The Department of Information and Communications Technology (DICT) is speeding up work on a centralized CPAL portal, a public registry that will list accredited cybersecurity testing laboratories, the equipment they have assessed and the certifications they have issued. DICT Secretary Henry Aguda discussed the portal during the agency's first official inspection of RT&Co. Cybersecurity Inc., the country's first accredited Cybersecurity Posture Assessment Laboratory (CPAL) provider, Newsbytes.PH reported on September 10.
As of publication, only one outlet has reported the portal announcement; DICT has not published a separate release on it. The accreditation framework behind it, however, is a matter of public record, and this article draws on that record for background.
What CPAL is
CPAL stands for Cybersecurity Posture Assessment Laboratory. A CPAL is a DICT-accredited testing lab that evaluates whether technology deployed in the Philippines is secure. The program was set up under Department Circular No. HRA-003, Series of 2026, and covers the technical assessment of four categories of systems:
- Information and communications technology (ICT), meaning ordinary IT systems and software
- Operational technology (OT), the systems that run physical processes in utilities and factories
- Industrial control systems (ICS)
- Internet of Things (IoT) devices
DICT describes the program as a standardized and vendor-neutral way to evaluate technology. In the statement carried by Newsbytes.PH, the agency called CPAL more than a compliance framework and an important component of the country's cybersecurity and national resilience strategy.
What the portal will do
The planned Centralized CPAL Portal is intended to let government agencies, companies and the public verify three things in one place:
- Which laboratories are accredited
- The results of equipment assessments
- Certification credentials
Today, none of this is centrally searchable. A procurement officer or company buying, say, industrial controllers or network gear has no single place to confirm that a product was tested by an accredited lab. The portal is meant to close that gap. Aguda also asked for a policy paper on the CPAL program to be completed. No launch date for the portal was given.
DICT also expects the program to give Filipino cybersecurity professionals hands-on experience in testing and evaluating digital and industrial systems, which makes CPAL a workforce program as well as a compliance one.
What the accreditation rules require
Circular HRA-003 was issued on February 2, 2026 and prescribes the documents a lab must submit to become, or remain, a CPAL, according to an analysis by eLegal Philippines. The requirements fall into four groups:
- Legal and institutional documents, such as the certificate of registration or articles of incorporation, governance structure and organizational chart.
- Declarations and attestations, including a vendor-neutrality statement, a conflict-of-interest declaration, confidentiality and independence undertakings, and sworn statements.
- Facility and infrastructure documentation, including a description of the testing lab, network isolation, an inventory of cybersecurity tools and chain-of-custody procedures.
- Personnel and competency requirements, such as staff CVs, proof of employment, professional certifications and designated officers.
Accreditation is valid for one year and must be renewed annually. The rules apply to every public or private institution applying for CPAL accreditation and to every existing CPAL undergoing renewal or surveillance, the Ocampo & Suralvo Law Offices summary notes. The DICT Cybersecurity Bureau is the implementing office.
The vendor-neutrality requirement matters. It means an accredited lab cannot be tied to the makers of the equipment it tests, which is what gives the portal's listings their value as an independent check.
Why this lands now
The inspection and the portal push come during a difficult month for Philippine government cybersecurity. DICT and the Cybercrime Investigation and Coordinating Center have been responding to a wave of intrusions and defacements of government websites, and the newly opened National Cybersecurity Center is meant to watch over 25 agencies around the clock. A Viettel report earlier this year counted 335 million Philippine records exposed in data breaches in the first half of 2026.
CPAL addresses a different layer of the problem. Incident response deals with attacks already under way; product testing is meant to keep insecure equipment out of critical systems in the first place.
Who this affects in the Philippines
Three groups should watch the portal:
- Government procurement offices, which will gain a way to check whether ICT, OT and IoT products were assessed by an accredited lab before buying.
- Vendors and integrators selling into government and critical infrastructure, who may increasingly be asked for CPAL assessment results.
- Cybersecurity firms considering accreditation. With one accredited lab so far, the field is open, but the one-year validity and the documentary requirements above set a real bar.
DICT has not said whether CPAL assessment will become mandatory for any category of purchase. Until the policy paper Aguda requested is finished, the program remains a voluntary accreditation scheme with a single accredited provider.
