Energy, Communications & Cybersecurity Subcommittee Meeting Packet, March 21, 2023
Summary
A meeting packet for the Energy, Communications & Cybersecurity Subcommittee of the Commerce Committee of The Florida House of Representatives, chaired by Mike Giallombardo, for Tuesday, March 21, 2023, 2:00 pm to 6:00 pm. The agenda lists HB 821 Renewable Energy Cost Recovery by Yeager, HB 1221 Broadband Internet Service Providers by Tomkow, HB 1437 Pub. Rec./Broadband Opportunity Program Information/DEO by Esposito and HB 1511 Cybersecurity by Giallombardo, plus proposed committee substitutes for HB 1025 and HB 1331. The staff analysis of HB 821 describes the Public Service Commission's jurisdiction over rates and service of investor-owned electric and natural gas utilities.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Energy, Communications & Cybersecurity Subcommittee Meeting Packet, March 21, 2023.”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2023-03-21-3226-energy-communications-cybersecurity-subcommittee-meeti-c02df00e10/
, SHA-256 e00f5d90127a54606d9d7cc8016853af458f96b38a0d5874a320f3d69c0ac98a.Full text
Energy, Communications &
Cybersecurity Subcommittee
Tuesday, March 21, 2023
2:00 pm - 6:00 pm
Reed Hall (102 HOB)
Meeting Packet
Paul Renner Mike Giallombardo
Speaker Chair
The Florida House of Representatives
Commerce Committee
Energy, Communications & Cybersecurity Subcommittee
Paul Renner Mike Giallombardo
Speaker Chair
Meeting Agenda
Tuesday, March 21, 2023
2:00 pm – 6:00 pm
Reed Hall (102 HOB)
I. Call to Order
II. Roll Call
III. Welcome and Opening Remarks
IV. Consideration of the following bill(s):
• HB 821 Renewable Energy Cost Recovery by Yeager
• HB 1221 Broadband Internet Service Providers by Tomkow
• HB 1437 Pub. Rec./Broadband Opportunity Program Information/DEO by Esposito
• HB 1511 Cybersecurity by Giallombardo
Consideration of the following proposed committee substitute(s):
• PCS for HB 1025 -- Government Vehicles
• PCS for HB 1331 -- Municipal Utilities
V. Closing Remarks
VI. Adjournment
303 House Office Building, 402 South Monroe Street, Tallahassee, FL 32399-1300
(850) 717-4870
HB 821
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: HB 821 Renewable Energy Cost Recovery
SPONSOR(S): Yeager
TIED BILLS: IDEN./SIM. BILLS: SB 1162
REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF
1) Energy, Communications & Cybersecurity Walsh Keating
Subcommittee
2) State Administration & Technology
Appropriations Subcommittee
3) Commerce Committee
SUMMARY ANALYSIS
The Public Service Commission (PSC) has broad jurisdiction over the rates and service of public (investor-
owned) electric and natural gas utilities in Florida. The PSC sets rates for these utilities through various
mechanisms to allow the utilities to recover their legitimate costs of providing service, including a return on the
utility’s prudent capital investments.
Currently, the fuel required by public utilities to provide service in Florida is purchased from competitive
providers in an open market. These purchases, if deemed prudent by the PSC, are passed through to utility
customers with no markup for profit to the utility. With one exception for a pilot project, public utility investments
in fuel production projects are not included in the rates of electric or natural gas public utilities.
Renewable natural gas (RNG) is the gaseous product of the decomposition of organic matter, processed into a
pipeline-quality gas that is fully interchangeable with conventional natural gas. Primary sources of RNG include
landfills, livestock operations, and wastewater treatment facilities. Hydrogen fuel is produced predominantly
from natural gas but can also be produced, at a greater cost, by electrolysis powered by renewable energy.
The bill allows electric and natural gas public utilities to recover through rates:
The costs of contracts for the purchase of RNG and hydrogen, with pricing above the current market
value of natural gas, if the PSC finds that the contract promotes the development or use of renewable
energy resources in the state and provides fuel diversification.
Prudently-incurred costs for RNG and hydrogen fuel infrastructure projects, including but not limited to:
o Capital investment in projects necessary to prepare or produce RNG and hydrogen fuel for
pipeline distribution and usage;
o Capital investment in facilities, including pipelines, necessary to inject and deliver RNG and
hydrogen fuel throughout this state;
o RNG and hydrogen fuel storage facilities;
o Operation and maintenance expenses associated with any such RNG and hydrogen fuel
infrastructure projects; and
o An appropriate return on investment consistent with the return allowed for other utility plants
used to provide service to customers.
The bill provides for cost recovery of prudent infrastructure project costs through an appropriate mechanism
administered by the PSC.
The bill does not appear to impact state or local government revenues or expenses.
The bill provides an effective date of July 1, 2023.
This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives .
STORAGE NAME: h0821.ECC
DATE: 3/19/2023
FULL ANALYSIS
I. SUBSTANTIVE ANALYSIS
A. EFFECT OF PROPOSED CHANGES:
Current Situation
Rate Setting for Public Utilities
The Public Service Commission (PSC) has broad jurisdiction over the rates and service of public
(investor-owned) electric and natural gas utilities in Florida.1 Under this broad grant of authority, and
through more specific grants of authority in Chapter 366, F.S., the PSC sets rates for such utilities
through various mechanisms, each of which is established in a separate administrative proceeding:
Base rates (set for electric and natural gas utilities)
o Adjusted as needed in a general rate case, conducted through a formal evidentiary
hearing for electric utilities and either a formal or informal proceeding for natural gas
utilities.2
o Designed to recover most operations and maintenance expenses, depreciation expense
(recovery of capital investment over time), and a return on capital investment.
Fuel and purchased power cost recovery charges (set for electric utilities only)
o Adjusted annually through a formal evidentiary hearing.
o Designed to recover the costs of fuel and the energy component of wholesale power
purchases.
o By PSC order, may include recovery of certain capital investments, including a return on
investment.
Purchased gas adjustment charges (set for natural gas utilities only)
o Adjusted annually through a formal evidentiary hearing.
o Designed to recover the costs of wholesale natural gas purchases.
Capacity cost recovery charges (set for electric utilities only)
o Adjusted annually through a formal evidentiary hearing.
o Designed to recover costs of the capacity component of wholesale power purchases.
o By statute, may include recovery of certain costs related to development of new nuclear
power plants, including a return.3
Environmental cost recovery charges (set for electric utilities only)
o Adjusted annually through a formal evidentiary hearing.
o Designed to recover costs to comply with government-mandated environmental
standards.
o By statute, may include recovery of certain capital investments, including a return on
investment.4
Storm protection plan cost recovery charges (set for electric utilities only)
o Adjusted annually through a formal evidentiary hearing.
o Designed to recover costs to implement PSC-approved storm protection plans.
o By statute, may include recovery of certain capital investments, including a return on
investment.5
Energy conservation and efficiency cost recovery charges (set for electric and natural gas
utilities)
o Adjusted annually through a formal evidentiary hearing.
o Designed to recover costs of implementing PSC-approved energy conservation and
efficiency programs.
1See, e.g., ss. 366.01, 366.04(1), 366.041, 366.05(1), and 366.06, F.S.
2 A natural gas utility or a public electric utility whose annual sales to end -use customers amount to less than 1,000 gigawatt hours may
request that the PSC process the utility’s petition for rate relief using an informal “proposed agency action” procedur e. S. 366.06(4),
F.S.
3 S. 366.93, F.S.
4 S. 366.8255, F.S.
5 S. 366.96, F.S.
STORAGE NAME: h0821.ECC PAGE: 2
DATE: 3/19/2023
As required by law, the PSC sets base rates to allow utilities to recover their legitimate costs of
providing service (not otherwise recovered through another cost recovery mechanism), including a
return on the utility’s prudent capital investments (“rate base”). 6 In each rate case, the PSC sets a
“reasonable” rate of return on equity for each utility to apply to its rate base. This rate is typically
applied to the utility’s investments that the PSC allows to be recovered through cost recovery
mechanisms other than base rates.
Currently, the fuel required by public utilities to provide service in Florida is purchased from competitive
providers in an open market. As noted above, public utilities recover their fuel costs through one of two
mechanisms; electric public utilities recover their fuel costs through fuel and purchased power cost
recovery charges, and natural gas public utilities recover their wholesale natural gas costs through
purchased gas adjustment charges. The PSC determines the prudence of a utility’s fuel costs largely
by determining whether the utility contracted for fuel on reasonable terms based on what was known or
should have been known by purchasers in the market at that time. These costs are passed through to
utility customers with no markup for profit to the utility.
With one exception, public utility investments in fuel production projects are not included in the rates of
electric or natural gas public utilities. In 2021, the PSC approved a comprehensive Stipulation and
Settlement Agreement to resolve a pending proceeding to set base rates for Florida Power & Light
Company (FPL). Among other things, the settlement authorized FPL to implement a “Green Hydrogen”7
pilot project to evaluate how its combustion turbine units operate with a hydrogen fuel mix and learn
how a hydrogen fuel production facility can be effectively used on-site with combustion turbine units.
The project uses energy from a solar-powered facility to convert water into green hydrogen through
electrolysis, which will then be burned as fuel in a nearby FPL natural-gas powered generator. The
settlement allowed FPL to include in its base rates estimated costs of $65 million for the project.8
Renewable Energy
Florida law provides that it is in the public interest to promote the development of renewable energy
resources to help diversify fuel types for electric production, minimize the volatility of fuel costs,
encourage investment within the state, improve environmental conditions, and make Florida a leader in
new and innovative technologies.9 The law defines renewable energy as energy produced from a
method that uses one or more of the following fuels or energy sources: hydrogen produced or resulting
from sources other than fossil fuels, biomass, solar energy, geothermal energy, wind energy, ocean
energy, and hydroelectric power.10
Hydrogen
Hydrogen can be produced using a process called electrolysis, which splits water into hydrogen and
oxygen.11 When renewable energy is used as the source of electricity to power an electrolyzer, 12 the
resulting hydrogen can result in zero greenhouse gas emissions 13 and is referred to as green hydrogen.
Electrolyzers range in size, varying from small appliance-sized units to larger-scale central production
facilities that can be tied directly to renewable forms of electricity production to power the unit. 14
6 Ss. 366.041(1) and 366.06(1), F.S.
7
See Hydrogen, below.
8 Order No. PSC -2021-0446-S-EI, issued December 2, 2021, in PSC Docket No. 20210015.
9 S. 366.91, F.S.
10 S. 366.91(2)(e), F.S. The term also includes waste heat from sulfuric acid manufacturing operations and electrical energy pro duced
using pipeline-quality synthetic gas produced from waste petroleum coke with carbon capture and sequestration.
11 Id.
12 The process of electrolysis uses an electrolyzer, which is a system that uses electricity to break water into hydrogen and oxygen .
Cummins, Inc., Electrolyzers 101: What They Are, How They Work, and Where They fit in a Green Economy,
https://www.cummins.com/news/2020/11/16/electrolyzers -101-what-they-are-how-they-work-and-where-they-fit-green-economy (last
visited Mar. 18, 2023).
13 Office of Energy Efficiency & Renewable Energy, Hydrogen Production: Electrolysis, U.S. Department of Energy,
https://www.energy.gov/eere/fuelcells/hydrogen-production-electrolysis (last visited Mar. 18, 2023).
14 Id.
STORAGE NAME: h0821.ECC PAGE: 3
DATE: 3/19/2023
Some alternative methods of producing hydrogen, mainly grey hydrogen15 and blue hydrogen,16 use
methane or coal to power the production process.17 Another alternative method of producing hydrogen,
turquoise hydrogen, uses methane through the process of pyrolysis, which creates a reaction to
generate hydrogen and solid carbon, which means that there are no carbon dioxide emissions
associated with the reaction.18, 19
The vast majority of hydrogen is currently produced using fossil fuels, mostly natural gas. Overall, less
than 0.7% of current hydrogen production utilizes renewable energy. 20 The production cost of green
hydrogen must significantly decrease for it to be competitive with more mature carbon-based pathways
of energy production.21 In 2022, the Legislature created a sales tax exemption for the purchase of
certain machinery and equipment used in the production and handling of green hydrogen. 22
Renewable Natural Gas
Renewable natural gas (RNG) is the gaseous product of the decomposition of organic matter,
processed into a pipeline-quality gas that is fully interchangeable with conventional natural gas. Primary
sources of RNG include landfills, livestock operations, and wastewater treatment facilities. 23
In 2021, the Legislature added the term “renewable natural gas” to Florida law and defined it as
“anaerobically generated biogas, landfill gas, or wastewater treatment gas refined to a methane content
of 90 percent or greater which may be used as a transportation fuel or for electric generation or is of a
quality capable of being injected into a natural gas pipeline.” The legislation authorizes the PSC to
approve cost recovery for the purchase of RNG by natural gas public utilities, even if pricing exceeds
the current market price of natural gas, if the PSC deems the purchase to be reasonable and prudent.24
The law does not indicate what the PSC must consider in determining the reasonableness and
prudence of an above-market RNG purchase.
15 Grey hydrogen is traditionally produced from methane that is split with steam into carbon dioxide and hydrogen.
16 Blue hydrogen production follows the same process as grey hydrogen production, but also includes the technology necessary to
capture the carbon dioxide produced when hydrogen is split from methane.
17
Despite the colorful names used for the different ways hydrogen is produced, the gas itself is invisible t o the human eye. National
Grid, Energy Explained – Hydrogen Colour Spectrum , https://www.nationalgrid.com/stories/energy-explained/hydrogen-colour-spectrum
(last visited Mar. 19, 2023)
18 Rachel Meidl & Kenneth Medlock, The Advanced Carb on Economy: A Sustainab le Hydrogen Pathway, Rice University’s Baker
Institute for Public Policy, Jun. 22, 2021, p. 3, available at https://www.bakerinstitute.org/media/files/files/ec39c09c/bi -brief-062221-ces-
carbonecon-4.pdf (last visited Mar. 18, 2023).
19 When utilizing pyrolysis to produce turquoise hydrogen, the reaction does produce a solid carbon by-product that can be used in
applications ranging from construction to farming. Id.
20 Florida Public Service Commission, Agency Analysis of HB 821, p. 2 (Mar. 14, 2023).
21 Office of Energy Efficiency & Renewable Energy, supra note 13.
22 S. 23, ch. 2022-97, Laws of Fla., codified at s. 212.08(7)(ppp), F.S.
23 Office of Energy Efficiency & Renewable Energy, Alternative Fuels Data Center – Renewab le Natural Gas Production, U.S.
Department of Energy, https://afdc.energy.gov/fuels/natural_gas_renewable.html (last visited Mar. 18, 2023).
24 Ch. 2021-178, Laws of Fla., codified at s. 366.91(2)(f) and (9), F.S.
STORAGE NAME: h0821.ECC PAGE: 4
DATE: 3/19/2023
Effect of the Bill
The bill allows electric and natural gas public utilities to recover through rates:
The costs of contracts for the purchase of RNG and hydrogen, with pricing above the current
market value of natural gas, if the PSC finds that the contract promotes the development or use
of renewable energy resources in the state and provides fuel diversification.
Prudently-incurred costs for RNG and hydrogen fuel infrastructure projects, including but not
limited to:
o Capital investment in projects necessary to prepare or produce RNG and hydrogen fuel
for pipeline distribution and usage;
o Capital investment in facilities, including pipelines, necessary to inject and deliver RNG
and hydrogen fuel throughout this state;
o RNG and hydrogen fuel storage facilities;
o Operation and maintenance expenses associated with any such RNG and hydrogen fuel
infrastructure projects; and
o An appropriate return on investment consistent with the return allowed for other utility
plants used to provide service to customers.
For RNG and hydrogen fuel infrastructure projects, the bill allows cost recovery through an appropriate
mechanism administered by the PSC. The bill provides that the costs of these infrastructure projects
deemed prudent by the PSC are not subject to disallowance or further prudence review except for
fraud, perjury, or intentional withholding of key information by the public utility. The bill also provides
that, for purposes of cost recovery for these infrastructure projects, RNG may include a mixture of RNG
and natural gas.
The bill provides an effective date of July 1, 2023.
B. SECTION DIRECTORY:
Section 1. Amends s. 366.91, F.S., relating to renewable energy.
Section 2. Provides an effective date.
II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT
A. FISCAL IMPACT ON STATE GOVERNMENT:
1. Revenues:
None.
2. Expenditures:
None.
B. FISCAL IMPACT ON LOCAL GOVERNMENTS:
1. Revenues:
None. See Fiscal Comments.
2. Expenditures:
None.
C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
STORAGE NAME: h0821.ECC PAGE: 5
DATE: 3/19/2023
Public utilities that are permitted by the PSC to recover the costs of RNG or hydrogen fuel infrastructure
projects will expand the base upon which they earn a return on investment. Owners of assets from
which RNG may be produced will realize additional revenue streams.
To the extent that the cost to produce and transport renewable natural gas from an RNG infrastructure
project is more expensive over a project’s lifetime than the production and transport of natural gas from
other sources would have been, customers of public utilities will pay higher rates than they would
otherwise have paid. To the extent that the cost to produce and transport hydrogen fuel from a
hydrogen fuel production infrastructure project is more expensive over a project’s lifetime than the cost
of fuel it replaces (e.g., natural gas), customers of public utilities will pay higher rates than they
otherwise would have paid. The bill does not require a showing of net benefits to utility customers.
D. FISCAL COMMENTS:
If new RNG or hydrogen fuel infrastructure projects are subject to local property taxes, the bill may
create additional revenues for the local government jurisdictions in which those facilities are located, if
sited within Florida.
III. COMMENTS
A. CONSTITUTIONAL ISSUES:
1. Applicability of Municipality/County Mandates Provision:
Not Applicable. The bill does not appear to affect county or municipal governments.
2. Other:
None.
B. RULE-MAKING AUTHORITY:
The bill does not authorize or require agency rulemaking.
C. DRAFTING ISSUES OR OTHER COMMENTS:
Currently, the fuel required by public utilities to provide service in Florida is purchased from competitive
providers in an open market. The PSC determines the prudence of a utility’s fuel costs largely by
determining whether the utility contracted for fuel on reasonable terms based on what was known or
should have been known by purchasers in the market at that time. These costs are passed through to
utility customers with no markup for profit to the utility. Fuel production by a public utility is not required
for the utility to provide service to its customers.
The bill allows a public utility to recover through customer rates its prudently-incurred costs for certain
fuel production infrastructure, expanding the types of investments upon which a monopoly utility may
earn a return through customer rates. The bill does not provide guidance for the PSC in determining
whether projects of this type, which have not previously been approved for cost recovery 25 – aside from
one green hydrogen pilot project included as part of a comprehensive rate case settlement – are
prudent. To the extent that a project is not expected to result in benefits to customers, it is not clear
whether the PSC may consider other factors that would allow it to make a prudence determination.
As drafted, the bill does not require that RNG or hydrogen infrastructure projects be sited within Florida
or that the fuel produced by such projects be used in the provision of utility services in the state. The bill
also does not place any limits on the volume of RNG or hydrogen fuel infrastructure projects for which
25 In 2016, the Florida Supreme Court overturned a PSC order approving cos t recovery, including a profit, for an electric utility’s
participation in a joint venture to produce natural gas in another state, finding that the PSC’s authority to set rates exten ds only to costs
arising from the generation, transmission, or distribution of electricity in the state and that whether “cost recovery of speculative capital
investments in gas exploration and production by an electric utility is in the public interest is a policy determination that must be made
by the Legislature.” Citizens of the State of Florida v Art Graham , 191 So. 3d 897, (Fla. 2016).
STORAGE NAME: h0821.ECC PAGE: 6
DATE: 3/19/2023
cost recovery may be approved by the PSC. While it may be assumed that the PSC will consider these
criteria in a prudence review, the bill could be clarified to indicate whether these criteria apply.
IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES
STORAGE NAME: h0821.ECC PAGE: 7
DATE: 3/19/2023
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 821 2023
1 A bill to be entitled
2 An act relating to renewable energy cost recovery;
3 amending s. 366.91, F.S.; revising the types of
4 contracts which are eligible for cost recovery by a
5 public utility under certain circumstances;
6 authorizing a public utility to recover prudently
7 incurred renewable natural gas and hydrogen fuel
8 infrastructure project costs through the appropriate
9 Public Service Commission cost-recovery mechanism;
10 providing that such costs prudently incurred are not
11 subject to further actions except under certain
12 circumstances; specifying eligible renewable natural
13 gas and hydrogen fuel infrastructure projects;
14 providing an effective date.
15
16 Be It Enacted by the Legislature of the State of Florida:
17
18 Section 1. Subsection (9) of section 366.91, Florida
19 Statutes, is amended, and subsection (10) is added to that
20 section, to read:
21 366.91 Renewable energy.—
22 (9) The commission may approve cost recovery by a gas
23 public utility for Contracts for the purchase of renewable
24 natural gas and hydrogen in which the pricing provisions exceed
25 the current market price of natural gas are eligible for cost
Page 1 of 3
CODING: Words stricken are deletions; words underlined are additions.
hb0821-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 821 2023
26 recovery, but only if which are otherwise deemed reasonable and
27 prudent by the commission finds that the contract meets the
28 overall goals of subsection (1) by promoting the development or
29 use of renewable energy resources in this state and providing
30 fuel diversification.
