\-SSr/7t2E)Ki£p oi U)f
NINETEENTH CONGRESS OF THE 
REPUBLIC OF THE PHILIPPINES 
First Regular Session
SENATE
S.B. No. 2066
23 ftBRU P5 •
RIXEIVEDBV:
Introduced by SEN. WIN GATCHALIAN
AN ACT
REQUIRING CRITICAL INFORMATION INFRASTRUCTURE INSTITUTIONS 
TO ADOPT AND IMPLEMENT ADEQUATE MEASURES TO PROTECT THEIR 
INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) SYSTEMS
AND INFRASTRUCTURE
EXPLANATORY NOTE
More and more Filipino individuais and businesses rely on and increase their use 
of digital technologies, including the internet, to perform their daily tasks, especially 
during the COVID-19 pandemic. The pandemic has no doubt rapidly accelerated the 
country's digital transformation and digital economy.
On average, Filipinos are estimated to use and consume 4.3 more digital services 
compared to pre-pandemic years and 95% of these pandemic consumers remain to be 
consumers today. Digital merchants are also getting tech-sawy as digital platforms, 
digital financial services and digital tools helped them survived the pandemic.1 E- 
commerce also grew significantly, and sales are expected to be valued at US$10.3 billion
1 Google, Temasek, & Bain & Company (2021). e-Conomy SEA 2021: Roaring 20s; The SEA digital divide. 
https://services.google.com/fh/files/misc/philippines_e_conomy_sea_2021_report.pdf


by 2025.2 Further, 53% of adult Filipinos were reported by the Bangko Sentral ng Pilipinas 
to have electronic money accounts in 2021, higher than 29% in 2019.3 Online education 
and remote work are also here to stay.4
With the increased use of digital technologies in our daily lives, malicious actors— 
from casual scammers to highly sophisticated state-backed groups—hunt for 
vulnerabilities in ICT systems and networks to steal information, disrupt essential 
services, and profit from attacks. Hence, it is critically important to ensure that the 
Philippines has a national policy framework for the protection of digital assets, especially 
critical information infrastructure (CII), against threats that could paralyze our economy 
and affect the wellbeing of Filipinos.
It is high time that we take the necessary steps to protect our CIIs by ensuring, 
at the minimum, compliance with international standards and globally accepted best 
practices for cybersecurity.
Thus, this measure seeks to protect the cybersecurity of CII by requiring the: (i) 
adoption of minimum information security standards, (ii) creation of a computer 
emergency response team and reporting of cybersecurity incidents, and (iii) development 
of a capable pool of cybersecurity professionals and practitioners that will be critical to 
the effective implementation of cybersecurity policy, rules, and standards. Simply put, 
this measure will provide a framework for ensuring the security and reliability of the
2 GlobalData (9 Dec 2021). Online shopping and rising internet penetration to lead Philippines e-commerce 
at 17% CAGR through 2025, forecasts GlobalData. https://www.globaldata.com/online-shopping-rising- 
internet-penetration-lead-philippines-e-commerce-17-cagr-2025-forecasts-globaldata/
3 Villanueva, J. (24 Jan 2022). PH digital transactions to grow despite challenges: BSP chief 
https://www.pna.gov.ph/articles/1166236; GCash alone grew 200% between 2020 and May 2022, now 
boasting 60 million users. See Cueto, F.E. (25 May 2022). Gcash claims 60 million users in PH. 
https://www.manilatimes.net/2022/05/25/business/top-business/gcash-claims-60-million-users-in- 
ph/1844877
4 World Bank (2020). Building a resilient recovery. Philippines Economic Update: December 2020 edition. 
https://openknowledge.worldbank.org/bitstream/handle/10986/34899/Philippines-Economic-Update- 
Building-a-Resilient-Recovery.pdf


1 ‘
country's digital ecosystem, which is crucial to the country's continued digitalization and 
growing digital economy.
As a necessary step to improving Philippine cybersecurity, the passage of this bill 
is earnestly sought for the security and well-being of all Filipinos^
IN GATCHALIAN


