Florida 2025 Regular Session

Florida House Bill H1293 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1
2	2
3	3	HB 1293 2025
4	4
5	5
6	6
7	7	CODING: Words stricken are deletions; words underlined are additions.
8	8	hb1293-00
9	9	Page 1 of 28
10	10	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
11	11
12	12
13	13
14	14	A bill to be entitled 1
15	15	An act relating to cybersecurity; amending s. 2
16	16	282.0041, F.S.; providing definitions; amending s. 3
17	17	282.0051, F.S.; revising the purposes for which the 4
18	18	Florida Digital Service is established; requiring the 5
19	19	Florida Digital Service to ensure that independent 6
20	20	project oversight on certain state agency information 7
21	21	technology projects is performed in a certain manner; 8
22	22	revising the date by which the Department of 9
23	23	Management Services, acting through the Florida 10
24	24	Digital Service, must provide certain recommendations 11
25	25	to the Executive Office of the Governor and the 12
26	26	Legislature; removing certain duties of the Florida 13
27	27	Digital Service; revising the total project cost of 14
28	28	certain projects for which the Florida Digital Service 15
29	29	must provide project oversight; specifying the date by 16
30	30	which the Florida Digital Service must provide certain 17
31	31	reports; requiring the state chief information 18
32	32	officer, in consultation with the Secretary of 19
33	33	Management Services, to designate a state chief 20
34	34	technology officer; providing duties of the state 21
35	35	chief technology officer; revising the total project 22
36	36	cost of certain projects for which certain procurement 23
37	37	actions must be taken; removing provisions prohibiting 24
38	38	the department, acting through the Florida Digital 25
39	39
40	40	HB 1293 2025
41	41
42	42
43	43
44	44	CODING: Words stricken are deletions; words underlined are additions.
45	45	hb1293-00
46	46	Page 2 of 28
47	47	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
48	48
49	49
50	50
51	51	Service, from retrieving or disclosing certain d ata in 26
52	52	certain circumstances; amending s. 282.00515, F.S.; 27
53	53	conforming a cross-reference; amending s. 282.318, 28
54	54	F.S.; providing that the Florida Digital Service is 29
55	55	the lead entity for a certain purpose; requiring the 30
56	56	Cybersecurity Operations Center to provid e certain 31
57	57	notifications; requiring the state chief information 32
58	58	officer to make certain reports in consultation with 33
59	59	the state chief information security officer; 34
60	60	requiring a state agency to report ransomware and 35
61	61	cybersecurity incidents within certain time periods; 36
62	62	requiring the Cybersecurity Operations Center to 37
63	63	immediately notify certain entities of reported 38
64	64	incidents and take certain actions; requiring the 39
65	65	state chief information security officer to notify the 40
66	66	Legislature of certain incidents within a cer tain time 41
67	67	period; requiring certain notification to be provided 42
68	68	in a secure environment; requiring the Cybersecurity 43
69	69	Operations Center to provide a certain report to 44
70	70	certain entities by a specified date; requiring the 45
71	71	Florida Digital Service to provide cyb ersecurity 46
72	72	briefings to certain legislative committees; 47
73	73	authorizing the Florida Digital Service to obtain 48
74	74	certain access to certain infrastructure and direct 49
75	75	certain measures; requiring a state agency head to 50
76	76
77	77	HB 1293 2025
78	78
79	79
80	80
81	81	CODING: Words stricken are deletions; words underlined are additions.
82	82	hb1293-00
83	83	Page 3 of 28
84	84	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
85	85
86	86
87	87
88	88	annually designate a chief information security 51
89	89	officer by a specified date; revising the purpose of 52
90	90	an agency's information security manager and the date 53
91	91	by which he or she must be designated; authorizing the 54
92	92	department to brief certain legislative committees in 55
93	93	a closed setting on certain records tha t are 56
94	94	confidential and exempt from public records 57
95	95	requirements; requiring such legislative committees to 58
96	96	maintain the confidential and exempt status of certain 59
97	97	records; authorizing certain legislators to attend 60
98	98	meetings of the Florida Cybersecurity Advisor y 61
99	99	Council; amending s. 282.3185, F.S.; requiring a local 62
100	100	government to report ransomware and certain 63
101	101	cybersecurity incidents to the Cybersecurity 64
102	102	Operations Center within certain time periods; 65
103	103	requiring the Cybersecurity Operations Center to 66
104	104	immediately notify certain entities of certain 67
105	105	incidents and take certain actions; requiring certain 68
106	106	notification to be provided in a secure environment; 69
107	107	amending s. 282.319, F.S.; revising the membership of 70
108	108	the Florida Cybersecurity Advisory Council; providing 71
109	109	an effective date. 72
110	110	73
111	111	Be It Enacted by the Legislature of the State of Florida: 74
112	112	75
113	113
114	114	HB 1293 2025
115	115
116	116
117	117
118	118	CODING: Words stricken are deletions; words underlined are additions.
