RMO No. 15-2014: Prescribes the revised Information and Communications Technology (ICT) Security Policy

Key points

1. Coverage. The Policy applies to all BIR employees and to third parties who develop, administer, maintain or process BIR information assets, directly or indirectly. These include partners, government agencies, contractors, temporary employees, consultants, third party service providers, taxpayers and the public. Compliance is mandatory.
2. Access to documents. Information asset owners, custodians and users may access the ICT Security documents, except those classified Confidential to the Information Systems Group (ISG). Third parties may access only documents classified Public, and viewing Confidential documents needs approval of the Deputy Commissioner (DCIR) – ISG.
3. Supporting documents. Standards, guidelines and procedures classified Internal Use have corresponding Revenue Memorandum Orders. Those classified Confidential to ISG get an ISG Memorandum Order prepared by the Security Management Division (SMD) or IT Planning and Standards Division (ITPSD) and approved by the DCIR-ISG.
4. Custody and review. SMD is the custodian of the Policy and its Manual, and with ITPSD manages and maintains the document. SMD reviews the Manual yearly and whenever significant events occur, such as security incidents, new vulnerabilities, structural changes, new government requirements, or legal and contractual obligations.
5. Responsibility and violations. Heads of Offices monitor adherence to the Policy. Violations subject the offender to immediate disciplinary and/or legal action.

Who is affected

• All BIR employees
• Third parties handling BIR information assets
• Heads of Offices

Deadlines and effectivity

• Manual reviewed annually and when significant events occur
• Issued March 24, 2014