Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City

Nineteenth Congress
First Regular Session

~~ 6923

House Bill No.

Introduced by Representative JOEY SARTE SALCEDA

AN ACT
REQUIRING CRITICAL INFORMATION INFRASTRUCTURE INSTITUTIONS
TO ADOPT AND IMPLEMENT ADEQUATE MEASURES TO PROTECT THEIR
INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT)
SYSTEMS AND INFRASTRUCTURE

EXPLANATORY NOTE

The COVID-19 pandemic accelerated the country’s digital transformation and digital
economy. Filipinos now use 4.3 more new digital services on average compared to pre-pandemic
years. E-commerce grew significantly, and sales are expected to be valued at US$10.3 billion by
2025.? The Bangko Sentral ng Pilipinas reported that 53% of adult Filipinos had electronic money
accounts in 2021, up from 29% in 2019.3 According to the World Bank’s assessment. online
education and remote work are here to stay.*

Increased use of digital technologies, especially the Internet, is accompanied by
cyberthreats and risks. Malicious actors — from casual scammers to highly sophisticated state-
backed groups — hunt for vulnerabilities in ICT systems and networks to steal information, disrupt
essential services, and profit from attacks. Hence, it is critically important to ensure that the
Philippines has a national policy framework for the protection of digital assets, especially critical
information infrastructure (Cll), against threats that could paralyze our economy and affect the
wellbeing of Filipinos,

The Philippine National Cyber Security Plan 2022 highlighted the goal of “assuring the
continuous operation of the nation’s critical information infrastructure.” These digital systems
underpin the operation of critical infrastructure, such as water, electricity, banking and financial
networks, telecommunications, and other networks vital to the operation of the country.

2 Google, Temasek, & Bain & Company (2021). e-Conomy SEA 2021: Roaring 20s: The SEA digit divide.
hitps//services noople.com/fh/ies/misc/philppines economy sea 2021 report. pdf

? GlobalData (9 Dec 202). Online shopping and rising internet penetration to lead Phipps e-commerce at 17% CAGR through 2025,
{forecasts GlobolDota. httos://www.plobaldata.com/online-shopping-rsing:internet-penetration-lead-philppines-e-commerce-17-cagr-2025.
forecasts-globaldata

‘Gcash alone grew 200% between 2020 and May 2022, now boasting 60 milion users. See Cueto, FE (25 May 2022). Gcash claims 60 milion
users in PH. htte://on maniatimes ne\/2022/05/25/ousiness/top-business/gcash:claims-60-milion-users-in-ph/ 1844877

‘World Bank (2020). Building a resilient recovery. Phillpines Economic Update: December 2020 edition.
hitos//openknowledze worldbank org/bitstream/handie/10986/32899/Philippines-Economic-Update- Building 9-Resiient-Recovery pail

Page |1


In light of these risks, it is high time to ensure the protection of Clls by ensuring, at the
minimum, compliance with international standards and globally accepted best practices for
cybersecurity.

‘As a proactive and institutionally cohesive response, this bill aims to protect the
cybersecurity of CII by requiring the: (i) adoption of minimum information security standards, (ii)
creation of a computer emergency response team and reporting of cybersecurity incidents, and
(iii) development of a capable pool of cybersecurity professionals and practitioners that will be
critical to the effective implementation of cybersecurity policy, rules, and standards.

If passed, the Critical Information Infrastructure Protection Act will provide a framework
for ensuring the security and reliability of the country’s digital ecosystem, which is crucial to the
country’s continued digitalization and growing digital economy. As a necessary step to improving
Philippine cybersecurity, the passage of this bill is earnestly sought for the security and well-being
ofall Filipinos.

In view of the foregoing, the immediate passage of this bill i iestly sought.

Page | 2


Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City

Nineteenth Congress
First Regular Session

“77> 6923

House Bill No.

Introduced by Representative JOEY SARTE SALCEDA

AN ACT
REQUIRING CRITICAL INFORMATION INFRASTRUCTURE INSTITUTIONS
TO ADOPT AND IMPLEMENT ADEQUATE MEASURES TO PROTECT THEIR
INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT)
SYSTEMS AND INFRASTRUCTURE

Be it enacted by the Senate and House of Representatives of the Philippines in Congress
assembled:

SECTION 1. Short Title.—This Act shall be known as “Critical Information Infrastructure
Protection Act.”

SEC. 2. Declaration of Policy. ~ The growth of information computer technology is
accompanied by new and serious threats and, as such, the state recognizes as vitally important the
establishment of a more secure cyberspace and a data protection regime that is compliant with
intemational standards and ensures the free flow of information.

It is the policy of the State to protect Critical Information Infrastructure (“CII”) from
cyberattacks and threats, data manipulation, cybercrimes, and activities of malicious actors. The
State recognizes that the protection of computers, networks, electronic devices, and digital assets,
including information, is a common objective and requires the combined efforts of the public and
private sectors, and cooperation with local and international actors, in order to minimize the
impact of, if not prevent, cyberattacks, threats, and risks on the nation’s security and socio-
economic well-being.