119	119	hb1293-00
120	120	Page 4 of 28
121	121	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
122	122
123	123
124	124
125	125	Section 1. Subsections (3) through (5), (6) through (16), 76
126	126	and (17) through (38) of section 282.0041, Florida Statutes, are 77
127	127	renumbered as subsections (4) through (6), (8) through (18), and 78
128	128	(20) through (41), respectively, and new subsections (3), (7), 79
129	129	and (19) are added to that section to read: 80
130	130	282.0041 Definitions. —As used in this chapter, the term: 81
131	131	(3) "As a service" means the contracting with or 82
132	132	outsourcing to a third party of a defined role or function as a 83
133	133	means of delivery. 84
134	134	(7) "Cloud provider" means an entity that provides cloud -85
135	135	computing services. 86
136	136	(19) "Enterprise digital data" means information held by a 87
137	137	state agency in electronic form that is deemed to be data own ed 88
138	138	by the state and held for state purposes by the state agency. 89
139	139	Enterprise digital data that is subject to statutory 90
140	140	requirements for particular types of sensitive data or to 91
141	141	contractual limitations for data marked as trade secrets or 92
142	142	sensitive corporate data held by state agencies shall be treated 93
143	143	in accordance with such requirements or limitations. The 94
144	144	department must maintain personnel with appropriate licenses, 95
145	145	certifications, or classifications to steward such enterprise 96
146	146	digital data, as necessary. En terprise digital data must be 97
147	147	maintained in accordance with chapter 119. This subsection may 98
148	148	not be construed to create or expand an exemption from public 99
149	149	records requirements under s. 119.07(1) or s. 24(a), Art. I of 100
150	150
151	151	HB 1293 2025
152	152
153	153
154	154
155	155	CODING: Words stricken are deletions; words underlined are additions.
156	156	hb1293-00
157	157	Page 5 of 28
158	158	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
159	159
160	160
161	161
162	162	the State Constitution. 101
163	163	Section 2. Subsection (6) of section 282.0051, Florida 102
164	164	Statutes, is renumbered as subsection (5), subsections (1) and 103
165	165	(4) and present subsection (5) are amended, and paragraph (c) is 104
166	166	added to subsection (2) of that section, to read: 105
167	167	282.0051 Department of Manageme nt Services; Florida 106
168	168	Digital Service; powers, duties, and functions. — 107
169	169	(1) The Florida Digital Service is established has been 108
170	170	created within the department to lead enterprise information 109
171	171	technology and cybersecurity efforts; to safeguard enterprise 110
172	172	digital data; to propose, test, develop, and deploy innovative 111
173	173	solutions that securely modernize state government, including 112
174	174	technology and information services ;, to achieve value through 113
175	175	digital transformation and interoperability ;, and to fully 114
176	176	support the cloud-first policy as specified in s. 282.206. The 115
177	177	department, through the Florida Digital Service, shall have the 116
178	178	following powers, duties, and functions: 117
179	179	(a) Develop and publish information technology policy for 118
180	180	the management of the state's information technology resources. 119
181	181	(b) Develop an enterprise architecture that: 120
182	182	1. Acknowledges the unique needs of the entities within 121
183	183	the enterprise in the development and publication of standards 122
184	184	and terminologies to facilitate digital interoperability; 123
185	185	2. Supports the cloud-first policy as specified in s. 124
186	186	282.206; and 125
187	187
188	188	HB 1293 2025
189	189
190	190
191	191
192	192	CODING: Words stricken are deletions; words underlined are additions.
193	193	hb1293-00
194	194	Page 6 of 28
195	195	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
196	196
197	197
198	198
199	199	3. Addresses how information technology infrastructure may 126
200	200	be modernized to achieve cloud -first objectives. 127
201	201	(c) Establish project management and oversight standards 128
202	202	with which state agencies must comply when implementing 129
203	203	information technology projects. The department, acting through 130
204	204	the Florida Digital Service, shall provide training 131
205	205	opportunities to state agencies to assist in the adoption of the 132
206	206	project management and oversight standards. T o support data-133
207	207	driven decisionmaking, the standards must include, but are not 134
208	208	limited to: 135
209	209	1. Performance measurements and metrics that objectively 136
210	210	reflect the status of an information technology project based on 137
211	211	a defined and documented project scope, co st, and schedule. 138
212	212	2. Methodologies for calculating acceptable variances in 139
213	213	the projected versus actual scope, schedule, or cost of an 140
214	214	information technology project. 141
215	215	3. Reporting requirements, including requirements designed 142
216	216	to alert all defined stakeh olders that an information technology 143
217	217	project has exceeded acceptable variances defined and documented 144
218	218	in a project plan. 145
219	219	4. Content, format, and frequency of project updates. 146
220	220	5. Technical standards to ensure an information technology 147
221	221	project complies with the enterprise architecture. 148
222	222	(d) Ensure that independent Perform project oversight on 149
223	223	all state agency information technology projects that have total 150
224	224
225	225	HB 1293 2025
226	226
227	227
228	228
229	229	CODING: Words stricken are deletions; words underlined are additions.
230	230	hb1293-00
231	231	Page 7 of 28
232	232	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
233	233
234	234
235	235
236	236	project costs of $25 $10 million or more and that are funded in 151
237	237	the General Appropriations Act or any other law is performed in 152
238	238	compliance with applicable state and federal law . The 153
239	239	department, acting through the Florida Digital Service, shall 154
240	240	report at least quarterly to the Executive Office of the 155
241	241	Governor, the President of the Senate, and the Speake r of the 156
242	242	House of Representatives on any information technology project 157
243	243	that the department identifies as high -risk due to the project 158
244	244	exceeding acceptable variance ranges defined and documented in a 159
245	245	project plan. The report must include a risk assessment, 160
246	246	including fiscal risks, associated with proceeding to the next 161
247	247	stage of the project, and a recommendation for corrective 162
248	248	actions required, including suspension or termination of the 163
249	249	project. 164
250	250	(e) Identify opportunities for standardization and 165
251	251	consolidation of information technology services that support 166
252	252	interoperability and the cloud -first policy, as specified in s. 167
253	253	282.206, and business functions and operations, including 168
254	254	administrative functions such as purchasing, accounting and 169
255	255	reporting, cash managem ent, and personnel, and that are common 170
256	256	across state agencies. The department, acting through the 171
257	257	Florida Digital Service, shall biennially on January 15 1 of 172
258	258	each even-numbered year provide recommendations for 173
259	259	standardization and consolidation to the Exec utive Office of the 174
260	260	Governor, the President of the Senate, and the Speaker of the 175
261	261
262	262	HB 1293 2025
263	263
264	264
265	265
266	266	CODING: Words stricken are deletions; words underlined are additions.
