Law / United States / 
Puerto Rico
Government Cybersecurity Act, agency cybersecurity programs and minimum standards for agencies and contracted service providers
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to the Executive Branch of Puerto Rico, including its agencies, public corporations and municipalities, and to any natural or legal person that does business or holds contracts with the Government, including private persons who perform public functions and services, but only as to the public functions and services performed and the data generated by them; a business with no such relationship to the Government is outside the Act.
- As an Agency, develop, document and implement, in collaboration with PRITS, a cybersecurity program that includes all of your information assets (including information technology services provided by third parties), a cybersecurity risk assessment performed at least once a year, an education plan for staff, contractors and the public, and an internal and external vulnerability evaluation (a penetration test) to validate your controls.
- As an Agency or a contracted service provider, meet, and make every natural or legal person that does business or contracts with you meet, the minimum cybersecurity standards listed in Article 7, which include layered access controls, NIST-based encryption of data in transit and at rest, remote access only through a virtual private network, malware and intrusion detection controls, data classification by criticality followed by multi-factor authentication for every user, role-based least-privilege access, payment card industry data security standards (or best practice) for card payments on an agency portal, and data backup and recovery plans folded into the agency contingency plan.
- Encrypt confidential information (such as personally identifiable information) in all its states, in transit and at rest; it may not be left exposed or unprotected in any circumstance.
- As a contracted service provider, include safeguards for sensitive assets in your contract, comply with the federal information security management law, and keep no less than three years of information; if your services relate to cybersecurity, or require sensitive citizen information to reside on your systems, hold every valid security certification PRITS requires when the contract is signed.
- As an Agency, consult PRITS before any contract, amendment, renewal or extension with a contracted service provider about the minimum cybersecurity requirements the provider must meet; a contract signed without that consultation must be sent to PRITS for evaluation and may be cancelled if it does not comply or cannot be amended to comply.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Article 10 lets PRITS fine an Agency not less than 50 and not more than 100 dollars per day per Incident, and, where there is obstruction, negligence, bad faith, recklessness or capricious refusal in handling or reporting a cyberattack, not less than 1,000 and not more than 5,000 dollars per violation.
- Rule
- Per violation only
- As of
- Minimum
- 1,000
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
The Puerto Rico Innovation and Technology Service (PRITS), which may fine a non-complying Agency after notice and an opportunity to be heard (Article 10).
What this law does
The Act applies to the Executive Branch, including every department, board, agency, public corporation and municipality, and to any natural or legal person that does business or holds contracts with the Government, but a private person performing public functions and services is covered only as to those functions and services.
Every Agency, in collaboration with PRITS, must develop, document and implement a cybersecurity program that covers all of its information assets, includes an annual cybersecurity risk assessment and includes an internal and external vulnerability evaluation. Every Agency and every contracted service provider must meet, and make every person that does business or contracts with them meet, the minimum cybersecurity standards that Article 7 lists.
Confidential information must be encrypted in transit and at rest. The Act states as public policy a prohibition on any covered agency or person paying a ransom in response to ransomware, with case-by-case exceptions for critical infrastructure or an imminent risk to life. The Government has six months to finish the steps needed to comply. The compilation of the Act incorporates the amendments made by Ley 140-2026.