31 (10) A public utility may recover, through the appropriate
32 cost-recovery mechanism administered by the commission,
33 prudently incurred costs for renewable natural gas and hydrogen
34 fuel infrastructure projects. If the commission determines that
35 such costs were prudently incurred, those costs are not subject
36 to disallowance or further prudence review except for fraud,
37 perjury, or intentional withholding of key information by the
38 public utility. For purposes of this subsection for utility cost
39 recovery only, renewable natural gas may include a mixture of
40 natural gas and renewable natural gas. Eligible renewable
41 natural gas and hydrogen fuel infrastructure projects include,
42 but are not limited to, capital investment in projects necessary
43 to prepare or produce renewable natural gas and hydrogen fuel
44 for pipeline distribution and usage; capital investment in
45 facilities, including pipelines, necessary to inject and deliver
46 renewable natural gas and hydrogen fuel throughout this state;
47 renewable natural gas and hydrogen fuel storage facilities;
48 operation and maintenance expenses associated with any such
49 renewable natural gas and hydrogen fuel infrastructure projects;
50 and an appropriate return on investment consistent with that
Page 2 of 3
CODING: Words stricken are deletions; words underlined are additions.
hb0821-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 821 2023
51 allowed for other utility plants used to provide service to
52 customers.
53 Section 2. This act shall take effect July 1, 2023.
Page 3 of 3
CODING: Words stricken are deletions; words underlined are additions.
hb0821-00
Energy, Communications & Cybersecurity Subcommittee
HB 821 by Rep. Yeager
Renewable Energy Cost Recovery
AMENDMENT SUMMARY
March 21, 2023
Amendment 1 by Rep. Yeager (strike-all):
• Specifies factors that the Public Service Commission (PSC) may consider in
determining whether a public utility contract for the purchase of renewable
natural gas (RNG) or hydrogen fuel is in the public interest.
• Specifies factors that the Public Service Commission (PSC) must consider in
determining whether a public utility’s RNG or hydrogen fuel infrastructure project
is in the public interest.
• Clarifies that an eligible RNG or hydrogen fuel infrastructure project must be
located in Florida.
• Specifies that costs incurred by a public utility for an RNG or hydrogen fuel
infrastructure project approved for cost recovery shall not be allowed until the
facility is placed in service.
• Requires an annual report from the PSC to provide information related to
approved RNG and hydrogen fuel infrastructure projects.
• Provides for repeal on June 30, 2028, unless reviewed and saved by the
Legislature; allows for continued recovery of previously approved costs after the
repeal date.
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 821 (2023)
Amendment No. 1
COMMITTEE/SUBCOMMITTEE ACTION
ADOPTED (Y/N)
ADOPTED AS AMENDED (Y/N)
ADOPTED W/O OBJECTION (Y/N)
FAILED TO ADOPT (Y/N)
WITHDRAWN (Y/N)
OTHER
1 Committee/Subcommittee hearing bill: Energy, Communications &
2 Cybersecurity Subcommittee
3 Representative Yeager offered the following:
4
5 Amendment (with title amendment)
6 Remove everything after the enacting clause and insert:
7 Section 1. Subsection (9) of section 366.91, Florida
8 Statutes, is amended, and subsection (10) is added to that
9 section, to read:
10 366.91 Renewable energy.—
11 (9) The commission may approve cost recovery by a gas
12 public utility for A public utility contracts for the purchase
13 of renewable natural gas or hydrogen fuel in which the pricing
14 provisions exceed the current market price of natural gas is
15 eligible for cost recovery, but only if which are otherwise
16 deemed reasonable and prudent by the commission finds, that the
349417 - h0821-strike.docx
Published On: 3/20/2023 8:42:12 PM
Page 1 of 6
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 821 (2023)
Amendment No. 1
17 contract provides net benefits to the public utility and its
18 customers and is therefore in the public interest. In making
19 this determination, the commission may consider the contract’s
20 impact on the overall diversity of the public utility’s natural
21 gas commodity supply or other fuel supply, the potential to
22 reduce the impact of volatility in the natural gas commodity
23 market upon the public utility and its customers, any
24 reliability benefits associated with the in-state production of
25 these fuel supplies, and the public utility’s cost of fuel.
26 (10)(a) A public utility may petition the commission for
27 approval to recover costs prudently incurred for a renewable
28 natural gas or hydrogen fuel infrastructure project at a
29 location in Florida for use in providing utility service within
30 this state.
31 (b) In its review of a petition filed pursuant to this
32 subsection, the commission shall consider:
33 1. The estimated volume and reliability of renewable
34 natural gas or hydrogen fuel that the project will produce for
35 use by the public utility, and the comparative cost of the same
36 volume of volume of natural gas purchases;
37 2. The estimated rate impact of the project over time,
38 including estimated savings, if any, to the public utility and
39 its customers;
40 3. The service and reliability benefits to be derived from
41 the project;
349417 - h0821-strike.docx
Published On: 3/20/2023 8:42:12 PM
Page 2 of 6
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 821 (2023)
Amendment No. 1
42 4. The proposed mechanism for recovery of project costs;
43 5. The impact of the project on fuel diversity in this
44 state and fuel cost volatility; and
45 6. Any other matter deemed relevant by the commission.
46 (c)1. Upon consideration of all matters specified in
47 paragraph (b), the commission shall determine whether , and the
48 extent to which, approval for recovery of project costs from the
49 public utility’s ratepayers provides net benefits to the state
50 and is therefore in the public interest.
51 2. If the commission approves recovery of project costs,
52 in whole or in part, the commission shall determine the
53 appropriate mechanism for recovery of such costs. Appropriate
54 mechanisms may include an existing cost recovery mechanism, not
55 excluding base rates, or a new cost recovery mechanism
56 established by the commission.
57 3. Costs approved by the commission are not subject to
58 disallowance or further prudence review except for fraud,
59 perjury, or intentional withholding of material information by
60 the public utility.
61 (d) Costs of renewable natural gas and hydrogen fuel
62 infrastructure projects that are eligible for recovery under
63 this subsection include:
64 1. Capital investment in projects necessary to prepare or
65 produce renewable natural gas or hydrogen fuel for pipeline
66 distribution and usage;
349417 - h0821-strike.docx
Published On: 3/20/2023 8:42:12 PM
Page 3 of 6
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 821 (2023)
Amendment No. 1
67 2. Capital investment in facilities, including pipelines,
68 necessary to inject into pipelines, and deliver for utility use,
69 renewable natural gas or hydrogen fuel throughout this state;
70 3. Renewable natural gas and hydrogen fuel storage
71 facilities;
72 4. Operation and maintenance expenses associated with such
73 renewable natural gas and hydrogen fuel infrastructure projects;
74 and
75 5. An appropriate return on investment consistent with th e
76 utility’s authorized return on investment for other utility
77 plants used to provide service to customers.
78 (e) Recovery of costs incurred by a public utility for a
79 renewable natural gas or hydrogen fuel infrastructure project
80 approved for cost recovery under this section shall not be
81 allowed until such facility is placed in service. Upon approval
82 of cost recovery by the commission, costs incurred prior to the
83 facility being placed in service may be deferred on the public
84 utility’s books for recovery once the facility is in service.
85 This shall not preclude application of any other appropriate
86 regulatory accounting rules that are otherwise deemed
87 appropriate, including but not limited to, normal recovery of
88 costs for construction work in progress.
89 (f) Beginning January 1, 2025, the commission must
90 annually submit a report to the Governor, the President of the
91 Senate, and the Speaker of the House of Representatives
349417 - h0821-strike.docx
Published On: 3/20/2023 8:42:12 PM
Page 4 of 6
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 821 (2023)
Amendment No. 1
92 indicating, for the 12-month reporting period and cumulatively:
93 the investment made in such infrastructure projects ; the
94 eligible costs incurred and the amount of such costs recovered;
95 the volume of renewable natural gas or hydrogen fuel used to
96 provide utility service; and an analysis of the price of
97 renewable natural gas or hydrogen fuel used to provide utility
98 service as compared to the market cost of gas, including actual
99 rate impacts of such projects.
100 (g) This subsection shall stand repealed on June 30, 20 28,
101 unless reviewed and saved from repeal by the Legislature. A
102 public utility may continue to recover eligible costs of
103 renewable natural gas or hydrogen fuel infrastructure projects
104 approved prior to June 30, 2028, under this subsection as being
105 in the public interest.
106 (h) The commission may adopt rules to implement and
107 administer this section.
108
109
110 -----------------------------------------------------
111 T I T L E A M E N D M E N T
112 Remove everything before the enacting clause and insert:
113 An act relating to renewable energy cost recovery; amending s.
114 366.91, F.S.; revising the types of contracts which are eligible
115 for cost recovery by a public utility under certain
116 circumstances; authorizing a public utility to recover prudently
349417 - h0821-strike.docx
Published On: 3/20/2023 8:42:12 PM
Page 5 of 6
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 821 (2023)
Amendment No. 1
117 incurred renewable natural gas and hydrogen fuel infrastructure
118 project costs approved by the Public Service Commission;
119 establishing criteria for consideration by the Public Service
120 Commission; establishing terms for cost recovery; specifying
121 eligible renewable natural gas and hydrogen fuel infrastructure
122 projects; requiring an annual report; providing for repeal on
123 June 30, 2028, unless reviewed and saved from repeal by the
124 Legislature; providing an effective date.
349417 - h0821-strike.docx
Published On: 3/20/2023 8:42:12 PM
Page 6 of 6
HB 1221
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: HB 1221 Broadband Internet Service Providers
SPONSOR(S): Tomkow
TIED BILLS: IDEN./SIM. BILLS: CS/SB 626
REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF
1) Energy, Communications & Cybersecurity Keating Keating
Subcommittee
2) State Administration & Technology
Appropriations Subcommittee
3) Commerce Committee
SUMMARY ANALYSIS
Rural electric cooperatives are electric utilities owned by their customer-members and located primarily in rural
areas where, at least historically, the economics of building or installing electrical infrastructure has not
attracted investment. To promote economic development, a cooperative in Florida may provide any energy or
nonenergy services to its membership. Currently, five of Florida’s 18 rural electric cooperatives are engaged in
or developing broadband service for their members. Both the state and federal government offer grant funds to
entities seeking to expand broadband Internet service into unserved areas.
The term pole attachment refers to the process by which communications services providers can place
communications infrastructure on existing electric utility poles. Rules governing pole attachments seek to
balance the desire to maximize value for users of both electric and communications services with concerns
unique to electric utility poles, such as safety and reliability. Since 2021, the Public Service Commission (PSC)
has had the authority to regulate and enforce rates, charges, terms, and conditions for pole attachments to
ensure that they are just and reasonable. No party yet has initiated proceedings at the PSC under this
authority. Attachments to poles owned by rural electric cooperatives are, and have historically been, exempt
from regulation.
The bill provides explicit authority for rural electric cooperatives in Florida to provide specified communications
services in the following circumstances:
The cooperative provides broadband Internet service directly or in partnership with a third party; or
The cooperative receives broadband grant funding pursuant to the Florida Broadband Opportunity
Program or from any other federal or state program offering grants to expand broadband Internet
service to unserved areas of the state.
Under the bill, if a cooperative provides a communications service under these terms, all poles owned by the
cooperative are subject to the PSC’s pole attachment regulations on the same terms as poles owned by
investor-owned electric utilities. Thus, the financial and legal responsibilities of parties to rural electric
cooperative pole attachment arrangements may substantially change depending on the PSC’s implementation
of its authority over pole attachment rates, charges, terms, and conditions.
The bill does not impact state or local government revenues or local government expenditures. The bill may
increase state government expenditures, but the PSC has indicated that it can handle the expected increased
workload with existing resources.
The bill provides an effective date of July 1, 2023.
This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives .
STORAGE NAME: h1221.ECC
DATE: 3/19/2023
FULL ANALYSIS
I. SUBSTANTIVE ANALYSIS
A. EFFECT OF PROPOSED CHANGES:
Current Situation
Regulation of Pole Attachments
The term pole attachment refers to the process by which communications services providers can place
communications infrastructure on existing electric utility poles. This reduces the number of poles that
must be built to accommodate utility and communications services, while reducing costs to users of
both services by allowing providers to share costs. Rules governing pole attachments seek to balance
the desire to maximize value for users of both electric and communications services with concerns
unique to electric utility poles, such as safety and reliability. 1 The space requested for a pole
attachment is typically one foot.
Pole attachments, originally by mutual agreement but later by federal statute and regulation, provide
non-pole-owning cable and telecommunication service providers with access to a utility’s distribution
poles, conduits, and ROW for:
Installing fiber, coaxial cable or wires, and other equipment;
Building an interconnected network; and
Reaching customers.2
Congress began regulating pole attachments 3 in 1978.4 The Telecommunications Act of 19965 (the Act)
expanded pole attachment rights to telecommunications 6 carriers. The Act requires utilities 7 to provide
nondiscriminatory access to cable television systems and telecommunications carriers. The Act also
authorizes the Federal Communications Commission8 (FCC) to regulate the rates, terms, and
conditions of attachments by cable television operators to the poles, conduit, or ROW owned or
controlled by utilities in the absence of parallel state regulation. 9 The Legislation withheld from FCC
jurisdiction the authority to regulate attachments where the utility is a railroad, cooperatively organized,
or owned by a government entity.10 Thus, federal pole attachment regulations apply only to investor-
owned electric utilities (IOUs). Municipal and cooperative electric utilities are specifically exempted from
federal pole attachment regulations.
The Act permits utilities to deny access where there is insufficient capacity and for reasons of safety,
reliability or generally applicable engineering purposes. In addition to establishing a right of access, the
Act provides a rate methodology for “attachments used by telecommunications carriers to provide
1 American Public Power Association, Issue Brief: Preserving the Municipal Exemption from Federal Pole Attachment Regulations (Jan.
2021) https://www.publicpower.org/policy/preserving-municipal-exemption-federal-pole-attachment-regulations (last visited Mar. 13,
2021).
2 Edison Electric Institute, Pole Attachments 101, https://ecfsapi.fcc.gov/file/7020708245.pdf (last visited Ma r. 13, 2021).
3
47 U.S.C. § 224(a)(4), defines ‘‘pole attachment’’ as “any attachment by a cable television system or provider of telecommuni cations
service to a pole, duct, conduit, or right-of-way owned or controlled by a utility.”
4 The Pole Attachment Act of 1978 granted utility pole access to cable companies, and was designed to promote utility competition and
service to the public. Communications Act Amendments of 1978, Pub. L. No. 95 -234. (Feb. 21, 1978).
5 Telecommunications Act of 1996, Pub. LA. No. 104-104, 110 Stat. 56 (1996).
6
The term “telecommunications” means the transmission, between or among points specified by the user, of information of the us er’s
choosing, without change in the form or content of the information as sent and received. 47 U.S.C. § 153(50).
7 47 U.S.C. § 224(a)(1), defines ‘‘utility’’ as “any person who is a local exchange carrier or an electric, gas, water, steam, or other public
utility, and who owns or controls poles, ducts, conduits, or rights -of-way used, in whole or in part, for any wire communications. Such
term does not include any railroad, any person who is cooperatively organized, or any person owned by the Federal Government or any
State.”
8 The FCC regulates interstate and international communications by radio, television, wire, satellite and cable in all 50 states, the
District of Columbia and U.S. territories. An independent U.S. government agency overseen by Congress, the FCC is the United States'
primary authority for communications law, regulation and technological innovation. FCC, What We Do, https://www.fcc.gov/about-
fcc/what-we-do (last visited Mar 19, 2023).
9 47 U.S.C. § 224.
10 In the Matter of Implementation of Section 224 of the Act- A Nat'l Broadb and Plan for Our Future, 26 F.C.C. Rcd. 5240, 5245–46
(2011)
STORAGE NAME: h1221.ECC PAGE: 2
DATE: 3/19/2023
telecommunications services”11 in addition to the existing methodology for attachments “used by a
cable television system solely to provide cable service.12
Federal law broadly preempts the regulation of telecommunications services. 13 However, federal law
allows states to exercise reverse preemption over the FCC’s jurisdiction of communications
infrastructure access,14 meaning that once a state adopts its own utility pole access rules, the FCC
loses jurisdiction over pole attachments to the extent that the state regulates such matters. 15
Pursuant to section 224(c) of the Act16, each state that regulates the rates, terms, and conditions for
pole attachments must certify to the FCC that:
It regulates such rates, terms, and conditions; and
In so regulating such rates, terms, and conditions, the state has the authority to consider and
does consider the interests of the subscribers of the services offered via such attachments, as
well as the interests of the consumers of the utility services provided by the pole owners.
Furthermore, a state is not considered to regulate the rates, terms, and conditions for pole attachments:
Unless the state has issued and made effective rules and regulations implementing the state's
regulatory authority over pole attachments; and
With respect to any individual matter, unless the state takes final action on a complaint
regarding such matter:
o Within 180 days after the complaint is filed with the state, or
o Within the applicable period prescribed for such final action in such rules and regulations
of the state, if the prescribed period does not extend beyond 360 days after the filing of
such complaint.
In Florida
In 2021, Florida exercised its power under the Act to assert reverse preemption over the FCC’s
regulation of pole attachments, directing the Florida Public Service Commission (PSC) to regulate and
enforce rates, charges, terms, and conditions for pole attachments, and to ensure that they are just and
reasonable. Accordingly, Florida law requires the PSC to adopt rules to administer its new regulatory
authority and, in doing so, to consider the interests of the subscribers and users of the services offered
through pole attachments, as well as the interests of the consumers of any pole owner providing such
attachments.17 Florida law maintains the federal regulatory exemption for attachments to poles owned
by government-owned or cooperative electric utilities.
Florida law provides that the Legislature’s intent is to encourage parties to enter into voluntary pole
attachment agreements and provides that it may not be construed to prevent parties from voluntarily
entering into such agreements without PSC approval. The law requires the PSC to hear and resolve
complaints concerning rates, charges, terms, conditions, voluntary agreements, or any denial of access
relative to pole attachments. The law specifies that a party's right to nondiscriminatory access to a pole
is identical to the rights afforded under section 224(f)(1) of the Act,18 and that a pole owner may deny
access to its poles on a nondiscriminatory basis when there is insufficient capacity, for reasons of
safety and reliability, and when required by generally applicable engineering purposes. A pole owner
must consider relevant construction and reliability standards approved by the PSC when evaluating
capacity, safety, reliability, and engineering requirements.
11 47 U.S.C. § 224(e).
12 47 U.S.C. § 224(d).
13 “No State or local statute or regulation, or other State or local legal requirement, may prohibit or have the effect of prohi biting the
ability of any entity to provide any interstate or intrastate telecommunications service.” 47 U.S.C. § 253(a).
14 47 U.S.C. § 224(c)(1).
15 Catherine J.K. Sandoval, Contested Places, Utility Pole Spaces: A Competition and Safety Framework for Analyzing Utility Pole
Association Rules, Roles, and Risks, 69 Cath. U. L. Rev. 473, 486–87 (2020).
16 47 U.S.C. § 224(c)
17 Ch. 2021-191, Laws of Fla., codified at s. 366.04(8), F.S.
18 47 U.S.C. s. 224(f)(1) provides for nondiscriminatory access to any pole, duct, conduit, or right-of-way owned or controlled by a utility,
subject to denial, on a nondiscriminatory basis, only on the grounds of insufficient pole capacity or for safety, reliability, or other
engineering purposes.
STORAGE NAME: h1221.ECC PAGE: 3
DATE: 3/19/2023
Under Florida law, FCC precedent is not binding upon the PSC. However, the bill requires the PSC to
apply the decisions and orders of the FCC and related appellate court decisions when determining just
and reasonable pole attachment rates, terms and conditions unless a pole owner or attaching entity
establishes by competent substantial evidence that an alternative cost-of-service based pole
attachment rate is appropriate and in the public interest.
To help establish precedent on the establishment of pole attachment rates and guide negotiations
toward voluntary pole attachment agreements, Florida law authorizes any pole owner or attaching
entity to participate in the first five formal administrative proceedings conducted by the PSC to
determine pole attachment rates. After the fifth such formal administrative proceeding is concluded by
final order, parties to subsequent pole attachment rate proceedings are limited to the specific pole
owner and pole attaching entities involved in and directly affected by the specific pole attachment rate.
Currently, no party has initiated a pole attachment proceeding at the PSC.