267	267	hb1293-00
268	268	Page 8 of 28
269	269	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
270	270
271	271
272	272
273	273	House of Representatives. 176
274	274	(f) Establish best practices for the procurement of 177
275	275	information technology products and cloud -computing services in 178
276	276	order to reduce costs, increas e the quality of data center 179
277	277	services, or improve government services. 180
278	278	(g) Develop standards for information technology reports 181
279	279	and updates, including, but not limited to, operational work 182
280	280	plans, project spend plans, and project status reports, for use 183
281	281	by state agencies. 184
282	282	(h) Upon request, assist state agencies in the development 185
283	283	of information technology -related legislative budget requests. 186
284	284	(i) Conduct annual assessments of state agencies to 187
285	285	determine compliance with all information technology standar ds 188
286	286	and guidelines developed and published by the department and 189
287	287	provide results of the assessments to the Executive Office of 190
288	288	the Governor, the President of the Senate, and the Speaker of 191
289	289	the House of Representatives. 192
290	290	(i)(j) Conduct a market analysis not less frequently than 193
291	291	every 3 years beginning in 2021 to determine whether the 194
292	292	information technology resources within the enterprise are 195
293	293	utilized in the most cost -effective and cost-efficient manner, 196
294	294	while recognizing that the replacement of certain legac y 197
295	295	information technology systems within the enterprise may be cost 198
296	296	prohibitive or cost inefficient due to the remaining useful life 199
297	297	of those resources; whether the enterprise is complying with the 200
298	298
299	299	HB 1293 2025
300	300
301	301
302	302
303	303	CODING: Words stricken are deletions; words underlined are additions.
304	304	hb1293-00
305	305	Page 9 of 28
306	306	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
307	307
308	308
309	309
310	310	cloud-first policy specified in s. 282.206; and whether the 201
311	311	enterprise is utilizing best practices with respect to 202
312	312	information technology, information services, and the 203
313	313	acquisition of emerging technologies and information services. 204
314	314	Each market analysis shall be used to prepare a strategic plan 205
315	315	for continued and fu ture information technology and information 206
316	316	services for the enterprise, including, but not limited to, 207
317	317	proposed acquisition of new services or technologies and 208
318	318	approaches to the implementation of any new services or 209
319	319	technologies. Copies of each market ana lysis and accompanying 210
320	320	strategic plan must be submitted to the Executive Office of the 211
321	321	Governor, the President of the Senate, and the Speaker of the 212
322	322	House of Representatives not later than December 31 of each year 213
323	323	that a market analysis is conducted. 214
324	324	(j)(k) Recommend other information technology services 215
325	325	that should be designed, delivered, and managed as enterprise 216
326	326	information technology services. Recommendations must include 217
327	327	the identification of existing information technology resources 218
328	328	associated with the services, if existing services must be 219
329	329	transferred as a result of being delivered and managed as 220
330	330	enterprise information technology services. 221
331	331	(k)(l) In consultation with state agencies, propose a 222
332	332	methodology and approach for identifying and collecting both 223
333	333	current and planned information technology expenditure data at 224
334	334	the state agency level. 225
335	335
336	336	HB 1293 2025
337	337
338	338
339	339
340	340	CODING: Words stricken are deletions; words underlined are additions.
341	341	hb1293-00
342	342	Page 10 of 28
343	343	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
344	344
345	345
346	346
347	347	(l)(m)1. Notwithstanding any other law, provide project 226
348	348	oversight on any information technology project of the 227
349	349	Department of Financial Services, the Department o f Legal 228
350	350	Affairs, and the Department of Agriculture and Consumer Services 229
351	351	which has a total project cost of $25 $20 million or more. Such 230
352	352	information technology projects must also comply with the 231
353	353	applicable information technology architecture, project 232
354	354	management and oversight, and reporting standards established by 233
355	355	the department, acting through the Florida Digital Service. 234
356	356	2. When ensuring performance of performing the project 235
357	357	oversight function specified in subparagraph 1., report by the 236
358	358	30th day after the end of each quarter at least quarterly to the 237
359	359	Executive Office of the Governor, the President of the Senate, 238
360	360	and the Speaker of the House of Representatives on any 239
361	361	information technology project that the department, acting 240
362	362	through the Florida Digital Se rvice, identifies as high -risk due 241
363	363	to the project exceeding acceptable variance ranges defined and 242
364	364	documented in the project plan. The report shall include a risk 243
365	365	assessment, including fiscal risks, associated with proceeding 244
366	366	to the next stage of the proje ct and a recommendation for 245
367	367	corrective actions required, including suspension or termination 246
368	368	of the project. 247
369	369	(m)(n) If an information technology project implemented by 248
370	370	a state agency must be connected to or otherwise accommodated by 249
371	371	an information techno logy system administered by the Department 250
372	372
373	373	HB 1293 2025
374	374
375	375
376	376
377	377	CODING: Words stricken are deletions; words underlined are additions.
