The 20th Congress has moved closer to creating a National Cybersecurity Agency (NCSA) that shall take charge of crafting and implementing a “comprehensive national framework to shield local institutions and digital systems from the increasingly pernicious threats and attacks on cyber space and thereby ensure a more secure digital future for all Filipinos,” according to Camarines Sur (CamSur) Rep. Migz Villafuerte.
Villafuerte was upbeat on the establishment soon of the proposed NCSA under the Department of Information and Communications Technology (DICT), following the recent approval by the House of Representatives on second reading of House Bill (HB) No. 423, or the “National Cybersecurity and Critical Information Infrastructure Protection (CIIP) Act of 2026.”
The former governor chairs the House committee on ICT, which endorsed the approval of this bill—as contained in Committee Report (CR) No. 423—that was the substitute measure consolidated by a Technical Working Group (TWG) from 26 CIIP or cybersecurity-related bills tackled by the Villafuerte-chaired panel during the First Regular Session.
In his sponsorship speech on Aug. 3, Villafuerte said on the floor that cybersecurity is no longer an ICT concern alone, in light of our mounting reliance on digital systems in all sectors—from the government, economy and finance to transportation, health and energy—that have transformed it into a national security concern.
“Ang cybersecurity ay hindi na lamang usapin ng teknolohiya. Isa na itong usapin ng pambansang seguridad. At kung permanente ang banta, permanente rin dapat ang ating institutional response.”
Hence, he said, the NCSA, as proposed in the House-approved HB 9605, aims to facilitate a whole-of-government approach to handling cybersecurity; beef up response to cyber attacks; establish minimum standards for CIIP; and provide for congressional oversight, judicial review and legal accountability.
“The question is no longer whether our country will experience another major cyber attack; the question is whether we are prepared for it when that happens,” Villafuerte said. “And because such a threat has become permanent, our institutional response must also be a permanent one.”
The proposed NCSA, he added, would strengthen national coordination, improve incident response, and establish minimum cybersecurity standards for critical information infrastructure.
“Ang tanong ngayon ay hindi na kung magkakaroon pa ba tayo ng malaking cyberattack. Ang tanong ay kung handa ba ang ating bansa kapag ito ay dumating,” Villafuerte said on the floor.
He said, “Ang panukalang batas na ito ang magbibigay ng permanenteng institutional framework upang maprotektahan ang ating mga kritikal na sistema, mapatatag ang ating pambansang katatagan, at mapangalagaan ang tiwala ng ating mga mamamayan sa digital na ekonomiya.”
“Ang cybersecurity ay hindi na lamang usapin ng teknolohiya. Isa na itong usapin ng pambansang seguridad. At kung permanente ang banta, permanente rin dapat ang ating institutional response,” he added.
Villafuerte said that “Sa kasalukuyan, ang ating ekonomiya, sistemang pinansyal, suplay ng kuryente, transportasyon, serbisyong pangkalusugan, at maging ang paghahatid ng serbisyo ng pamahalaan ay nakasalalay na sa digital systems.”
“Kapag ang mga sistemang ito ay nakompromiso ng cyber attack, hindi lamang mga computer ang naaapektuhan. Naaapektuhan ang ekonomiya, ang mga serbisyo sa publiko, at ang kaligtasan ng bawat Pilipino,” he said.
“Ang tanong ngayon ay hindi na kung magkakaroon pa ba tayo ng malaking cyberattack. Ang tanong ay kung handa ba ang ating bansa kapag ito ay dumating.”
Villafuerte had sponsored the CIIP bill with FPJ Bayanihan Rep. Brian Poe, an assistant majority leader, and Nueva Ecija Mika Suansing, who chairs the House committee on appropriations.
The 26 cybersecurity bills studied by the TWG included HB 2826, which Migz Villafuerte authored with Deputy Majority Leader Luigi Villafuerte, CamSur Rep. Tsuyoshi Anthony Horibata and Bicol Saro Rep. Terry Ridon.
The authors of the other cybersecurity bills include Reps. Poe, Jude Acidre, Juan Carlos Atayde, Bernadette Barbers, Javier Miguel Lopez Benitez, Gervile Luistro, Salvador Pleyto, Lani Mercado-Revilla, Bryan Revilla, Ramon Jolo Revilla III, Andrew Julian Romualdez, Yedda Marie Romualdez, Jurdin Jesus Romualdo, Keith Micah Tan and Emilio Bernardino Yulo.
Luigi Villafuerte explained that the approval of this cybersecurity bill has become urgent on the heels of President Marcos’ recent issuance of Executive Order (EO) No. 119, which updated the Government Data Classification Framework of 1964 to accelerate the country’s digital transformation while safeguarding Filipinos against cybersecurity risks.
While EO 119 enables government agencies to adopt cloud technologies, Luigi Villafuerte this new data security framework in place of the one established in 1964 yet provides for standardized cybersecurity practices to protect government information and strengthens our country’s resiliency against cyber threats.
As regards cybersecurity risks, he noted that mobile payments service provider GCash, for instance, reported last July having blocked some 6,700 bogus merchant accounts tied to QRPh scams known as “quishing,” in which bad actors use phony QR codes to redirect users to fake GCash payment pages or illegitimate accounts to steal cash from the victims.
Philippine National Police (PNP) chief Gen. Jose Melencio Nartatez Jr. told the media, meanwhile, that also in July, the PNP-Anti-Cybercrime Group conducted 6,845 cyber patrol operations against potential online threats, with at least 220 digital forensic examinations conducted by the police as technical assistance to cyber-related cases.
This proposed Cybersecurity Act is among the 48 priority measures that President Marcos identified for urgent action last year with the legislative-Executive Development Advisory Committee (LEDAC).
The House already approved 21 of these 48 LEDAC priorities measures since last year, of which 12 bills were co-authored by the Villafuertes.
