DICT Provides Mandatory Documentary Requirements for Cybersecurity Evaluations and Cybersecurity Posture Assessment Laboratory Certification
On February 2, 2026, the Department of Information and Communications Technology (DICT) issued Department Circular No. HRA-003 with the subject “Prescribing Mandatory Documentary Requirements for the Accreditation and Renewal of Cybersecurity Testing Laboratories under the Cybersecurity Posture Assessment Laboratory Framework”. The purpose of the circular in order to prescribe the mandatory documentary requirements for institutions applying for initial accreditation or renewal of Cybersecurity Posture Assessment Laboratory (CPAL) accredited cybersecurity testing laboratories and to designate the DICT-Cybersecurity Bureau (CSB) as the implementing, accrediting and oversight office for evaluating compliance with these requirements. Accreditation granted by the CSB will be in effect for 1 year from its issuance.
The general documentary requirements that all applicant institutions must submit to the CSB are the following:
1. Legal and Institutional Documents
i. Certificate of Registration (Securities and Exchange Commission (SEC), Cooperative Development Authority (CDA), State Universities and Colleges (SUC) Charter, or equivalent)
ii. Articles of Incorporation or Institutional Charter
iii. Organizational Profile and Governance Structure
iv. Organizational Chart identifying testing, compliance, and oversight roles
2. Declarations and Attestations
i. Vendor Neutrality and Conflict of Interest Declaration
ii. Data Confidentiality and Non-Disclosure Undertaking
iii. Declaration of Independence from manufacturers, distributors, or resellers
iv. Sworn Statement attesting to the accuracy and completeness of submissions
3. Facility and Infrastructure Documentation
i. Description of cybersecurity testing facilities
ii. Network isolation and test environment architecture
iii. Inventory of testing tools and platforms
iv. Device handling and chain-of-custody procedures
4. Personnel and Competency Requirements.
i. Curriculum vitae of cybersecurity testing personnel
ii. Valid professional certifications (e.g., ISO/IEC 15408 (evaluators and certifiers of products), ISO/IEC 18045 (for laboratory managers and quality assurance personnel), Security+, CEH, OSCP, CISSP, CREST, GICSP (cybersecurity standards)
iii. Proof of institutional employment or appointment
iv. Designation of the following:
- Laboratory Head or Test Manager
- Compliance or Ethics Officer
In order to demonstrate compliance with international standards, the CSB will also require submission of:
1. Laboratory and Quality Management
i. ISO/IEC 17025 Certification or formal declaration of alignment
ii. ISO/IEC 27001 Certification or equivalent information security controls
iii. ISO 9001 Certification, where available
2. Cybersecurity Standards Alignment. Documented alignment with frameworks such as:
i. NIST SP 800 series
ii. ISO/IEC 15408 (Common Criteria)
iii. ISO/IEC 17065 (Conformity Assessment requirements for bodies certifying products, processes, and services)
iv. CIS Benchmark
v. IEC 62443 (for ICS/OT systems)
3. Tool Validation
i. Licensing, validation, or version control records for testing tools
ii. Calibration or configuration records for critical test platforms
In addition, the CSB may also require the submission of the following:
1. Customer or stakeholder satisfaction survey results
2.Client feedback summaries or evaluation reports
3. Evidence of corrective actions taken in response to feedback
4. Sample Test Execution Reports (TERs) or anonymized assessment summaries
It should be noted that academic institutions may satisfy this requirement through institutional evaluation reports, externally reviewed project outputs, or audit feedback.
Finally, renewal or continued accreditation will be subject to the submission of:
1. Annual Compliance Self-Assessment Checklist
2. Updated Vendor Neutrality and Conflict of Interest Declaration
3. Incident Disclosure Reports, if any
4. Technical Capability Update (tools, personnel, scope)
5. Corrective Action Plans addressing prior audit findings
6. Personnel and competencies requirement
The full issuance may be accessed here.