Rural Electric Cooperatives
Rural electric cooperatives are electric utilities that are owned by their consumer-members. These
private companies are generally nonprofit, with their principal purpose being to deliver electrical service
to their members. Rural electric cooperatives are mostly located in rural areas where, at least
historically, the return on investment for building or installing electrical infrastructure was not enough for
investor-owned utilities to want to service them.19
Historically, rural homes, farms, and businesses were some of the last places to electrify in the United
States (U.S.). By the mid-1930’s, 90 percent of U.S. urban homes were electrified, 20 however, the
opposite was true in rural areas—only one out of 10 rural homes had electric service.21 This lack of
electrical service deeply limited economic development in rural areas of the country. Despite this
impact, the costs to electrify most rural areas were usually prohibitive and often thought not
economically feasible.22 In the limited areas where rural electric power was available, often the prices
paid by such consumers were far higher than those paid by their urban counterparts.
In 1935, Executive Order 7037, issued by President Franklin Roosevelt, created the Rural
Electrification Administration (REA). One year later, Congress passed the Rural Electrification Act (Pub.
L. 74–605), codifying the REA and creating a loan program to encourage the growth of rural
electrification. Even with these available federal loans, established investor-owned utilities did not have
much interest in building rural systems. However, there was significant interest from farmer-based
electric cooperatives.23 By 1939, with assistance from REA funds, 413 rural electric cooperatives had
been established in the U.S.,24 and by 1950, 80 percent of U.S. farms had electric service. 25
During a reorganization of the United States Department of Agriculture (USDA) in 1994, the REA was
replaced with the Rural Utilities Service, which still exists today. 26 According to the National Rural
Electric Cooperative Association (NRECA), now over 99 percent of U.S. farms have electrical service. 27
Rural electric cooperatives continue to be the most prevalent way for consumers in rural areas to obtain
electrical service.28
19 University of Wisconsin Center for Cooperatives, Research on the Economic Impact of Cooperatives,
https://reic.uwcc.wisc.edu/electric/ (last visited Mar. 19, 2023).
20
Id.
21 National Rural Electric Cooperative Association, History, https://www.electric.coop/our-organization/history (last visited Mar. 19,
2023).
22 United States Department of Agriculture, Celeb rating the 80th Anniversary of the Rural Electrification Administration , Feb. 21, 2017,
https://www.usda.gov/media/blog/2016/05/20/celebrating-80th-anniversary-rural-electrification-administration (last visited Mar.19,
2023).
23 National Rural Electric Cooperative Association, History, supra note 22.
24 University of Wisconsin Center for Cooperatives , supra note 20.
25 Celeb rating the 80th Anniversary of the Rural Electrification Administration, supra note 23.
26 University of Wisconsin Center for Cooperatives , supra note 20.
27 National Rural Electric Cooperative Association, History, supra note 22.
28 United States Energy Information Administration, Today in Energy: August 15, 2019,
https://www.eia.gov/todayinenergy/detail.php?id=40913.
STORAGE NAME: h1221.ECC PAGE: 4
DATE: 3/19/2023
As of 2019, rural electric cooperatives in the U.S. averaged 7.98 customers per mile of line, as
compared with 32.4 customers per mile of line for the rest of the electricity industry. In addition, while
rural electric cooperatives have ownership of 42 percent of U.S. electricity distribution lines, their
electricity sales only represent 12 percent of the nation’s overall sales. Rural electric cooperatives have
a different customer mix as well. For rural electric cooperatives, 53 percent of their customers are
residential, with the remainder being commercial, industrial, and transportation customers —which
generally have much higher energy consumption. For the U.S. electric industry at-large, the percentage
of residential customers is 38 percent.29
These factors lead to rural electric cooperatives receiving significantly less revenue per dollar of capital
investment in distribution. Rural electric cooperatives’ average revenue for mile of distribution line is
$19,135 (versus $79,298 for the rest of the electricity industry) and their cost of distribution plant per
customer is $4,219 (versus $3,698).30 Thus, on a per customer basis, the distribution of electric power
in rural areas is higher versus the rest of the industry.
In Florida
In 1937, the REA drafted the Electric Cooperative Corporation Act as a model state law for states to
adopt for forming and operating rural electric cooperatives. Florida’s first distribution electric
cooperatives were formed that same year.31 At that time, much of Florida’s geographic territory lacked
electrical service, due to, like most of the U.S., the lack of enough economic development to make
providing service worthwhile for existing electric companies.
At present, Florida has 18 rural electric cooperatives, with 16 of these cooperatives being distribution
cooperatives and two being generation and transmission cooperatives. These cooperatives are
represented by the Florida Electric Cooperative Association (FECA). 32 These cooperatives operate in
57 of Florida’s 67 counties and have more than 2.7 million customers.33 Much like other areas of the
U.S., Florida rural electric cooperatives serve a large percentage of area, but have a low customer
density. Specifically, Florida cooperatives serve approximately 10 percent of Florida’s total electric
utility customers, but their service territory covers 60 percent of Florida’s total land mass. Each
cooperative is governed by a board of cooperative members elected by the cooperative’s
membership.34
In addition to providing electric service, cooperatives in Florida are authorized to own and operate
water and sewer systems.35 To promote economic development, cooperatives may provide any energy
or nonenergy services to its membership.36
Broadband Internet Deployment
Fixed and mobile broadband Internet services provide access to numerous employment, education,
entertainment, and health care opportunities.37 Communities that lack broadband access can have
difficulty attracting new capital investment. While Florida’s urban areas are served at a fixed broadband
coverage rate of 98 percent, its rural areas are served at a rate of 78.6 percent. 38 This disparity is
caused primarily by high per-unit construction costs required to build broadband infrastructure across
29 National Rural Electric Cooperative Association, Fact Sheet: Feb ruary 2021, https://www.cooperative.com/programs-
services/bts/documents/data/electric-co-op-fact-sheet-update-february-2021.pdf (last visited Mar. 19, 2023).
30 Id.
31 Seminole Electric Cooperative, Empowering our Community, https://www.seminole-electric.com/ (last visited Mar. 19, 2023).
32 Florida Electric Cooperative Association, Memb ers, https://feca.com/members/ (last visited Mar 19, 2023).
33 Florida Electric Cooperative Association, Our History, https://feca.com/our-history/ (last visited Mar 19, 2023).
34 Id.
35 S. 425.04(4), F.S.
36 S. 425.04 (15), F.S.
37 U.S. Federal Communications Commission (FCC), 2018 Broadb and Deployment Report, at 1 (Feb. 2, 2018), availab le at
https://docs.fcc.gov/public/attachments/FCC-18-10A1.pdf (last visited Mar. 23, 2023).
38 FCC, 2021 Broadb and Deployment Report at 63 (Jan. 19, 2021), availab le at https://docs.fcc.gov/public/attachments/FCC-21-
18A1.pdf (last visited Mar. 23, 2023). For purposes of this data, ‘fixed broadband services’ are measured at 25 megabits per second
downstream and 3 megabits per second upstream.
STORAGE NAME: h1221.ECC PAGE: 5
DATE: 3/19/2023
larger swaths of rural geographic areas.39 The recent COVID-19 pandemic amplified the need for
broadband Internet access in everyday life. Studies indicate that broadband Internet access matters for
jobs, income, business relocation, civic engagement, and health. 40
Broadband Growth Programs
Florida Broadband Opportunity Program
Established under s. 288.9962, F.S., the Broadband Opportunity Program (BOP) is a competitive
reimbursement program within the Florida Department of Economic Opportunity (DEO). 41 The purpose
of the program is to award grants to applicants who seek to expand broadband Internet service to
unserved areas of Florida. To operate the program, the Legislature appropriated $400 million in
federally funded State and Local Fiscal Recovery Funds (SLFRF) to increase Floridians’ acc ess to
reliable, affordable, and high-speed internet service.42
Connect America Fund
One of the earliest and most significant federal broadband programs is the Connect America Fund,
which is part of the FCC’s Universal Service Fund (USF). Started in 2011, the purpose of the fund is to
provide subsidies to telecommunications companies to expand telecommunications infrastructure in
rural and remote areas of the United States.43 The Connect America Fund is a “high-cost” program,
meaning that it is designed to ensure that consumers in rural, insular, and high cost areas have access
to modern telecommunications networks and that services through those networks, like voice and
broadband, are available at a cost comparable to that in more developed urban areas. 44 The Connect
America Fund is the largest of the USF’s programs, and has an annual budget of $4.5 billion. 45
Broadband Technology Opportunities Program
The Broadband Technology Opportunities Program (BTOP) is a federal grant program administered by
the National Telecommunications and Information Administration (NTIA), part of the U.S. Department of
Commerce. The BTOP is funded by the American Recovery and Reinvestment Act of 2009 (Pub. L.
111-5), and has an annual budget of $4 billion. The purpose of the program is to “bridge the
technological divide” and BTOP projects include deploying broadband Internet infrastructure,
enhancing and expanding public computer centers, and encouraging the sustainable adoption of
broadband service.46
USDA Programs: ReConnect Program and the Rural Broadband Program
The USDA operates two programs aimed at developing broadband in rural areas—the ReConnect
Program and the Rural Broadband Program. Though these programs both existed prior to 2021, the
Infrastructure Investment and Jobs Act (Public Law 117-58), signed into law on November 15, 2021,
39
American Broadband Initiative, Milestones Report, at 11 (Feb. 13, 2019), availab le at
https://www.ntia.doc.gov/files/ntia/publications/american_broadband_initiative_milestones_report.pdf (last visited Mar. 23, 2023).
40 COVID-19 lockdowns expose the digital have-nots in rural areas – here’s which policies can get them connected (Sep. 2, 2020),
https://theconversation.com/covid-19-lockdowns-expose-the-digital-have-nots-in-rural-areas-heres-which-policies-can-get-them-
connected-144324 (last visited Mar. 23, 2023).
41
Florida Department of Economic Opportunity, Broadb and Opportunity Program , https://www.floridajobs.org/community-planning-and-
development/broadband/broadband-opportunity-program (last visited Mar. 19, 2023).
42 Id.
43 Federal Communications Commission, Universal Service Monitoring Report, Feb. 13, 2023, (available at:
https://www.fcc.gov/general/federal-state-joint-board-monitoring-reports).
44 Federal Communications Commission, Universal Service for High Cost Areas-Connect America Fund,
https://www.fcc.gov/general/universal-service-high-cost-areas-connect-america-fund#releases (last vis ited Mar. 19, 2023).
45 Universal Service Administrative Co., Program Overview, https://www.usac.org/high-cost/program-overview/ (last visited Mar 3,
2023).19
46 National Telecommunications and Information Administration, Broadband Technology Opportunities Program,
https://ntia.gov/category/broadband-technology-opportunities-
program#:~:text=The%20Broadband%20Technology%20Opportunities%20Program,in%20communities%20across%20the%20country
(last visited Mar. 19, 2023).
STORAGE NAME: h1221.ECC PAGE: 6
DATE: 3/19/2023
provided new funding for both of these programs (and other broadband initiatives). The ReConnect
Program received $1.926 billion in funds for grants and loans and the Rural Broadband Program
received $74 million in funds for loans.47
The purpose of the ReConnect Program is to offer loans, grants, and loan-grant combinations to
facilitate broadband deployment in rural areas that currently do not have sufficient access to
broadband. The entities eligible to apply for the Reconnect Program include:
Corporations, limited liability companies, and limited liability partnerships;
State and local governments;
U.S. territories and possessions; and
Indian tribes, as defined in Section 4 of the Indian Self-Determination and Education Assistance
Act (25 U.S.C. §450b).48
Reconnect grants may be used for:
Construction or improvement of facilities required to provide fixed terrestrial broadband
services;
Funding of reasonable pre-application expenses; and
Funding the acquisition of an existing telecommunications system that does not currently
provide sufficient access to broadband.49
The Rural Broadband Program offers funds to help construct, improve, or acquire facilities and
equipment needed to provide broadband to rural areas. The entities eligible to apply for the program
are:
Corporations
Limited liability companies
Cooperative or mutual organizations
State and local governments
Indian tribes and tribal organizations
For the most recent years prior to 2021, Congress only appropriated funds to the Rural Broadband
Program for loans. However, with the increase in funding under the Infrastructure Investment and Jobs
Act, funding for grants and loan guarantees is also now available in the program. 50
While the USDA’s Reconnect and Rural programs are similar in their purpose, a key distinction lies in
the standards for eligible service areas. For the ReConnect Program, eligible service areas exist where
at least 90% of households lack sufficient access to broadband with at least 100 Mbps download and
20 Mbps upload speed (100/20 Mbps service). For the Rural Broadband Program, the standard for
eligibility is if the area in question does not have at least 50% of households with at least 25 Mbps
download and 3 Mbps upload speed (25/3 Mbps service).
Rural Electric Cooperative Engagement in Broadband
According to the NRECA, about 200 rural electric cooperatives are currently providing or building out
broadband service. In addition, the NRECA states that 200 additional rural electric cooperatives are
“assessing the feasibility of providing service to more than 6 million households in co-op service areas
that don’t have access to high-speed internet service.”51 To support its members who are or would like
to be engaged in the broadband business, the NRECA launched a new level of service for its members
in July 2022 called NRECA Broadband.52 The stated purpose of NRECA Broadband is to offer federal
47 Congressional Research Service, Infrastructure Investment and Job s Act: Funding for USDA
Rural Broadb and Programs, Nov. 19. 2021 (available at: https://crsreports.congress.gov/product/pdf/IF/IF11918).
48 United States Department of Agriculture, ReConnect Program, https://www.usda.gov/reconnect/program-overview (last visited Mar
19, 2023).
49 Id.
50 Federal Communications Commission, Universal Service for High Cost Areas-Connect America Fund, supra note 47.
51 National Rural Electric Cooperatives Association, Broadband, https://www.electric.coop/issues-and-policy/broadband (last visited Mar
19, 2023).
52 Id.
STORAGE NAME: h1221.ECC PAGE: 7
DATE: 3/19/2023
policy and regulatory advocacy; communication, events, and education; and operations and technology
support.53
While rural electric cooperatives have experience in operating a monopoly electric utility, many have
little institutional experience in operating in a non-monopoly competitive market in general or in
broadband telecommunications specifically. Thus, these companies can face challenges in learning
how to market and provide broadband services.54
Currently, five of Florida’s 18 rural electric cooperatives, are engaged in or developing broadband
service:
Glades Electric Cooperative (5.1 members per mile of line).
Central Florida Electric Cooperative (6.34 members per mile of line).
Suwannee Valley Electric Cooperative (4.5 members per mile of line).
Tri-County Electric Cooperative (4.48 members per mile of line).
Escambia River Electric Cooperative (6.94 members per mile of line).
According to the FECA these five cooperatives are the most rural in nature of the cooperatives in
Florida.55
Effect of the Bill
The bill explicitly authorizes rural electric cooperatives in Florida to provide communications services,
as defined in s. 350.81, F.S., in the following circumstances:
The cooperative provides broadband service directly or in partnership with a third party; or
The cooperative receives broadband grant funding pursuant to the Florida Broadband
Opportunity Program or from any other federal or state program offering grants to expand
broadband Internet service to unserved areas of the state.
Communications services, as defined in s. 350.81, F.S., include any advanced service, cable service,
or telecommunications service. Advanced service includes high-speed-Internet-access-service
capability in excess of 200 kilobits per second in the upstream or the downstream direction. 56
If a cooperative provides a communications service under these terms, all poles owned by the
cooperative are subject to pole attachment regulation on the same terms as poles owned by investor-
owned electric utilities.
B. SECTION DIRECTORY:
Section 1. Amends s. 425.04, F.S., relating to powers of rural electric cooperatives.
Section 2. Provides an effective date.
II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT
A. FISCAL IMPACT ON STATE GOVERNMENT:
1. Revenues:
None.
53 Cooperative.com, NRECA Broadb and, https://www.cooperative.com/topics/telecommunications-broadband/nreca-
broadband/Pages/default.aspx (last visited Mar. 19, 2023).
54 National Rural Electric Cooperatives Association, Along Those Lines: What It Takes for Electric Co-ops to Enter the Broadb and
Space, Jan 24, 2023, https://www.electric.coop/along-those-lines-what-it-takes-for-electric-co-ops-to-enter-the-broadband-space.
55 Senate Analysis of CS/SB 626 (2023), p. 15 (March 8, 2023), citing an email from Drew Love, Director of Government Affairs, F lorida
Electric Cooperatives Association, to Senate Regulated Industries Staff (Mar. 6, 2023).
56 S. 350.81, F.S.
STORAGE NAME: h1221.ECC PAGE: 8
DATE: 3/19/2023
2. Expenditures:
The bill may increase state government expenditures. The PSC has indicated that it can handle the
expected increased workload with existing resources.
B. FISCAL IMPACT ON LOCAL GOVERNMENTS:
1. Revenues:
None.
2. Expenditures:
None.
C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
The financial and legal responsibilities of parties to rural electric cooperative pole attachment
arrangements in Florida may substantially change depending on the PSC’s implementation of new pole
attachment regulatory authority under this bill.
D. FISCAL COMMENTS:
None.
III. COMMENTS
A. CONSTITUTIONAL ISSUES:
1. Applicability of Municipality/County Mandates Provision:
Not Applicable. The bill does not appear to affect county or municipal governments.
2. Other:
None.
B. RULE-MAKING AUTHORITY:
The bill does not authorize or require agency rulemaking.
C. DRAFTING ISSUES OR OTHER COMMENTS:
None.
IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES
STORAGE NAME: h1221.ECC PAGE: 9
DATE: 3/19/2023
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1221 2023
1 A bill to be entitled
2 An act relating to broadband Internet service
3 providers; amending s. 425.04, F.S.; authorizing rural
4 electric cooperatives to provide communications
5 services under certain circumstances for the purpose
6 of expanding broadband Internet service to unserved
7 areas of this state; providing an effective date.
8
9 Be It Enacted by the Legislature of the State of Florida:
10
11 Section 1. Section 425.04, Florida Statutes, is amended,
12 to read:
13 425.04 Powers.—A cooperative shall have all of the
14 following powers power:
15 (1) To sue and be sued, in its corporate name.;
16 (2) To have perpetual existence.;
17 (3) To adopt a corporate seal and alter the same at
18 pleasure.;
19 (4) To generate, manufacture, purchase, acquire,
20 accumulate and transmit electric energy, and to distribute,
21 sell, supply, and dispose of electric energy in rural areas to
22 its members, to governmental agencies and political
23 subdivisions, and to other persons not in excess of 10 percent
24 of the number of its members; to process, treat, sell, and
25 dispose of water and water rights; to purchase, construct, own
Page 1 of 5
CODING: Words stricken are deletions; words underlined are additions.
hb1221-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1221 2023
26 and operate water systems; to own and operate sanitary sewer
27 systems; and to supply water and sanitary sewer services.
28 However, a no cooperative may not shall distribute or sell any
29 electricity, or electric energy to any person residing within
30 any town, city or area in which the person is receiving adequate
31 central station service or who at the time of commencing such
32 service, or offer to serve, by a cooperative, is receiving
33 adequate central station service from any utility agency,
34 privately or municipally owned individual partnership or
35 corporation.;
36 (5) To make loans to persons to whom electric energy i s or
37 will be supplied by the cooperative for the purpose of, and
38 otherwise to assist such person in, wiring their premises and
39 installing therein electric and plumbing fixtures, appliances,
40 apparatus and equipment of any and all kinds and character, and
41 in connection therewith, to purchase, acquire, lease, sell,
42 distribute, install and repair such electric and plumbing
43 fixtures, appliances, apparatus and equipment, and to accept or
44 otherwise acquire, and to sell, assign, transfer, endorse,
45 pledge, hypothecate and otherwise dispose of notes, bonds and
46 other evidences of indebtedness and any and all types of
47 security therefor.;
48 (6) To make loans to persons to whom electric energy is or
49 will be supplied by the cooperative for the purpose of, and
50 otherwise to assist such persons in, constructing, maintaining
Page 2 of 5
CODING: Words stricken are deletions; words underlined are additions.
hb1221-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1221 2023
51 and operating electric refrigeration plants.;
52 (7) To become a member in one or more other cooperatives
53 or corporations or to own stock therein.;
54 (8) To construct, purchase, take, receive, lease as
55 lessee, or otherwise acquire, and to own, hold, use, equip,
56 maintain, and operate, and to sell, assign, transfer, convey,
57 exchange, lease as lessor, mortgage, pledge, or otherwise
58 dispose of or encumber, electric transmission and distribution
59 lines or systems, electric generating plants, electric
60 refrigeration plants, lands, buildings, structures, dams, plants
61 and equipment, and any and all kinds and classes of real or
62 personal property whatsoever, which shall be deemed necessary,
63 convenient or appropriate to accomplish the purpose for which
64 the cooperative is organized.;
65 (9) To purchase or otherwise acquire; to own, hold, use
66 and exercise; and to sell, assign, transfer, convey, mortgage,
67 pledge, hypothecate, or otherwise dispose of or encumber,
68 franchises, rights, privileges, licenses, rights-of-way and
69 easement.;
70 (10) To borrow money and otherwise contract indebtedness;
71 to issue notes, bonds, and other evidences of indebtedness
72 therefor; and to secure the payment thereof by mortgage, pledge,
73 deed of trust, or any other encumbrance upon any or all of its
74 then owned or after-acquired real or personal property, assets,
75 franchises, revenues or income.;
Page 3 of 5
CODING: Words stricken are deletions; words underlined are additions.
hb1221-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1221 2023
76 (11) To construct, maintain, and operate electric
77 transmission and distribution lines along, upon, under and
78 across all public thoroughfares, including without limitation,
79 all roads, highways, streets, alleys, bridges and causeways, and
80 upon, under and across all publicly owned lands, subject,
81 however, to the requirements in respect of the use of such
82 thoroughfares and lands that are imposed by the respective
83 authorities having jurisdiction thereof upon corporations
84 constructing or operating electric transmission and distribution
85 lines or systems.;
86 (12) To exercise the power of eminent domain in the manner
87 provided by the laws of this state for the exercise of that
88 power by corporations constructing or operating electric
89 transmission and distribution lines or systems.;
90 (13) To provide communications services, as defined in s.
