1.1 Continue, enhance, and expand the Cybersecurity Planning Committee to involve and meet the cybersecurity needs of an increasing number of stakeholders.

1.2 Develop and promulgate a cybersecurity framework based on industry leading practices, such as the NIST CSF.

1.3 Develop, test, and enhance cyber incident response and business continuity plans, processes, and procedures.

2.1 Perform continual, comprehensive, and periodic (e.g., annual) cyber risk assessments.

2.2 Maintain complete inventories of IT and operational technology (OT) hardware and software owned or operated by or on behalf of government entities.

2.3 Continually assess government entities’ cybersecurity maturity and identify areas for enhancement.

2.4 Obtain CISA Cyber Hygiene assessments across external government networks and web applications.

2.5 Perform recurring vulnerability scans of internal and external networks, systems, and applications.

3.1 Migrate all remaining and appropriate government domains to the .gov Internet domain.

3.2 Upgrade or replace outdated, end-of-life, and unsupported software.

3.3 Establish effective software patch management processes.

3.4 Implement architectural measures and controls to protect data at rest and in transit from unauthorized access and use.

3.5 Enhance identity and access management, particularly for administrative and other privileged accounts.

• 3.5.1 Implement strong password policies and controls.

• 3.5.2 Require Multi-Factor Authentication (MFA) for public services and government accounts.

3.6 Implement and enhance system and network logging and monitoring capabilities.

4.1 Adopt and leverage the NICE Framework (i.e., Workforce Framework for Cybersecurity) to build and enhance cyber workforce development, training, and retention programs.

4.2 Continually deliver cybersecurity awareness training to all government personnel, including simulated phishing campaigns targeting specific users.

4.3 Develop and provide specialized, role-and skills-based cybersecurity training for cyber, IT, and OT teams.

4.4 Establish a cybersecurity mentorship program between students and cyber & IT professionals.

5.1 Develop and launch cyber awareness and education initiatives for businesses, educational institutions, and citizens.

5.2 Establish and enhance public-private partnerships aimed at improving cybersecurity across Puerto Rico.