Furthermore, PROTECTION OF Cll infrastructures that power our virtual environment must be able to sustain operation before, during, or after any cyber incidences or attacks. To fully understand the importance of the ® critical information infrastructure in the we look at how this was described”: information supporting the critical infrastructure supporting essential of government business, and/or; information infrastructure oO essential to the national economy. For the purpose of this document, we shall define critical information infrastructure as, “critical infostruture whose failure or limited operation due to natural or man-made disasters HO impact on the majority of citizens.” However in order to bring everyone on the same page, this document will adopt the elements of infostructure, whether physical or virtual, cited under Prevention Act of 20127 as follows: computer systems, and/or networks, and/or computer programs, computer data and/or traffic data. 21 Mansfield, N. Organization for Economic Co-Operation and Development. Development of Policies for Protection of Critical Information Infrastructure. 2007. South Korea. into the regular or destruction of such systems and assets will on the other hand is a have debilitating impact on national security, where economic assessed security, national public health, of a government government (Certifying Body be or other institutions that program, although voluntary program, to standards). This still proposed as a in turn will institutionalize major activities that will help establish the the goal of implementing baseline for our cybersecurity capability and environment for the government. At Reactive and Manual state, a doctrine and the primary concern is to put out fires as opposed preventing the fire from spreading. At the Tools-Based state, tools and technologies are used to and Assessment However, agencies and organizations assist people in reacting faster. and 2) National Drill Exercises. classified as Cll shall have mandatory compliance to Level 3 and government At the Integrated The compliance agencies and organizations with sytems that the focus is on interoperability and assessment shall be of three levels:1) Protection As- have been classified under National Security sessment (inventory level), 2) Security System Assessment requirements (readiness) and, 3) Compliance shall be compliant with the relevant to standards on to Cyber Risks to Cll (voluntary). Information Security (ISO/IEC 27000). Cybersecurity Assessment and Compliance Establish i. Protection Assessment for National Cyber Drills and Exercises Project Project (Readiness) iii. Certificate of Compliance Program for situational awareness. to Cyber Risks Defense state, operation functions are ona predictive and agile level because After establishing the baseline results for the events are reviewed and assessment and compliance, analyzed government units shall participate in National Cyber Drills and Exercises. This shall become to Cll(Voluntary Program) Picture state, where standards are based on data exchange At the Dynamic (ICT Systems) ii. Security Assessment to finding the cause of the fire and a resilient ICT capacity in the protection of our critical infostructure: Compliance during cyber-attacks must be determined. voluntary program agencies may compliance our Clls, the government will focus on two unit. Level 3 by a third party institution To determine and establish the resiliency of would surely cause a tremendous the Cybercrime embedded programming composed infrastructure, and/or; information components becomes promote digital governance, the support components that such public safety and order. As our government works towards digitization of our government, it is also emphasized infostructure is so vital that interference and/ mandatory 4) ®&& KEY PROGRAM AREAS a compliance for all government to help the responders and operators identify, detect, mitigate, and recover from these attacks. agencies in order to sustain the development The strategic initiative of protecting the Cll of our cybersecurity towards the desired At the Resilient Enterprise state, under levels 1 and 2 shall become maturity level of our systems. the objective is predictive and mission-focused to isolate and Figure 3 illustrates the cybersecurity contain damage, secure supply maturity model?? and the agility state we chains, and a standard practice and will work as complementary the preparation of the Information to Systems Strategic Plan (ISSP) of any government agency. digital Since the ISSP is the blueprint of the environment of a government agency, this is an appropriate vehicle to ensure that compliance and assessment 22 desire to achieve the Resilient Enterprise. infrastructure to continue We operation through will not be able to defend not know are institutionalized during implementation Therefore, and well if we do 23 32 cyber-attacks. our strengths and weaknesses. in conducting a self-assessment, the level of the agility and speed R.A. No. 10175, Sec. 3 (j). protect key critical of response Lentz, R.(2011.)[PowerPoint slides]. http://www.dintel.org/Documentos/2011/Foros/ses2Mcafee/lentz.pdf 33