91 350.81(1), notwithstanding any other provision of law, if the
92 cooperative provides broadband service directly or in
93 partnership with a third party or receives broadband grant
94 funding pursuant to s. 288.9962 or from any other federal or
95 state program offering grants to expand broadband Inter net
96 service to unserved areas of this state; however, all poles
97 owned by the cooperative are subject to regulation under s.
98 366.04(8) on the same basis as if such cooperative were a public
99 utility.
100 (14) To conduct its business and exercise any or all of
Page 4 of 5
CODING: Words stricken are deletions; words underlined are additions.
hb1221-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1221 2023
101 its powers within or without this state.;
102 (15)(14) To adopt, amend, and repeal bylaws.; and
103 (16)(15) To do and perform any and all other acts and
104 things, and to have and exercise any and all other powers which
105 may be necessary, convenient or appropriate to accomplish the
106 purpose for which the cooperative is organized.
107 (17) To promote economic development by providing, an
108 electric cooperative may provide any energy or nonenergy
109 services to its membership.
110 Section 2. This act shall take effect July 1, 2023.
Page 5 of 5
CODING: Words stricken are deletions; words underlined are additions.
hb1221-00
HB 1437
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: HB 1437 Pub. Rec./Broadband Opportunity Program Information/DEO
SPONSOR(S): Esposito
TIED BILLS: IDEN./SIM. BILLS: CS/SB 552
REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF
1) Energy, Communications & Cybersecurity Mortellaro Keating
Subcommittee
2) Ethics, Elections & Open Government
Subcommittee
3) Commerce Committee
SUMMARY ANALYSIS
In 2021, the Legislature created the Broadband Opportunity Program to award grants to applicants who seek
to expand access to broadband Internet service in unserved areas of the state. The grant program is
administered by the Florida Office of Broadband within the Department of Economic Opportunity (DEO). The
grant process requires that certain information about existing and proposed telecommunications facilities be
submitted to DEO.
This bill creates a public record exemption for information relating to communications service locations, project
proposals, and challenges submitted to and held by DEO under s. 288.9962, F.S. Under the bill, such
information is confidential and exempt if it is not otherwise publicly available and would reveal:
The location and capacity of communications network facilities;
Communications network coverage areas, including geographical maps;
Features, functions, and capabilities of communications network infrastructure and facilities;
Security, including cybersecurity, of the design, construction, and operation of the communications
network and associated services and products;
Specific customer locations; or
Sources of funding or in-kind contributions for a project.
The bill provides a statement of public necessity for this exemption. The statement provides that disclosing this
information could result in identification of vulnerabilities of communications services networks and facilities,
thus allowing security breaches that may damage and disrupt the safe and reliable operation of such networks,
adversely impacting the public health and safety of the state and affecting business interests through
compromised network security.
The bill is subject to the Open Government Sunset Review Act and will repeal on October 2, 2028 unless
saved by reenactment.
The bill provides an effective date of July 1, 2023.
Article I, s. 24(c) of the Florida Constitution requires a two-thirds vote of the members present and
voting for final passage of a newly created or expanded public record or public meeting exemption.
The bill creates a public record exemption; thus, it requires a two-thirds vote for final passage.
This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives .
STORAGE NAME: h1437.ECC
DATE: 3/19/2023
FULL ANALYSIS
I. SUBSTANTIVE ANALYSIS
A. EFFECT OF PROPOSED CHANGES:
Current Situation
Public Record Exemptions
Article I, section 24(a) of the Florida Constitution establishes the state’s public policy for accessing
government records. This section guarantees that every person has the right to inspect or copy any
public record from the legislative, executive, and judicial branches of government. Authority to grant
exemptions from public records is vested solely to the Legislature. The Legislature, may provide an
exemption of records, from the requirements of art. I, s. 24(a) of the Florida Constitution.1 A proposed
exemption must pass by a two-thirds vote of each chamber, state with specificity the public necessity to
justify the exemption,2 and be no broader than necessary to accomplish the public purpose. 3
Public policy regarding access to government records is addressed further in s. 119.07(1), F.S., which
guarantees every person a right to inspect and copy any state, county, or municipal record, unless the
record is exempt. Public exemptions are subject to the Open Government Sunset Review Act (Act)4
which provides that a public record or public meeting exemption may be created 5 or maintained only if it
serves an identifiable public purpose. In addition, it may be no broader than necessary to meet one of
the following purposes:
Allow the state or its political subdivisions to effectively and efficiently administer a
governmental program, which administration would be significantly impaired without the
exemption.
Protect sensitive personal information that, if released, would be defamatory or would
jeopardize an individual’s safety; however, only the identity of an individual may be exempted
under this provision.
Protect trade or business secrets.6
The Act requires the Legislature to review each public record exemption and each public meeting
exemption five years after enactment. If the Legislature does not reenact an exemption, it will
automatically repeal on October 2nd of the fifth year after enactment.
Florida’s Office of Broadband
In 2020, the Legislature designated the Department of Economic Opportunity (DEO) as the lead state
agency to facilitate the expansion of broadband Internet service in the state. 7 The Florida Office of
Broadband (Office) was created within DEO’s Division of Community Development for purposes of
developing, marketing, and promoting broadband Internet service in the state. 8
In 2021, the Legislature appropriated $1.5 million to DEO to develop geographic information system
maps of broadband Internet service availability, including transmission speeds, consistent with the
Federal Communications Commission’s data collection program standards. 9 DEO must collaborate with
broadband service providers, state agencies, local government entities, private businesses, educational
institutions, and community organizations to develop these maps.10 Through its website, DEO allows
1 Article I, s. 24(c), FLA. CONST.
2 This portion of a public record exemption is commonly referred to as a “public necessity statement.”
3 Article I, s. 24(c), FLA. CONST.
4 S. 119.15, F.S.
5 An example of an exception to a public record exemption would be allowing another agency access to confidential and exempt
records.
6 S. 119.15(6)(b), F.S.
7 Ch. 2002-26, Laws of Fla.
8 Id.
9 Ch. 2021-24, Laws of Fla.
10 Id.
STORAGE NAME: h1437.ECC PAGE: 2
DATE: 3/19/2023
for public input concerning the speed, connectivity, and access to broadband Internet service in areas
throughout the state to help identify unserved and underserved areas.
Broadband Opportunity Program
In 2021, the Legislature also created the Broadband Opportunity Program 11 to award grants to
applicants who seek to expand access to broadband Internet service 12 in unserved13 areas of the state,
regardless of the technology to be used. Grant funds may not be used to provide broadband Internet
service to a geographic area where broadband Internet is already deployed by at least one provider.14
Applicants eligible for grant awards include corporations, limited liability companies, general
partnerships, limited partnerships, political subdivisions, and Indian tribes. 15
In support of a grant application, an applicant must provide specified information, including, among
other things:
A description of the project area;
A description of the kind and amount of broadband Internet service infrastructure that is
proposed; and
Evidence demonstrating the unserved nature of the project area.16
After the close of the grant application process, the Office must publish on its website, from each grant
application submitted, the proposed unserved areas to be served and the proposed broadband internet
speeds of the areas to be served.17
If a broadband Internet service provider provides service in or adjacent to a proposed project area, it
can submit a written challenge to the office within 45 days of the information’s publication. The
challenge must demonstrate:
The provider currently has deployed broadband Internet service to retail customers within the
project area;
The provider has begun construction to provide broadband Internet service to retail customers
within the proposed project area within the timeframe proposed by the applicant; or
The provider commits to providing broadband Internet service to retail customers within the
proposed project area within the timeframe proposed by the applicant.
Within three business days after the submission of a written challenge, the office is to notify the
applicant of the challenge. The office must evaluate each challenge submitted. If the office determines
that the provider currently has deployed, has begun construction to provide, or commits to provide
broadband Internet service in the proposed project area, the office may not fund the challenged
project.18
11 Section 288.9962, F.S.
12 Section 288.9961(2)(a), F.S., defines the term “broadband Internet service” to mean any service that provides access to the Inter net
with a capacity for transmission at a consistent speed of at least 25 megabits per second download and 3 megabits per second upload.
13 Section 288.9961(2)(g), F.S., defines the term “unserved” to mean a geographic area of the state without access to broadband
Internet service.
14 S. 288.9962(2), F.S.
15 S. 288.9962(3), F.S.
16 S. 288.9962(5), F.S.
17 S. 288.9962(6)(b), F.S.
18 S. 288.9962(e), F.S.
STORAGE NAME: h1437.ECC PAGE: 3
DATE: 3/19/2023
Effect of the Bill
The bill creates a public record exemption by providing that information relating to communications
services locations, project proposals, and challenges submitted to and held by DEO under s. 288.9962,
F.S., are confidential and exempt19 if the information is not otherwise publicly available and would
reveal:
The location and capacity of communications network facilities;
Communications network coverage areas, including geographical maps indicating actual or
proposed locations of network infrastructure, facilities, or coverage;
Features, functions, and capabilities of communications network infrastructure and facilities;
Security, including cybersecurity, of the design, construction, and operation of the
communications network and associated services and products;
Specific customer locations;
Sources of funding or in-kind contributions for a project.
The bill is subject to Open Government Sunset Review Act and shall repeal on October 2, 2028 unless
saved through reenactment.
The bill provides that there is a public necessity for this exemption because the information at issue
contains security information and propriety business information. The bill states that disclosing
locations, capacities, features, and functions of communications networks and facilities could result in
identifying vulnerabilities in these networks and facilities which could allow security breaches that may
damage and disrupt the safe and reliable operation of such networks and facilities, adversely impacting
the public health and safety of the state and affecting business interests through compromising network
security.
The bill provides an effective date of July 1, 2023.
B. SECTION DIRECTORY:
Section 1. Amends s. 119.0712, F.S., to create a public records exemption for certain information
held by the Department of Economic Opportunity.
Section 2. Provides a public necessity statement.
Section 3. Provides an effective date.
19 There is a difference between records the Legislature designates exempt from public record requirements and those the Legislature
deems confidential and exempt. A record classified as exempt from public disclosure may be disclosed under cert ain circumstances.
See WFTV, Inc. v. Sch. Bd. of Seminole, 874 So.2d 48, 53 (Fla. 5th DCA 2004), review denied 892 So.2d 1015 (Fla. 2004); City of
Rivera Beach v. Barfield, 642 So.2d 1135 (Fla. 4th DCA 1994); Williams v. City of Minneola, 575 So.2d 683, 68 7 (Fla. 5th DCA 1991). If
the Legislature designates a record as confidential and exempt from public disclosure, such record may not be released by the
custodian of public records, to anyone other than the persons or entities specifically designated in sta tute. See Op. Att’y Gen. Fla.
(1985).
STORAGE NAME: h1437.ECC PAGE: 4
DATE: 3/19/2023
II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT
A. FISCAL IMPACT ON STATE GOVERNMENT:
1. Revenues:
None.
2. Expenditures:
The bill may have an insignificant negative fiscal impact on DEO. DEO’s staff responsible for
complying with public record requests may require training related to the newly created public
record exemption. These costs, however, would be absorbed, as they are
part of the day-to-day responsibilities of the agency.
B. FISCAL IMPACT ON LOCAL GOVERNMENTS:
1. Revenues:
None.
2. Expenditures:
None.
C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
None.
D. FISCAL COMMENTS:
None.
III. COMMENTS
A. CONSTITUTIONAL ISSUES:
1. Applicability of Municipality/County Mandates Provision:
Not applicable. The bill does not appear to require counties or municipalities to spend funds or take
action requiring the expenditure of funds; reduce the authority that counties and municipalities have
to raise revenues in the aggregate; or reduce the percentage of state tax shared with counties and
municipalities.
2. Other:
Vote Requirement
Article I, section 24(c) of the Florida Constitution requires a two-thirds vote of the members present
and voting for final passage of a newly created or expanded public record or public m eeting
exemption. The bill creates a public record exemption; thus, it requires a two-thirds vote for final
passage.
Public Necessity Statement
Article I, section 24(c) of the Florida Constitution requires a public necessity statement for a newly
created or expanded public record or public meeting exemption. The bill creates a public record
exemption; thus, it includes a public necessity statement.
Breadth of Exemption
Article 1, section 24(c) of the Florida Constitution requires a newly created or expanded public
record or public meeting exemption to be no broader than necessary to accomplish the stated
purpose of the law. The exemption created by the bill does not appear to be broader than
necessary to accomplish its purpose.
STORAGE NAME: h1437.ECC PAGE: 5
DATE: 3/19/2023
B. RULE-MAKING AUTHORITY:
None.
C. DRAFTING ISSUES OR OTHER COMMENTS:
The bill creates a public record exemption for information that reveals communications network
coverage areas. This may conflict with the requirement that DEO publish or share certain information
related to proposed or existing coverage areas under its broadband grant program.
IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES
STORAGE NAME: h1437.ECC PAGE: 6
DATE: 3/19/2023
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1437 2023
1 A bill to be entitled
2 An act relating to public records; amending s.
3 119.0712, F.S.; providing an exemption from public
4 records requirements for certain information relating
5 to communications services locations, project
6 proposals, and challenges submitted to and held by the
7 Department of Economic Opportunity under the Broadband
8 Opportunity Program; providing for future legislative
9 review and repeal of the exemption; providing a
10 statement of public necessity; providing an effective
11 date.
12
13 Be It Enacted by the Legislature of the State of Florida:
14
15 Section 1. Subsection (5) is added to section 119.0712,
16 Florida Statutes, to read:
17 119.0712 Executive branch agency-specific exemptions from
18 inspection or copying of public records.—
19 (5) DEPARTMENT OF ECONOMIC OPPORTUNITY.—Information
20 relating to communications services locations, project
21 proposals, and challenges submitted to and held by the
22 Department of Economic Opportunity under s. 288.9962 is
23 confidential and exempt from s. 119.07(1) and s. 24(a), Art. I
24 of the State Constitution if such information is not otherwise
25 publicly available and would reveal:
Page 1 of 3
CODING: Words stricken are deletions; words underlined are additions.
hb1437-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1437 2023
26 (a) The location and capacity of communications network
27 facilities;
28 (b) Communications network coverage areas, including
29 geographical maps indicating actual or proposed locations of
30 network infrastructure, facilities, or coverage;
31 (c) The features, functions, and capabilities of
32 communications network infrastructure and facilities;
33 (d) Security, including cybersecurity, of the design,
34 construction, and operation of the communications network and
35 associated services and products;
36 (e) Specific customer locations; or
37 (f) Sources of funding or in-kind contributions for a
38 project.
39
40 This subsection is subject to the Open Government Sunset Review
41 Act in accordance with s. 119.15 and shall stand repealed on
42 October 2, 2028, unless reviewed and saved from repeal through
43 reenactment by the Legislature.
44 Section 2. The Legislature finds that it is a public
45 necessity that information relating to communications services
46 locations, project proposals, and challenges submitted to and
47 held by the Department of Economic Opportunity under s.
48 288.9962, Florida Statutes, be made exempt from s. 119.07(1),
49 Florida Statutes, and s. 24(a), Article I of the State
50 Constitution if such information is not otherwise publicly
Page 2 of 3
CODING: Words stricken are deletions; words underlined are additions.
hb1437-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1437 2023
51 available and would reveal the location and capacity of
52 communications network facilities; communications network
53 coverage areas, including geographical maps indicating actual or
54 proposed locations of network infrastructure, facilities, or
55 coverage; the features, functions, and capabilities of
56 communications network infrastructure and facilities; security,
57 including cybersecurity, of the design, construction, and
58 operation of the communications network and associated services
59 and products; specific customer locations; or sources of funding
60 or in-kind contributions for a project. Such information
61 contains security information and proprietary business
62 information of communications services providers. The disclosure
63 of sensitive information relating to the locations, capacities,
64 features, and functions of communications networks and
65 facilities could result in identification of vulnerabilities in
66 such networks and facilities and allow security breaches that
67 may damage and disrupt the safe and reliable operation of such
68 networks, adversely impacting the public health and safety of
69 the state. Disclosure of such information would adv ersely affect
70 the business interests and compromise the network security of
71 such communications services providers and their networks and
72 facilities.
73 Section 3. This act shall take effect July 1, 2023.
Page 3 of 3
CODING: Words stricken are deletions; words underlined are additions.
hb1437-00
Energy, Communications & Cybersecurity Subcommittee
HB 1437 by Rep. Esposito
Pub. Rec./Broadband Opportunity Program Information/DEO
AMENDMENT SUMMARY
March 21, 2023
Amendment 1 by Rep. Esposito (lines 22-72):
• Removes information that reveals communication network coverage areas from
the public record exemption created by this bill.
• Clarifies that the exemption does not apply to publication of information by the
Department of Economic Opportunity that identifies specified areas proposed to
be served, and the broadband Internet speeds in those areas, under the
requirements of the state’s Broadband Opportunity Program.
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1437 (2023)
Amendment No. 1
COMMITTEE/SUBCOMMITTEE ACTION
ADOPTED (Y/N)
ADOPTED AS AMENDED (Y/N)
ADOPTED W/O OBJECTION (Y/N)
FAILED TO ADOPT (Y/N)
WITHDRAWN (Y/N)
OTHER
1 Committee/Subcommittee hearing bill: Energy, Communications &
2 Cybersecurity Subcommittee
3 Representative Esposito offered the following:
4
5 Amendment
6 Remove lines 22-72 and insert:
7 Department of Economic Opportunity under s. 288.9962 or pursuant
8 to a federal broadband access grant program implemented by the
9 Department of Economic Opportunity is confidential and exempt
10 from s. 119.07(1) and s. 24(a), Art. I of the State Constitution
11 if such information is not otherwise publicly available and the
12 release of such information would reveal:
13 a. The location or capacity of communications network
14 facilities;
258651 - h1437-line22.docx
Published On: 3/20/2023 7:18:32 PM
Page 1 of 3
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1437 (2023)
Amendment No. 1
15 b. Communications network areas, including geographical
16 maps indicating actual or proposed locations of network
17 infrastructure or facilities;
18 c. The features, functions, and capabilities of
19 communications network infrastructure and facilities;
20 d. Security, including cybersecurity, of the design,
21 construction, and operation of the communications network and
22 associated services and products;
23 e. Specific customer locations; or
24 f. Sources of funding or in-kind contributions for a
25 project.
26 2. This exemption does not apply to any required functions
27 of the department under s. 288.9962 relating to publishing a
28 description of the proposed unserved areas to be served and the
29 proposed broadband Internet speeds of the areas to be served as
30 provided by the applicant and approved by the department.
31 3. This paragraph is subject to the Open Government Sunset
32 Review Act in accordance with s. 119.15 and shall stand repealed
33 on October 2, 2028, unless reviewed and saved from repeal
34 through reenactment by the Legislature.
35 Section 2. The Legislature finds that it is a public
36 necessity that certain information relating to communications
37 services locations, project proposals, and challenges submitted
38 to the Department of Economic Opportunity under the Broadband
39 Opportunity Program or pursuant to a federal broadband access
258651 - h1437-line22.docx
Published On: 3/20/2023 7:18:32 PM
Page 2 of 3
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1437 (2023)
Amendment No. 1
40 grant program implemented by the department be made confidential
41 and exempt from public records requirements. Such information
42 contains security information and proprietary business
43 information of communications services providers. The disclosure
44 of sensitive information relating to the location, capacity,
45 features, functions, and security of these networks could result
46 in the identification of vulnerabilities in such networks and
47 allow a security breach that could damage the networks or
48 disrupt the networks' safe and reliable operation, adversely
49 impacting the public health and safety of this state. Further,
50 the disclosure of such information would adversely affect the
51 business interests and compromise the network security of the
52 communications services providers and their networks. Therefore,
53 the Legislature finds that it is a public necessity that certain
54 information relating to communications services locations,
55 project proposals, and challenges submitted to the Department of
56 Economic Opportunity under the Broadband Opportunity Program or
57 pursuant to a federal broadband access grant program implemented
58 by the department be held confidential and exempt from
59 disclosure under s. 119.07(1), Florida Statutes, and s. 24(a),
60 Article I of the State Constitution.
61
258651 - h1437-line22.docx
Published On: 3/20/2023 7:18:32 PM
Page 3 of 3
HB 1511
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: HB 1511 Cybersecurity
SPONSOR(S): Giallombardo
TIED BILLS: IDEN./SIM. BILLS: SB 1708
REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF
1) Energy, Communications & Cybersecurity Mortellaro Keating
Subcommittee
2) State Administration & Technology
Appropriations Subcommittee
3) Commerce Committee
SUMMARY ANALYSIS
Over the last decade, cybersecurity has rapidly become a growing concern. Cyberattacks are growing in
frequency and severity. Currently, the Department of Management Services (DMS) oversees information
technology (IT) governance and security for the executive branch of state government. The Florida Digital
Service (FLDS) is housed within DMS and was established in 2020 to replace the Division of State
Technology. Through FLDS, DMS implements duties and policies for information technology and cybersecurity
for state agencies.