378	378	hb1293-00
379	379	Page 11 of 28
380	380	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
381	381
382	382
383	383
384	384	of Financial Services, the Department of Legal Affairs, or the 251
385	385	Department of Agriculture and Consumer Services, consult with 252
386	386	these departments regarding the risks and other effects of such 253
387	387	projects on their inform ation technology systems and work 254
388	388	cooperatively with these departments regarding the connections, 255
389	389	interfaces, timing, or accommodations required to implement such 256
390	390	projects. 257
391	391	(n)(o) If adherence to standards or policies adopted by or 258
392	392	established pursuant t o this section causes conflict with 259
393	393	federal regulations or requirements imposed on an entity within 260
394	394	the enterprise and results in adverse action against an entity 261
395	395	or federal funding, work with the entity to provide alternative 262
396	396	standards, policies, or requi rements that do not conflict with 263
397	397	the federal regulation or requirement. The department, acting 264
398	398	through the Florida Digital Service, shall annually by January 265
399	399	15 report such alternative standards to the Executive Office of 266
400	400	the Governor, the President of th e Senate, and the Speaker of 267
401	401	the House of Representatives. 268
402	402	(o)(p)1. Establish an information technology policy for 269
403	403	all information technology -related state contracts, including 270
404	404	state term contracts for information technology commodities, 271
405	405	consultant services, and staff augmentation services. The 272
406	406	information technology policy must include: 273
407	407	a. Identification of the information technology product 274
408	408	and service categories to be included in state term contracts. 275
409	409
410	410	HB 1293 2025
411	411
412	412
413	413
414	414	CODING: Words stricken are deletions; words underlined are additions.
415	415	hb1293-00
416	416	Page 12 of 28
417	417	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
418	418
419	419
420	420
421	421	b. Requirements to be included in solicita tions for state 276
422	422	term contracts. 277
423	423	c. Evaluation criteria for the award of information 278
424	424	technology-related state term contracts. 279
425	425	d. The term of each information technology -related state 280
426	426	term contract. 281
427	427	e. The maximum number of vendors authorized on each s tate 282
428	428	term contract. 283
429	429	f. At a minimum, a requirement that any contract for 284
430	430	information technology commodities or services meet the National 285
431	431	Institute of Standards and Technology Cybersecurity Framework. 286
432	432	g. For an information technology project wherein pr oject 287
433	433	oversight is required pursuant to paragraph (d) or paragraph (l) 288
434	434	(m), a requirement that independent verification and validation 289
435	435	be employed throughout the project life cycle with the primary 290
436	436	objective of independent verification and validation being to 291
437	437	provide an objective assessment of products and processes 292
438	438	throughout the project life cycle. An entity providing 293
439	439	independent verification and validation may not have technical, 294
440	440	managerial, or financial interest in the project and may not 295
441	441	have responsibility for, or participate in, any other aspect of 296
442	442	the project. 297
443	443	2. Evaluate vendor responses for information technology -298
444	444	related state term contract solicitations and invitations to 299
445	445	negotiate. 300
446	446
447	447	HB 1293 2025
448	448
449	449
450	450
451	451	CODING: Words stricken are deletions; words underlined are additions.
452	452	hb1293-00
453	453	Page 13 of 28
454	454	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
455	455
456	456
457	457
458	458	3. Answer vendor questions on information technology -301
459	459	related state term contract solicitations. 302
460	460	4. Ensure that the information technology policy 303
461	461	established pursuant to subparagraph 1. is included in all 304
462	462	solicitations and contracts that are administratively executed 305
463	463	by the department. 306
464	464	(p)(q) Recommend potential methods for standardizing data 307
465	465	across state agencies which will promote interoperability and 308
466	466	reduce the collection of duplicative data. 309
467	467	(q)(r) Recommend open data technical standards and 310
468	468	terminologies for use by the enterprise. 311
469	469	(r)(s) Ensure that enterprise information technology 312
470	470	solutions are capable of utilizing an electronic credential and 313
471	471	comply with the enterprise architecture standards. 314
472	472	(2) 315
473	473	(c) The state chief information officer, in consultation 316
474	474	with the Secretary of Mana gement Services, shall designate a 317
475	475	state chief technology officer who shall be responsible for all 318
476	476	of the following: 319
477	477	1. Establishing and maintaining an enterprise architecture 320
478	478	framework that ensures information technology investments align 321
479	479	with the state's strategic objectives and initiatives pursuant 322
480	480	to paragraph (1)(b). 323
481	481	2. Conducting comprehensive evaluations of potential 324
482	482	technological solutions and cultivating strategic partnerships, 325
483	483
484	484	HB 1293 2025
485	485
486	486
487	487
488	488	CODING: Words stricken are deletions; words underlined are additions.
489	489	hb1293-00
490	490	Page 14 of 28
491	491	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
492	492
493	493
494	494
495	495	internally with state enterprise agencies and externally with 326
496	496	the private sector, to leverage collective expertise, foster 327
497	497	collaboration, and advance the state's technological 328
498	498	capabilities. 329
499	499	3. Supervising program management of enterprise 330
500	500	information technology initiatives pursuant to paragraphs 331
501	501	(1)(c), (d), and (l); pro viding advisory support and oversight 332
502	502	for technology-related projects; and continuously identifying 333
503	503	and recommending best practices to optimize outcomes of 334
504	504	technology projects and enhance the enterprise's technological 335
505	505	efficiency and effectiveness. 336
506	506	(4) For information technology projects that have a total 337
507	507	project cost of $25 $10 million or more: 338
508	508	(a) State agencies must provide the Florida Digital 339
509	509	Service with written notice of any planned procurement of an 340
510	510	information technology project. 341
511	511	(b) The Florida Digital Service must participate in the 342
512	512	development of specifications and recommend modifications to any 343
513	513	planned procurement of an information technology project by 344
514	514	state agencies so that the procurement complies with the 345
515	515	enterprise architecture. 346
516	516	(c) The Florida Digital Service must participate in post -347
517	517	award contract monitoring. 348
518	518	(5) The department, acting through the Florida Digital 349
519	519	Service, may not retrieve or disclose any data without a shared -350
520	520
521	521	HB 1293 2025
522	522
523	523
524	524
525	525	CODING: Words stricken are deletions; words underlined are additions.
