LAWMAKERS have proposed the creation of an annual Cybersecurity Risk Management and Mitigation Fund (CRMMF) to strengthen the country’s defenses against increasing cyber threats targeting government institutions and private businesses.
Under House Bill 2826 filed by Camarines Sur Reps. Migz Villafuerte and Luigi Villafuerte, the CRMMF will finance threat identification and detection, incident response, system recovery, personnel training, equipment procurement, and other cybersecurity preparedness and prevention activities.
Migz Villafuerte, chairman of the House committee on information and communications technology, said 30 percent of the fund will serve as a Quick Response Fund to restore critical information infrastructure (CII) affected by cybercrime incidents such as phishing, ransomware, social engineering schemes, and emerging artificial intelligence (AI)-driven threats like deepfakes.
The amount and beneficiary agencies of the CRMMF will be determined upon the President’s approval based on the recommendation of the proposed National Cybersecurity Agency (NCSA), which the lawmakers seek to establish under HB 2826, or the Cybersecurity Act.
The proposal follows the Department of Information and Communications Technology’s (DICT) recent disclosure that it successfully thwarted Distributed Denial of Service (DDoS) attacks against major Philippine banks on November 5-known globally as Guy Fawkes Day, when hacking and cyberactivism often spike.
DICT activated ‘Oplan Cyberdome,’ coordinating with the Cybercrime Investigation and Coordinating Center (CICC), National Telecommunications Commission (NTC), and law enforcement agencies to defend against the attacks.
Lawmakers said the CRMMF may also be used to address ongoing threats within the current fiscal year and those that occurred within the two preceding years. New cybersecurity legislation forms part of the 44 priority measures under the Common Legislative Agenda agreed upon by President Marcos and Congress leaders.
Under HB 2826, agencies receiving CRMMF allocations must submit monthly utilization reports to the NCSA. A National Computer Emergency Response Team (NCERT) will also be established to lead rapid detection, mitigation, and recovery efforts in cyber incidents affecting national security or public interest.
The bill mandates all national government agencies, government-owned corporations, and local government units to adopt cybersecurity baselines and appoint Chief Information Security Officers.
HB 2826 also imposes administrative and criminal penalties for unauthorized disclosure of confidential data and cyberattacks on CIIs. Penalties range from six to 12 years’ imprisonment and fines starting at P500,000 up to life imprisonment and a minimum P1 million fine for cases involving national security.