'f':" REPUBLIC OT T}"IE PHILIPTINES

*gP&ftTerill'lT *F t r{F*fi l\,{&3**$ &l'JsSt,} ldlMl.J l*l t*&T i *t'$ S ?E* l"t t* *l-* trY

il{EMORANI}UM CINCULAR NO. ., iJ i

F&R

{,,'I

reoM

SUB.TECT :

DATE

aLt cBITrcaL rFrrosrr.ucfil*B{cr} ou$Ens 4NSoPERATOnsT sqvEBNMEIt{T .egEfiCIES' BUS$sssSf,C?OAS AF{D ALL OTHENSC$NCEEFTSD

i, q,

BT}DOI,FO A- SALALII}TASecretary

)

rRsscRIlING Tffi pollcrn& nwns aNI) AEGUI"&TIOi!I$

OI{ Tffi TBOT$CTION OF IH}IVIDUAI.S STTTUT,ATNtrTT

Tm HATTOI{dL CYBEB,SECSHTTY ?r,ali {NC*P} ?#I;l

T AUGUST 20171

Sectisn L Referenms

l.I. $ectioe 2{c} of R.A. t*Is. tSE44 mandates the DICT tc ensure the universal a&er$ to

quality, aforOalls, reliable and secrffi services; and

i:. 5;u*ti* 2{I} T; ensuro tte righrgsf individuals to pivacy and con{idcntiality of their

persorat info:m*fien; ard , ""

i.t. se*ior,2{m} To ens*re the securirry of criti&al ICT infrastructures including informatioa

assets of the Swsromsnt, in*ivjduatt nndb'urinesses; aod

1.4. $estion i{n} fo proyide ovemigkt over *grncie* governing ard regulating the ICT sector

*ad ensrffi ,oo*o**i pnotection anA .*lfrt*, dxa pivacy and security, fosfer co*np*tition

and tk guudr oftlrc ICT sedor.t*

$ectisn IL Definition of Terus

,cyherseeErity - is rhe coll*ticn of toolq plicies, $scurity concepts, sscurity s5f€g$Erds,

"ni6"f;r"*;'tii', **ugqn*t eproachm, actitrns, faining trest pr*c$cw, assdancE and

ffi*"l"gr;u tt*t c* & used ti prsttrt the cyber envimrmemt and orgarimtion and usecs

assst$" *r frifionl rnfantr**ture {cr$ * refer* * *"- Critical Infurnatio* trnfrr*trrrcture ar Criticsl Infostructur* {CII} * t

co1apuffi By$tems, snd/or networks *t "**r physicat sr virtual, *dl*t tlre oomputer {

progr&m$" **p*er data and/srtraffic date tlut are vital ta this comfy tb* the ir*rprity or

6crffr*td11 of *r imerfcreffis with srmh system and asses rr,trdd have a d€bilit$iry impct

on security, rational or esos*mic *ecrxity, natinnal ryth stld $afsty or afly cambin*tion of

ino** *"tiers. $ectors furitially classifie+ as CIIs *rs the following: goYEmmsrt

ffi;pgl?rtiotl gand sm, air)- *ogy, lr/rater, Seal& silergsncy servic.es, b*nking and

finaace"bu*inesprg6ess outsoUrcing telesoffim11ui6afious, medig" r

\')

-rP

,,.!,

lnfrrmrtion *nd communrm*osr Torrrronology (rcrl - refers to tl-E totality of elmusnic

means to ass* cr'&p, coll#, $O*En p*o***, Loive, trarsrnit, prg$Ent' and disseminate

information

Informrtimsysteh-apFlisatioms,mrr,ices,infgrs0#bntcchnologyomet.*orgtherinformation h*ndling

National se*urity $]q$t€e'" ${ss} ': any ' iafonratio} sy$tellr includiw

, telscommudcatiom Bystffn ussd or oi"r5*A by ary orgrrizmion or outs63u€d q a third

'" potty. The &Ecriul operatiotr or tne of rvhich: I '{,

q.

b) IlrvotvEs "tyd"gr" ,td't*o *f'r*A.m n*ional secrrriry;

c) lnvolver ****f, and corltol of miliary s:ces; )

it mroko muipr"i"t that is an intcgrat part bf * weapcu or weapoap system; or

;ir- ;;ita$ e direct tulfillrngrrt of military or intelligence missions'

Traffie Light f,rthml {ILP} - i*-1set tf deslgnations dsvcloped by the Fsrum of Incidffit

Respocse sd s*;y G*; {flRsr} ** iil**rn* tlw sensitive infsrffirion i$ shsred

kctlctr UI. B*c$rouud :'

This Mcmarard,m Circuhr wkicb ccicrs etl CU "'#nefs

and operato'rs' gov'rtrmsnt

ag,ncies, n,eires$;etol* and alt ottt" ***.e is being issld to pescrfue tk polisics"

rules and regulations on the prste{t+n of government rg"-;t- *tipulated in 'b*

1-IBCP 2fi22'

fhe NCSF ftfi?2,etteohed herE'!#itlt'[ ;;pr*rd 1teqadofma as tb natioil]al *am*qmrk that

will guide *r,a in*tit *i*nlirc &s i#;;"tation of infotmatio*r security gsvemarffi i* the

cauntry. ThE viei; -f d* NCSp Z*i:: is fsr our csumtrv to have a 'tnr'led and resilient

iorortn .tor*." Tn;;;*frJIil' th; frllo*og *jectivectre to be tulfilted:

a) Ta systematicrlty aad meMieally harderr tho cIIs for resiliency;

ti fo pt*p*re and se*ure gsvsrrm$lt infosrusfi$e;

c) To raisc tk uiii*du-in ttre hsirms g*tor onoyter ri*ks and uss of security msa,ufc$

amoagbusincsser to prevent *d rygttd, respond strdrecwsr *cm a*acks; and

if) Ta raise the ur*idn *u of inAii.l*n6 on cyUer risks ss thry nsed to adept th€ right no$ns