526	526	hb1293-00
527	527	Page 15 of 28
528	528	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
529	529
530	530
531	531
532	532	data agreement in place between the department and the 351
533	533	enterprise entity that has primary custodial responsibility of, 352
534	534	or data-sharing responsibility for, that data. 353
535	535	Section 3. Subsection (1) of section 282.00515, Florida 354
536	536	Statutes, is amended to read: 355
537	537	282.00515 Duties of Cabinet agencies. — 356
538	538	(1) The Department of Legal Affairs, the Department of 357
539	539	Financial Services, and the Department of Agriculture and 358
540	540	Consumer Services shall adopt the standards established in s. 359
541	541	282.0051(1)(b), (c), and (q) (r) and (3)(e) or adopt alternative 360
542	542	standards based on best prac tices and industry standards that 361
543	543	allow for open data interoperability. 362
544	544	Section 4. Paragraphs (a) through (k) of subsection (4) of 363
545	545	section 282.318, Florida Statutes, are redesignated as 364
546	546	paragraphs (b) through (l), respectively, subsection (10) is 365
547	547	renumbered as subsection (11), subsection (3) and present 366
548	548	paragraph (a) of subsection (4) are amended, a new paragraph (a) 367
549	549	is added to subsection (4), and a new subsection (10) is added 368
550	550	to that section, to read: 369
551	551	282.318 Cybersecurity. — 370
552	552	(3) The department, acting through the Florida Digital 371
553	553	Service, is the lead entity responsible for leading enterprise 372
554	554	information technology and cybersecurity efforts, safeguarding 373
555	555	enterprise digital data, establishing standards and processes 374
556	556	for assessing state agency cyberse curity risks, and determining 375
557	557
558	558	HB 1293 2025
559	559
560	560
561	561
562	562	CODING: Words stricken are deletions; words underlined are additions.
563	563	hb1293-00
564	564	Page 16 of 28
565	565	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
566	566
567	567
568	568
569	569	appropriate security measures. Such standards and processes must 376
570	570	be consistent with generally accepted technology best practices, 377
571	571	including the National Institute for Standards and Technology 378
572	572	Cybersecurity Framework, for cyber security. The department, 379
573	573	acting through the Florida Digital Service, shall adopt rules 380
574	574	that mitigate risks; safeguard state agency digital assets, 381
575	575	data, information, and information technology resources to 382
576	576	ensure availability, confidentiality, and integri ty; and support 383
577	577	a security governance framework. The department, acting through 384
578	578	the Florida Digital Service, shall also: 385
579	579	(a) Designate an employee of the Florida Digital Service 386
580	580	as the state chief information security officer. The state chief 387
581	581	information security officer must have experience and expertise 388
582	582	in security and risk management for communications and 389
583	583	information technology resources. The state chief information 390
584	584	security officer is responsible for the development, operation, 391
585	585	and oversight of cyber security for state technology systems. The 392
586	586	Cybersecurity Operations Center shall immediately notify the 393
587	587	state chief information officer and the state chief information 394
588	588	security officer shall be notified of all confirmed or suspected 395
589	589	incidents or threats of state agency information technology 396
590	590	resources. The state chief information officer, in consultation 397
591	591	with the state chief information security officer, and must 398
592	592	report such incidents or threats to the state chief information 399
593	593	officer and the Governor. 400
594	594
595	595	HB 1293 2025
596	596
597	597
598	598
599	599	CODING: Words stricken are deletions; words underlined are additions.
600	600	hb1293-00
601	601	Page 17 of 28
602	602	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
603	603
604	604
605	605
606	606	(b) Develop, and annually update by February 1, a 401
607	607	statewide cybersecurity strategic plan that includes security 402
608	608	goals and objectives for cybersecurity, including the 403
609	609	identification and mitigation of risk, proactive protections 404
610	610	against threats, tactical risk d etection, threat reporting, and 405
611	611	response and recovery protocols for a cyber incident. 406
612	612	(c) Develop and publish for use by state agencies a 407
613	613	cybersecurity governance framework that, at a minimum, includes 408
614	614	guidelines and processes for: 409
615	615	1. Establishing asse t management procedures to ensure that 410
616	616	an agency's information technology resources are identified and 411
617	617	managed consistent with their relative importance to the 412
618	618	agency's business objectives. 413
619	619	2. Using a standard risk assessment methodology that 414
620	620	includes the identification of an agency's priorities, 415
621	621	constraints, risk tolerances, and assumptions necessary to 416
622	622	support operational risk decisions. 417
623	623	3. Completing comprehensive risk assessments and 418
624	624	cybersecurity audits, which may be completed by a private sector 419
625	625	vendor, and submitting completed assessments and audits to the 420
626	626	department. 421
627	627	4. Identifying protection procedures to manage the 422
628	628	protection of an agency's information, data, and information 423
629	629	technology resources. 424
630	630	5. Establishing procedures for accessing inf ormation and 425
631	631
632	632	HB 1293 2025
633	633
634	634
635	635
636	636	CODING: Words stricken are deletions; words underlined are additions.