NINETEENTH CONGRESS OF THE 
REPUBLIC OF THE PHILIPPINES 
First Regular Session
SENATE
S.B. No. 2066
0cnau'
k^Pj1 
♦!..»&><‘i-r
23 ABR12 P5:11
WtCElVEO BV; /
Introduced by SEN. WIN GATCHALIAN
AN ACT
REQUIRING CRITICAL INFORMATION INFRASTRUCTURE INSTITUTIONS TO 
ADOPT AND IMPLEMENT ADEQUATE MEASURES TO PROTECT THEIR 
INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) SYSTEMS AND 
INFRASTRUCTURE
Be it enacted by the Senate and House of Representatives of the Phiiippines in Congress 
assembied:
1 
SECTION 1. Tide. - This Act shall be known as the xyCriticai Information
2 
Infrastructure Protection Act of2022."
3
4 
SEC. 2. Deciaration of Poiicy. - The State recognizes the vital role of information
5 
and communications technology in nation building. With the growth of information
6 
computer technology (ICT), new and serious threats arising from Its use and our reliance
7 
on it in our daily lives surface and, as such, the State recognizes as vitally important the
8 
establishment of a more secure cyberspace and a data protection regime that is compliant
9 
with international standards and ensures the free flow of information.
10 
It is hereby declared the policy of the State to protect Critical Information
11 
Infrastructure ("CII") from cyberattacks and threats, data manipulation, cybercrimes, and


3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
1 
activities of malicious actors. The State recognizes that the protection of computers,
2 
networks, electronic devices, and digital assets, including information, is a common 
objective and requires the combined efforts of the public and private sectors, and 
cooperation with local and international actors, in order to minimize the impact of, if not 
prevent, cyberattacks, threats, and risks on the nation's security and socio-economic well­
being.
Further, the adoption and implementation of minimum information security 
standards is a globally accepted best practice to provide guidance, which would lead to 
more efficient use of resources, improved risk management, consistent delivery of critical 
and essential services, and effective protection of the confidentiality, integrity, and 
availability of information that is vital to the nation.
SEC. 3. Definition. - For the purpose of this Act and for the implementation of the 
policy contained herein, the following definitions shall apply:
a. ""Criticai infrastructurd' refers to assets, systems, and networks, whether 
physical or virtual, that are considered so vital that their destruction or 
disruption would have a debilitating impact on national security, health and 
safety, or economic well-being of citizens, or any combination thereof.
b. ''Criticai Information Infrastructure (CII)" refers to computer systems, ICT 
information and communications technology (ICT) networks, and digital assets 
that are necessary for the continuous operation and delivery of the country's 
critical infrastructure services.
c. "CIIinstitutioif refers to a government agency or a private company that owns, 
operates, controls, and/or maintains critical information infrastructure, and 
whose operation is nationwide in scope and/or covers metropolitan centers, 
including Metro Manila, Metro Cebu, Metro Davao, and, by 2025, Metro 
Cagayan de Oro, or as defined and updated by the National Economic 
Development Authority (NEDA) or the Philippine Statistics Authority (PSA).


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28 
29
e.
d. '"Computer Emergency Response Team" or "CERT refers to an organization 
that studies computer and network security in order to provide incident 
response services to victims of attacks, publish alerts concerning vulnerabilities 
and threats, and to offer other information to help improve computer and 
network security.
Information security' refers to the preservation of the confidentiality, integrity, 
and availability of information. This may also involve other properties, such as 
authenticity, accountability, non-repudiation, and reliability of information.
f. "Information security incident' refers to an occurrence that actually or 
potentially jeopardizes the confidentiality, integrity, or availability of an 
information system or the information the system processes, stores, or 
transmits or that constitutes a violation or imminent threat of violation of 
security policies, security procedures, or acceptable use policies.
g. "Information systenf refers to applications, services, information technology 
assets, or any component handling information.
SEC. 4. Coverage of Criticai Information Infrastructure. - This Act covers CII, 
whether in the public or private sector, in industries including, but not limited to:
a. 
Banking and finance;
b. 
Broadcast media;
c. 
Emergency services and disaster response;
d. 
Energy;
e. 
Health;
f. 
Telecommunications;
g. Transportation (land, sea, air); and
h. Water.
An entity, whether public or private, that owns, operates, and maintains CII in the 
industries mentioned above, and as updated by the Department of Information and 
Communications Technology (DICT), shall be covered by this Act.


