BSP Introduces Cybersecurity Maturity Framework and New Self-Assessment Requirement for BSFIs
The Bangko Sentral ng Pilipinas (BSP) has issued Circular No. 1232, series of 2026, introducing the Cybersecurity Maturity Framework (CMF) and the Cybersecurity Control Self-Assessment (CCSA) requirement to strengthen information and cybersecurity off-site surveillance and risk assessment among banks and other BSP-supervised financial institutions (BSFIs). The circular amends the Manual of Regulations for Banks and the Manual of Regulations for Non-Bank Financial Institutions in line with the BSP’s effort to reinforce the existing regulatory framework and enhance cyber resilience in the financial sector.
Under the new framework, the BSP replaces the IT Rating System with the Supervisory Assessment Framework (SAFr) for assessing BSFIs and incorporates the CMF and CCSA into the information technology risk management provisions. The circular emphasizes that BSFIs must undertake periodic and rigorous self-assessment exercises using more robust data sets and variables as part of their information security risk management system.
A structured benchmark for cyber resilience
The CMF is designed to support BSFIs in strengthening both institutional and sector-wide cyber resilience amid increasing digitalization and an evolving threat landscape. Aligned with global standards, the framework provides a structured approach for assessing and improving cybersecurity practices and capabilities across key control areas.
The CCSA will complement the CMF by serving as a benchmarking tool for a BSFI’s current activities, processes, and guidelines, while also helping institutions plan their target maturity. The assessment includes activity- and capability-based questions intended to reflect the institution’s maturity in a particular control area and to gather cyber trends and practices.
The BSP will evaluate cybersecurity maturity based on the CCSA and other supervisory activities, with results assessed under four maturity tiers: Foundational, Established, Managed, and Optimized. The circular provides that the tiers are meant to reflect different levels of control adoption, integration, automation, and strategic embedding of cybersecurity into governance and decision-making.
Tiering based on risk profile
The circular also links maturity expectations to a BSFI’s IT profile classification. Institutions with a Simple IT profile are expected to move from Foundational to Established, those with a Moderate profile from Established to Managed, and those with a Complex profile from Managed to Optimized.
According to the BSP, BSFIs are encouraged to continue enhancing their cybersecurity capabilities and to implement more advanced controls consistent with their risk profile.
Annual reporting requirements
To support the new framework, the circular requires BSFIs to electronically submit periodic reports to the appropriate supervising department of the BSP. These include the Annual IT Profile, which must be filed within twenty-five calendar days after the end of the reference year, and the CCSA, which must be submitted on or before 31 March following the end of the reference year for BSFIs notified by the BSP as having a Moderate or Complex IT profile, as well as other BSFIs specifically identified by the BSP.
The circular likewise amends the relevant reporting appendices of the MORB and MORNBFI to reflect the CCSA submission requirement. Detailed procedures for filing the CCSA through the Advanced SupTech Engine for Risk-based Compliance (ASTERiSC) platform, as well as the maturity assessment process, will be covered in a separate regulatory issuance.
Initial filing and effectivity
For purposes of transition, the BSP stated that the initial CCSA shall be due sixty calendar days from the release of the reporting guidelines. The circular will take effect fifteen calendar days after publication in a newspaper of general circulation.
The new circular reflects the BSP’s continuing push to modernize supervisory tools and ensure that BSFIs remain equipped to identify, measure, and respond to cybersecurity risks in a rapidly changing digital environment.
For more information, click here.