637	637	hb1293-00
638	638	Page 18 of 28
639	639	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
640	640
641	641
642	642
643	643	data to ensure the confidentiality, integrity, and availability 426
644	644	of such information and data. 427
645	645	6. Detecting threats through proactive monitoring of 428
646	646	events, continuous security monitoring, and defined detection 429
647	647	processes. 430
648	648	7. Establishing agency cybersecurity incident response 431
649	649	teams and describing their responsibilities for responding to 432
650	650	cybersecurity incidents, including breaches of personal 433
651	651	information containing confidential or exempt data. 434
652	652	8. Recovering information and data in respons e to a 435
653	653	cybersecurity incident. The recovery may include recommended 436
654	654	improvements to the agency processes, policies, or guidelines. 437
655	655	9. Establishing a cybersecurity incident reporting process 438
656	656	that includes procedures for notifying the department and the 439
657	657	Department of Law Enforcement of cybersecurity incidents. 440
658	658	a. The level of severity of the cybersecurity incident is 441
659	659	defined by the National Cyber Incident Response Plan of the 442
660	660	United States Department of Homeland Security as follows: 443
661	661	(I) Level 5 is an em ergency-level incident within the 444
662	662	specified jurisdiction that poses an imminent threat to the 445
663	663	provision of wide-scale critical infrastructure services; 446
664	664	national, state, or local government security; or the lives of 447
665	665	the country's, state's, or local governme nt's residents. 448
666	666	(II) Level 4 is a severe -level incident that is likely to 449
667	667	result in a significant impact in the affected jurisdiction to 450
668	668
669	669	HB 1293 2025
670	670
671	671
672	672
673	673	CODING: Words stricken are deletions; words underlined are additions.
674	674	hb1293-00
675	675	Page 19 of 28
676	676	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
677	677
678	678
679	679
680	680	public health or safety; national, state, or local security; 451
681	681	economic security; or civil liberties. 452
682	682	(III) Level 3 is a high-level incident that is likely to 453
683	683	result in a demonstrable impact in the affected jurisdiction to 454
684	684	public health or safety; national, state, or local security; 455
685	685	economic security; civil liberties; or public confidence. 456
686	686	(IV) Level 2 is a medium -level incident that may impact 457
687	687	public health or safety; national, state, or local security; 458
688	688	economic security; civil liberties; or public confidence. 459
689	689	(V) Level 1 is a low -level incident that is unlikely to 460
690	690	impact public health or safety; national, state, or local 461
691	691	security; economic security; civil liberties; or public 462
692	692	confidence. 463
693	693	b. The cybersecurity incident reporting process must 464
694	694	specify the information that must be reported by a state agency 465
695	695	following a cybersecurity incident or ransomware incident, 466
696	696	which, at a minimum, must include the following: 467
697	697	(I) A summary of the facts surrounding the cybersecurity 468
698	698	incident or ransomware incident. 469
699	699	(II) The date on which the state agency most recently 470
700	700	backed up its data; the physical location of the backup, if the 471
701	701	backup was affected; and if the backup was created using cloud 472
702	702	computing. 473
703	703	(III) The types of data compromised by the cybersecurity 474
704	704	incident or ransomware incident. 475
705	705
706	706	HB 1293 2025
707	707
708	708
709	709
710	710	CODING: Words stricken are deletions; words underlined are additions.
711	711	hb1293-00
712	712	Page 20 of 28
713	713	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
714	714
715	715
716	716
717	717	(IV) The estimated fiscal impact of the cybersecurity 476
718	718	incident or ransomware incident. 477
719	719	(V) In the case of a ransomware incident, the details of 478
720	720	the ransom demanded. 479
721	721	c.(I) A state agency shall report all ransomware incidents 480
722	722	and any cybersecurity incidents incident determined by the state 481
723	723	agency to be of severity level 3, 4, or 5 to the Cybersecurity 482
724	724	Operations Center and the Cybercrime Office of the Department of 483
725	725	Law Enforcement as soon as possible but no later than 12 48 484
726	726	hours after discovery of the cybersecurity incident and no later 485
727	727	than 6 12 hours after discovery of the ransomware inc ident. The 486
728	728	report must contain the information required in sub -subparagraph 487
729	729	b. 488
730	730	(II) The Cybersecurity Operations Center shall : 489
731	731	(A) Immediately notify the Cybercrime Office of the 490
732	732	Department of Law Enforcement of a reported incident and provide 491
733	733	to the office regular reports on the status of the incident, 492
734	734	preserve forensic data to support a subsequent investigation, 493
735	735	and provide aid to the investigative efforts of the office upon 494
736	736	the office's request if the state chief information security 495
737	737	officer finds that the investigation does not impede remediation 496
738	738	of the incident and that there is no risk to the public and no 497
739	739	risk to critical state functions. 498
740	740	(B) Immediately notify the state chief information officer 499
741	741	and the state chief information security officer of a reported 500
742	742
743	743	HB 1293 2025
744	744
745	745
746	746
747	747	CODING: Words stricken are deletions; words underlined are additions.
748	748	hb1293-00
749	749	Page 21 of 28
750	750	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
751	751
752	752
753	753
754	754	incident. The state chief information security officer shall 501
755	755	notify the President of the Senate and the Speaker of the House 502
756	756	of Representatives of any severity level 3, 4, or 5 incident as 503
757	757	soon as possible but no later than 24 12 hours after receiving a 504
758	758	state agency's incident report. The notification must include a 505
759	759	high-level description of the incident and the likely effects 506
760	760	and must be provided in a secure environment . 507
761	761	d. A state agency shall report a cybersecurity incident 508
762	762	determined by the state agency to be of severity level 1 or 2 to 509
763	763	the Cybersecurity Operations Center and the Cybercrime Office of 510
764	764	the Department of Law Enforcement as soon as possible. The 511
765	765	report must contain the information required in sub -subparagraph 512
766	766	b. 513
767	767	d.e. The Cybersecurity Operations Center shall provide a 514
768	768	consolidated incident report by the 30th day after the end of 515
769	769	each quarter on a quarterly basis to the Governor, the Attorney 516
770	770	General, the executive director of the Department of Law 517
771	771	Enforcement, the President of the Senate, the Speaker of the 518
772	772	House of Representatives, and the Florida Cybersecurity Advisory 519
773	773	Council. The report provided to the Florida Cybersecurity 520
774	774	Advisory Council may not contain the name of any agency, network 521
775	775	information, or system identifying information but must contain 522
776	776	sufficient relevant information to allow the Florida 523
777	777	Cybersecurity Advisory Council to fulfill its responsibilities 524
778	778	as required in s. 282.319(9). 525
779	779
780	780	HB 1293 2025
781	781
782	782
783	783
784	784	CODING: Words stricken are deletions; words underlined are additions.
