Executive Agreement No. 048-DP-2026 — Authorization to DIGER for Direct Contracting of Security and Cybersecurity Services for Public Digital Infrastructure

This executive agreement authorizes DIGER to directly contract specialized security and cybersecurity services to protect the State's digital infrastructure. Direct contracting is justified because it requires secretive operations and highly specialized technical work. DIGER can purchase software, hardware, training, and professional services needed to protect critical systems used by 80+ institutions.

Whereas, in accordance with Article 235 of the Constitution of the Republic, the President of the Republic exercises the executive power in representation and for the benefit of the People.

Whereas, in accordance with Article 245, Numerals 1, 2, 11, and 45 of the Constitution of the Republic, it is the responsibility of the President of the Republic, among other attributions, to direct the general policy of the State and represent it, as well as to issue Agreements, Decrees, and to enact regulations and resolutions in accordance with the Law.

Whereas the contracts for works, goods, and services executed by organs of the public administration shall be governed in accordance with the procedures established by the State Procurement Law, and its Article 63 establishes the assumptions for Direct Procurement, which may be conducted in the following cases: "...4) When circumstances require that Government operations be kept secret; ....... 6) When it concerns specialized scientific, technical, or artistic works...." and, in its final paragraph, it literally establishes that "...In order to carry out Direct Procurement in the cases referred to above, authorization from the President of the Republic shall be required when it concerns contracts of the Centralized Public Administration or from the superior governing body, when it concerns Contracts of the Decentralized Administration or from other public organisms referred to in Article 1 of this Law, and an Agreement must be issued expressing in detail its reasons".

Whereas, in accordance with Article 11 of the General Law of Public Administration, the President of the Republic is responsible for the supreme direction and coordination of the Centralized and Decentralized Public Administration, and may act on his own or in Council of State Secretaries.

Whereas, through Article 4 of EXECUTIVE DECREE NUMBER PCM-004-2026, published on February 25, 2026, in the Official Gazette "La Gaceta", the functions and attributions of the DIRECTORATE OF MANAGEMENT BY RESULTS (DIGER) were reformed, hereinafter "...responsible for governing, executing, supervising, coordinating, and administering the framework of plans, policies, programs, and projects in digital matters of the public sector in the areas of connectivity, digital procedures and platforms, digital economy, open data, digital talent, cybersecurity, and other emerging technologies, in accordance with the priorities and allocations established by the Presidency of the Republic...".

Whereas, as a consequence of said attributions, the DIRECTORATE OF MANAGEMENT BY RESULTS (DIGER) administers critical technological infrastructure of the State, comprised of data centers, interoperability platforms, virtualization infrastructure, communication networks, storage systems, digital identity platforms, authentication mechanisms, cryptographic infrastructure, institutional integration services, and other technological components that enable the continuous provision of government digital services.

Whereas strategic digital services operate, are integrated, and consume services on the Public Digital Infrastructure administered by the DIRECTORATE OF MANAGEMENT BY RESULTS (DIGER), whose availability, integrity, confidentiality, authenticity, and continuity constitute essential elements for the secure functioning of the Public Administration and the provision of digital public services to citizens. Said infrastructure supports, among others, the Management by Results System, through which more than eighty (80) institutions of the Public Administration register, consult, and exchange information for the monitoring of results measurement and strategic decision-making; the National Electronic Wallet (BIEN), formalized by the National Registry of Persons for the generation of the Biometric National Identification Document (DNIB), through Session No. CPRNP-037-2026 and certification published in the Official Gazette "La Gaceta" dated the seventeenth (17) of July of the current year 2026, which currently interoperates with the National Registry of Persons, National Institute of Migration, and the National Police; likewise, it supports the development and implementation of the National Interoperability Bus, conceived as the national infrastructure of trust intended to enable secure, interoperable, standardized, and controlled exchange of information among public institutions, progressively increasing the number of integrated entities and, consequently, the institutional dependence on the Public Digital Infrastructure administered by DIGER. Similarly, said infrastructure provides shared technological services, including the hosting of institutional platforms and specialized services for various entities of the Public Administration, consolidating itself as a transversal component for State operations, whose criticality increases proportionally to the growth of the government digital ecosystem and the progressive incorporation of new institutions, platforms, and strategic digital services. Consequently, the protection of security and cybersecurity of the Public Digital Infrastructure constitutes a matter of public interest and an essential element to guarantee the operational continuity of the State, the uninterrupted provision of digital public services, the protection of secure information exchange among institutions, and the consolidation of the digital transformation process of the State of Honduras, being indispensable to adopt permanent measures to strengthen institutional cybersecurity capabilities oriented to prevent, detect, contain, and respond promptly to threats that may compromise the critical technological infrastructure of the State.