Further, the adoption and implementation of minimum information security standards is a
globally accepted best practice to provide guidance, which would lead to more efficient use of
resources, improved risk management, consistent delivery of critical and essential services, and
effective protection of the confidentiality, integrity, and availability of information that is vital to
the nation.

SEC. 3. Definition. — For the purpose of this Act and for the implementation of the policy
contain herein, the following definitions shall apply:

(a) Critical infrastructure, refers to assets, systems, and networks, whether physical or
virtual, that are considered so vital that their destruction or disruption would have a debilitating

Page | 1


impact on national security, health and safety, or economic well-being of citizens, or any
combination thereof.

(b) Critical Information Infrastructure (Cll), refers to computer systems, ICT information
and communications technology (ICT) networks, and digital assets that are necessary for the
continuous operation and delivery of the country’s critical infrastructure services.

(©) Cll institution, refers to a government agency or a private company that owns, operates,
controls, and/or maintains critical information infrastructure, and whose operation is nationwide
in scope and/or covers metropolitan centers, including Metro Manila, Metro Cebu, Metro Davao,
and, by 2025, Metro Cagayan de Oro, or as defined and updated by the National Economic
Development Authority (NEDA) or the Philippine Statistics Authority (PSA).

(@) Computer Emergency Response Team or CERT, refers to an organization that studies
computer and network security in order to provide incident response services to victims of attacks,

publish alerts concerning vulnerabilities and threats, and to offer other information to help
improve computer and network security.

(e) Information security, refers to the preservation of the confidentiality, integrity, and
availability of information. This may also involve other properties, such as authenticity,
accountability, non-repudiation, and reliability of information.

() Information security incident, refers to an occurrence that actually or potentially
jeopardizes the confidentiality, integrity, or availability of an information system or the
information the system processes, stores, or transmits or that constitutes a violation or imminent
threat of violation of security policies, security procedures, or acceptable use policies.

(g) Information system, refers to applications, services, information technology assets, or
any component handling information.

SEC. 4. Coverage of Critical Information Infrastructure. — This Act covers CII, whether
in the public or private sector, in industries including, but not limited to:

(a) Banking and finance:

(b) Broadcast media;

(c) Emergency services and disaster response;
(d) Energy;

(f) Health;

(g) Telecommunications;

(h) Transportation (land, sea, air); and

(® Water.

Page | 2


An entity, whether public or private, that owns, operates, and maintains Cll in the
industries mentioned above, and as updated by the Department of Information and
Communications Technology (DICT), shall be covered by this Act.

The DICT shall institute a consultation process to update the definition of a Cll, the list of

Cll institutions, and the sector or industry covered as CII every three (3) years from the effectivity
of this Act.

SEC. 5. Adoption of Minimum Information Security Standards. - All covered Cll
institutions shall adopt and implement adequate measures to protect their ICT systems and
infrastructure, and respond to and recover from any information security incident, in compliance
with existing laws, rules and regulations.

They are required to:

(a) adopt the Code of Practice stipulated in the Philippine National Standard (PNS) on
ISO/IEC 27001 Information Security Management System (ISMS) (series of standards) and PNS
ISO 22301 Security and resilience — Business continuity management systems (BCMS). They shall
also adopt the ISO/IEC 27701 Privacy Information Management Systems, as applicable;

(b) submit to the DICT a copy of their formal certification as proof of adoption of the PNS
ISO/IEC 27000 (series of standards), PNS ISO 22301, and ISO/IEC 27701, as applicable; and

(c) ensure that their certificates are up-to-date and shall submit the latest annual audit
confirmation to the DICT.

In lieu of the submission of formal certification above, covered CII institutions shall
subject themselves to an annual information security self-assessment using standards, such as but
not limited to, the Center for Internet Security (CIS) Controls or the National Institute of Standards
and Technology (NIST) Special Publication (SP) 800-53, during the first quarter of each year. The
concerned institution shall submit this self-declaration and attest to its validity to the DICT on or
before the 31% of March. The self-declaration shall be signed off by the respective head of the
department directly in charge of the agency’s information security systems.

Each Cll institution shall adopt programs, guidelines, and written procedures for the
implementation of its chosen information security standard, which shall be included in their annual
submission.

The DICT shall have the authority to determine and update information security standards,
and require CI institutions to comply with such standards, as it deems it necessary and
appropriate.

Nothing in this Act shall prevent a government agency or a sector regulator from imposing
additional or more stringent information security standards for compliance by industry players
under its jurisdiction, as it deems necessary.