The bill:
Authorizes FLDS to act more independently from DMS in performing certain functions relating to state
technology and cybersecurity, including rulemaking;
Modifies the definition for “incident”;
Requires FLDS to create an operations committee to foster collaboration between agencies;
Changes the method by which the state Chief Information Officer (CIO) is appointed;
Shifts authority to appoint a state chief data officer to the CIO;
Gives FLDS oversight of the Northwest Regional Data Center (NWRDC);
Requires FLDS to provide cybersecurity briefings to members of any legislative committee or
subcommittee responsible for policy matters relating to cybersecurity;
Provides that any legislative committee or subcommittee responsible for policy matters relating to
cybersecurity may hold meetings closed by the respective legislative body when being briefed on
certain information;
Provides that state agencies shall report a ransomware or cybersecurity incident to FLDS, the
Cybersecurity Operations Center, and the Cybercrime Office at FDLE as soon as possible, but no later
than four hours after discovery of a cybersecurity incident and no later than two hours after discovery of
a ransomware incident;
Creates a new advisory council called, the State Technology Advancement Council (STAC); and
Provides grounds for government and private entities to gain a presumption against liability for events
connected to a cybersecurity incident.
The bill does not have a fiscal impact on state or local government revenues or local government expenditures.
The bill may increase state expenditures. See Fiscal Analysis & Economic Impact Statement.
The bill provides an effective date of July 1, 2023.
This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives .
STORAGE NAME: h1511.ECC
DATE: 3/20/2023
FULL ANALYSIS
I. SUBSTANTIVE ANALYSIS
A. EFFECT OF PROPOSED CHANGES:
Cybersecurity Governance
Present Situation
Over the last decade, cybersecurity has rapidly become a growing concern. The cyberattacks are
growing in frequency and severity. Cybercrime is expected to inflict $8 trillion worth of damage globally
in 2023.1 The United States is often a target of cyberattacks, including attacks on critical infrastructure,
and has been a target of more significant cyberattacks 2 over the last 14 years than any other country.3
The Colonial Pipeline is an example of critical infrastructure that was attacked, disrupting what is
arguably the nation’s most important fuel conduit.4
Ransomware is a type of cybersecurity incident where malware5 that is designed to encrypt files on a
device and renders the files and the systems that rely on them unusable. In other words, critical
information is no longer accessible. During a ransomware attack, malicious actors demand a ransom in
exchange for regained access through decryption. If the ransom is not paid, the ransomware actors will
often threaten to sell or leak the data or authentication information. Even if the ransom is paid, there is
no guarantee that the bad actor will follow through with decryption.
In recent years, ransomware incidents have become increasingly prevalent among the nation’s state,
local, tribal, and territorial government entities and critical infrastructure organizations. 6 For example,
Tallahassee Memorial Hospital was hit by a ransomware attack early this February, and the hospitals
systems were forced to shut down, impacting many local residents in need of medical care. 7
Information Technology and Cybersecurity Management
The Department of Management Services (DMS) oversees information technology (IT)8 governance
and security for the executive branch in Florida.9 The Florida Digital Service (FLDS) is housed within
DMS and was established in 2020 to replace the Division of State Technology. 10 FLDS works under
DMS to implement policies for information technology and cybersecurity for state agencies.11
1 Cybercrime Magazine, Cyb ercrime to Cost the World $8 Trillion Annually in 2023, https://cybersecurityventures.com/cybercrime-to-
cost-the-world-8-trillion-annually-in-2023/ (last visited March 7, 2023).
2
“Significant cyber-attacks” are defined as cyber-attacks on a country’s government agencies, defense and high -tech companies, or
economic crimes with losses equating to more than a million dollars. FRA Conferences, Study: U.S. Largest Target for Significant
Cyb er-Attacks, https://www.fraconferences.com/insights-articles/compliance/study-us-largest-target-for-significant-cyber-
attacks/#:~:text=The%20United%20States%20has%20been%20on%20the%20receiving,article%20is%20from%20FRA%27s%20sister
%20company%2C%20Compliance%20Week (last visited Mar. 20, 2023).
3 Id.
4
S&P Global, Pipeline operators must start reporting cyb erattacks to government: TSA orders,
https://www.spglobal.com/commodityinsights/en/market-insights/latest-news/electric-power/052721-pipeline-operators-must-start-
reporting-cyberattacks-to-government-tsa-
orders?utm_campaign=corporatepro&utm_medium=contentdigest&utm_source=esgmay2021 (last visited Mar. 8, 2023).
5 “Malware” means hardware, firmware, or software that is intentionally included or inserted i n a system for a harmful purpose.
https://csrc.nist.gov/glossary/term/malware (last visited Mar 16, 2023).
6 Cybersecurity and Infrastructure Agency, Ransomware 101, https://www.cisa.gov/stopransomware/ransomware-101 (last visited
January 30, 2022).
7 Tallahassee Democrat, TMH says it has taken ‘major step’ toward restoration after cyb ersecurity incident (Feb. 15, 2023)
https://www.tallahassee.com/story/news/local/2023/02/14/tmh-update-hospital-has-taken-major-step-toward-restoration/69904510007/
(last visited Mar. 7, 2023).
8 The term “information technology” means equipment, hardware, software, firmware, programs, systems, networks, infrastructure,
media, and related material used to automatically, electronically, and wirelessly collect, receive, access, transmit, display, store, record,
retrieve, analyze, evaluate, process, classify, manipulate, manage, assimilate, control, communicate, exchange, convert, converge,
interface, switch, or disseminate information of any kind or form. S. 282.0041(19), F.S.
9 See s. 20.22, F.S.
10 Ch. 2020-161, L.O.F.
11 See s. 20.22(2)(b), F.S.
STORAGE NAME: h1511.ECC PAGE: 2
DATE: 3/20/2023
The head of FLDS is appointed by the Secretary of Management Services 12 and serves as the state
chief information officer (CIO).13 The CIO must have at least five years of experience in the
development of IT system strategic planning and IT policy and, preferably, have leadership-level
experience in the design, development, and deployment of interoperable software and data solutions. 14
FLDS must propose innovative solutions that securely modernize state government, including
technology and information services, to achieve value through digital transformation and
interoperability, and to fully support Florida’s cloud first policy.15
DMS, through FLDS, has the following powers, duties, and functions:
Develop IT policy for the management of the state’s IT resources;
Develop an enterprise architecture;
Establish project management and oversight standards with which state agencies must comply
when implementing IT projects;
Perform project oversight on all state agency IT projects that have a total cost of $10 million or
more and that are funded in the General Appropriations Act or any other law; and
Identify opportunities for standardization and consolidation of IT services that support
interoperability, Florida’s cloud first policy, and business functions and operations that are
common across state agencies.16
Information Technology Security Act
In 2021, the Legislature passed the IT Security Act,17 which requires DMS and the state agency18
heads to meet certain requirements in order to enhance the IT security of the state agencies.
Specifically, the IT Security Act provides that DMS is responsible for establishing standards and
processes consistent with accepted best practices for IT security,19 including cybersecurity, and
adopting rules that safeguard an agency’s data, information, and IT resources to ensure availability,
confidentiality, integrity, and to mitigate risks.20 In addition, DMS must:
Designate a state chief information security officer (CISO) to oversee state IT security;
Develop, and annually update, a statewide IT security strategic plan;
Develop and publish an IT security framework for use by state agencies;
Collaborate with the Cybercrime Office within the Florida Department of Law Enforcement
(FDLE) to provide training; and
Annually review the strategic and operational IT security plans of executive branch agencies. 21
State Cybersecurity Act
In 2022, the Legislature passed the State Cybersecurity Act,22 which requires DMS and the heads of
the state agencies 23 to meet certain requirements to enhance the cybersecurity24 of the state agencies.
12 The Secretary of Management Services serves as the head of DMS and is appointed by the Governor, subject to confirmation by t he
Senate. S. 20.22(1), F.S.
13 S. 282.0051(2)(a), F.S.
14 Id.
15
S. 282.0051(1), F.S.
16 Id.
17 S. 282.318, F.S.
18 The term “state agency” means any official, officer, commission, board, authority, council, committee, or department of the e xecutive
branch of state government; the Justice Administrative Commission; and the Public Service Commission. The term does not i nclude
university boards of trustees or state universities. S. 282.0041(33), F.S. For purposes of the IT Security Act, the term includes the
Department of Legal Affairs, The Department of Agriculture and Consumer Services, and the Department of Financial S ervices. S.
282.318(2), F.S.
19 The term “information technology security” means the protection afforded to an automated information system in order to attai n the
applicable objectives of preserving the integrity, availability, and confidentiality of data, information, and information technology
resources. S. 282.0041(22), F.S.
20 S. 292.318(3), F.S.
21 Id.
22 S. 282.318, F.S.
23 For purposes of the State Cybersecurity Act, the term “state agency” includes the Department of Legal Affairs, the Department of
Agriculture and Consumer Services, and the Department of Financial Services. S. 282.318(2), F.S.
24 “Cybersecurity” means the protection afforded to an automated information system in order to attain the applicable objectives of
preserving the confidentiality, integrity, and availability of data, information, and information technology resources. S. 282.0041(8), F.S.
STORAGE NAME: h1511.ECC PAGE: 3
DATE: 3/20/2023
DMS is tasked with completing the following, through FLDS:
Establishing standards for assessing agency cybersecurity risks;
Adopting rules to mitigate risk, support a security governance framework, and safeguard agency
digital assets, data,25 information, and IT resources;26
Designating a chief information security officer (CISO);
Developing and annually updating a statewide cybersecurity strategic plan such as identification
and mitigation of risk, protections against threats, and tactical risk detection for cyber
incidents;27
Developing and publishing for use by state agencies a cybersecurity governance framework;
Assisting the state agencies in complying with the State Cybersecurity Act;
Annually providing training on cybersecurity for managers and team members;
Annually reviewing the strategic and operational cybersecurity plans of state agencies;
Tracking the state agencies’ implementation of remediation plans;
Providing cybersecurity training to all state agency technology professionals that develops,
assesses, and documents competencies by role and skill level;
Maintaining a Cybersecurity Operations Center (CSOC) led by the CISO to serve as a
clearinghouse for threat information and coordinate with FDLE to support responses to
incidents; and
Leading an Emergency Support Function under the state emergency management plan.28
The State Cybersecurity Act requires the head of each state agency to designate an information
security manager to administer the state agency’s cybersecurity program.29 The head of the agency
has additional tasks in protecting against cybersecurity threats as follows:
Establish a cybersecurity incident response team with FLDS and the Cybercrime Office, which
must immediately report all confirmed or suspected incidents to the CISO;
Annually submit to DMS the state agency’s strategic and operational cybersecurity plans;
Conduct and update a comprehensive risk assessment to determine the security threats ;
Develop and update written internal policies and procedures for reporting cyber incidents ;
Implement safeguards and risk assessment remediation plans to address identified risks;
Ensure internal audits and evaluations of the agency’s cybersecurity program are conducted;
Ensure that the cybersecurity requirements for the solicitation, contracts, and service-level
agreement of IT and IT resources meet or exceed applicable state and federal laws, regulations,
and standards for cybersecurity, including the National Institute of Standards and Technology
(NIST)30 cybersecurity framework;
Provide cybersecurity training to all agency employees within 30 days of employment; and
Develop a process that is consistent with the rules and guidelines established by FLDS for
detecting, reporting, and responding to threats, breaches, or cybersecurity incidents. 31
Florida Cybersecurity Advisory Council
25 “Data” means a subset of structured information in a format that allows such information to be electronically retrieved and t ransmitted.
S. 282.0041(9), F.S.
26 “Information technology resources” means data processing hardware and software and services, communications, supplies,
personnel, facility resources, maintenance, and training. S. 282.0041(22), F.S.
27 “Incident” means a violation or imminent threat of violation, whether such violation is accidental or deliberate, of information
technology resources, security, policies, or practices. An imminent threat of violation refers to a situation in which the st ate agency has
a factual basis for believing that a specific incident is about to occur. S. 282.0041(19), F.S.
28 S. 282.318(3), F.S.
29 S. 282.318(4)(a), F.S.
30 NIST, otherwise known as the National Institute of Standards and Technology, “is a non -regulatory government agency that develops
technology, metrics, and standards to drive innovation and economic competitiveness at U.S.-based organizations in the science and
technology industry.” Nate Lord, What is NIST Compliance, DataInsider (Dec. 1, 2020), https://www.digitalguardian.com/blog/what-nist-
compliance (last visited Mar. 17, 2023).
31 S. 282.318(4), F.S.
STORAGE NAME: h1511.ECC PAGE: 4
DATE: 3/20/2023
The Florida Cybersecurity Advisory Council32 (CAC) within DMS33 assists state agencies in protecting
IT resources from cyber threats and incidents.34 The CAC must assist FLDS in implementing best
cybersecurity practices, taking into consideration the final recommendations of the Florida
Cybersecurity Task Force – a task force created to review and assess the state’s cybersecurity
infrastructure, governance, and operations.35 The CAC meets at least quarterly to:
Review existing state agency cybersecurity policies;
Assess ongoing risks to state agency IT;
Recommend a reporting and information sharing system to notify state agencies of new risks ;
Recommend data breach simulation exercises;
Assist FLDS in developing cybersecurity best practice recommendations; and
Examine inconsistencies between state and federal law regarding cybersecurity. 36
The CAC must work with NIST and other federal agencies, private sector businesses, and private
security experts to identify which local infrastructure sectors, not covered by federal law, are at the
greatest risk of cyber-attacks and to identify categories of critical infrastructure as critical cyber
infrastructure if cyber damage to the infrastructure could result in catastrophic consequences.37
The CAC must also prepare and submit a comprehensive report to the Governor, the President of the
Senate, and the Speaker of the House of Representatives that includes data, trends, analysis, findings,
and recommendations for state and local action regarding ransomware incidents as stated below:
Descriptive statistics, including the amount of ransom requested, duration of the incident, and
overall monetary cost to taxpayers of the incident;
A detailed statistical analysis of the circumstances that led to the ransomware incident which
does not include the name of the state agency or local government, network information, or
system identifying information;
Statistical analysis of the level of cybersecurity employee training and frequency of data backup
for the state agencies or local governments that reported incidents;
Specific issues identified with current policy, procedure, rule, or statute and recommendations to
address those issues; and
Other recommendations to prevent ransomware incidents.
State Data Center
In 2022, legislation moved the State Data Center (SDC) from FLDS to DMS, which now operates and
maintains the SDC. The SDC provides data center services that comply with applicable state and
federal laws, regulations, and policies, including all applicable security, privacy, and auditing
requirements.38 The standards used by the SDC are created through the Information Technology
Infrastructure Library (ITIL), the International Organization for Standardization, and the International
Electrotechnical Commission (ISO/IEC) 20000, and the Project Management Institute’s (PMI) best
practices.
Northwest Regional Data Center
The Northwest Regional Data Center (NWRDC) is the leading computing provider for educational and
governmental communities in Florida. In 2022, NWRDC (located at Florida State University) was
declared an official state data center, and the current SDC resources, contracts, and assets were
transferred to NWRDC, through contract.39 This allows for NWRDC to provide services from the SDC
32 Under Florida law, an “advisory council” means an advisory body created by specific statutory enactment and appointed to func tion
on a continuing basis. Generally, an advisory council is enacted to study the problems arising in a specified functional or program area
of state government and to provide recommendations and policy alternatives. S. 20.03(7), F.S.; See also s. 20.052, F.S.
33 S. 282.319(1), F.S.
34 S. 282.319(2), F.S.
35 S. 282.319(3), F.S.
36 S. 282.319(9), F.S.
37 S. 282.319(10), F.S.
38 S. 282.201(1), F.S.
39 S. 282.201(5), F.S.
STORAGE NAME: h1511.ECC PAGE: 5
DATE: 3/20/2023
facility. The NWRDC offers services and 24/7 management support for various IT support solutions,
including: public/private cloud services, backup and recovery, storage, managed services, Tallahassee
fiber loop, Florida LambdaRail, MyFloridaNet, Florida Power and Light Fibernet, CenturyLink
Connectivity, security services, multi-site colocation, and disaster recovery.40
Cyber Incident Response
The National Cyber Incident Response Plan (NCIRP) was developed according to the direction of
Presidential Policy Directive (PPD)-41,41 by the U.S. Department of Homeland Security. The NCIRP is
part of the broader National Preparedness System and establishes the strategic framework for a whole-
of-Nation approach to mitigating, responding to, and recovering from cybersecurity incidents posing risk
to critical infrastructure.42 The NCIRP was developed in coordination with federal, state, local, and
private sector entities and is designed to interface with industry best practice standards for
cybersecurity, including the NIST Cybersecurity Framework.
The NCIRP adopted a common schema for describing the severity of cybersecurity incidents affecting
the U.S. The schema establishes a common framework to evaluate and assess cybersecurity incidents
to ensure that all departments and agencies have a common view of the severity of a given incident;
urgency required for responding to a given incident; seniority level necessary for coordinating response
efforts; and level of investment required for response efforts. 43
The severity level of a cybersecurity incident in accordance with the NCIRP is determined as follows:
Level 5: An emergency-level incident within the specified jurisdiction if the incident poses an
imminent threat to the provision of wide-scale critical infrastructure services; national, state, or
local security; or the lives of the country’s, state’s, or local government’s citizens.
Level 4: A severe-level incident if the incident is likely to result in a significant impact within the
affected jurisdiction which affects the public health or safety; national, state, or local security;
economic security; or individual civil liberties.
Level 3: A high-level incident if the incident is likely to result in a demonstrable impact in the
affected jurisdiction to public health or safety; national, state, or local security; economic
security; civil liberties; or public confidence.
Level 2: A medium-level incident if the incident may impact public health or safety; national,
state, or local security; economic security; civil liberties; or public confidence.
Level 1: A low-level incident if the incident is unlikely to impact public health or safety; national,
state, or local security; economic security; or public confidence. 44
State agencies and local governments in Florida, must report all ransomware incidents and any
cybersecurity incidents at severity levels three, four, and five incident as soon as possible, but no later
than 48 hours after discovery of a cybersecurity incident and no later than 12 hours after discovery of a
ransomware incident, to the Cybersecurity Operations Center (CSOC).45 The CSOC shall notify the
President of the Senate and the Speaker of the House of Representatives of any severity level three,
four, or five as soon as possible, but no later than 12 hours after receiving the incident report from the
state agency or local government.46 For state agency incidents at severity levels one and two, they
must report these to the CSOC and the Cybercrime Office at FDLE as soon as possible.47
40
NWRDC: Florida’s Cloud Broker, Ab out Northwest Regional Data Center, at https://www.nwrdc.fsu.edu/about (last visited Mar. 15,
2023).
41 Annex for PPD-41: U.S. Cyb er Incident Coordination, available at: https://obamawhitehouse.archives.gov/the-press-
office/2016/07/26/annex-presidential-policy-directive-united-states-cyber-incident (last visited Mar. 15, 2023).
42 Cybersecurity & Infrastructure Security Agency, Cyb ersecurity Incident Response, available at
https://www.cisa.gov/topics/cybersecurity-best-practices/organizations-and-cyber-safety/cybersecurity-incident-
response#:~:text=%20National%20Cyber%20Incident%20Response%20Plan%20%28NCIRP%29%20The,incidents%20and%20how%
20those%20activities%20all%20fit%20together (last visited Mar. 15, 2023).
43 Id.
44 S. 282.318(3)(c)9.a, F.S.
45 S. 282.318(3)(c)9.c, F.S.
46 S. 282.318(3)(c)9.c.(II), F.S.
47 S. 282.318(3)(c)(9)(d), F.S.
STORAGE NAME: h1511.ECC PAGE: 6
DATE: 3/20/2023
The notification must include a high-level description of the incident and the likely effects. An incident
report for a cybersecurity or ransomware incident by a state agency or local government must include,
at a minimum:
A summary of the facts surrounding the cybersecurity or ransomware incident;
The date on which the state agency or local government most recently backed up its data, the
physical location of the backup, if the backup was affected, and if the backup was created
using cloud computing;
The types of data compromised by the cybersecurity or ransomware incident;
The estimated fiscal impact of the cybersecurity or ransomware incident;
In the case of a ransomware incident, the details of the ransom demanded; and
If the reporting entity is a local government, a statement requesting or declining assistance
from the CSOC, FDLE Cybercrime Office, or sheriff.48
In addition, the CSOC must provide consolidated incident reports to the President of the Senate,
Speaker of the House of Representatives, and the CAC on a quarterly basis.49 The consolidated
incident reports to the CAC may not contain any state agency or local government name, network
information, or system identifying information, but must contain sufficient relevant information to allow
the CAC to fulfill its responsibilities.50
Legislation passed in 2022 additionally requires state agencies and local governments to submit an
after-action report to FLDS within one week of the remediation of a cybersecurity or ransomware
incident.51 The report must summarize the incident, state the resolution, and any insights from the
incident.
