Bam Aquino Proposes National Cybersecurity Agency to Strengthen Digital Defenses

What Readers Should Know
Bam Aquino’s Senate Bill 2248 proposes a National Cybersecurity Agency with strategy, coordination and infrastructure-protection functions. The proposal remains pending legislation.
Key Takeaways
- Senate Bill 2248 was filed June 3, 2026.
- It proposes a dedicated cybersecurity agency.
- Business training and research partnerships are included.
- Critical infrastructure operators would face additional requirements.
- A related House measure has passed third reading.
The measure would coordinate cybersecurity strategy and introduce safeguards for critical information infrastructure.
Senator Bam Aquino is pushing a proposal to establish a National Cybersecurity Agency, seeking stronger coordination against hacking, data breaches and other digital threats.
Senate Bill No. 2248, filed on June 3, 2026, would establish the agency and strengthen protection of critical information infrastructure. It remains a legislative proposal.
The measure has drawn renewed attention following reports of security incidents affecting government and private organizations.
On November 10, the National Privacy Commission confirmed receiving personal data breach notifications from 10 government agencies or their identified offices. The commission said each notification undergoes assessment to determine the circumstances, possible impact and appropriate regulatory response.
Aquino’s proposal would make the new agency responsible for national cybersecurity strategy, policy implementation and coordination with government bodies, businesses and international partners.
It also includes training for private enterprises, particularly MSMEs that may need assistance protecting business and customer records.
Research partnerships with academic institutions and international counterparts would support the development of local cybersecurity expertise.
Under the proposed framework, government agencies, government-owned and controlled corporations, and local government units would adopt minimum cybersecurity and resilience measures. Critical infrastructure operators would face risk-assessment, monitoring, audit and incident-reporting requirements.
A related measure, House Bill No. 9605, passed third reading on August 12 and was transmitted to the Senate on August 13. That approval does not, by itself, establish the proposed agency.
For businesses and citizens, the proposal raises a practical question: how can national coordination improve digital protection while keeping organizations accountable for the information entrusted to them?
Frequently Asked Questions
Has the agency already been established?
No. The measure discussed remains a proposal.
What is the Senate bill number?
Senate Bill No. 2248.
Would MSMEs receive assistance?
The proposal includes data-security training for businesses such as MSMEs.
What would critical infrastructure operators do?
Conduct assessments, maintain monitoring and comply with proposed audit and reporting requirements.
Does House passage make the measure law?
No. Further legislative steps are required.