SEC. 6. National Computer Emergency Response Team (“‘NCERT”) as the Centralized
Information Security Incident Reporting Mechanism. ~ All covered CI Institutions shall:

Page |3


(a) report all information security incidents affecting their institutions to the DICT’s
Philippine National Computer Emergency Response Team, which shall be the central authority
for all Sectoral and Organizational CERTs in the country;

(b) submit an information security incident detection report to the NCERT within twenty-
four (24) hours upon detection of the incident(s). The report shall contain basic information about
the incident, such as: (1) date when the incident was first detected, (ii) nature of the information
security incident, (iii) possible business processes and functions compromised, and (iv) agency's
initial response and next steps:

(c) submit an incident progress report, upon request of the NCERT, in order to help assess
and provide the necessary support in responding to an incident;

(@) submit a post-incident report, which contains the following information: (i) magnitude
of business operations compromised, (ji) risk assessment, and (iii) the agency’s response. They
shall also provide the necessary additional information about the incident, as requested by the
NCERT;

(©) compile on an annual basis a summary of all information security incident reports and
submit an annual report to the DICT Cybersecurity Bureau every 30" of June;

() comply with the reporting mechanism and template prescribed by the DICT, in the
submission of all the reporting requirements described above: Provided, that information-sharing
shall be done using established communication protocol, using at the minimum, the Traffic Light
Protocol (TLP) as established by the DICT MC 2017-005 or succeeding policies; and

(g) participate in activities that help promote awareness, capacity building, and improve
an organization’s information security readiness, protection, and incident response capabilities,
such as but not limited to cyber drills.

SEC. 7. Designation of Personnel with Information Security Credentials. — All government
agencies shall have at least one personnel with sufficient information security training and
credentials. Such personnel shall, preferably, hold at least Division Chief plantilla position (or
equivalent) and perform decision making or management functions. The DICT shall identify and
release a list of credentials that meet this requirement. Such personnel shall be the point person
for (i) compliance with prescribed standards, (ii) building information security capability within
the agency, and (iii) compliance with the agency’s and NCERT’s reporting requirements.

SEC. 8. Compliance by all covered CII Institutions. —

(a) Government compliance: The Department of Budget and Management (DBM) shall
review the submission by a CII Institution to the DICT of a formal certification or self-declaration
of compliance with any of the prescribed information security standards, whichever submission
applies, as a prerequisite to budgetary approval. A government institution or sector regulator,
which itself operates or has jurisdiction over Cl, shall comply with the requirements set forth in
this Act.

(b) Non-government or private company compliance: Compliance with this Act,
specifically of Sections 5 (standards) and 6 (reporting), shall be a prerequisite for the granting of
any regulatory approval, permit, and/or license to a private company covered under Section 4 of
this Act.

Page | 4


SEC. 9. Implementing Agency. ~The DICT, through its Cybersecurity Bureau, shall be the
implementing agency of this Act, in accordance with the National Cybersecurity Plan and relevant
DICT policies. The DICT shall:

(a) create and maintain a database of all certifications, self-declaration, and attestations of
all covered Cll institutions;

(b) prescribe minimum information security standards for compliance by all CII
institutions;

(c) serve as the custodian for information security standards and incident reports;

(d) collect and analyze all pertinent information about an information security incident,
and provide to government institutions, sectoral CERTs, and to the public a technical report of
information security incidents for purposes of policy, regulation, and providing guidance to all
stakeholders on local information security issues;

(e) prescribe a mechanism and template for the reporting of information security incidents
to the NCERT; and

(£) institute a consultation process and hold consultations to update the coverage and
definition of CII, minimum information security standards, and recognize individual information
security certifications every three (3) years from the effectivity of this Act.

SEC. 10. Responsibilities ofthe Department Heads and Sector Regulators with jurisdiction
over CII Institutions, — The heads of departments and sector regulators who have a mandate over
covered CII Institutions, including Sectoral CERT Leads as identified in DICT DC 003-2020, in
coordination with the DICT, shall be responsible for issuing the necessary policy and regulation
that promote information security and require compliance of CII institutions with the prevailing
standards to ensure information security and business continuity.

SEC. 11. Appropriations. ~ The initial funding requirements for the implementation of this
Act shall be charged against the existing budget of the covered CII institutions and such other
appropriate funding sources as the DBM may identify, subject to relevant laws, rules, and
regulations.

SEC. 12. Penalties. - Non-compliance with the provisions of this Act, whether or not it
results in data loss, breaches, hacking, or similar incidents, may result in administrative, civil, or
criminal liability under applicable laws, including but not limited to Republic Act No. 10175 also
known as the Cybercrime Prevention Act of 2012 and Republic Act No. 10173 or the Data Privacy
Act of 2012.

SEC. 13. Annual Report. ~ Every 30" of April of every year, the DICT shall report to the
Office of the President the status of the implementation of this Act.

SEC. 14. Separability Clause. — If any provision of this Act is declared invalid or

unconstitutional, the remaining provisions not affected thereby shall continue to be in full force
and effect.

Page | 5


SEC. 15. Repealing Clause. ~ All laws, rules, and regulations inconsistent with this Act
are hereby repealed or modified accordingly.

SEC. 16. Effectivity. ~ This Act shall take effect fifteen (15) days after its publication in
the Official Gazette or in a newspaper of general circulation.

Approved,

Page |6