DICT Mandates ISO Cybersecurity Standards for Telecom Firms

The Department of Information and Communications Technology (DICT) has tightened information security requirements for the telecommunications sector with the issuance of Department Circular No. HRA-003, Series of 2025 on July 28, 2025. The new policy mandates that telecom operators secure certifications under the ISO/IEC 27000 family of standards, internationally recognized benchmarks for information security management.

 

The measure stems from Republic Act No. 11659, which amended the Public Service Act to require telecom companies to maintain ISO certifications as a continuing qualification for retaining their franchise or authority to operate. It also draws from the SIM Registration Act (R.A. 11934), which obliges public telecommunications entities to adopt DICT-prescribed minimum cybersecurity standards to protect consumer data and national security.

 

Under the Circular, all natural and juridical persons engaged in the telecommunications business—except micro, small, and medium enterprises (MSMEs) covered by the Magna Carta for MSMEs—must comply with the prescribed standards. These include ISO/IEC 27001 on information security management systems, ISO/IEC 27002 on security controls, and ISO/IEC 27011 on telecom-specific protections, among others.

 

Telecom operators must obtain certifications from accreditation bodies recognized by the Department of Trade and Industry’s Philippine Accreditation Bureau. Maintaining such certifications will serve as an ongoing requirement for keeping a franchise or operating license from the National Telecommunications Commission (NTC). To ease the transition, companies are given a three-year compliance period. The NTC is also directed to issue guidelines on enforcement.

 

DICT Secretary Henry R. Aguda underscored that the policy aims to strengthen consumer protection and safeguard national security amid rising cyber threats. He noted that the adoption of international standards will also align the Philippine telecommunications sector with global best practices, enhancing investor confidence and ensuring more reliable and secure services for the public.