REPUBLIC OF THE PHILIPPINES DEPARTMENT OF INFORMATION AND. COMMUNICATIONS TECHNOLOGY DEPARTMENT CIRCULAR NO. oy JUN 0 2 2020 Series of 2020 RE: AMENDMENTS TO DEPARTMENT CIRCULAR NO. 2017 - 002, RE: PRESCRIBING THE PHILIPPINE GOVERNMENT'S CLOUD, FIRST POLICY. WHEREAS, the Department of Information and Communications Technology (DICT) is the primary policy, planning, coordinating, implementing, and administrative entity of the ecutive Branch of the government that will plan, develop, and promote the national Information and Communications ‘Technology (ICI) development agenda;' WHEREAS, it is the declared policy of the State to promote the development and widespread use of emerging ICT, and to foster and accelerate the convergence of ICT and ICT. enabled faciltes;? WHEREAS, the DICT is authorized to formulate, recommend, and implement national policies, plans, programs and guidelines that will promote the development and use of [CT with due consideration to the advantages of convergence and emerging technologies,’ WHEREAS, Department Circular (DC) No. 2017-002, re: Presmibing the Philippine Government's Cloud Virst Poly, declared it the policy of the government to adopt a “cloud first” approach and for government departments and agencies 10 consider cloud computing solutions as a primary part of their infostructuce planning and procurements! WHEREAS, the use of cloud computing offers the key advantages of giving access to the global system of solutions and services, and up-to-date digital innovations and services, in order to improve the citizen’s experience with government; WHEREAS, as a matter of global industry standards, cloud service providers maintain robust and up-to-date authentication systems and state-of-the-art technology to effectively address the continuing cybersecurity concems of their end users, and provide appropriate safeguards ‘against the breach in the confidentiality, integrity, or availability of the services, applications, o data stored in the cloud; WHEREAS, countsies across th world, including Singapore, Kingdom of Saudi Arabia, United States, Canada, United Kingdom, Chile, Australia, among other jurisdictions, have adopted 6, RA 10844 4 §5.1, Deparment Circular (DC) No, 2017-002. DICT Building, C.P. Garcia Avenue, Diliman, Quezon City 1104 Trunkline (+832) 8 920-0101 https:!/www dict. gov.phWHEREAS, the broad range of data owned and possessed by the Philippine government necessitates the use of appropriate data classification schemes that consider the different levels of data sensitivity, and the impact of unauthorized disclosure, use, alteration, and destruction of data, for purposes of ensuring that the security controls and protection chosen by government agencies ‘and instrumentalities in their cloud deployment models are commensurate to the associated data risks and vulnerabilities, with the end goal of maintaining secure data management systems that address relevant national security, confidentiality, and data privacy concerns; WHEREAS, while flesbilty, security, and costefficieney afforded by qualigy cloud ‘computing services is favored, che Philippine government does not relinquish any power or control over its data by virtue of its adoption of the technologys WHEREAS, Office of the President (OP) Memorandum Circular (MC) No. 78 s. 1964, as amended by OP MC 196 s. 1968, provides for rules governing security of classified matter in government offices; WHEREAS, Executive Order No. 2 s. 2016, provided guidelines to operationalize in the Executive Branch the people’s constitutional right to information, and the state policies for full public disclosure and transparency in the public service; WHEREAS, in accordance with §9, Chapter 2, Book VII of the 1987 Revised Administrative Code, the Department has, since the issuance of DC 2017-002 continued with its ageney rulemaking processes with due notice and public consultations, and duly considered the views submitted by interested parties and stakeholders from the public and private sectors, in an effort to address issues arising from policy implementation and its potential improvement in pursuit of public interest. NOW, THEREFORE, in view of the foregoing, in the exigencies of the service, and pursuant t0 the provisions of existing laws, rules, and regulations, the following directives are hereby issued: Section 1. Amendments to DC 2017-002—The following amendments to the provisions of DC 2017-002, re: Prescribing the Philippine Goremiment’ Clond First Poi, ace hereby "9.4. This Circular sall corer all exentve departments, barca, ofces, agencies, and insirumentalities of the National Government, incnding Gorerument Onned andor Controlid Corporations (GOCCS) and their subsidiaries, State Universities and Colleges (SUCS), and Leal Gaverament Units (LGUs). The implementation of this Cinedar shall tikevive caver coud. service providers, intermediaries, and otler private entities with transactions, contract, or data related to, nv convection with or arg fro the rendition of cond computing services forthe Philippine government. 