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26 
27
The DICT shall institute a consultation process to update the definition of a CII, 
the list of CII institutions, and the sector or industry covered as CII every three (3) years 
from the effectivity of this Act.
SEC. 5. Adoption of Minimum Information Security Standards. - All covered CII 
institutions shall adopt and implement adequate measures to protect their ICT systems 
and infrastructure, and respond to and recover from any information security incident, in 
compliance with existing laws, rules and regulations.
They are required to:
a. adopt the Code of Practice stipulated in the Philippine National Standard (PNS) 
on ISO/IEC27001 Information Security Management System (ISMS) (series of 
standards) and PNS ISO 22301 Security and resilience - Business continuity 
management systems (BCMS). They shall also adopt the ISO/IEC27701 Privacy 
Information Management Systems, as applicable;
b. submit to the DICT a copy of their formal certification as proof of adoption of 
the PNS ISO/IEC 27000 (series of standards), PNS ISO 22301, and ISO/IEC 
27701, as applicable; and
c. ensure that their certificates are up-to-date and shall submit the latest annual 
audit confirmation to the DICT.
In lieu of the submission of formal certification above, covered CII institutions shall 
subject themselves to an annual information security self-assessment using standards, 
such as but not limited to, the Center for Internet Security (CIS) Controls or the National 
Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, during the 
first quarter of each year. The concerned institution shall submit this self-declaration and 
attest to its validity to the DICT on or before the 31st of March. The self-declaration shall 
be signed off by the respective head of the department directly in charge of the agency's 
information security systems.


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
Each CII institution shall adopt programs, guidelines, and written procedures for 
the implementation of its chosen information security standard, which shall be included 
in their annual submission.
The DICT shall have the authority to determine and update information security 
standards, and require CII institutions to comply with such standards, as it deems it 
necessary and appropriate.
Nothing in this Act shall prevent a government agency or a sector regulator from 
imposing additional or more stringent information security standards for compliance by 
industry players under its jurisdiction, as it deems necessary.
SEC. 6. National Computer Emergency Response Team CNCERV) as the 
Centralized Information Security Incident Reporting Mechanism. - All covered CII 
Institutions shall:
a. Report all information security incidents affecting their Institutions to the DICT's 
Philippine National Computer Emergency Response Team, which shall be the 
central authority for all Sectoral and Organizational CERTs in the country;
b. Submit an information security incident detection report to the NCERT within 
twenty-four (24) hours upon detection of the incident(s). The report shall 
contain basic information about the incident, such as: (1) date when the 
incident was first detected, (ii) nature of the information security incident, (Hi) 
possible business processes and functions compromised, and (iv) agency's 
initial response and next steps;
c. Submit an incident progress report, upon request of the NCERT, in order to 
help assess and provide the necessary support in responding to an incident;
d. Submit a post-incident report, which contains the following information: (i) 
magnitude of business operations compromised, (ii) risk assessment, and (Hi) 
the agency's response. They shall also provide the necessary additional 
information about the incident, as requested by the NCERT;