Effect of the Bill
The bill creates the “Florida Cyber Protection Act.”
The bill shifts authorities related to cybersecurity governance that the Department of Management
Services (DMS) has under current law to the FLDS. In doing so, the bill allows FLDS to make decisions
and have oversight, without having to act through DMS. The bill explicitly gives FLDS the authority to
respond to any state agency cybersecurity incident.
The bill modifies the definition for “incident” to include anything that may “jeopardize the confidentiality,
integrity, or availability of an information technology system or the information the system processes,
stores, or transmits.” The definition of “ransomware” is amended to include incidents commonly referred
to as “cyberextortion.”
Under the bill, FLDS must create an operations committee. The committee is formed to develop
collaborative efforts between agencies on cybersecurity issues. The CIO is to serve as the executive
director of the committee which will be composed of:
The Attorney General, or his or her designee;
The Secretary of State, or his or her designee;
The Executive director of the Department of Law Enforcement, or his or her designee;
A representative from each state agency;
A representative of the Florida State Guard; and
A representative of the Florida National Guard.
The bill changes the method by which the CIO is appointed, requiring the Governor to appoint the
position subject to confirmation by the Senate. The bill removes the requirement that the CIO consult
the Secretary of Management Services when appointing a state chief data officer.
48 S. 282.318(3)(c)9.b, F.S.
49 S. 282.318(3)(c)9.e, F.S.
50 Id.
51 S. 282.318(4)(k), F.S.
STORAGE NAME: h1511.ECC PAGE: 7
DATE: 3/20/2023
The bill reduces the cost threshold at which state agencies must report information technology projects
to FLDS. Under the bill, state agencies must report such projects if the cost is $5 million or more.
The bill shifts oversight of the state data center to FLDS, and with this shift, FLDS will receive full
access to the state data center infrastructure. All of DMS’s responsibilities with the data center shift to
FLDS, including appointing a director of the state data center.
The bill also gives FLDS oversight for the Northwest Regional Data Center (NWRDC). Accordingly,
NWRDC is to provide FLDS with access to information regarding operations of the state data center.
Under the bill, FLDS must oversee any cybersecurity audit completed by a private sector vendor to
ensure it meets applicable standards, processes, and timelines.
The bill provides that state agencies shall report a ransomware or cybersecurity incident to FLDS, the
CSOC, and the Cybercrime Office at FDLE as soon as possible, but no later than four hours after
discovery of a cybersecurity incident and no later than two hours after discovery of a ransomware
incident. Furthermore, the bill requires FLDS to notify the Governor, President of the Senate, and the
Speaker of the House of any incident discovered by a state agency but not timely reported. The
reporting requirement is for all severity levels of cyber incidents.
The bill requires that when the CSOC notifies the President of the Senate and the Speaker of the
House of Representatives of any level 3, 4, or 5 incident, the notification must be provided in a secure
environment. The bill removes the requirement under current law that a state agency must report an
incident determined to be of severity levels 1 or 2 to the CSOC and the Cybercrime Office at FDLE.
The bill requires FLDS to provide cybersecurity briefings to members of any legislative committee or
subcommittee responsible for policy matters relating to cybersecurity. Any legislative committee or
subcommittee responsible for policy matters relating to cybersecurity may hold meetings closed by the
respective legislative body at which the committee or subcommittee is briefed on records which are to
be made confidential and exempt.
The bill makes the state CIO a member of the Florida Cybersecurity Advisory Council (CAC), replacing
the Secretary of Management Services. Members of any legislative committee or subcommittee
responsible for policy matters relating to cybersecurity must be invited to and may attend meetings of
the CAC. The bill provides that a meeting of the CAC at which two or more members of the Legislature
are in attendance may not be construed as a meeting of a legislative committee or subcommittee or as
a prearranged gathering between more than two members of the legislature where they are meeting to
agree on a formal legislative action.
The bill creates a new advisory council called the State Technology Advancement Council (STAC).
STAC is created within the Executive Office of the Governor. The bill states that the purpose of STAC is
to:
Assist state agencies and advise the legislature on innovative technologies;
Improve state technology project timelines;
Develop efficient state technology processes;
Assist in creation of development and testing environments that allow state entities to proof
technology concepts before engaging in procurement and otherwise developing processes to
reduce wasteful spending on inappropriate technology;
Assist the Florida College System institutions and state universities with technology transfer
processes; and
Support research on and development of innovative technologies.
Under the bill, the state CIO, or his or her designee, shall serve as the executive director of STAC.
STAC is to be comprised of the following members appointed by the Governor:
A person with senior level experience in cloud computing technology;
An engineer;
A person with senior level experience in the space industry;
STORAGE NAME: h1511.ECC PAGE: 8
DATE: 3/20/2023
A data scientist; and
Other persons with relevant experience as determined by the Governor.
The bill requires that members serve terms of four years except the first year. For the purposes of
providing staggered terms, the initial appointments of two of the members appointed shall be for two
years instead of four. All members of the council are eligible for reappointment. The state CIO shall
serve as a non-voting member. Members shall serve without compensation but are entitled to receive
reimbursement for per diem and travel expenses. The bill requires that members of STAC maintain the
confidential or exempt status of information received in the performance of their duties and
responsibilities as members of the STAC. The council shall meet at least quarterly.
Beginning June 1, 2024, and annually on June 1 after STAC is created, the STAC must submit a report
describing its activities and recommendations to the Governor, Senate President, and Speaker of the
House of Representatives.
The bill requires that invoices must be sent to FLDS rather than DMS under s.1004.649, F.S.
Presumption Against Liability
Present Situation
Access to Courts
The Florida Constitution broadly protects the right to access the courts, which "shall be open to every
person for redress of any injury..."52 However, this constitutional right is not unlimited.
In Kluger v. White,53 the Court stated that it would not completely prohibit the Legislature from altering a
cause of action, but neither would it allow the Legislature "to destroy a traditional and long-standing cause
of action upon mere legislative whim..." The takeaway from Kluger and other relevant case law is that the
Legislature may:
Reduce the right to bring a cause of action as long as the right is not entirely abolished. 54
Abolish a cause of action that is not "traditional and long-standing"—that is, a cause of action that
did not exist at common law, and that did not exist in statute before the adoption of the Florida
Constitution's Declaration of Rights.55
Abolish a cause of action if the Legislature either:
o Provides a reasonable commensurate benefit in exchange; 56 or
o Shows an "overpowering public necessity for the abolishment of such right, and no
alternative method of meeting such public necessity can be shown." 57
Tort Liability and Negligence
52
Art. I, s. 21, Fla. Const.
53 Kluger, 281 So. 2d 1.
54 See Achord v. Osceola Farms Co., 52 So. 3d 699 (Fla. 2010).
55 See Anderson v. Gannett Comp., 994 So. 2d 1048 (Fla. 2008) (false light was not actionable under the common law); McPhail v.
Jenkins, 382 So. 2d 1329 (Fla. 1980) (wrongful death was not actionable under the common law); see also Kluger, 281 So. 2d at 4 ("We
hold, therefore, that where a right of access to the courts for redress for a particular injury has been provided by statutory law predating
the adoption of the Declaration of Rights of the Constitution of the State of Florida, or where such right has become a part of the common
law of the State . . . the Legislature is without power to abolish such a right without providing a reasonable alternative . . . unless the
Legislature can show an overpowering public necessity . . .").
56 Kluger, 281 So. 2d at 4; see Univ. of Miami v. Echarte, 618 So. 2d 189 (Fla. 1993) (upholding a statutory cap on medical malpractice
damages because the Legislature provided arbitration, which is a "commensurate benefit" for a claimant); accord Lasky v. State Farm
Ins. Co., 296 So. 2d 9 (Fla. 1974); b ut see Smith v. Dept. of Ins., 507 So. 2d 1080 (Fla. 1992) (striking down a noneconomic cap on
damages, which, while not wholly abolishing a cause of action, did not provide a commensurate benefit).
57 Kluger, 281 So. 2d at 4-5 (noting that in 1945, the Legislature abolished the right to sue for several causes of action, but successfully
demonstrated "the public necessity required for the total abolition of a right to sue") (citing Rotwein v. Gersten, 36 So. 2d 419 (Fla. 1948);
see Echarte, 618 So. 2d at 195 ("Even if the medical malpractice arbitration statutes at issue did not provide a commensurate benefit, we
would find that the statutes satisfy the second prong of Kluger which requires a legislative finding that an 'overpowering public necessity'
exists, and further that 'no alternative method of meeting such public necessity can be shown'").
STORAGE NAME: h1511.ECC PAGE: 9
DATE: 3/20/2023
A "tort" is a wrong for which the law provides a remedy. The purpose of tort law is to fairly compensate
a person harmed by another person’s wrongful acts, whether intentional, reckless, or negligent, through
a civil action or other comparable process. A properly-functioning tort system:
Provides a fair and equitable forum to resolve disputes;
Appropriately compensates legitimately harmed persons;
Shifts the loss to responsible parties;
Provides an incentive to prevent future harm; and
Deters undesirable behavior.58
"Negligence" is a legal term for a type of tort action that is unintentionally committed. In a negligence
action, the plaintiff is the party that brings the lawsuit, and the defendant is the party that defends
against it. To prevail in a negligence lawsuit, a plaintiff must demonstrate that the:
Defendant had a legal duty of care requiring the defendant to conform to a certain standard of
conduct for the protection of others, including the plaintiff, against unreasonable risks;
Defendant breached his or her duty of care by failing to conform to the required standard;
Defendant’s breach caused the plaintiff’s injury; and
Plaintiff suffered actual damage or loss resulting from his or her injury. 59
Courts distinguish varying degrees of civil negligence by using terms such as:
Slight Negligence The failure to exercise great care. This often applies to injuries caused by
common carries charged with the duty to exercise the highest degree of
care toward their passengers.60
Ordinary Negligence The failure to exercise that degree of care which an ordinary prudent person
would exercise; or, in other words, a course of conduct which a reasonable
and prudent person would know might possibly result in injury to others. 61
Gross Negligence A course of conduct which a reasonable and prudent person knows would
probably and most likely result in injury to another.62 To prove gross
negligence, a plaintiff must usually show that the defendant had knowledge
or awareness of imminent danger to another and acted or failed to act with
a conscious disregard for the consequences.63 Once proven, gross
negligence may support a punitive64 damages award.65
In Florida, before a court awards damages in a negligence action, the jury generally assigns a fault
percentage to each party under the comparative negligence rule. Florida applies 66 a "pure" comparative
negligence rule, which allows a plaintiff to recover damages proportional to his or her fault
percentage.67 For example, if a plaintiff is 40 percent at fault for an accident causing the plaintiff’s injury
and the defendant is 60 percent at fault, the plaintiff would recover 60 percent of his or her damages.
The Florida Rules of Civil Procedure generally require a plaintiff in a civil action to file a complaint, and
require a defendant to file an answer to the complaint. 68 Florida is a "fact-pleading jurisdiction." This
58
Am. Jur. 2d Torts s. 2.
59 6 Florida Practice Series s. 1.1; see Barnett v. Dept. of Financial Services, 303 So. 3d 508 (Fla. 2020).
60 See Faircloth v. Hill, 85 So. 2d 870 (Fla. 1956); see also Holland America Cruises, Inc. v. Underwood, 470 So. 2d 19 (Fla. 2d DCA
1985); Werndli v. Greyhound Corp., 365 So. 2d 177 (Fla. 2d DCA 1978); 6 Florida Practice Series s. 1.2.
61 See De Wald v. Quarnstrom , 60 So. 2d 919 (Fla. 1952); see also Clements v. Deeb , 88 So. 2d 505 (Fla. 1956); 6 Florida Practice
Series s. 1.2.
62 See Clements, 88 So. 2d 505; 6 Florida Practice Series s. 1.2.
63 See Carraway v. Revell, 116 So. 2d 16 (Fla. 1959).
64 Punitive damages are awarded in addition to actual damages to punish a defendant for behavior considered especially harmful.
Florida generally caps punitive damage awards at $500,000 or triple the value of compensatory damages, whichever is greater, and
caps cases of intentional misconduct with a financial motivation at two million dollars or four times the amount of compensatory
damages, whichever is greater. S. 768.73(1), F.S.
65 See Glaab v. Caudill, 236 So. 2d 180 (Fla. 2d DCA 1970); 6 Florida Practice Series s. 1.2; s. 768.72(2), F.S.
66 The comparative negligence standard does not apply to any action brought to recover economic damages from pollution, based on
an intentional tort, or to which the joint and several liability doctrines is specifically applied in chs. 403 , 498, 517, 542, and 895, F.S. S.
768.81(4), F.S.
67 S. 768.81(2), F.S.; see Williams v. Davis, 974 So. 2d 1052 (Fla. 2007).
68 Fla. R. Civ. P. 1.100.
STORAGE NAME: h1511.ECC PAGE: 10
DATE: 3/20/2023
means that a pleading setting forth a claim for relief, including a complaint, must generally state a
cause of action and contain a:
Short and plain statement of the grounds on which the court’s jurisdiction depends, unless the
court already has jurisdiction and the claim needs no new grounds to support it;
Short and plain statement of the ultimate facts 69 showing the pleader is entitled to relief; and
Demand for the relief to which the pleader believes he or she is entitled to.70
However, certain allegations 71 must be plead with "particularity," which is a heightened level of pleading
requiring a statement of facts sufficient to satisfy the elements of each claim.
Burden of Proof and Presumptions
The burden of proof is an obligation to prove a material fact in issue. 72 Generally, the party who asserts
the material fact in issue has the burden of proof.73 In a civil proceeding, for example, the burden of
proof is on the plaintiff to prove the allegations contained in his or her complaint. Further, a defendant in
either a criminal or a civil proceeding has the burden to prove any affirmative defenses 74 he or she may
raise in response to the charges or allegations. However, there are certain statutory and com mon law
presumptions 75 that may shift the burden of proof from the party asserting the material fact in issue to
the party defending against such fact.76 These presumptions remain in effect following the introduction
of evidence rebutting the presumption, and the factfinder must decide if such evidence is strong
enough to overcome the presumption.77 A presumption is a legal inference that can be made with
knowing certain facts. Most presumptions are able to be rebutted, if proven to be false or thrown into
sufficient doubt by the evidence.78
Cybersecurity Standards
Per Florida law, local governments are required to adopt cybersecurity standards that safeguard the
local government’s data, information technology, and information technology resources to ensure
availability, confidentiality, and integrity.79 The standards must be consistent with generally accepted
best practices for cybersecurity, including the NIST cybersecurity framework. 80 Once the standards are
adopted, each local government is to notify FLDS as soon as possible.81
The National Institute for Standards and Technology (NIST) is a non-regulatory federal agency housed
within the U.S. Department of Commerce. NIST is charged with providing a prioritized, flexible,
repeatable, performance-based, and cost-effective framework that helps owners and operators of
critical infrastructure identify, assess, and manage cyber risk. While the framework was developed with
critical infrastructure in mind, it can be used by organizations in any sector of the econom y or society.82
The framework is designed to complement, and not replace, an organization’s own unique approach to
cybersecurity risk management. As such, there are a variety of ways to use the framework and the
69 Ultimate facts are facts that must be accepted for a claim to prevail, usually inferred from a number o f supporting evidentiary facts,
which themselves are facts making other facts more probable. See Legal Information Institute, Ultimate Fact,
https://www.law.cornell.edu/wex/ultimate_fact (last visited Mar. 16, 2023); see also Legal Information Institute, Evidentiary Facts,
https://www.law.cornell.edu/wex/evidentiary_fact (last visited Mar. 16, 2023).
70 See Goldschmidt v. Holman, 571 So. 2d 422 (Fla. 1990); Fla. R. Civ. P. 1.110.
71 These allegations include fraud, mistake, condition of the mind, and denial of performance or occurrence. Fla. R. Civ. P. 1.1 20(b),(c).
72 5 Florida Practice Series s. 16:1.
73 Id.; see Berg v. Bridle Path Homeowners Ass’n, Inc., 809 So. 2d 32 (Fla. 4th DCA 2002).
74
An affirmative defense is a defense which, if proven, negates criminal or civil liability even if it is proven that the defen dant committed
the acts alleged. Examples include self-defense, entrapment, insanity, necessity, and respondeat superior. Legal Information Institute,
Affirmative Defense, https://www.law.cornell.edu/wex/affirmative_defense (last visited Mar. 16, 2021).
75 These presumptions tend to be social policy expressions, such as the presumption that all people are sane or that all children born in
wedlock are legitimate. 5 Florida Practice Series s. 16:1.
76 5 Florida Practice Series s. 16:1.
77 Id.
78 Legal Information Institute, Presumption, https://www.law.cornell.edu/wex/presumption (last visited Mar. 16, 2023).
79 S.282.3185(4)(a), F.S.
80 Id.
81 S.282.3185(4)(d), F.S.
82 National Institute of Standards and Technology, Framework for Improving Critical Infrastructure Cyb ersecurity,
https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf (last visited March 7, 202 3).
STORAGE NAME: h1511.ECC PAGE: 11
DATE: 3/20/2023
decision about how to apply it is left to the implementing organization. For example, an organization
may use its current processes and consider the framework to identify opportunities to strengthen its
cybersecurity risk management. The framework, overall, provides an outline of best practices that helps
organizations decide where to focus resources for cybersecurity protection. 83 Other cybersecurity
standards include:
NIST special publication 800-171 Provides recommended requirements for protecting the
confidentiality of controlled unclassified information. If a
manufacturer is part of a Department of Defense, General
Services Administration, NASA, or other state or federal
agency supply chain then they must comply with these security
requirements.84
NIST special publications 800-53 A category of security and privacy controls. Covers the steps in
and 800-53A the Risk Management Framework that address security
controls for federal information systems.85
The Federal Risk and Organization established by the General Services
Authorization Management Administration (a Federal Government Program) that provides
Program security assessment U.S. federal agencies, state agencies, and their vendors with a
framework standardized set of best practices to assess, adopt, and
monitor the use of cloud-based technology services under the
Federal Information Security Management Act (FISMA).86
CIS Critical Security Controls The Center for Internet Security Critical Security Controls (CIS)
are a prescriptive and simplified set of best practices for
strengthening cybersecurity for different organizations. CIS was
created in response to extreme data losses experienced by
organizations in the U.S. defense industrial base.87
The International Organization ISO/IEC 27001 (ISO) enables organizations of all sectors to
for Standardization/International manage security of financial information, intellectual property,
Electrotechnical Commission employee data and information entrusted by third parties. ISO
27000 – series family of has auditors and is an international standard. There are 804
standards
technical committees and subcommittees concerned with such
standards of development.88
Effect of the Bill
The bill provides a presumption against liability for events connected to a cybersecurity incident. Under
the bill:
A county or municipality that substantially complies with s. 282.3185, F.S., shall gain a
presumption against liability.
83 Id.
84
NIST, What is the NIST SP 800-171 and Who Needs to Follow It?, https://www.nist.gov/blogs/manufacturing-innovation-blog/what-
nist-sp-800-171-and-who-needs-follow-it-0#:~:text=NIST%20SP%20800-
171%20is%20a%20NIST%20Special%20Publication,protecting%20the%20confidentiality%20of%20controlled%20unclassified%20infor
mation%20%28CUI%29 (last visited Mar. 15, 2023).
85 NIST, Selecting Security and Privacy Controls: Choosing the Right Approach , https://www.nist.gov/blogs/cybersecurity-
insights/selecting-security-and-privacy-controls-choosing-right-approach (last visited Mar. 16, 2023).
86 Reciprocity, How State and Local Agencies Can Use FedRAMP, https://reciprocity.com/how-state-and-local-agencies-can-use-
fedramp/#:~:text=The%20Federal%20Risk%20and%20Authorization%20Management%20Program%20%28FedRAMP%29,cloud%20p
roducts%20offered%20by%20cloud%20service%20providers%20%28CSPs%29 (last visited Mar. 16, 2023).
87 CIS Security, CIS Critical Security Controls, https://www.cisecurity.org/controls (last visited Mar. 16, 2023).
88 ITGovernance, ISO 27001, The International Security Standard,
https://www.itgovernanceusa.com/iso27001#:~:text=ISO%2027001%20is%20a%20globally%20recognized%20information%20security,
trusted%20benchmark.%20Protect%20your%20data%2C%20wherever%20it%20lives (last visited Mar. 16, 2023).
