SP)
26 
800-53, during the first quarter of each year. The concerned institution shall submit
27 
this self-declaration and attest to its validity to the DICT on or before the last day of
28 
March. The self-declaration shall be signed off by the respective head of the
29 
department directly in charge of the agency's information security systems.
30 
Each CII institution shall adopt programs, guidelines, and written procedures
31 
for the implementation of its chosen information security standard, which shall be
32 
included in their annual submission.
4


1 
The DICT shall have the authority to determine and update information security
2 
standards, and require CII institutions to comply with such standards, as it deems It
3 
necessary and appropriate.
4 
Nothing in this Act shall prevent a government agency or a sector regulator
5 
from imposing additional or more stringent information security standards for
6 
compliance by industry players under Its jurisdiction, as it deems necessary.
7 
Sec. 6. National Computer Emergency Response Team (NCERT) as the
8 
Centralized Information Security Incident Reporting Mechanism. - All covered CII
9 
Institutions shall:
10 
a. Report all information security incidents affecting their institutions to the
11 
NCERT of the DICT, which shall be the central authority for all Sectoral and
12 
Organizational CERTs in the country;
13 
b. Submit an information security incident detection report to the NCERT
14 
within twenty-four (24) hours upon detection of the incident(s). The report
15 
shall contain basic information about the incident, such as:
16 
i. 
date when the incident was first detected;
17 
ii. 
nature of the information security incident;
18 
iii. 
possible business processes and functions compromised; and
19 
iv. 
agency's initial response and next steps.
20 
c. Submit an incident progress report, upon request of the NCERT, in order to
21 
help assess and provide the necessary support in responding to an incident;
22 
d. Submit a post-incident report., which contains the following information: (i)
23 
magnitude of business operations compromised, (ii) risk assessment, and
24 
(iii) the agency's response. They shall also provide the necessary additional
25 
information about the incident, as requested by the NCERT;
26 
e. Compile on an annual basis a summary of all information security incident
27 
reports and submit an annual report to the DICT Cybersecurity Bureau every
28 
30th of June;
29 
f. Comply with the reporting mechanism and template prescribed by the DICT,
30 
in the submission of all the reporting requirements described above:
31 
Provided, That information-sharing shall be done using established


1 
communication protocol, using at the minimum, the Traffic Light Protocol
2 
(TLP) as established by the DICT MC 2017-005 or succeeding policies;
3 
g. Participate in activities that help promote awareness, capacity-building, and
4 
improve an organization's information security readiness, protection, and
5 
incident response capabilities, such as but not limited to, cyber drills.
6 
Sec. 7. Designation of Personnel with Information Security Credentials. - All
7 
government agencies shall have at least one personnel with sufficient information
8 
security training and credentials. Such personnel shall, preferably, hold at least
9 
Division Chief plantifla position or any other position of equivalent rank, and perform
10 
decision making or management functions. The DICT shall identify and release a list
11 
of credentials that meet this requirement. Such personnel shall be the point person
12 
for (i) compliance with prescribed standards, (ii) building information security
13 
capability within the agency, and (iii) compliance with the reporting requirements of
14 
the agency and NCERT.
15 
Section 8. Compliance by all covered QI Institutions. -
16 
a. Government compliance - The Department of Budget and Management
17 
(DBM) shall review the submission by a CII Institution to the DICT of a
18 
formal certification or self-declaration of compliance with any of the
19 
prescribed information security standards, whichever submission applies, as
20 
a prerequisite to budgetary approval. A government institution or sector
21 
regulator, which itself operates or has jurisdiction over CII, shall comply
22 
with the requirements set forth in this Act.
23 
b. Non-government or private company compliance-Compliance with this Act,
24 
specifically of Sections 5 and 6, shall be a prerequisite for the granting of
25 
any regulatory approval, permit, and/or license to a private company
26 
covered under Section 4 of this Act.
27 
Sec. 9. Implementing Agency. - The DICT, through its Cybersecurity Bureau,
28 
shall be the implementing agency of this Act, in accordance with the National
29 
Cybersecurity Plan and relevant DICT policies. The DICT shall:
30 
a. Create and maintain a database of all certifications, self-declaration, and
31 
attestations of all covered CII institutions;


1 
b. Prescribe minimum information security standards for compliance by all CII
2 
institutions;
3 
c. Serve as the custodian for information security standards and incident
4 
reports;
5 
d. Collect and analyze all pertinent information about an information security
6 
incident, and provide to government institutions, sectoral CERTs, and to the
7 
public, a technical report of information security incidents for purposes of
8 
policy, regulation, and providing guidance to all stakeholders on local
9 
information security Issues;
10 
e. Prescribe a mechanism and template for the reporting of information
11 
security incidents to the NCERT; and
12 
f. Institute a consultation process and hold consultations to update the
13 
coverage and definition of QI, minimum information security standards, and
14 
recognize individual information security certifications every three (3) years
15 
from the effectivity of this Act.
16 
Sec. 10. Responsibilities of the Department Heads and Sector Regulators with
17 
jurisdiction over CII Institutions. - The heads of departments and sector regulators
18 
who have a mandate over covered CII Institutions, including Sectoral CERT Leads as
19 
identified in DICT Department Circular 003-2020, in coordination with the DICT, shall
20 
be responsible for issuing the necessary policy and regulation that promote
21 
information security and require compliance of CII institutions to the prevailing
22 
standards to ensure information security and business continuity.
23 
Sec. 11. Administrative Liability. - The respective heads of departments,
24 
agencies, bureaus, offices, government-owned and controlled corporations (GOCCs)
25 
and government financial institutions (GFIs), and State Colleges and Universities
26 
(SUCs) shall be administratively liable for non-compliance with this Act pursuant to
27 
existing laws, rules, and regulations.
28 
Sec. 12. Funding. - The initial funding requirements for the implementation of
29 
this Act shall be charged against the existing budget of the covered CII institutions
30 
and such other appropriate funding sources as the DBM may identify, subject to
31 
relevant laws, rules, and regulations.


1 
Sec. 13. Penalty. - Non-compliance with the provisions of this Act, whether or
2 
not it results in data loss, breaches, hacking, or similar incidents, may result in
3 
administrative, civil, or criminal liability under applicable laws, including but not limited
4 
to. Republic Act No. 10175, also known as the "Cybercrime Prevention Act of 2012",
5 
and Republic Act No. 10173, or the "Data Privacy Act of 2012'.
6 
Sec. 14. Annual Report. - Every 30th of April of every year, the DICT shall report
7 
to the Office of the President the status of the implementation of this Act.
8 
Sec. 15. Separability Clause. - If any provision of this Act is declared invalid or
9 
unconsbtubonal, the remaining provisions not affected thereby shall continue to be in
10 
full force and effect.
11 
Sec. 16. Repealing Clause. - All laws, rules, and regulations inconsistent with
12 
this Act are hereby repealed or modified accordingly.
13 
Sec. 17. Effectivity. -This Act shall take effect fifteen (15) days following the
14 
completion of its publication either in the Official Gazette or in two (2) newspapers of
15 
general circulation in the Philippines.
Approved,
8