Security operations for Philippine organizations, staffed while you sleep.

Yes. The National Privacy Commission states that "the functions of the Security Incident Response Team (SIRT) may be outsourced," and that there is no precise formula for the team’s composition. What the NPC requires is that the members collectively be ready to assess and evaluate a security incident, restore integrity to the information and communications system, mitigate and remedy resulting damage, and comply with reporting requirements. A managed SOC can perform the detection, investigation, and containment work. One thing does not transfer: the NPC is explicit that the obligation to notify remains with the personal information controller even when processing is outsourced or subcontracted. Accountability stays with you, so the engagement needs a documented escalation path to your decision-makers.

The Implementing Rules and Regulations of the Data Privacy Act of 2012 require that the Commission and affected data subjects be notified within seventy-two (72) hours upon knowledge of, or when there is reasonable belief by the personal information controller or processor, that a notifiable personal data breach has occurred. Seventy-two hours is not long once you account for confirming what happened, determining which data and which data subjects are affected, and preparing a notice. That timeline is the practical argument for having monitoring, log retention, and an investigation process in place beforehand rather than assembling one during the incident.

No. The NPC states that notification is mandatory only when all of the required elements are present, so not every personal data breach is notifiable. However, documentation is broader than notification: the NPC requires that all security incidents and personal data breaches be documented through written reports, including those not covered by the notification requirements, and that any or all reports be made available when requested by the Commission. Personal information controllers and processors are also required to submit an Annual Report. In practice this means you need a defensible record of incidents you decided not to report, and the reasoning behind that decision.

BSP Circular No. 1232, Series of 2026, establishes a Cybersecurity Maturity Framework (CMF) and a Cybersecurity Control Self-Assessment (CCSA) for BSP Supervised Financial Institutions. The circular states that all BSFIs are required to have periodic and rigorous self-assessment exercises using more robust data sets and variables as part of their information security risk management system. Submission of the CCSA itself is narrower: it is required of BSFIs notified by the Bangko Sentral as having a moderate and complex IT Profile, plus other BSFIs specifically identified by the Bangko Sentral. Because the Bangko Sentral evaluates a BSFI’s cybersecurity maturity using the CCSA alongside other supervisory activities, the self-assessment should reflect controls you can actually evidence in operation.

Under BSP Circular 1232 the expected maturity is tied to IT Profile classification rather than to institution size alone. A Simple IT Profile maps to Foundational to Established, a Moderate IT Profile to Established to Managed, and a Complex IT Profile to Managed to Optimized. The practical consequence is that moving from Established to Managed generally means demonstrating that controls run continuously and produce evidence, not that a policy exists. Continuous monitoring, documented triage, and retained logs are usually what separate those two tiers in an examination.

No, and we would rather be precise about that than imply otherwise. Cyberuptive has team members based in Cebu who support regional coordination and client communication. Security operations themselves are delivered from our United States security operations center, which provides the 24/7 monitoring, triage, and escalation coverage. During discovery we document exactly which personnel perform which functions, where data is processed and retained, and how escalation reaches your team, so the arrangement can be assessed against your own contractual and regulatory commitments.

ISO/IEC 27001 is not a Philippine statutory requirement. It is a contractual one. Philippine service providers, particularly business process outsourcing firms and technology companies serving clients in the United States, European Union, Australia, and Japan, are frequently required to hold certification before those clients will place regulated or sensitive data with them. ISO 27001 is also referenced in BSP issuances on technology risk management. We are not a certification body and cannot certify you. What a managed SOC contributes is the operational evidence that several Annex A control areas depend on: monitoring, logging, vulnerability management, and incident response that demonstrably ran.

Manila is a constant eighteen hours ahead of Honolulu, and neither location observes daylight saving time, so the relationship never shifts. A Philippine business day of 08:00 to 17:00 corresponds to 14:00 to 23:00 in Honolulu. More usefully, 02:00 in Manila, a common hour for ransomware detonation precisely because nobody is watching, is 08:00 in Honolulu. Your unattended overnight window is our staffed business morning rather than the graveyard shift of a provider who is asleep at the same time you are.

Scope should be written before pricing. A vulnerability assessment and penetration testing engagement normally defines the in-scope systems and applications, whether testing is external, internal, or both, whether it is authenticated, the testing window, rules of engagement covering what testers may and may not do, and the reporting format including how findings are ranked and retested. Ask any provider whether a retest after remediation is included, because a report of unfixed findings satisfies almost no auditor or client. Our penetration testing services page sets out how we scope this work.