Law / United States / 
Puerto Rico
Government Cybersecurity Act, incident reporting to the Puerto Rico Innovation and Technology Service
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Security, Reporting
As of .
What it requires
- Applies to Agencies, and, for the notice and reporting duties in Articles 7(10) and 7(11), to contracted service providers of information and communications technology and to external providers under a cybersecurity services contract; a business with no contract with the Government is outside the Act.
- As an information and communications technology contracted service provider, share information and notify PRITS and the contracting Agency within 48 hours (no más de cuarenta y ocho horas) of discovering a cybersecurity incident, or a potential incident, that may put at risk the confidential data, software products, firmware or services of the Government or of any natural or legal person.
- As an external provider under a cybersecurity services contract, file monthly reports with PRITS on the cybersecurity status of the information systems and any sensitive asset managed on behalf of the Agency, covering the threats detected, threat actors and vulnerabilities, the immediate response and remediation actions, the total number of information security incidents reported to PRITS through the cybersecurity incident reporting platform, and the assessment of the cybersecurity status.
- As an Agency, report any suspected security incident to the Office for the Evaluation of Cyber Incidents so that the Office, in coordination with the Agency, carries out incident management, and comply with the Office's requirements and requests and implement the recommendations or directives it notifies.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Article 10 lets PRITS fine an Agency not less than 50 and not more than 100 dollars per day per Incident, and, where there is obstruction, negligence, bad faith, recklessness or capricious refusal in handling or reporting a cyberattack, not less than 1,000 and not more than 5,000 dollars per violation.
- Rule
- Per violation only
- As of
- Minimum
- 1,000
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
The Puerto Rico Innovation and Technology Service (PRITS), which may fine a non-complying Agency after notice and an opportunity to be heard (Article 10).
What this law does
A contracted service provider of information and communications technology must share information with, and notify, PRITS and the contracting Agency within 48 hours of discovering a cybersecurity incident or a potential incident that could put Government data, software products, firmware or services at risk.
Under any cybersecurity services contract, the external provider must file monthly reports with PRITS on the cybersecurity status of the information systems and sensitive assets it manages for the Agency. Every Agency must report any suspected security incident to the Office for the Evaluation of Cyber Incidents so that the Office, in coordination with the Agency, carries out incident management.
The Office for the Evaluation of Cyber Incidents must file a quarterly report with the House of Representatives and the Senate. A contracted service provider identified as responsible for the conduct that Article 10 describes is subject to monetary sanctions up to the contracted amount. A contracted service provider identified as responsible, and an entity with a significant number of the same people, may not be contracted by an Agency or a Government contractor for five years.