RTPUBT,IC CIF 1'HI FHILIFPINTS

* ff p&.ft T M E fil y * f t f€ tr df fi e,t,s,T i * i',n ..1 {'i ** fl*&$ &S t-c hi I * f,'Ti*ll* S T ** I'l S'*L*"*Y

METTToRANDuM,cTRCULAnNo' $ iry #

FOR

, FROM

SUBJECT

DATE

ALL GO\{ESNMENT ACEIIICIES \RODOLFO A' S;ALALIMA$ecrmry " : '

l-c.

pRESCAIBIFIG TIIS POTICIE$' BUTSS Aliil) REGLfi*TroI'{s

oN THE PROTECTION OF GOVERNMENT AGEN-Cryq

STIPI}L&TEN IN ?HE NATTQNAL CYBERSECTj TTY P['A'N

{NCSP} 2C2}

I AUGU$T 'b1?

\

))

Section I. Bef*rences 1 *.

1.1. Ses,tion ?(c) of R.A. No. lg&44 paadarryfre DICT to etrsure the mivffial acffi t0 qualtly,

affordable, rdiable ald scerre srvices; mtt

l.?. Secri6$ tS) Ts $nffire &c rights sf iudividu*l$ ts Friv"py md eo*fidmtinlity of ftsir

personal information; and \..1.3. $retiw 2(m) To en$rrr€ the $du*ty of critical IC? in*astnptres inctudin* irfarMion

assets ofthe g+rerament, individuals d buein"Esse*; md '"-

1.4. Smtion 2{n} Ta pro;& orrc,reigt*orer ag€r$ics goveraing and requryirg the ICT s*ur aard

snffrrs scofiflner S,t*rti* aad wdfu, dda primasy ad saenrify, "tY

sqryBlitio$ md &e

grau*h ofthc ICT se$or.

r$cet*om lL lhfmitio* of Ttrm*

Cyhergg[urry - is dre collection, of iools, p*li*i**, sorr$ity cotlq&p$, s$$t$ity +4&Suerds,

fidril;;" ,iut ***g.msnt appiffikes, aetions" fainin& best prartices, sssxlrarcc axtd

iec5.ologiss that ean U uoO m pnwt the cyber snvirotrmest aad ugauization mrdosds aEseb-

Crithel Informstior Infrastnrfune or Criric*l Infostrs€'tffe.tflI) - refss t<r th* caryrPut*r

syst€rus, mdlor s€rtrsorks wboftrer &ysisel ar virt$ql, der the csmputer proffiSl$, coBlputsr

A*L **l* traffi* dala t:r# are vial to this coretry tbat ttts incryanity or &srnrctioa of or

iuterferemce wi& ewh rystern aad a$s€f,$ rysdd h*rc a dpbilirafins impact o$ ss&rity, a*imal od

eommric wuity, nationat hsal& asd ssety or aay eombination of thosB matters- Seetors

i"i*i*Uy ctaseifid 6 CU* are tre following: gp\trnm€n*, tmsprtation (lmd, 38a, air), ffisSIn

wnte.r, tpdt&, s$efgc$oy s3ryitgs, lmt tps 8d fiuan*eo busin*ss proffiss u&ogrcing'

lelccommxnieations, medla.

rnformcti+n *ad camm*nic*tisx Tscho$ology {ICq - refers to *e gotality of electrmic

*** to rcck, s:rmtq Goll6, eto1e, pmcms, rmeiYe, fmsnrit' pr€Sgnt' A*d di5Soglifiate

- L;.P LAildlfult H- .. "--.l

6l ti.{ ltA r.L1tt. j-:,1rrr;.! rlr. I :it :}.i,.C r r "r I

Aen'1,;rri, I q jrd! r.: tl(c., 3,ir t{ I'-

*Eo r"qlnnr r'I l

filiii.i:information.

n6

/,;.f;

Imfcm*etim systea - aBplisdons, setrvice*, informatiao technorogf as$$ts or oihs infmm$ion

ha'ndling comPo'trcrts"