Stcdon fY. G*remlfolitY ,

_ Ifl order to tro1st aur citiaen in &e omlirc wudd, aProgram on Cybersecurity Bhrcaticn and

, Awareaers chnltr b6 devetoped *e i*pfu**ni"O ly*":t agsffiis$ of *e gpveflIln€nt in{

coordiuatian *itl Jfr*i givate arpnizations with Src fotiowing cornpngu6:

A.,Integr*dorofCyhrkurityCtrrsmi*theEducrtignfuior.

The-Academric &ctar shatl crsste.rechnisel working crraupn to rwiew existing

curriculum and develop CvberBecuritv *try*, fHm T- *::S3'i:'.*.i:::i*;ff;' ffi ,#1,,ff-)l'i',i"#ffiffi&; tr'i'

"vu"*"curitv cowses. in. thy curriculum or

-! --- - rr-i*.i*^lnr*, o-rl nthP-r

[{;ulucu urand otherils#;s" qompur$ $cien11,*rnturmation Technology, Law, tT*'**il, rl"""#ll_*

ILlu5wrurar -*'l-r---- * _..-'.d t I u.p LAW 6."N:.i:tl, I

I orrlce & tt4 H Tt${At tc$[l'{rgitat;*t iicsr:r I

"t

I+t

.v

interdisciplinary programs *mt are pr,oje*ed tq \ of rqlevance !o irnfuo-ve-CyberSecunty oftfru **rrr" XL'inriferamra*o* oi3untt crrni"ulum shall k adoptsd withia ttr year. Thc

TES*A adDcFEd shsll imhde s14bj€cs rela.tcd ta Cyhrswuri$ as idsnrifisd by ttls TIVG$

to U" *t*ma Atrember &fiaEICT stdl $eat as mmtber sfths TWS$.

;

S. ?r*iring *f Tr*irers {foT} *crl Certifrcntisrr ' i -r

fivste and'Academic Smtors s&all co'ntinually coaduct periodic T*Pog of Trainers

hog6* in or*r to devolop'skitl*d Cyber$ecurify.mirers. The$e pool of tr:doeru shall bs

i*q&r** tr6 cascqde grkrSes$ty mesr*,s et ttreir respectiye agencies a*d aress of,opo*iUititier aad utenO mntinuing professio:ral_ edue*tian activities in Cybqdecurity

ddrrrt-d by the DICT Cykr$ccluity Buresu andattrer oertifyiug purtaers.

.i . C. #pBIaT (paper, Badio, Internet{$ociet Mdia} end Tekvtion};

All govtrr*nsrt ag*rcies, law e,r:forcem€N$ prosecution selYice, SUC$, pivare *olleges aild

uniGrsities, m$dii Bectors and otlrer conc€r$ed institrria$ and srggniration shall conErtut*

ard assi$t tt6 DICT in tts con&rct oflhis C$er*curiry elftaett Progrflrgs'

$- Ob*srvn*ee af Cykt**u*ty SY* ItrEk

Cyher$writy -{rrmrcnsss Mon& sha{l be held every first we*k of Ootober of each year. All

,*p"*t *gcncies shall o&senre tk said Cybsrsscurity Week in orrder to Sromote 8ltrarGtrcs$

eo4 shou&,sc current researo{and devslopment tlu€s& and vulusrfibilitiee, id,armatiar

stmring end all oflrsr activities niirted m Cyber$ecnrity"

S* Philippina Gt*ernmcat Wttrite*

All officiat gonemment wEbrit*s shatl be required to inslude C$rcr$ecurity A'wareaess

related ca*ter$- {s$ues and comcerns relative s the smtsnt shall be *ddr6s$d within the

\ agercy, iaase$ requiring firrther assistarse may be rcferred to the BICT Cybsr$wurity

Bureau.

' Section Y. Fundiag for the luphment*tion of the |{CSP 2022

:' i ' d to includr ttre flrnding for csmpliarcs'"in their annualAll govemmcnt agrnotcs ers rcqum

*pprkuti"* i#iuOing the Infornration Systems srategic}Iarr {IssP) pursrnnt to Eo 265,

-.Tgd, *a dl ather ptogrn*s ral# to *ybersecwity. '

{Se*tton YI' Timefmme for Complinnce

CII3 aoverd by this ord+r skll *nmply withia six $) months *om &e srgning of &is Order,

$ettior YIL Rcpeding CIaarc

All is5tlae$es, sr&r$, rules ard rryul*ions or parts tkrccf $,tith qrE in$sn$isteirt with thet'- - -t

prooirio* ,of thi, tvtemcrand1grl- Circutar *re hcr*y repealed" anoetded or moditied

rq

accordingly: ..

\

Section VIII. Seprrability Clause

Should any provision of this Memorandunn Circular k deelared invalid or un*onstitution*1,

the other provisions not allbcted thereby shall remain valid and subsisting.

SectionUL Effectivil-y-

This Memorandum Circuiar shall talie effect upon submission of three (3i certified true

copies to the {.Jniversity of the Phiiippines Law Center andlor publication iu a aewspaper ofgeneral cir*ulation. f-$

.\'.

s