STORAGE NAME: h1511.ECC PAGE: 12
DATE: 3/20/2023
A sole proprietorship, partnership, corporation, trust, estate, cooperative, association, or other
commercial entity acquires, maintains, stores, or uses personal information shall gain a
presumption against liability if the entity substantially complies with s. 501.171, F.S., and has
adopted a cybersecurity program that substantially aligns with the current version of any of the
following:
National Institute of Standards and Technology (NIST) Framework for Improving Critical
Infrastructure Cybersecurity.
NIST special publication 800-171.
NIST special publications 800-53 and 800-53A.
The Federal Risk and Authorization Management Program security assessment
framework.
CIS Critical Security Controls
The International Organization for Standardization/International Electrotechnical
Commission 27000 – series family of standards; or
If the entity is regulated by the state or Federal Government, or both, or if otherwise
subject to the requirements of any of the following laws and regulations, it must
substantially comply its cybersecurity program to the current version of:
o The security requirements of the Health Insurance Portability and Accountability
Act of 1996;
o Title V of the Gramm-Leach-Bliley Act of 1999 as amended;
o The Federal Information Security Modernization Act of 2014; or
o The Health Information Technology for Economic and Clinical Health Act.
A commercial entity that substantially complies with a combination of industry-recognized cybersecurity
frameworks or standards, including the payment card industry data security standard, gains a
presumption against liability, and must adopt the revised frameworks or standards within 1 year after
the latest publication date stated in the revisions.
The bill does not establish a private cause of action. It provides that a failure of a county, municipality,
or commercial entity to substantially implement a cybersecurity program that would allow it to gain a
presumption against liability under the bill is not evidence of negligence and does not constitute
negligence per se.
The bill provides that the act shall take effect July 1, 2023
B. SECTION DIRECTORY:
Section 1: Provides a short title for the act.
Section 2: Amends s. 282.0041, F.S., relating to definitions.
Section 3: Amends s. 282.0051, F.S. relating to DMS; FLDS; powers, duties, and functions.
Section 4: Amends s. 282.201, F.S., relating to the State Data Center.
Section 5: Amends s. 282.318, F.S., relating to cybersecurity.
Section 6: Amends s. 282.3185, F.S., relating to local government cybersecurity.
Section 7: Amends and adds to s. 282.319, F.S., relating to Florida Cybersecurity Advisory Council.
Section 8: Creates s. 282.3195, F.S., creating a State Technology Advancement Council.
Section 9: Creates s. 768.401, F.S., creating a presumption against liability.
Section 10: Amends s. 1004.649, F.S., relating to the Northwest Regional Data Center.
Section 11: Provides an effective date of July 1, 2023.
II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT
A. FISCAL IMPACT ON STATE GOVERNMENT:
STORAGE NAME: h1511.ECC PAGE: 13
DATE: 3/20/2023
1. Revenues:
None.
2. Expenditures:
The bill may impose additional expenditures on FLDS, as many oversight tasks shift to FLDS.
Additionally, the per diem expenses of the newly created State Technology Advancement Council
may result in increased expenditures.
B. FISCAL IMPACT ON LOCAL GOVERNMENTS:
1. Revenues:
None.
2. Expenditures:
None.
C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
None.
D. FISCAL COMMENTS:
None.
III. COMMENTS
A. CONSTITUTIONAL ISSUES:
1. Applicability of Municipality/County Mandates Provision:
Not applicable. This bill does not appear to require counties or municipalities to spend funds or take
action requiring the expenditures of funds; reduce the authority that counties or municipalities have
to raise revenues in the aggregate; or reduce the percentage of state tax shared with counties or
municipalities.
2. Other:
None.
B. RULE-MAKING AUTHORITY:
The bill shifts the authority to adopt rules relating to cybersecurity and the administration of s. 282.318,
F.S., from DMS to FLDS.
C. DRAFTING ISSUES OR OTHER COMMENTS:
None.
IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES
STORAGE NAME: h1511.ECC PAGE: 14
DATE: 3/20/2023
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
1 A bill to be entitled
2 An act relating to cybersecurity; providing a short
3 title; amending s. 282.0041, F.S.; revising
4 definitions; amending s. 282.0051, F.S.; clarifying
5 the powers, duties, and functions of the Florida
6 Digital Service; revising the cost threshold of state
7 agency information technology projects for which the
8 Florida Digital Service must perform project
9 oversight; requiring the Florida Digital Service to
10 establish an operations committee for a certain
11 purpose and composed of certain members; requiring the
12 Governor to appoint a state chief information officer
13 subject to confirmation by the Senate; conforming
14 provisions to changes made by the act; amending s.
15 282.201, F.S.; requiring the Florida Digital Service
16 to oversee the state data center; requiring the
17 Florida Digital Service to be provided with full
18 access to state data center infrastructure; requiring
19 the Northwest Regional Data Center to provide the
20 Florida Digital Service with access to certain
21 information; conforming provisions to changes made by
22 the act; amending s. 282.318, F.S.; clarifying the
23 authority of the Florida Digital Service; requiring
24 the Florida Digital Service to oversee certain
25 cybersecurity audits; requiring a state agency to
Page 1 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
26 report ransomware and cybersecurity incidents within a
27 certain time period; requiring the Florida Digital
28 Service to notify the Governor and Legislature of
29 certain incidents; providing that certain notification
30 must be provided in a secure environment; requiring
31 the Florida Digital Service to provide cybersecurity
32 briefings to certain legislative committees;
33 authorizing the Florida Digital Service to respond to
34 certain cybersecurity incidents; authorizing certain
35 legislative committees to hold closed meetings to
36 receive certain briefings; requiring such committees
37 to maintain the confidential and exempt status of
38 certain records; amending s. 282.3185, F.S.; requiring
39 a local government to report ransomware and
40 cybersecurity incidents within a certain time period;
41 requiring the Florida Digital Service to notify the
42 Governor and Legislature of certain incidents;
43 providing that certain notification must be provided
44 in a secure environment; amending s. 282.319, F.S.;
45 revising the membership of the Florida Cybersecurity
46 Advisory Council; providing that members of certain
47 legislative committees must be invited to and may
48 attend meetings of the council; providing
49 construction; creating s. 282.3195, F.S.; creating the
50 State Technology Advancement Council within the
Page 2 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
51 Executive Office of the Governor; providing for the
52 purpose, membership, terms of office, and meetings of
53 the council and members; providing requirements for
54 members relating to confidential and exempt
55 information and certain agreements; requiring the
56 council to submit an annual report to the Governor and
57 Legislature beginning on a specified date; creating s.
58 768.401, F.S.; providing a presumption against
59 liability in connection with a cybersecurity incident
60 for a county, municipality, or commercial entity that
61 complies with certain requirements; requiring certain
62 entities to adopt certain revised frameworks or
63 standards within a specified time period; providing
64 that a private cause of action is not established;
65 providing that certain failures are not evidence of
66 negligence and do not constitute negligence per se;
67 amending s. 1004.649, F.S.; conforming provisions to
68 changes made by the act; providing an effective date.
69
70 Be It Enacted by the Legislature of the State of Florida:
71
72 Section 1. This act may be cited as the "Florida Cyber
73 Protection Act."
74 Section 2. Subsections (1), (7), (19), and (28) of section
75 282.0041, Florida Statutes, are amended to read:
Page 3 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
76 282.0041 Definitions.—As used in this chapter, the term:
77 (1) "Agency assessment" means the amount each customer
78 entity must pay annually for services from the Florida Digital
79 Service Department of Management Services and includes
80 administrative and data center services costs.
81 (7) "Customer entity" means an entity that obtains
82 services from the Florida Digital Service Department of
83 Management Services.
84 (19) "Incident" means a violation or an imminent threat of
85 violation, whether such violation is accidental or deliberate,
86 of information technology resources, security, policies, or
87 practices which may jeopardize the confidentiality, integrity,
88 or availability of an information technology system or the
89 information the system processes, stores, or transmits. An
90 imminent threat of violation refers to a situation in which a
91 state agency, county, or municipality has a factual basis for
92 believing that a specific incident is about to occur.
93 (28) "Ransomware incident" means a malicious cybersecurity
94 incident in which a person or an entity introduces software that
95 gains unauthorized access to or encrypts, modifies, or otherwise
96 renders unavailable a state agency's, county's, or
97 municipality's data and thereafter the person or entity demands
98 a ransom to prevent the publication of the data, restore access
99 to the data, or otherwise remediate the impact of the software.
100 Such incidents are commonly referred to as cyberextorti on.
Page 4 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
101 Section 3. Section 282.0051, Florida Statutes, is amended
102 to read:
103 282.0051 Department of Management Services; Florida
104 Digital Service; powers, duties, and functions.—
105 (1) The Florida Digital Service is has been created within
106 the department to propose innovative solutions that securely
107 modernize state government, including technology and information
108 services, to achieve value through digital transformation and
109 interoperability, and to fully support the cloud-first policy as
110 specified in s. 282.206. The department, through the Florida
111 Digital Service, shall have the following powers, duties, and
112 functions:
113 (a) Develop and publish information technology policy for
114 the management of the state's information technology resources.
115 (b) Develop an enterprise architecture that:
116 1. Acknowledges the unique needs of the entities within
117 the enterprise in the development and publication of standards
118 and terminologies to facilitate digital interoperability;
119 2. Supports the cloud-first policy as specified in s.
120 282.206; and
121 3. Addresses how information technology infrastructure may
122 be modernized to achieve cloud-first objectives.
123 (c) Establish project management and oversight standards
124 with which state agencies must comply when implementing
125 information technology projects. The department, acting through
Page 5 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
126 the Florida Digital Service, shall provide training
127 opportunities to state agencies to assist in the adoption of the
128 project management and oversight standards. To support data-
129 driven decisionmaking, the standards must include, but are not
130 limited to:
131 1. Performance measurements and metrics that objectively
132 reflect the status of an information technology project based on
133 a defined and documented project scope, cost, and schedule.
134 2. Methodologies for calculating acceptable variances in
135 the projected versus actual scope, schedule, or cost of an
136 information technology project.
137 3. Reporting requirements, including requirements designed
138 to alert all defined stakeholders that an information technology
139 project has exceeded acceptable variances defined and documented
140 in a project plan.
141 4. Content, format, and frequency of project updates.
142 5. Technical standards to ensure an information technology
143 project complies with the enterprise architecture.
144 (d) Perform project oversight on all state agency
145 information technology projects that have total project costs of
146 $5 $10 million or more and that are funded in the General
147 Appropriations Act or any other law. The department, acting
148 through the Florida Digital Service, shall report at least
149 quarterly to the Executive Office of the Governor, the President
150 of the Senate, and the Speaker of the House of Representatives
Page 6 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
151 on any information technology project that the Florida Digital
152 Service department identifies as high-risk due to the project
153 exceeding acceptable variance ranges defined and documented in a
154 project plan. The report must include a risk assessment,
155 including fiscal risks, associated with proceeding to the next
156 stage of the project, and a recommendation for corrective
157 actions required, including suspension or termination of the
158 project.
159 (e) Identify opportunities for standardization and
160 consolidation of information technology services that support
161 interoperability and the cloud-first policy, as specified in s.
162 282.206, and business functions and operations, including
163 administrative functions such as purchasing, accounting and
164 reporting, cash management, and personnel, and that are common
165 across state agencies. The department, acting through the
166 Florida Digital Service, shall biennially on January 1 of each
167 even-numbered year provide recommendations for standardization
168 and consolidation to the Executive Office of the Governor, the
169 President of the Senate, and the Speaker of the House of
170 Representatives.
171 (f) Establish best practices for the procurement of
172 information technology products and cloud-computing services in
173 order to reduce costs, increase the quality of data center
174 services, or improve government services.
175 (g) Develop standards for information technology reports
Page 7 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
176 and updates, including, but not limited to, operational work
177 plans, project spend plans, and project status reports, for use
178 by state agencies.
179 (h) Upon request, assist state agencies in the development
180 of information technology-related legislative budget requests.
181 (i) Conduct annual assessments of state agencies to
182 determine compliance with all information technology standards
183 and guidelines developed and published by the Florida Digital
184 Service department and provide results of the assessments to the
185 Executive Office of the Governor, the President of the Senate,
186 and the Speaker of the House of Representatives.
187 (j) Conduct a market analysis not less frequently than
188 every 3 years beginning in 2021 to determine whether the
189 information technology resources within the enterprise are
190 utilized in the most cost-effective and cost-efficient manner,
191 while recognizing that the replacement of certain legacy
192 information technology systems within the enterprise may be cost
193 prohibitive or cost inefficient due to the remaining useful life
194 of those resources; whether the enterprise is complying with the
195 cloud-first policy specified in s. 282.206; and whether the
196 enterprise is utilizing best practices with respect to
197 information technology, information services, and the
198 acquisition of emerging technologies and information services.
199 Each market analysis shall be used to prepare a strategic plan
200 for continued and future information technology and information
Page 8 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
201 services for the enterprise, including, but not limited to,
202 proposed acquisition of new services or technologies and
203 approaches to the implementation of any new services or
204 technologies. Copies of each market analysis and accompanying
205 strategic plan must be submitted to the Executive Office of the
206 Governor, the President of the Senate, and the Speaker of the
207 House of Representatives not later than December 31 of each year
208 that a market analysis is conducted.
209 (k) Recommend other information technology services that
210 should be designed, delivered, and managed as enterprise
211 information technology services. Recommendations must include
212 the identification of existing information technology resources
213 associated with the services, if existing services must be
214 transferred as a result of being delivered and managed as
215 enterprise information technology services.
216 (l) In consultation with state agencies, propose a
217 methodology and approach for identifying and collecting both
218 current and planned information technology expenditure data at
219 the state agency level.
220 (m)1. Notwithstanding any other law, provide project
221 oversight on any information technology project of the
222 Department of Financial Services, the Department of Legal
223 Affairs, and the Department of Agriculture and Consumer Services
224 which has a total project cost of $20 million or more. Such
225 information technology projects must also comply with the
Page 9 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
226 applicable information technology architecture, project
227 management and oversight, and reporting standards established by
228 the department, acting through the Florida Digital Service.
229 2. When performing the project oversight function
230 specified in subparagraph 1., report at least quarterly to the
231 Executive Office of the Governor, the President of the Senate,
232 and the Speaker of the House of Representatives on any
233 information technology project that the department, acting
234 through the Florida Digital Service, identifies as high-risk due
235 to the project exceeding acceptable variance ranges defined and
236 documented in the project plan. The report shall include a risk
237 assessment, including fiscal risks, associated with proceeding
238 to the next stage of the project and a recommendation for
239 corrective actions required, including suspension or termination
240 of the project.
241 (n) If an information technology project implemented by a
242 state agency must be connected to or otherwise accommodated by
243 an information technology system administered by the Department
244 of Financial Services, the Department of Legal Affairs, or the
245 Department of Agriculture and Consumer Services, consult wit h
246 these departments regarding the risks and other effects of such
247 projects on their information technology systems and work
248 cooperatively with these departments regarding the connections,
249 interfaces, timing, or accommodations required to implement such
250 projects.
Page 10 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
251 (o) If adherence to standards or policies adopted by or
252 established pursuant to this section causes conflict with
253 federal regulations or requirements imposed on an entity within
254 the enterprise and results in adverse action against an entity
255 or federal funding, work with the entity to provide alternative
256 standards, policies, or requirements that do not conflict with
257 the federal regulation or requirement. The department, acting
258 through the Florida Digital Service, shall annually report such
259 alternative standards to the Executive Office of the Governor,
260 the President of the Senate, and the Speaker of the House of
261 Representatives.
262 (p)1. Establish an information technology policy for all
263 information technology-related state contracts, including state
264 term contracts for information technology commodities,
265 consultant services, and staff augmentation services. The
266 information technology policy must include:
267 a. Identification of the information technology product
268 and service categories to be included in state term contracts.
269 b. Requirements to be included in solicitations for state
270 term contracts.
271 c. Evaluation criteria for the award of information
272 technology-related state term contracts.
273 d. The term of each information technology-related state
274 term contract.
275 e. The maximum number of vendors authorized on each state
Page 11 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
276 term contract.
277 f. At a minimum, a requirement that any contract for
278 information technology commodities or services meet the National
279 Institute of Standards and Technology Cybersecurity Framework.
280 g. For an information technology project wherein project
281 oversight is required pursuant to paragraph (d) or paragraph
282 (m), a requirement that independent verification and validation
283 be employed throughout the project life cycle with the prima ry
284 objective of independent verification and validation being to
285 provide an objective assessment of products and processes
286 throughout the project life cycle. An entity providing
287 independent verification and validation may not have technical,
288 managerial, or financial interest in the project and may not
289 have responsibility for, or participate in, any other aspect of
290 the project.
291 2. Evaluate vendor responses for information technology -
292 related state term contract solicitations and invitations to
293 negotiate.
294 3. Answer vendor questions on information technology -
295 related state term contract solicitations.
296 4. Ensure that the information technology policy
297 established pursuant to subparagraph 1. is included in all
298 solicitations and contracts that are administratively executed
299 by the department.
300 (q) Recommend potential methods for standardizing data
Page 12 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
301 across state agencies which will promote interoperability and
302 reduce the collection of duplicative data.
303 (r) Recommend open data technical standards and
304 terminologies for use by the enterprise.
305 (s) Ensure that enterprise information technology
306 solutions are capable of utilizing an electronic credential and
307 comply with the enterprise architecture standards.
308 (t) Establish an operations committee that shall meet as
309 necessary for the purpose of developing collaborative efforts
310 between agencies and other governmental entities relating to
311 cybersecurity issues, including the coordination of response
312 efforts relating to cybersecurity incidents and issues relating
313 to the interoperability of agency projects. The state chief
314 information security officer shall serve as the executive
315 director of the committee. The committee shall be composed of
316 the following members:
317 1. The Attorney General, or his or her designee.
318 2. The Secretary of State, or his or her designee.
319 3. The executive director of the Department of Law
320 Enforcement, or his or her designee.
321 4. A representative of each state agency.
322 5. A representative of the Florida State Guard.
323 6. A representative of the Florida National Guard.
324 (2)(a) The Governor shall appoint Secretary of Management
325 Services shall designate a state chief information officer,
Page 13 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
326 subject to confirmation by the Senate, who shall administer the
327 Florida Digital Service. The state chief information officer,
328 before prior to appointment, must have at least 5 years of
329 experience in the development of information system strategic
330 planning and development or information technology policy, and,
331 preferably, have leadership-level experience in the design,
332 development, and deployment of interoperable software and data
333 solutions.
334 (b) The state chief information officer, in consultation
335 with the Secretary of Management Services, shall designate a
336 state chief data officer. The chief data officer must be a
337 proven and effective administrator who must have significant and
338 substantive experience in data management, data governance,
339 interoperability, and security.
340 (3) The department, acting through the Florida Digital
341 Service, and from funds appropriated to the Florida Digital
342 Service, shall:
343 (a) Create, not later than December 1, 2022, and maintain
344 a comprehensive indexed data catalog in collaboration with the
345 enterprise that lists the data elements housed within the
346 enterprise and the legacy system or application in which these
347 data elements are located. The data catalog must, at a minimum,
348 specifically identify all data that is restricted from public
349 disclosure based on federal or state laws and regulations and
350 require that all such information be protected in accordance
Page 14 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
351 with s. 282.318.
352 (b) Develop and publish, not later than December 1, 2022,
353 in collaboration with the enterprise, a data dictionary for each
354 agency that reflects the nomenclature in the comprehensive
355 indexed data catalog.
356 (c) Adopt, by rule, standards that support the creation
357 and deployment of an application programming interface to
358 facilitate integration throughout the enterprise.
359 (d) Adopt, by rule, standards necessary to facilitate a
360 secure ecosystem of data interoperability that is compliant with
361 the enterprise architecture.
362 (e) Adopt, by rule, standards that facilitate the
363 deployment of applications or solutions to the existing
364 enterprise system in a controlled and phased approach.
365 (f) After submission of documented use cases developed in
366 conjunction with the affected agencies, assist the affected
367 agencies with the deployment, contingent upon a specific
368 appropriation therefor, of new interoperable applications and
369 solutions:
370 1. For the Department of Health, the Agency for Health
371 Care Administration, the Agency for Persons with Disabilities,
372 the Department of Education, the Department of Elderly Affairs,
373 and the Department of Children and Families.
374 2. To support military members, veterans, and their
375 families.
Page 15 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
376 (4) For information technology projects that have a total
377 project costs cost of $5 $10 million or more:
378 (a) State agencies must provide the Florida Digital
379 Service with written notice of any planned procurement of an
380 information technology project.
381 (b) The Florida Digital Service must participate in the
382 development of specifications and recommend modifications to any
383 planned procurement of an information technology project by
384 state agencies so that the procurement complies with the
385 enterprise architecture.
386 (c) The Florida Digital Service must participate in post-
387 award contract monitoring.
388 (5) The department, acting through the Florida Digital
389 Service, may not retrieve or disclose any data without a shared -
390 data agreement in place between the department and the
391 enterprise entity that has primary custodial responsibility of,
392 or data-sharing responsibility for, that data.