Nrtiomd ffuourity systam ${**} * ee$,* mry informarion sy$6* fucludirrg *roeomuunis'tion

systcm rxcd or op$rd€d by my *gsaiuatioil sr ou*rre€d to a thkd $rty. The fua*tion,

operatim tr u'*e of q'bish: i

nllnvolw*inelliggrm*tli'iti*;..'' i

-''

b) Irolrrcs *rg--l.d'a*ivitie relafied to natiomt seeuity;

c) Imrolrm r-*mane aud wntiel of mititry Qcast*..:,.. ^.d) Ir"ol*u equipment that is ar in&gfal prt of a w@a ar ltBaFtrs.rystem;or

e) I* rririsat * *, *iln mm*r If *tfrr, or irrtetligenc* uissions',\

TIts:ELightPrutonol{TLP)-isas'e*ofdesignationcdevetopdbytheFmulroflncident^)', Respons srd il;;"ffi'{Fr*il**i;;-*" that seusili}e infmmatiot is drred wi,t

,ntiPet mdaardiqrcc,r) \

Section IIL Background &

This Msmorffidue Circular whieh *or'Ss all govermre*t agnncic* i-t5-y"* to prescnbe

the policie d;*d-t"sr1"i"t" ;'e; puoit*ti* ur gsv*rnmtilt agencies $tipmtafied in the

NSm ?*22. Tk NCSP=2*22,meUe*hsewi0L i* appved urd adapt*d as the aatjonal

framerra* tkt wi$ g$rdn ffid ***ia*lo*lio rhc imptffis€o#riom of r"lorfi0,*ti0* mcuity

sCIy€ilHrlce fu the -*r&, The yfui{n-orG NCSp ?022 i; far our sollsuy m hatn *'lnrsted ard

ioitiu*t ire*;#?;;*ryIdai* *r fdrcwing abjectives shsutd bE frrtfitted:

a) To systair*tically and mcthodicaHy ry* *i go***t ageacies fs resilie$cy;

b) To prrye *nd rwure gsl'ranlmffit infowtlc'*se;

c) Ts rei; the awmemosslo ** busine*s secttr m cyber risks a*t u** of smwity

f,ref,sure$amongbusimstslspfeY€mtandprotwt,mspondaodrecorrErftomasaejks;8ndd) To ffiise trre Jrramsss erh;iviaual$ on *ykr rids* as tby necd to adopt tho right

t ,rssts of cYbusocari$

' S*ticaIY. Gcn*raIPoIi*Y '

A) ESTABLISIIMEHT Or C{IY&*NMENT COMrdITnn wE',RcENeY REST0NSE

.rn*mstccEnr) n ,

AII gpw{finsnt agmoies and fuse$ffiffifalitieg shll €$tablish their own CERT in aacmdance to

$ICT'$ mlm ad proce&res. This cE:RTs dhrlt respond ts oyb€r8ttEf"k8, ry1.9q* -

onesthsrreapprmttyaimEdd*ealins.taaagihg,ordteringinforrration'Twwilltakegqvernreat-wifi *nfti-f*Vete6 *;**'*!- ba*€d- on thc assumptidn of a evt*rattack' In

proncesi*e tneEo lueastsqs, *p eot*runrnt will ewrye thfit t-Fs q.s itl $owliffIp$ bascd CI{t

csmmsr iots*tiur*rb aoc+eta -edrrd-, aud will conduet risk analysis or iB admiaistrative

- 'respnsibilities to optimize thesemeasures

3

ffiErr----lOfFTCE of ui *r:$Wri

^U$+l[$:iatiIf titUtlXl

\ A6nr'irttiirw Lluitt 16,: Pslh'il:.1$r' I

IB) , s[P lti?.uri "ml

s) COLLA6XATION ffITII f.ffial A$rD INTERF{ATI1}}{AI riXX*CgSo

,fi[&rrratis'1" For P-urPose't ofSCERT sbalt collabcrate with lffiffl lirkrges for s$tu o

sySamdic coor*ioagon *,*, CER?q i*6*.i"*f eilaboratiou rhall be po,rd only *rou*

the NCERT ;