3.2. The Pbilippine Congress, the Jndiciar, the Indkpendent Constitutional Commissions, andthe Office ofthe Onabudsmuan, are ereby encouraged to adopt ‘the Clond First Policy counterparts for their respective institutions in accordance Page 210sith tbe provisions of the Philippine Constitution, esting avs, crenlars, aes and realations. Whenever necesay, the DICT may be reqnesed to provide technical expert and assistance inthe derelopaent ere." Section 1.2. The provisions of §5.2, et seq., of DC 2017-002 on the Philippine government's general adoption of cloud computing for the storage, use, and processing of its data are hereby amended to read as follows: "5.2. Im the storage, use, and processing of data, all government agencies and iastramentaites of the Repu ofthe Pilppines sail adop cloud eompnting as ‘the preferred ICT deployment strategy, method, or technolegy fr adnanisrative se, or Jor the delivery of goverament semies. By aay of exception, ICT deployment strates, methods o eclnolees other than cloud computing may be nile provided tha the agency or instrumentality presets adnate, reasonable cand welleasoned usifeations to conch that: , Routine Service reports eon operations and exercises, ‘which comin information of value bat not of vital interest twa foreyen powers Roatine Intligence report AL Techel ater not of major importance but whic has 4 dsinc itary value or requires protection otherwise, ‘eye ew weapun elevate to influence minor tats or sevice tests of wa equipment of standard patter, Cerin personnel rears and staff matters £ Crtun compilations of data or items which individually ‘maybe classified RESTRICTED, of which may be tunclasafie, but the aggregation of which enfanees thir secunty val 1 Matters, investigations and documents of a personal and ‘sciphnary nature, the knowledge of which is desirable to seguir for adunisteative ens and or development vyHighly Sensive Data standaed of care and protccton higher than that preserbd for sensitive dats May be stored or processed inthe toad only 3 ‘necessary, in which case, a scare private cloud hosted in om premise infrastruc ‘within the tenitony or in other ertitores ‘ver which the Philippines has jorsdeto, shall be Utlizd. Thy Sensitive dita shall at alltimes besubjeet 10 specific encrypaion requirements consistent withthe standard of care and protection higher than tha presenbed for sensitive ad above sersitive data Identification of perionne being investigated for misconduct, antmaly or fraud prioe ro the fling of appropriate charges or completion ofthe Findings of boards created for sich pros. (Official data Eling clas a8 “Top Scere and “Secret under MC 78 5 1964, and the ke, Ft may include 2. Very important political dncuments dating with suel traitor ax negotiate for major alliances, 1. Major governmental projects auch as drastic proposals to adjust the nation’s economy (before offical publication) «© Matter chting to new and fa reaching experimental, technical and sckntfe developments in methods of warfare ‘or defense eg, vital mater relaing to atomie war defense again biolopeal wate or matter affecting Forure operational state «Information which wold indicate the capabilities oF major sucecrsts of our antelgence services or which would imped secret sources, £. Ciel informacion about erypeography in so far as it relates to devices and equipment under developmen fp Cena compulations of data or items whieh indivislly ‘may be chsifed SECRET of lower, but which collectively be pat sn inher pad, igh level direerves dealing with important negotiations (as dissin from major negotiations wiich would be inthe TOP SECRIET eateyory) with other countries i Propose for new schemes of goverment or other contol, foreknowledge of which would seriously prejudice their operation: ). Matters tlating to cern new methods of warfare oF ‘fens, inelading siete and technical developments, ‘ot chssifed a8 TOP SECRET, ep, new designs of Service sorcraft, guided projects, tanks, radar and an-submarine ovis») SECRET grading ie uated i (0) Ir materly influences a major aspect of miliary tates, 0) It involves» noel principe apiicable w existe trmportant projets: (3) ese sufficiently revolutionary to rele in a major audsance in existing teliniques ori the performance of Coty secret weapons (@) less liable to compeomise sume other projeets already so graded Ie Phin or demi of achernes for the defense of areas other than etal strate areas, including plans or paticuaes oF ‘operations conmected ith ther. Vital miliary information, iachading photographs, maps, se, relating to impurtant defenses, establishments, snd Page 10 of 11f telligence which is notin the TOP SECRET category bbut which would reveal a sceret source, oF the value of which depenals upon concealing the fct that we posses it - Capptographic devices and equipment unless specifically enn toa lower elssfcation. 1s Ceres compilations of data or items which individually may be classified CONFIDENTIAL or lower, but which collectively shouldbe put in a higher grade ‘This generally includes politi! documents dealing with smarters of international acgotiations, technical matters of sritay esa, major governmental projecte such as proponals to adjust the nation’s economy (before official ppubbeation) intemal audit data, sade sere, technical data supporting technology transfer agreements Page 11 of 11