785	785	hb1293-00
786	786	Page 22 of 28
787	787	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
788	788
789	789
790	790
791	791	10. Incorporating information obtained through detection 526
792	792	and response activiti es into the agency's cybersecurity incident 527
793	793	response plans. 528
794	794	11. Developing agency strategic and operational 529
795	795	cybersecurity plans required pursuant to this section. 530
796	796	12. Establishing the managerial, operational, and 531
797	797	technical safeguards for protecting sta te government data and 532
798	798	information technology resources that align with the state 533
799	799	agency risk management strategy and that protect the 534
800	800	confidentiality, integrity, and availability of information and 535
801	801	data. 536
802	802	13. Establishing procedures for procuring informa tion 537
803	803	technology commodities and services that require the commodity 538
804	804	or service to meet the National Institute of Standards and 539
805	805	Technology Cybersecurity Framework. 540
806	806	14. Submitting after -action reports following a 541
807	807	cybersecurity incident or ransomware incide nt. Such guidelines 542
808	808	and processes for submitting after -action reports must be 543
809	809	developed and published by December 1, 2022. 544
810	810	(d) Assist state agencies in complying with this section. 545
811	811	(e) In collaboration with the Cybercrime Office of the 546
812	812	Department of Law Enforcement, annually provide training for 547
813	813	state agency information security managers and computer security 548
814	814	incident response team members that contains training on 549
815	815	cybersecurity, including cybersecurity threats, trends, and best 550
816	816
817	817	HB 1293 2025
818	818
819	819
820	820
821	821	CODING: Words stricken are deletions; words underlined are additions.
822	822	hb1293-00
823	823	Page 23 of 28
824	824	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
825	825
826	826
827	827
828	828	practices. 551
829	829	(f) Annually review the strategic and operational 552
830	830	cybersecurity plans of state agencies. 553
831	831	(g) Annually provide cybersecurity training to all state 554
832	832	agency technology professionals and employees with access to 555
833	833	highly sensitive information which develops, assesses, and 556
834	834	documents competencies by role and skill level. The 557
835	835	cybersecurity training curriculum must include training on the 558
836	836	identification of each cybersecurity incident severity level 559
837	837	referenced in sub-subparagraph (c)9.a. The training may be 560
838	838	provided in collabor ation with the Cybercrime Office of the 561
839	839	Department of Law Enforcement, a private sector entity, or an 562
840	840	institution of the State University System. 563
841	841	(h) Operate and maintain a Cybersecurity Operations Center 564
842	842	led by the state chief information security offic er, which must 565
843	843	be primarily virtual and staffed with tactical detection and 566
844	844	incident response personnel. The Cybersecurity Operations Center 567
845	845	shall serve as a clearinghouse for threat information and 568
846	846	coordinate with the Department of Law Enforcement to supp ort 569
847	847	state agencies and their response to any confirmed or suspected 570
848	848	cybersecurity incident. 571
849	849	(i) Lead an Emergency Support Function, ESF-20 ESF CYBER, 572
850	850	under the state comprehensive emergency management plan as 573
851	851	described in s. 252.35. 574
852	852	(j) Provide cyberse curity briefings to the members of any 575
853	853
854	854	HB 1293 2025
855	855
856	856
857	857
858	858	CODING: Words stricken are deletions; words underlined are additions.
859	859	hb1293-00
860	860	Page 24 of 28
861	861	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
862	862
863	863
864	864
865	865	legislative committee or subcommittee responsible for policy 576
866	866	matters relating to cybersecurity. 577
867	867	(k) Have the authority to obtain immediate access to 578
868	868	public or private infrastructure hosting enterprise digital data 579
869	869	and to direct, in consultation with the state agency that holds 580
870	870	the particular enterprise digital data, measures to assess, 581
871	871	monitor, and safeguard the enterprise digital data. 582
872	872	(4) Each state agency head shall, at a minimum: 583
873	873	(a) Designate a chief informa tion security officer to 584
874	874	integrate the agency's technical and operational cybersecurity 585
875	875	efforts with the Cybersecurity Operations Center. This 586
876	876	designation must be provided annually in writing to the Florida 587
877	877	Digital Service by January 15. For a state agency under the 588
878	878	jurisdiction of the Governor, the agency's chief information 589
879	879	security officer shall be under the general supervision of the 590
880	880	agency head or designee for administrative purposes but shall 591
881	881	report to the state chief information officer. An agency ma y 592
882	882	request that the department procure a chief information security 593
883	883	officer as a service to fulfill the agency's duties under this 594
884	884	paragraph. 595
885	885	(b)(a) Designate an information security manager to ensure 596
886	886	compliance with cybersecurity governance and with the state's 597
887	887	enterprise security program and incident response plan. The 598
888	888	information security manager must coordinate with the agency's 599
889	889	chief information security officer and the Cybersecurity 600
890	890
891	891	HB 1293 2025
892	892
893	893
894	894
895	895	CODING: Words stricken are deletions; words underlined are additions.