Whereas the DIRECTORATE OF MANAGEMENT BY RESULTS (DIGER), within the framework of its attributions as the governing body of the State's digital transformation, develops and implements the technological infrastructure that supports digital trust services used by the Public Administration, including Advanced Digital Signature, which constitutes an essential mechanism to guarantee the authenticity, integrity, non-repudiation, traceability, and legal validity of electronic documents. By virtue of the nature of said services, the technological and cryptographic infrastructure that supports them requires the highest levels of security, availability, integrity, and resilience, inasmuch as any violation, alteration, unavailability, or compromise of its protection mechanisms could affect confidence in the State's electronic processes, compromise the security of digital transactions, put at risk the legal efficacy of administrative acts issued by electronic means, and generate impacts on the continuity of digital public services, circumstances that make it indispensable to permanently strengthen institutional cybersecurity capabilities, with the purpose of guaranteeing operational continuity, the security of technological infrastructure, and confidence in the digital services provided by the State.

Whereas the DIRECTORATE OF MANAGEMENT BY RESULTS (DIGER), in the exercise of its competencies in cybersecurity matters, presented to the President of the Republic, through Official Memorandum No. DM-DIGER 236-2026, dated July 2, 2026, to which was attached the Technical Report on Cybersecurity Evaluation, the results of specialized cybersecurity assessments conducted on strategic institutions of the State, in which the existence of critical vulnerabilities, deficiencies in security controls, exposure of technological assets, and risk scenarios susceptible to compromising the confidentiality, integrity, availability, and continuity of government digital services were documented, concluding the necessity to adopt, with priority and immediate character, measures for strengthening the security and cybersecurity infrastructure administered by the DIRECTORATE OF MANAGEMENT BY RESULTS (DIGER), in order to protect the Public Digital Infrastructure of the State and guarantee the continuity of digital public services.

Whereas, during the implementation of the National Electronic Wallet (BIEN), a cybersecurity incident was recorded consisting of automated attacks directed against public services, causing temporary degradation of service availability and requiring the immediate execution of specialized measures of containment, monitoring, analysis, and mitigation; it being determined through the corresponding technical analyses that the security controls implemented prevented the compromise of digital identity and citizens' credentials, without prejudice to evidencing the necessity to strengthen institutional capabilities for perimetral protection and response against advanced threats (SECURITY INCIDENT REPORT HONDURAS DIGITAL ID PROJECT MAY 2026).

Whereas, additionally, a computer security incident was recorded on institutional platforms hosted within the technological infrastructure administered by the DIRECTORATE OF MANAGEMENT BY RESULTS (DIGER), which made necessary the immediate adoption of measures of isolation, containment, segmentation, monitoring, and analysis, with the purpose of preventing the propagation of the incident to other government services that operate on the Public Digital Infrastructure of the State, being confirmed through the corresponding technical analyses that the security mechanisms implemented by DIGER prevented the compromise of the technological infrastructure under its administration (EXECUTIVE REPORT PLATFORM SECURITY INCIDENT).

Whereas the documented cybersecurity incidents, together with the results of technical evaluations conducted on strategic institutions of the State, allow one to objectively establish that the cyber threats faced by the Public Digital Infrastructure of the State do not constitute merely potential or hypothetical risks, but certain, current, and verifiable risks, characterized by the exploitation of vulnerabilities, automated campaigns, attempted unauthorized access, active reconnaissance of technological infrastructure, and other activities typical of advanced cyber threats; concluding from said reports that it is indispensable to strengthen, with priority character and at the earliest possible date, perimetral protection, institutional cybersecurity capabilities, monitoring, detection, prevention, containment, and incident response mechanisms, as well as to implement advanced security controls that allow reducing the attack surface, preserving the operational continuity of digital public services, and guaranteeing the protection of the Public Digital Infrastructure of the State.

