On September 9, 2026, the Federal Bureau of Investigation ("FBI" or the "Bureau") released its first unclassified Cyber Strategy (the "Strategy"), a public statement, issued in full without a classified annex, of how the Bureau intends to investigate and disrupt cyber adversaries, support victims, work with partners, and build its own capabilities.[1] The Strategy implements the Administration's Cyber Strategy for America of March 2026 and was issued weeks after the presidential memorandum of August 12, 2026 that directed the Departments of Justice and Homeland Security to establish a program for vetted private companies to act against transnational cyber-enabled crime.[2] In this Legal Update, we summarize the Strategy's commitments to victims, identify what those commitments do and do not change as a matter of law, and set out practical implications for companies in Puerto Rico that must decide, often within hours, whether and how to involve the FBI.
The Strategy is a policy document. It creates no new legal rights or protections, and the decision to engage the FBI continues to be governed by existing statutes, the company's contracts, and the privilege and preservation considerations that attach to any incident. What the Strategy changes is the Bureau's stated posture, and that posture is relevant to how counsel sequences a report to the FBI alongside the 10-day notice to the Departamento de Asuntos del Consumidor ("DACO"), the 48-hour notice that government vendors owe the Puerto Rico Innovation and Technology Service ("PRITS"), and the federal sector-specific requirements.
The Strategy's Commitments to Victims
The Strategy is organized around four pillars: investigating, disrupting, and imposing costs on cyber adversaries; supporting victims; increasing impact through partnerships; and enhancing the Bureau's cyber capabilities. For companies, the second pillar is the operative one. The Bureau commits to pursue the actor rather than the victim, to limit its evidence collection to what the crime requires using the least intrusive feasible method, to notify compromised or at-risk organizations proactively, and to shorten the interval between its detection of a threat and its notification of affected companies through automated indicator sharing. It also describes the resources available to victims: Cyber Threat Teams and a Cyber Action Team for significant incidents, coordinators for industrial control systems in every field office, and the Recovery Asset Team, which works with financial institutions to freeze fraudulent transfers, the mechanism most relevant to business email compromise.
The third pillar describes the Bureau's partnership structures, including the National Cyber Investigative Joint Task Force and the Joint Ransomware Task Force co-chaired with CISA, and its channels for private-sector engagement. The fourth addresses workforce and tools, including court-authorized remote collection and disruption capabilities and the use of AI-enabled tools, which the Strategy states will remain subject to human review and legal controls.
What the Strategy Does Not Change
Reporting remains voluntary, and protections come from statute. No federal law requires a private company to report a cyber incident to the FBI. Where protections for sharing exist, they derive from statute rather than from the Strategy. The Cybersecurity Information Sharing Act of 2015 provides liability and antitrust protections for sharing cyber threat indicators in accordance with its procedures; its authorities currently expire on December 11, 2026 unless Congress acts.[3] CIRCIA, once its final rule takes effect, will attach protections to reports made to CISA, including limits on regulatory use and preservation of privilege, on the terms the statute and the rule set.[4] Counsel should confirm which channel a disclosure uses and which protections follow.
Privilege is not preserved by the Bureau's good intentions. Most federal courts of appeals reject the doctrine of selective waiver: a company that discloses privileged analysis to the government generally cannot assert privilege over the same material against private litigants.[5] The Strategy's pledge to collect only what the crime requires does not alter that rule. The workable approach is to share facts and indicators (which systems were affected, when, and by what means) while withholding legal analysis and the forensic firm's conclusions, and to document that the disclosure was limited.
Regulatory and statutory periods continue to run. Engagement with the FBI does not suspend the notification periods discussed in our forthcoming Legal Update on breach notification obligations in Puerto Rico and under federal law. Ley Núm. 111-2005 permits a delay in notice to affected individuals where law enforcement determines that notice would impede an investigation; the 10-day period for notice to DACO is not extended.[6] For vendors to the Government of Puerto Rico, the 48-hour notice to PRITS and the contracting agency under Ley Núm. 40-2024 runs independently of any report to the FBI, and the Oficina para la Evaluación de Incidentes Cibernéticos within PRITS, not the Bureau, is the Government's receiving office.[7] HIPAA permits disclosures of protected health information to law enforcement within defined limits, which should be observed when the data at issue is health data.[8]
Sanctions screening and the FBI report are linked. OFAC's ransomware advisories identify a timely report to law enforcement and cooperation with the investigation as significant mitigating factors in any enforcement determination arising from a ransom payment.[9] A company weighing a payment therefore has a concrete legal reason to involve the FBI early, independent of the Strategy.
Active measures remain off limits. The August 12, 2026 memorandum contemplates vetted, contracted companies acting under DOJ and DHS supervision. The Computer Fraud and Abuse Act is unchanged for everyone else.[10]
Considerations Specific to Puerto Rico
The FBI's San Juan Field Office is the Bureau's point of contact for incidents affecting companies in Puerto Rico, and the Strategy's emphasis on pre-incident relationships applies there as anywhere. Two local features bear on the decision to engage. First, because DACO publishes notices within 24 hours of receipt, a company that reports to the FBI and then notifies DACO should expect the incident to become public on DACO's timetable, not the Bureau's; the law-enforcement delay reaches the resident notice only. Second, business email compromise is consistently among the largest categories of loss in the FBI's annual Internet Crime Report, and the Recovery Asset Team's ability to freeze a wire depends on a report to the Internet Crime Complaint Center within hours of the transfer; the incident response plan should treat that report as a same-day action.
Practical Implications for Companies
We will continue to monitor developments, including the procedures for the program established under the August 12, 2026 memorandum, and will provide further updates as warranted. If you have questions about the matters discussed in this Legal Update, please contact the MZLS lawyers with whom you regularly work.
Endnotes
This publication provides general information on legal developments of interest to clients and friends of Maceira Zayas (MZLS). It is not a comprehensive treatment of the subject matter and does not constitute legal advice. Readers should consult counsel before acting on any matter discussed here. Developments after the date of this Legal Update are not reflected.