896	896	hb1293-00
897	897	Page 25 of 28
898	898	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
899	899
900	900
901	901
902	902	Operations Center to ensure that the unique needs of the agency 601
903	903	are met administer the cybersecurity program of the state 602
904	904	agency. This designation must be provided annually in writing to 603
905	905	the department by January 15 1. A state agency's information 604
906	906	security manager, for purposes of these information security 605
907	907	duties, shall work in collaboration with the agency's chief 606
908	908	information security officer and report directly to the agency 607
909	909	head. 608
910	910	(10) The department may brief any legislative committee or 609
911	911	subcommittee responsible for cybersecurity policy in a meeting 610
912	912	or other setting closed by the respective body under the rules 611
913	913	of such legislative body at which the legislative committee or 612
914	914	subcommittee is briefed on records made confidential and exempt 613
915	915	under subsections (5) and (6). The legislative committee or 614
916	916	subcommittee must mainta in the confidential and exempt status of 615
917	917	such records. A legislator serving on a legislative committee or 616
918	918	subcommittee responsible for cybersecurity policy may also 617
919	919	attend meetings of the Florida Cybersecurity Advisory Council, 618
920	920	including any portions of su ch meetings that are exempt from s. 619
921	921	286.011 and s. 24(b), Art. I of the State Constitution. 620
922	922	Section 5. Paragraphs (b) and (c) of subsection (5) of 621
923	923	section 282.3185, Florida Statutes, are amended to read: 622
924	924	282.3185 Local government cybersecurity. — 623
925	925	(5) INCIDENT NOTIFICATION. — 624
926	926	(b)1. A local government shall report all ransomware 625
927	927
928	928	HB 1293 2025
929	929
930	930
931	931
932	932	CODING: Words stricken are deletions; words underlined are additions.
933	933	hb1293-00
934	934	Page 26 of 28
935	935	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
936	936
937	937
938	938
939	939	incidents and any cybersecurity incident determined by the local 626
940	940	government to be of severity level 3, 4, or 5 as provided in s. 627
941	941	282.318(3)(c) to the Cybersecurity Operations Center, the 628
942	942	Cybercrime Office of the Department of Law Enforcement, and the 629
943	943	sheriff who has jurisdiction over the local government as soon 630
944	944	as possible but no later than 12 48 hours after discovery of the 631
945	945	cybersecurity incident and no later than 6 12 hours after 632
946	946	discovery of the ransomware incident. The report must contain 633
947	947	the information required in paragraph (a). 634
948	948	2. The Cybersecurity Operations Center shall : 635
949	949	a. Immediately notify the Cybercrime Office of the 636
950	950	Department of Law Enforcement and the sheri ff who has 637
951	951	jurisdiction over the local government of a reported incident 638
952	952	and provide to the Cybercrime Office of the Department of Law 639
953	953	Enforcement and the sheriff who has jurisdiction over the local 640
954	954	government regular reports on the status of the incident, 641
955	955	preserve forensic data to support a subsequent investigation, 642
956	956	and provide aid to the investigative efforts of the Cybercrime 643
957	957	Office of the Department of Law Enforcement upon the office's 644
958	958	request if the state chief information security officer finds 645
959	959	that the investigation does not impede remediation of the 646
960	960	incident and that there is no risk to the public and no risk to 647
961	961	critical state functions. 648
962	962	b. Immediately notify the state chief information security 649
963	963	officer of a reported incident. The state chief infor mation 650
964	964
965	965	HB 1293 2025
966	966
967	967
968	968
969	969	CODING: Words stricken are deletions; words underlined are additions.
970	970	hb1293-00
971	971	Page 27 of 28
972	972	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
973	973
974	974
975	975
976	976	security officer shall notify the President of the Senate and 651
977	977	the Speaker of the House of Representatives of any severity 652
978	978	level 3, 4, or 5 incident as soon as possible but no later than 653
979	979	24 12 hours after receiving a local government's incident 654
980	980	report. The notification must include a high -level description 655
981	981	of the incident and the likely effects and must be provided in a 656
982	982	secure environment. 657
983	983	(c) A local government may report a cybersecurity incident 658
984	984	determined by the local government to be of severity level 1 or 659
985	985	2 as provided in s. 282.318(3)(c) to the Cybersecurity 660
986	986	Operations Center, the Cybercrime Office of the Department of 661
987	987	Law Enforcement, and the sheriff who has jurisdiction over the 662
988	988	local government. The report shall contain the information 663
989	989	required in paragraph (a). The Cybersecurity Operations Center 664
990	990	shall immediately notify the Cybercrime Office of the Department 665
991	991	of Law Enforcement and the sheriff who has jurisdiction over the 666
992	992	local government of a reported incident and provide regular 667
993	993	reports on the status of the cybersecurity incident, preserve 668
994	994	forensic data to support a subsequent investigation, and provide 669
995	995	aid to the investigative efforts of the Cybercrime Office of the 670
996	996	Department of Law Enforcement upon request if the state chief 671
997	997	information security officer finds that the investigation does 672
998	998	not impede remediation of the cybersecurity incident and that 673
999	999	there is no risk to the public and no risk to critical state 674
1000	1000	functions. 675
1001	1001
1002	1002	HB 1293 2025
1003	1003
1004	1004
1005	1005
1006	1006	CODING: Words stricken are deletions; words underlined are additions.
1007	1007	hb1293-00
1008	1008	Page 28 of 28
1009	1009	F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
1010	1010
1011	1011
1012	1012
1013	1013	Section 6. Paragraph (j) of subsection (4) of section 676
1014	1014	282.319, Florida Statutes, is amended, and paragraph (m) is 677
1015	1015	added to that subsection, to read: 678
1016	1016	282.319 Florida Cybersecurity Advisory Council. — 679
1017	1017	(4) The council shall be comprised of the following 680
1018	1018	members: 681
1019	1019	(j) Three representatives from critical infrastructure 682
1020	1020	sectors, one of whom must be from a utility provider water 683
1021	1021	treatment facility, appointed by the Governor. 684
1022	1022	(m) A representative of local government. 685
1023	1023	Section 7. This act shall take effect July 1, 2025. 686