Whereas the best practices and international standards in the protection of critical infrastructures and cybernetic risk management recognize the necessity to safeguard information related to the security and cybersecurity architecture of systems that support essential State services. In that sense, the NIST Cybersecurity Framework (CSF 2.0) recognizes that the protection of critical infrastructures requires permanent management of cyber risk through the identification of critical assets, the implementation of appropriate security controls, and the protection of information whose disclosure could increase risk on said assets. For its part, the STANDARD ISO/IEC 27001:2022 recognizes information classification as an essential control for information security management, providing that it be classified in accordance with its level of sensitivity, criticality, value, and protection requirements, as well as the implementation of controls that guarantee that access to said information be granted only to authorized persons, in accordance with the functions they perform and the organization's own needs. Likewise, the guidelines issued by the Cybersecurity and Infrastructure Security Agency (CISA) promote the protection of critical infrastructure through the reduction of the attack surface, the protection of sensitive information related to defense mechanisms, and the limitation of disclosure of technical information whose exposure could facilitate the preparation or execution of cyber attacks. Consequently, information related to the architecture, design, operation, and mechanisms of security and cybersecurity of the Public Digital Infrastructure of the State constitutes strategic information whose disclosure or unnecessary exposure could compromise the efficacy of implemented protection measures, increase cyber risk, and affect the continuity of digital public services that said infrastructure supports.

Whereas, in accordance with Numeral 4 of Article 63 of the State Procurement Law, direct procurement is appropriate when circumstances require that Government operations be kept secret. In the present case, the definition and eventual publication of the technical requirements necessary for the strengthening of security and cybersecurity of the Public Digital Infrastructure of the State would imply revealing, directly or indirectly, the protection capabilities, security needs, and defense mechanisms required for the protection of said infrastructure, objectively increasing the risk to the State's strategic digital services. Consequently, said circumstances justify that the procedure be processed through the direct procurement modality, avoiding the public disclosure of the technical requirements whose exposure could compromise the efficacy of the security and cybersecurity measures implemented for the protection of the Public Digital Infrastructure of the State.

Whereas the protection of the Public Digital Infrastructure of the State requires the acquisition and implementation of goods, technologies, and highly specialized technical services for strengthening the State's security and cybersecurity capabilities, because these are solutions of high technological complexity whose integration, operation, and implementation demand specialized technical knowledge and capabilities, being applicable, additionally, the assumption provided in Numeral 6 of Article 63 of the State Procurement Law.

Whereas the National Congress, as a Power of the State and constitutional organ charged with the exercise of legislative power, requires having adequate infrastructure conditions for the efficient, continuous, and secure development of its functions.

Whereas it is necessary to guarantee minimum financing for the remodeling, modernization, and conditioning of the buildings of the National Congress, in order to adapt its installations to current needs for security, accessibility, technology, and functionality.

Whereas, through Decree No. 88-2026, Article 155-F was added to Decree No. 62-2026, establishing provisions to address commitments linked with the strengthening of security and airport control, making it necessary to complement the regime applicable to the contract identified in said provision.

Whereas the tax and customs benefit applicable shall be limited exclusively to operations directly linked with the execution of the contract and shall be subject to the procedures and controls established in current legislation.

Whereas, through Decree No. 161-2026, Article 186 of Decree No. 62-2026 was reformed, approving an allocation of up to ONE THOUSAND THREE HUNDRED MILLION LEMPIRAS EXACTLY (L. 1,300,000,000.00) to maintain the stability of the urban transportation tariff during the year 2026.

Whereas it is necessary to strengthen the technological mechanisms for monitoring and verification of subsidized transportation, contributing to greater traceability, control, and transparency in the use of public resources.

Whereas, in accordance with what is established in Article 205, Attribution 1) of the Constitution of the Republic, it corresponds to the National Congress: To create, decree, interpret, reform, and repeal laws.