BIR Form 2307 for Cybersecurity Consultants and Penetration Testers: Technical Consultant Rate or IT Service Rate?
A business that engages a cybersecurity consultant or penetration tester for advisory, assessment, or testing work withholds expanded withholding tax (EWT) and issues BIR Form 2307, because this work falls under the “management and technical consultants” item of Section 2.57.2(A), Revenue Regulations (RR) No. 2-98, as amended by RR No. 11-2018 — the same bracket this series already covers for software developers and IT consultants. There is no separate, dedicated cybersecurity ATC; the rate turns on the payee’s individual-vs-corporate status.
This guide is part of the BIR Form 2307 series. It covers why cybersecurity work sits in the technical-consultant bracket rather than a distinct code, the individual-vs-firm rate split, and a worked example for a penetration-testing engagement.
Generate a Cybersecurity Consultant's BIR Form 2307 FREE →Does “technical consultant” cover cybersecurity and penetration testing work? #
Yes — RR No. 2-98’s named-professional enumeration covers “management and technical consultants” as a category, and a cybersecurity consultant performing a security assessment, vulnerability scan, penetration test, or incident-response advisory is providing technical consulting services within that description. The regulation does not list cybersecurity by name the way it names architects or engineers, but it does not need to: the item is defined by the nature of the service (technical advisory and assessment work) rather than by an exhaustive list of every specialty.
“…the following individuals shall be subjected to expanded withholding tax: …management and technical consultants…”
— Section 2.57.2(A) of Revenue Regulations No. 2-98, as amended, listing individually engaged professionals subject to expanded withholding tax
This is the same reasoning this series applies to software developers and IT consultants: a client retaining a cybersecurity professional to test or harden its systems is paying for technical consulting, not purchasing packaged software or hardware, so the engagement falls under this bracket rather than a goods-purchase or general-contractor rate.
Individual consultant or security firm — why the payee type changes the rate #
The ATC and rate depend on whether the payee is the individual cybersecurity consultant or a security/IT consulting firm organized as a corporation, the same individual-vs-entity split applied throughout this series.
| Payee | Condition | ATC | Rate |
|---|---|---|---|
| Individual cybersecurity consultant/penetration tester | Gross income for the current year ≤ ₱3,000,000, and a valid sworn declaration is on file | WI010 | 5% |
| Individual cybersecurity consultant/penetration tester | Gross income for the current year > ₱3,000,000, VAT-registered, or no valid declaration on file | WI011 | 10% |
| Cybersecurity/IT security firm organized as a corporation | Gross income for the current year ≤ ₱720,000 | WC010 | 10% |
| Cybersecurity/IT security firm organized as a corporation | Gross income for the current year > ₱720,000 | WC011 | 15% |
A fintech company that retains an independent penetration tester working under their own name and TIN withholds at WI010/WI011. The same company paying an invoice from “SecureStack Consulting, Inc.” for an identical penetration test withholds at WC010/WC011 instead — the service is the same, but the payee’s legal form changes the code and rate.
Who withholds on a cybersecurity engagement? #
Any business that pays an individual or firm to assess, test, or advise on its information security is a withholding agent on that payment, regardless of whether the output is a one-time report or an ongoing retainer. Common examples:
- A bank engaging an independent consultant to run an annual penetration test on its online banking platform
- An e-commerce company retaining a security firm for a PCI-DSS compliance assessment
- A corporation paying a consultant for an incident-response retainer following a breach
- A BPO engaging a vulnerability-assessment specialist ahead of a client security audit
As with any other named professional under this bracket, the individual consultant secures the lower 5% rate by filing an Income Payee’s Sworn Declaration of Gross Receipts/Sales with the paying business, together with a copy of their BIR Certificate of Registration — see BIR Form 2307 for Professional Fees for how this declaration works.
Worked example: a bank’s annual penetration test #
Metro Savings Bank engages Consultant Carlo Dizon, an individually practicing cybersecurity consultant, for a fixed project fee of ₱350,000 to conduct an annual penetration test of its online banking platform. Dizon bills the bank directly under his own name and TIN and has an Income Payee’s Sworn Declaration of Gross Receipts/Sales (Annex “B-1”) on file confirming his gross income for the year has not exceeded ₱3,000,000, so ATC WI010 at 5% applies.
| Item | Amount |
|---|---|
| Gross consulting fee | ₱350,000.00 |
| EWT withheld (5%, ATC WI010) | ₱17,500.00 |
| Net amount paid to Consultant Dizon | ₱332,500.00 |
The bank remits the ₱17,500 withheld through BIR Form 0619-E monthly and BIR Form 1601-EQ quarterly, and issues Dizon a BIR Form 2307 showing the fee, ATC WI010, and the amount withheld — which he credits against his income tax due. Had the bank instead engaged “SecureStack Consulting, Inc.,” a corporation, for the identical penetration test, it would withhold using ATC WC010 at 10% (assuming the firm’s gross income for the year does not exceed ₱720,000) — ₱35,000 withheld on the same ₱350,000 fee.
Frequently asked questions #
Is a cybersecurity consultant’s fee subject to expanded withholding tax? #
Yes. A cybersecurity consultant or penetration tester engaged directly by a business for advisory, assessment, or testing work falls under the “management and technical consultants” item of Section 2.57.2(A) of Revenue Regulations No. 2-98, as amended by RR No. 11-2018 — the same technical-consultant bracket this series covers for software developers and IT consultants.
What withholding tax rate applies to an individual cybersecurity consultant? #
An individually engaged cybersecurity consultant is withheld at 5% (ATC WI010) if their gross income for the current year does not exceed ₱3,000,000 and a sworn declaration is on file, or 10% (ATC WI011) if it exceeds ₱3,000,000, the consultant is VAT-registered, or no valid declaration has been submitted.
Does the rate change if a cybersecurity firm is engaged instead of an individual consultant? #
Yes. If the payee is a cybersecurity or IT security firm organized as a corporation rather than the individual consultant, the payment falls under the corporate professional-fee item: 10% (ATC WC010) if the firm’s gross income for the current year does not exceed ₱720,000, or 15% (ATC WC011) if it exceeds ₱720,000.
Is a penetration test treated differently from ongoing security monitoring? #
Not for ATC purposes. A one-time penetration test, a periodic vulnerability assessment, and an ongoing security advisory retainer are all payments for a technical consulting service to the same client, so they fall under the same WI010/WI011 or WC010/WC011 bracket regardless of whether the engagement is a single project or a recurring contract.
Summary #
Cybersecurity consultants and penetration testers fall under the same “management and technical consultants” item of RR No. 2-98 that covers other individually engaged advisory professionals — there is no separate cybersecurity-specific ATC. An individual consultant is withheld at 5%/10% (ATC WI010/WI011) once a sworn declaration is on file, while a cybersecurity or IT security firm organized as a corporation is withheld at 10%/15% (ATC WC010/WC011) based on its own gross income threshold. For the general consultant mechanics this builds on, see BIR Form 2307 for Professional Fees, and for the closely parallel IT scenario, see BIR Form 2307 for Software Developers and IT Consultants.