C) PRIVACY OF PERSONAL DATA l

Thd ssurity ms privm,y of pqml dara md agsqnon* o*r slraripg ef psonal data inrmrvirrg

gov*rnmn t *S*oi**-i - *rite"p*y -h"Il t; in cqfuma*c* *A ee i*irmrcec &om the

Natioaal F?ilracY Commixitlt

' D) B&8P$N$IBILITY Or aGNNCY [IEAI]*

.t+hsency ad o&er orgmization Mt

-shail aot as the qirg*niation*s

(cyso],ard ,*hall G *r-ra rerynoble for &e irrplemenetioa sf

iutsmoffiduntihdarindreirrespetivoafficer' ' !

E) IUOHITARING AI\lIl EyALU{TI$N OFCCMTLTAHCE TO TIIr }rc$P 1{}f;!

Govsrmmt agrncies md it* 1,*d"".ril* shau bG *ubjeated to a oonitaring and edntion

$ysre' esrsbli*ed b;;Id' ; &i*"ti* tffi bvcl of tuir respective corryliance 8 &e NC$P

2A72. ,

r) t}RsAFfis,ltTICINAL MErysrffi

ThgCYSoeshallereaFaaorgacizatiorhi&{tcdbyathairmamtsbeelect*d*ilroflgmsmberagsncics. The ehainnas shalt tbp;t r-epsft tr3 &e DICT m r mriodis bqsis' Atr qnnual qosftWse-

d"rr u* hdd fof e[ cY.so$ fw prpose af information *ri*g. s

.${*tionY.ruBdingfor&etgrtirmeaationofth*ItrcsP}$lt

AII governnnr* agnnci** idpcfifig(l as CIIs are r$ql&sd to6huld€{ dreir +xpersee fm cffirylians$

. m thi* Mmormdun cir*ular, irckidfug the ld&atias $ystems $tratcgic Plaa {Is$P) pruxrat

to ES 36J" s.?0S0, arld all oter pregrdlrs relaled ta oybcrsesurirry' Said g(}lam$fctrt agrmciee

shafi id;e hr thsir arnual brd$Et &e said$xpens€$'

--t

tucti*r YI. Tiudr*m*f*r C*s*lieap

cils covefd by rhis sralcr *IBII sCIffiply $,ithi{t six {6} moaihs &om &e siguiug cf &in &dpx' , *

S*{t*tE YIt Rcpeling Clame

AII isguailces, order$, rules agd rsgplatio,ls or palts qrrf u,hit'h are inoo*sktat wisr the

!fidsion* of this ru**orauc,* ci*ukr; rr**by mpmled" mnded or udifid mcerdingly' "

)

Cvbersmuriry fficerttrc provisions sf this

I

I

I

I,t

i

I

1

Ii1

I

I4j

i

&

q

li

I

J

l0

i)

orrK[ d *r fi*iit*il **n:gittlil{ ffi6i,5Iilii.dm,r:1rutrr{ Rstcr ;r,;d lleguUtrglr

th: $if. }:t ?3t? ' :Im\

1

rr-r

Section VIII. Separability Clause

Should *ny provision cf this Memorardrun Circular be de*lared invalid or unconstitutional, tho

other provisions not affected thereby shall remain valid and subsisting.

Section IX. Effectivi(v

This Memorandrun Circular shall take effect upon subrnissiau of ttree (3) certifiedtnre copies to

the Universrtv of the Philippines Law Center and/ot publication in a newspaper of general

$irculation. , ' *

-r:

ffi--{Fnec d *, *mlu*r $ffi$t *AIruE Rfq$Iif;

ffi-H"l$e]Dt

ld0ititltsl*t F*}!t a& ffags:*'r*

,1

"hor*at*-r* eriV

tt