You can study cybersecurity in the Philippines, several schools award a degree with that exact name, and nobody licenses the profession. What you cannot assume is that two cybersecurity degrees contain the same thing. CHED has not issued a programme standard for this field, so the curriculum is the school's own work. That single fact should drive how you compare offers.
What CHED has, and what it does not
CHED sets national curricula through memorandum orders called policies, standards and guidelines. Computing has one: CMO No. 25, s. 2015, the revised PSGs for BS Computer Science, BS Information Systems and BS Information Technology. CHED's published index of memorandum orders carries no equivalent for a cybersecurity degree.
CMO No. 25 does take security seriously inside the programmes it governs. Information Assurance and Security is listed as a required knowledge area for computer science and for information technology, following the ACM curricula the order references. The BSIT professional course list carries Information Assurance and Security 1 and 2 as separate three-unit courses, alongside Networking 1 and 2, Systems Administration and Maintenance, Systems Integration and Architecture, and a six-unit practicum.
So a BSIT graduate is not starting from zero. A dedicated cybersecurity degree simply spends far more of the four years on the same territory.
Programmes without a PSG still need government authority. CHED processes applications for government authority to operate undergraduate programmes through issuances of its own - the general procedures date back to CMO No. 38, s. 2004 and have been amended since - and state universities route new programmes through their own governing boards. When you are looking at a school, ask for the authority covering the exact programme name on the diploma, not a related one.
Which schools offer it
A handful of schools publish a dedicated cybersecurity degree on their own sites:
- University of Science and Technology of Southern Philippines offers a BS in Cybersecurity, describing it as providing "inter-disciplinary knowledge and skills to contribute to the pool of cyber security professionals in the country as part of the National Cybersecurity Plan," covering technology, strategy, policy, legality and standards.
- University of the Visayas offers a BS in Cybersecurity through its College of Engineering, Technology and Architecture, covering network protection, ethical hacking and digital forensics.
- Lyceum of the Philippines University-Batangas offers a BS in Cybersecurity under its College of Computing, Arts and Sciences.
- Manila Central University takes the other approach: BS Information Technology with a certificate in cybersecurity.
That last model is common and worth understanding. Many schools deliver security as a specialisation, track or certificate attached to BSIT or BS Computer Science rather than as a separate degree. Neither approach is automatically better. The specialisation route gives you a degree with a national standard behind it; the dedicated degree gives you more security units. What decides it is the actual checklist.
How to read a cybersecurity curriculum
Because there is no PSG to compare against, use this instead. A serious programme has real depth in the four foundations that security is built on, then security on top:
| Foundation | What to look for |
|---|---|
| Networking | At least two courses, with hands-on routing, switching and packet analysis - not one survey subject |
| Operating systems | Linux and Windows administration, not just an OS theory course |
| Programming | Enough to script and automate, plus one course where you read other people's code |
| Data and databases | Database systems and, ideally, an introduction to data handling and logging |
| Security proper | Network security, application security, cryptography, incident response, digital forensics, governance and risk |
Then check the parts a brochure will not tell you:
- Is there a dedicated laboratory, and can students run isolated virtual environments?
- Does the programme require an internship, and where have students actually been placed?
- Do faculty hold industry certifications or come from practice?
- Is there a capstone that produces something you can show an interviewer?
- Does the school run or join capture-the-flag competitions?
A programme that answers those well is worth more than the word "cybersecurity" on the diploma.
The certifications that stand in for a licence
Nobody licenses security practitioners here. The PRC's 46 professional regulatory boards do not include one for cybersecurity, information security or computing generally. The market substitutes private certification, and employers do read it.
The ones you will see in Philippine job postings:
- CompTIA Security+ - the common entry credential. CompTIA recommends Network+ and around two years of experience in a security or systems administration role, but does not require them as prerequisites. The current version covers general security concepts, threats and mitigations, security architecture, security operations, and security programme management.
- EC-Council Certified Ethical Hacker (CEH) - widely requested for offensive-security and penetration-testing roles.
- ISC2 CISSP - the senior credential, with five years of required work experience and eight domains, from security and risk management through software development security. It is not a graduation-day certificate.
- ISC2 Certified in Cybersecurity (CC) - ISC2's entry-level credential for people starting the career.
A sensible plan for a student: build the foundations during the degree, sit an entry-level certification near graduation or in the first job, and treat CISSP as a five-years-out target. Costs and exam windows for all of these are set by the issuing bodies and change; check their own pages rather than a review centre's summary.
The law you are expected to know
Two statutes come up constantly in Philippine security work.
Republic Act No. 10175, the Cybercrime Prevention Act of 2012, defines cybercrime offences and the investigative and enforcement machinery around them. It is the reason "authorised testing" language exists in every legitimate penetration-testing engagement letter.
Republic Act No. 10173, the Data Privacy Act of 2012, governs personal data. Section 21 makes each personal information controller responsible for the data under its control and requires it to "designate an individual or individuals who are accountable for the organizations compliance with this Act." That sentence is where the data protection officer role comes from, and DPO or privacy-compliance work is one of the most reliable entry points into the field for graduates who prefer governance to hacking.
If a curriculum has no course touching either law, that is a gap worth asking about.
Careers and the honest version of the job market
Realistic first roles are security operations centre analyst, IT support or systems administration with a security brief, junior network engineer, governance-risk-and-compliance analyst, and data privacy or compliance associate. Penetration tester and incident responder are usually second or third jobs, not first ones, because employers want operational experience behind them.
The employers are banks and other financial institutions, business process outsourcing and shared-services companies serving overseas clients, telcos, government agencies, and the consulting and audit firms that sell security services. The outsourcing sector is a large part of why security roles exist in the Philippines at all, and it also means night-shift work is common early on.
Two cautions worth stating plainly. First, salary claims for this field circulate widely online and are rarely sourced; treat any specific figure without a named survey behind it as marketing. Second, entry-level demand is thinner than the headlines about a global skills shortage suggest, because much of that shortage is for experienced people. The graduates who land jobs quickly are the ones with something to show - a home lab, competition results, an internship, a certification.
For a wider view of how computing degrees compare in demand, see our guides on the best IT schools in the Philippines and in-demand courses in the Philippines. Senior high students heading this way usually come through the ICT strand, though no school requires it.
Sources
- CHED Memorandum Order No. 25, s. 2015 — Revised Policies, Standards and Guidelines for BS Computer Science, BS Information Systems and BS Information Technology
- Commission on Higher Education — index of CHED Memorandum Orders by year
- Professional Regulation Commission — Professional Regulatory Boards
- University of Science and Technology of Southern Philippines — BS in Cybersecurity
- University of the Visayas — Bachelor of Science in Cybersecurity
- Lyceum of the Philippines University-Batangas — Bachelor of Science in Cybersecurity
- Manila Central University — BS Information Technology with Certificate in Cybersecurity
- CompTIA — Security+ certification
- ISC2 — CISSP certification
- Republic Act No. 10175 — Cybercrime Prevention Act of 2012 (LawPhil)
- Republic Act No. 10173 — Data Privacy Act of 2012 (LawPhil)
