MANILA, Philippines — The Philippines is taking a major step toward strengthening its defenses against cyberattacks after the House of Representatives approved a sweeping cybersecurity measure that could fundamentally reshape how the country protects government systems, businesses and critical infrastructure.
House Bill No. 9605, or the proposed “National Cybersecurity and Critical Information Infrastructure Protection Act of 2026,” was approved on third and final reading in the House, according to the Philippine Information Agency and the House of Representatives. The measure now moves to the Senate for consideration.
At the heart of the proposal is the creation of a National Cybersecurity Agency (NCSA) that would serve as the country’s central policy, planning, administrative and implementation body for cybersecurity.
The proposed agency is envisioned as a unified authority capable of coordinating the government’s response to increasingly sophisticated cyber threats while establishing cybersecurity standards for organizations operating in critical sectors.
A new layer of protection for critical infrastructure
The measure comes as the Philippines becomes increasingly dependent on digital systems for banking, communications, government services, healthcare, transportation, energy and other essential activities.
Lawmakers argue that protecting these systems is no longer simply an information-technology concern—it is a matter of economic security, public safety and national security.
HB 9605 seeks to establish mandatory cybersecurity standards and certification systems covering organizations, technology providers and IT professionals. The objective is to move cybersecurity away from fragmented practices toward more consistent and enforceable security requirements.
The House has specifically highlighted the need to safeguard critical infrastructure such as energy systems, financial institutions and government networks, where a successful cyberattack could potentially disrupt services affecting millions of Filipinos.
Why the measure is gaining urgency
The push for stronger cyber defenses comes as cyber threats continue to evolve worldwide.
Recent Philippine reporting has highlighted concerns involving phishing, ransomware, data breaches, compromised credentials and attacks against digital infrastructure. One recent analysis citing cybersecurity-industry data reported thousands of phishing attacks and hundreds of data-breach incidents in the Philippines during the first half of 2026.
These developments underscore a growing reality: as more Filipinos rely on online banking, digital government services, e-commerce and electronic communications, the potential impact of a major cyberattack extends far beyond computers and corporate networks.
A cyber incident affecting a bank, telecommunications provider, power facility or government platform can quickly become a disruption to ordinary daily life.
House bill creates a centralized cybersecurity authority
One of the most significant provisions of HB 9605 is the establishment of the National Cybersecurity Agency.
Under the proposal, the NCSA would provide centralized direction for national cybersecurity policy and coordinate efforts to protect critical information infrastructure.
The House measure is also designed to consolidate and strengthen cybersecurity responsibilities that are currently distributed among government institutions.
A separate report on the measure said the proposed agency would be placed under the Office of the President, with cybersecurity functions and related resources currently handled by the Department of Information and Communications Technology’s cybersecurity arm to be transferred into the new structure.
That structure could give the government a more unified chain of responsibility when responding to large-scale cyber incidents.
What could change for businesses?
The proposed legislation could also have implications for private companies, particularly organizations operating systems considered essential to the country’s economy and public services.
Instead of treating cybersecurity solely as an internal IT function, the proposed framework would impose standardized security expectations on covered organizations.
For businesses, this could mean greater emphasis on cybersecurity governance, technical safeguards, employee training, certification and preparedness for cyber incidents.
The proposed approach is particularly important for sectors where a digital breach could have consequences beyond the company itself.
Filipino consumers could also feel the impact
For ordinary Filipinos, cybersecurity legislation may sound like a technical issue—but its consequences could be highly personal.
Digital banking accounts, online government transactions, mobile communications, health records and other services all depend on systems that must remain secure.
A stronger national cybersecurity framework could help improve the government’s ability to coordinate responses to attacks and establish consistent protection standards across critical systems.
However, passing a law alone will not eliminate cybercrime.
Cybersecurity experts and industry observers continue to emphasize the importance of adequate funding, skilled personnel, modern technology, rapid incident response and cooperation between government and the private sector.
The bill is not yet a law
Despite the House approval, HB 9605 is not yet a law.
The measure must still undergo consideration in the Senate. If the Senate approves a different version, the two chambers would need to reconcile their respective versions before the final measure can be sent to the President.
Only after completing the legislative process and receiving presidential approval can the proposed framework become law.
The House itself described the measure as one of the major legislative milestones of the second regular session of the 20th Congress.
The bigger question: Can the Philippines stay ahead?
The passage of HB 9605 signals that cybersecurity is increasingly being treated as a national priority rather than simply an IT problem.
But the real test will come after legislation.
A National Cybersecurity Agency would need sufficient resources, highly trained personnel, modern infrastructure and clear authority to respond effectively when attacks occur.
The Philippines’ rapid digital transformation has created enormous opportunities for economic growth and public-service delivery. It has also created a larger digital battlefield for cybercriminals.
The House has now taken the next step.
The bigger question is whether the country can build the defenses, talent and coordination needed before the next major cyberattack exposes the cost of being unprepared.
Leave a Reply