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
e. Compile on an annual basis a summary of all information security incident 
reports and submit an annual report to the DICT Cybersecurity Bureau every 
30th of June;
f. Comply with the reporting mechanism and template prescribed by the DICT, in 
the submission of all the reporting requirements described above: Provided, 
that information-sharing shall be done using established communication 
protocol, using at the minimum, the Traffic Light Protocol (TLP) as established 
by the DICT MC 2017-005 or succeeding policies.
g. Participate in activities that help promote awareness, capacity building, and 
improve an organization's information security readiness, protection, and 
incident response capabilities, such as but not limited to cyber drills.
SEC. 7. Designation of Personnei with Information Security Credentiais. - All 
government agencies shall have at least one personnel with sufficient information security 
training and credentials. Such personnel shall, preferably, hold at least Division Chief 
plantilla position (or equivalent) and perform decision making or management functions. 
The DICT shall identify and release a list of credentials that meet this requirement. Such 
personnel shall be the point person for (i) compliance with prescribed standards, (ii) 
building information security capability within the agency, and (iii) compliance with the 
agency's and NCERT's reporting requirements.
SEC. 8. Compiiance by aii covered CIIInstitutions.
a. 
Government compliance. - The Department of Budget and Management (DBM) 
shall review the submission by a CII Institution to the DICT of a formal certification or 
self-declaration of compliance with any of the prescribed information security standards, 
whichever submission applies, as a prerequisite to budgetary approval. A government 
institution or sector regulator, which itself operates or has jurisdiction over CII, shall 
comply with the requirements set forth in this Act.
b. 
Non-government or private company compliance. - Compliance with this Act, 
specifically of Sections 5 (standards) and 6 (reporting), shall be a prerequisite for the


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26
27
28
29
30
granting of any regulatory approval, permit, and/or license to a private company covered 
under Section 4 of this Act.
SEC. 9. Implementing Agency. - The DICT, through its Cybersecurity Bureau, shall 
be the implementing agency of this Act, in accordance with the National Cybersecurity 
Plan and relevant DICT policies. The DICT shall:
a. create and maintain a database of all certifications, self-declaration, and 
attestations of all covered CII institutions;
b. prescribe minimum information security standards for compliance by all CII 
institutions;
c. serve as the custodian for information security standards and incident reports;
d. collect and analyze all pertinent information about an Information security 
incident, and provide to government institutions, sectoral CERTs, and to the 
public a technical report of information security incidents for purposes of policy, 
regulation, and providing guidance to all stakeholders on local information 
security issues;
e. prescribe a mechanism and template for the reporting of information security 
incidents to the NCERT; and
f. institute a consultation process and hold consultations to update the coverage 
and definition of CII, minimum information security standards, and recognize 
individual information security certifications every three (3) years from the 
effect!vity of this Act.
SEC. 10. - Responsibilities of the Department Heads and Sector Regulators with 
Jurisdiction over CII Institutions. - The heads of departments and sector regulators who 
have a mandate over covered CII Institutions, including Sectoral CERT Leads as identified 
in DICT DC 003-2020, in coordination with the DICT, shall be responsible for issuing the 
necessary policy and regulation that promote information security and require compliance 
of CII institutions to the prevailing standards to ensure information security and business 
continuity.


1
2
3
4
5
6
7
8 
9
10
11
12
13
14
15
16
17
18
19
20 
21 
22
23
24
25
26 
27
SEC. 11. Administrative Liability. - The respective heads of departments, agencies, 
bureaus, offices, GOCCs, GFIs, and SUCs shall be administratively liable for non- 
compliance with this Act pursuant to existing laws, rules, and regulations.
SEC. 12. Funding. - The initial funding requirements for the implementation of this 
Act shall be charged against the existing budget of the covered CII institutions and such 
other appropriate funding sources as the DBM may identify, subject to relevant laws, 
rules, and regulations.
SEC. 13. Penalty. - Non-compliance with the provisions of this Act, whether or not 
it results in data loss, breaches, hacking, or similar incidents, may result in administrative, 
civil, or criminal liability under applicable laws, including but not limited to Republic Act 
No. 10175 also known as the Cybercrime Prevention Act of 2012 and Republic Act No. 
10173 or the Data Privacy Act of 2012.
SEC. 14. Annual Report. - Every 30th of April of every year, the DICT shall report 
to the Office of the President the status of the implementation of this Act.
Sec. 15. Separability Clause. - If any provision of this Act is declared invalid or 
unconstitutional, the remaining provisions not affected thereby shall continue to be in full 
force and effect.
SEC. 16. Repealing Clause. - All laws, rules, and regulations inconsistent with this 
Act are hereby repealed or modified accordingly.
SEC. 17. Effectivity. - This Act shall take effect fifteen (15) days following the 
completion of its publication in two (2) newspapers of general circulation.
Approved,