393 (6) The department, acting through the Florida Digital
394 Service, shall adopt rules to administer this section.
395 Section 4. Section 282.201, Florida Statutes, is amended
396 to read:
397 282.201 State data center.—The state data center is
398 established within the department and shall be overseen by the
399 Florida Digital Service. The provision of data center services
400 must comply with applicable state and federal laws, regulations,
Page 16 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
401 and policies, including all applicable security, privacy, and
402 auditing requirements. The Florida Digital Service department
403 shall appoint a director of the state data center who has
404 experience in leading data center facilities and has expertise
405 in cloud-computing management. The Florida Digital Service shall
406 be provided with full access to state data center
407 infrastructure.
408 (1) STATE DATA CENTER DUTIES.—The state data center shall:
409 (a) Offer, develop, and support the services and
410 applications defined in service-level agreements executed with
411 its customer entities.
412 (b) Maintain performance of the state data center by
413 ensuring proper data backup; data backup recovery; disaster
414 recovery; and appropriate security, power, cooling, fire
415 suppression, and capacity.
416 (c) Develop and implement business continuity and disaster
417 recovery plans, and annually conduct a live exercise of each
418 plan.
419 (d) Enter into a service-level agreement with each
420 customer entity to provide the required type and level of
421 service or services. If a customer entity fails to execute an
422 agreement within 60 days after commencement of a service, the
423 state data center may cease service. A service-level agreement
424 may not have a term exceeding 3 years and at a minimum must:
425 1. Identify the parties and their roles, duties, and
Page 17 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
426 responsibilities under the agreement.
427 2. State the duration of the contract term and specify the
428 conditions for renewal.
429 3. Identify the scope of work.
430 4. Identify the products or services to be delivered with
431 sufficient specificity to permit an external financial or
432 performance audit.
433 5. Establish the services to be provided, the business
434 standards that must be met for each service, the cost of each
435 service by agency application, and the metrics and processes by
436 which the business standards for each service are to be
437 objectively measured and reported.
438 6. Provide a timely billing methodology to recover the
439 costs of services provided to the customer entity pursuant to s.
440 215.422.
441 7. Provide a procedure for modifying the service-level
442 agreement based on changes in the type, level, and cost of a
443 service.
444 8. Include a right-to-audit clause to ensure that the
445 parties to the agreement have access to records for audit
446 purposes during the term of the service-level agreement.
447 9. Provide that a service-level agreement may be
448 terminated by either party for cause only after giving the other
449 party and the Florida Digital Service department notice in
450 writing of the cause for termination and an opportunity for the
Page 18 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
451 other party to resolve the identified cause within a reasonable
452 period.
453 10. Provide for mediation of disputes by the Division of
454 Administrative Hearings pursuant to s. 120.573.
455 (e) For purposes of chapter 273, be the custodian of
456 resources and equipment located in and operated, supported, and
457 managed by the state data center.
458 (f) Assume administrative access rights to resources and
459 equipment, including servers, network components, and other
460 devices, consolidated into the state data center.
461 1. Upon consolidation, a state agency shall relinquish
462 administrative rights to consolidated resources and equipment.
463 State agencies required to comply with federal and state
464 criminal justice information security rules and policies shall
465 retain administrative access rights sufficient to comply with
466 the management control provisions of those rules and policies;
467 however, the state data center shall have the appropriate type
468 or level of rights to allow the center to comply with its duties
469 pursuant to this section. The Department of Law Enforcement
470 shall serve as the arbiter of disputes pertaining to the
471 appropriate type and level of administrative access rights
472 pertaining to the provision of management control in accordance
473 with the federal criminal justice information guidelines.
474 2. The state data center shall provide customer entities
475 with access to applications, servers, network components, and
Page 19 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
476 other devices necessary for entities to perform business
477 activities and functions, and as defined and documented in a
478 service-level agreement.
479 (g) In its procurement process, show preference for cloud -
480 computing solutions that minimize or do not require the
481 purchasing, financing, or leasing of state data center
482 infrastructure, and that meet the needs of customer agencies,
483 that reduce costs, and that meet or exceed the applicable state
484 and federal laws, regulations, and standards for cybersecurity.
485 (h) Assist customer entities in transitioning from state
486 data center services to the Northwest Regional Data Center or
487 other third-party cloud-computing services procured by a
488 customer entity or by the Northwest Regional Data Center on
489 behalf of a customer entity.
490 (2) USE OF THE STATE DATA CENTER.—The following are exempt
491 from the use of the state data center: the Department of Law
492 Enforcement, the Department of the Lottery's Gaming System,
493 Systems Design and Development in the Office of Policy and
494 Budget, the regional traffic management centers as described in
495 s. 335.14(2) and the Office of Toll Operations of the Department
496 of Transportation, the State Board of Administration, state
497 attorneys, public defenders, criminal conflict and civil
498 regional counsel, capital collateral regional counsel, and the
499 Florida Housing Finance Corporation.
500 (3) AGENCY LIMITATIONS.—Unless exempt from the use of the
Page 20 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
501 state data center pursuant to this section or authorized by the
502 Legislature, a state agency may not:
503 (a) Create a new agency computing facility or data center,
504 or expand the capability to support additional computer
505 equipment in an existing agency computing facility or data
506 center; or
507 (b) Terminate services with the state data center without
508 giving written notice of intent to terminate services 180 days
509 before such termination.
510 (4) FLORIDA DIGITAL SERVICE DEPARTMENT RESPONSIBILITIES.—
511 The Florida Digital Service department shall provide operational
512 management and oversight of the state data center, which
513 includes:
514 (a) Implementing industry standards and best practices for
515 the state data center's facilities, operations, maintenance,
516 planning, and management processes.
517 (b) Developing and implementing cost-recovery mechanisms
518 that recover the full direct and indirect cost of services
519 through charges to applicable customer entities. Such cost -
520 recovery mechanisms must comply with applicable state and
521 federal regulations concerning distribution and use of funds and
522 must ensure that, for any fiscal year, no service or customer
523 entity subsidizes another service or customer entity. The
524 Florida Digital Service department may recommend other payment
525 mechanisms to the Executive Office of the Governor, the
Page 21 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
526 President of the Senate, and the Speaker of the House of
527 Representatives. Such mechanisms may be implemented only if
528 specifically authorized by the Legislature.
529 (c) Developing and implementing appropriate operating
530 guidelines and procedures necessary for the state data center to
531 perform its duties pursuant to subsection (1). The guidelines
532 and procedures must comply with applicable state and federal
533 laws, regulations, and policies and conform to generally
534 accepted governmental accounting and auditing standards. The
535 guidelines and procedures must include, but need not be limited
536 to:
537 1. Implementing a consolidated administrative support
538 structure responsible for providing financial management,
539 procurement, transactions involving real or personal property,
540 human resources, and operational support.
541 2. Implementing an annual reconciliation process to ensure
542 that each customer entity is paying for the full direct and
543 indirect cost of each service as determined by the customer
544 entity's use of each service.
545 3. Providing rebates that may be credited against future
546 billings to customer entities when revenues exceed costs.
547 4. Requiring customer entities to validate that sufficient
548 funds exist before implementation of a customer entity's request
549 for a change in the type or level of service provided, if such
550 change results in a net increase to the customer entity's cost
Page 22 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
551 for that fiscal year.
552 5. By November 15 of each year, providing to the Office of
553 Policy and Budget in the Executive Office of the Governor and to
554 the chairs of the legislative appropriations committees the
555 projected costs of providing data center services for the
556 following fiscal year.
557 6. Providing a plan for consideration by the Legislative
558 Budget Commission if the cost of a service is increased for a
559 reason other than a customer entity's request made pursuant to
560 subparagraph 4. Such a plan is required only if the service cost
561 increase results in a net increase to a customer entity for that
562 fiscal year.
563 7. Standardizing and consolidating procurement and
564 contracting practices.
565 (d) In collaboration with the Department of Law
566 Enforcement and the Florida Digital Service, developing and
567 implementing a process for detecting, reporting, and responding
568 to cybersecurity incidents, breaches, and threats.
569 (e) Adopting rules relating to the operation of the state
570 data center, including, but not limited to, budgeting and
571 accounting procedures, cost-recovery methodologies, and
572 operating procedures.
573 (5) NORTHWEST REGIONAL DATA CENTER CONTRACT.—In order for
574 the Florida Digital Service department to carry out its duties
575 and responsibilities relating to the state data center, the
Page 23 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
576 state chief information officer shall assume responsibility for
577 the contract entered into by the secretary of the department
578 shall contract by July 1, 2022, with the Northwest Regional Data
579 Center pursuant to s. 287.057(11). The contract shall provide
580 that the Northwest Regional Data Center will manage the
581 operations of the state data center and provide data center
582 services to state agencies. Notwithstanding the terms of the
583 contract, the Northwest Regional Data Center must provide the
584 Florida Digital Service with access to information regarding the
585 operations of the state data center.
586 (a) The Florida Digital Service department shall provide
587 contract oversight, including, but not limited to, reviewing
588 invoices provided by the Northwest Regional Data Center for
589 services provided to state agency customers.
590 (b) The Florida Digital Service department shall approve
591 or request updates to invoices within 10 business days after
592 receipt. If the Florida Digital Service department does not
593 respond to the Northwest Regional Data Center, the invoice will
594 be approved by default. The Northwest Regional Data Center must
595 submit approved invoices directly to state agency customers.
596 Section 5. Subsection (10) of section 282.318, Florida
597 Statutes, is renumbered as subsection (11), subsections (3),
598 (4), and (7) and present subsection (10) are amended, and a new
599 subsection (10) is added to that section, to read:
600 282.318 Cybersecurity.—
Page 24 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
601 (3) The department, acting through the Florida Digital
602 Service, is the lead entity responsible for establishing
603 standards and processes for assessing state agency cybe rsecurity
604 risks and determining appropriate security measures. Such
605 standards and processes must be consistent with generally
606 accepted technology best practices, including the National
607 Institute for Standards and Technology Cybersecurity Framework,
608 for cybersecurity. The department, acting through the Florida
609 Digital Service, shall adopt rules that mitigate risks;
610 safeguard state agency digital assets, data, information, and
611 information technology resources to ensure availability,
612 confidentiality, and integrity; and support a security
613 governance framework. The department, acting through the Florida
614 Digital Service, shall also:
615 (a) Designate an employee of the Florida Digital Service
616 as the state chief information security officer. The state chief
617 information security officer must have experience and expertise
618 in security and risk management for communications and
619 information technology resources. The state chief information
620 security officer is responsible for the development, operation,
621 and oversight of cybersecurity for state technology systems. The
622 state chief information security officer shall be notified of
623 all confirmed or suspected incidents or threats of state agency
624 information technology resources and must report such incidents
625 or threats to the state chief information officer and the
Page 25 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
626 Governor.
627 (b) Develop, and annually update by February 1, a
628 statewide cybersecurity strategic plan that includes security
629 goals and objectives for cybersecurity, including the
630 identification and mitigation of risk, proactive protections
631 against threats, tactical risk detection, threat reporting, and
632 response and recovery protocols for a cyber incident.
633 (c) Develop and publish for use by state agencies a
634 cybersecurity governance framework that, at a minimum, includes
635 guidelines and processes for:
636 1. Establishing asset management procedures to ensure that
637 an agency's information technology resources are identified and
638 managed consistent with their relative importance to the
639 agency's business objectives.
640 2. Using a standard risk assessment methodology that
641 includes the identification of an agency's priorities,
642 constraints, risk tolerances, and assumptions necessary to
643 support operational risk decisions.
644 3. Completing comprehensive risk assessments and
645 cybersecurity audits, which may be completed by a private sector
646 vendor, and submitting completed assessments and audits to the
647 Florida Digital Service. The Florida Digital Service shall
648 oversee any cybersecurity audit completed by a private sector
649 vendor to ensure that the audit meets applicable standards,
650 processes, and timelines department.
Page 26 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
651 4. Identifying protection procedures to manage the
652 protection of an agency's information, data, and information
653 technology resources.
654 5. Establishing procedures for accessing information and
655 data to ensure the confidentiality, integrity, and availability
656 of such information and data.
657 6. Detecting threats through proactive monitoring of
658 events, continuous security monitoring, and defined detection
659 processes.
660 7. Establishing agency cybersecurity incident response
661 teams and describing their responsibilities for responding to
662 cybersecurity incidents, including breaches of personal
663 information containing confidential or exempt data.
664 8. Recovering information and data in response to a
665 cybersecurity incident. The recovery may include recommended
666 improvements to the agency processes, policies, or guidelines.
667 9. Establishing a cybersecurity incident reporting process
668 that includes procedures for notifying the Florida Digital
669 Service department and the Department of Law Enforcement of
670 cybersecurity incidents.
671 a. The level of severity of the cybersecurity incident is
672 defined by the National Cyber Incident Response Plan of the
673 United States Department of Homeland Security as follows:
674 (I) Level 5 is an emergency-level incident within the
675 specified jurisdiction that poses an imminent threat to the
Page 27 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
676 provision of wide-scale critical infrastructure services;
677 national, state, or local government security; or the lives of
678 the country's, state's, or local government's residents.
679 (II) Level 4 is a severe-level incident that is likely to
680 result in a significant impact in the affected jurisdiction to
681 public health or safety; national, state, or local security;
682 economic security; or civil liberties.
683 (III) Level 3 is a high-level incident that is likely to
684 result in a demonstrable impact in the affected jurisdiction to
685 public health or safety; national, state, or local security;
686 economic security; civil liberties; or public confidence.
687 (IV) Level 2 is a medium-level incident that may impact
688 public health or safety; national, state, or local security;
689 economic security; civil liberties; or public confidence.
690 (V) Level 1 is a low-level incident that is unlikely to
691 impact public health or safety; national, state, or local
692 security; economic security; civil liberties; or public
693 confidence.
694 b. The cybersecurity incident reporting process must
695 specify the information that must be reported by a state agency
696 following a cybersecurity incident or ransomware incident,
697 which, at a minimum, must include the following:
698 (I) A summary of the facts surrounding the cybersecurity
699 incident or ransomware incident.
700 (II) The date on which the state agency most recently
Page 28 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
701 backed up its data; the physical location of the backup, if the
702 backup was affected; and if the backup was created using cloud
703 computing.
704 (III) The types of data compromised by the cybersecurity
705 incident or ransomware incident.
706 (IV) The estimated fiscal impact of the cybersecurity
707 incident or ransomware incident.
708 (V) In the case of a ransomware incident, the details of
709 the ransom demanded.
710 c.(I) A state agency shall report all ransomware incidents
711 and any cybersecurity incidents incident determined by the state
712 agency to be of severity level 3, 4, or 5 to the Florida Digital
713 Service, the Cybersecurity Operations Center, and the Cybercrime
714 Office of the Department of Law Enforcement as soon as possible
715 but no later than 4 48 hours after discovery of the
716 cybersecurity incident and no later than 2 12 hours after
717 discovery of the ransomware incident. The report must contain
718 the information required in sub-subparagraph b. The Florida
719 Digital Service shall notify the Governor, the President of the
720 Senate, and the Speaker of the House of Representatives of any
721 incident discovered by a state agency but not timely reported
722 under this sub-sub-subparagraph.
723 (II) The Cybersecurity Operations Center shall notify the
724 President of the Senate and the Speaker of the House of
725 Representatives of any severity level 3, 4, or 5 incident as
Page 29 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
726 soon as possible but no later than 12 hours after receiving a
727 state agency's incident report. The notification must include a
728 high-level description of the incident and the likely effects
729 and must be provided in a secure environment.
730 d. A state agency shall report a cybersecurity incident
731 determined by the state agency to be of severity level 1 or 2 to
732 the Cybersecurity Operations Center and the Cybercrime Office of
733 the Department of Law Enforcement as soon as possible. The
734 report must contain the information required in sub -subparagraph
735 b.
736 e. The Cybersecurity Operations Center shall provide a
737 consolidated incident report on a quarterly basis to the
738 President of the Senate, the Speaker of the House of
739 Representatives, and the Florida Cybersecurity Advisory Council.
740 The report provided to the Florida Cybersecurity Advisory
741 Council may not contain the name of any agency, network
742 information, or system identifying information but must contain
743 sufficient relevant information to allow the Florida
744 Cybersecurity Advisory Council to fulfill its responsibilities
745 as required in s. 282.319(9).
746 10. Incorporating information obtained through detection
747 and response activities into the agency's cybersecurity incident
748 response plans.
749 11. Developing agency strategic and operational
750 cybersecurity plans required pursuant to this section.
Page 30 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
751 12. Establishing the managerial, operational, and
752 technical safeguards for protecting state government data and
753 information technology resources that align with the state
754 agency risk management strategy and that protect the
755 confidentiality, integrity, and availability of information and
756 data.
757 13. Establishing procedures for procuring information
758 technology commodities and services that require the commodity
759 or service to meet the National Institute of Standards and
760 Technology Cybersecurity Framework.
761 14. Submitting after-action reports following a
762 cybersecurity incident or ransomware incident. Such guidelines
763 and processes for submitting after-action reports must be
764 developed and published by December 1, 2022.
765 (d) Assist state agencies in complying with this section.
766 (e) In collaboration with the Cybercrime Office of the
767 Department of Law Enforcement, annually provide training for
768 state agency information security managers and computer security
769 incident response team members that contains training on
770 cybersecurity, including cybersecurity threats, trends, and best
771 practices.
772 (f) Annually review the strategic and operational
773 cybersecurity plans of state agencies.
774 (g) Annually provide cybersecurity training to all state
775 agency technology professionals and employees with access to
Page 31 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
776 highly sensitive information which develops, assesses, and
777 documents competencies by role and skill level. The
778 cybersecurity training curriculum must include training on the
779 identification of each cybersecurity incident severity level
780 referenced in sub-subparagraph (c)9.a. The training may be
781 provided in collaboration with the Cybercrime Office of the
782 Department of Law Enforcement, a private sector entity, or an
783 institution of the State University System.
784 (h) Operate and maintain a Cybersecurity Operations Center
785 led by the state chief information security officer, which must
786 be primarily virtual and staffed with tactical detection and
787 incident response personnel. The Cybersecurity Operations Center
788 shall serve as a clearinghouse for threat information and
789 coordinate with the Department of Law Enforcement to support
790 state agencies and their response to any confirmed or suspected
791 cybersecurity incident.
792 (i) Lead an Emergency Support Function, ESF CYBER, under
793 the state comprehensive emergency management plan as described
794 in s. 252.35.
795 (j) Provide cybersecurity briefings to the members of any
796 legislative committee or subcommittee responsible for policy
797 matters relating to cybersecurity.
798 (k) Have the authority to respond to any state agency
799 cybersecurity incident.
800 (4) Each state agency head shall, at a minimum:
Page 32 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
801 (a) Designate an information security manager to
802 administer the cybersecurity program of the state agency. This
803 designation must be provided annually in writing to the Florida
804 Digital Service department by January 1. A state agency's
805 information security manager, for purposes of these information
806 security duties, shall report directly to the agency head.
807 (b) In consultation with the department, through the
808 Florida Digital Service, and the Cybercrime Office of the
809 Department of Law Enforcement, establish an agency cybersecurity
810 response team to respond to a cybersecurity incident. The agency
811 cybersecurity response team shall convene upon notification of a
812 cybersecurity incident and must immediately report all confirmed
813 or suspected incidents to the state chief information security
814 officer, or his or her designee, and comply with all applicable
815 guidelines and processes established pursuant to paragraph
816 (3)(c).
817 (c) Submit to the Florida Digital Service department
818 annually by July 31, the state agency's strategic and
819 operational cybersecurity plans developed pursuant to rules and
820 guidelines established by the department, through the Florida
821 Digital Service.
822 1. The state agency strategic cybersecurity plan must
823 cover a 3-year period and, at a minimum, define security goals,
824 intermediate objectives, and projected agency costs for the
825 strategic issues of agency information security policy, risk
Page 33 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
826 management, security training, security incident response, and
827 disaster recovery. The plan must be based on the statewide
828 cybersecurity strategic plan created by the Florida Digital
829 Service department and include performance metrics that can be
830 objectively measured to reflect the status of the state agency's
831 progress in meeting security goals and objectives identified in
832 the agency's strategic information security plan.
833 2. The state agency operational cybersecurity plan must
834 include a progress report that objectively measures progress
835 made towards the prior operational cybersecurity plan and a
836 project plan that includes activities, timelines, and
837 deliverables for security objectives that the state agency will
838 implement during the current fiscal year.
839 (d) Conduct, and update every 3 years, a comprehensive
840 risk assessment, which may be completed by a private sector
841 vendor, to determine the security threats to the data,
842 information, and information technology resources, including
843 mobile devices and print environments, of the agency. The risk
844 assessment must comply with the risk assessment methodology
845 developed by the Florida Digital Service department and is
846 confidential and exempt from s. 119.07(1), except that such
847 information shall be available to the Auditor General, the
848 Florida Digital Service within the department, the Cybercrime
849 Office of the Department of Law Enforcement, and, for state
850 agencies under the jurisdiction of the Governor, the Chief
Page 34 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
851 Inspector General. If a private sector vendor is used to
852 complete a comprehensive risk assessment, it must attest to the
853 validity of the risk assessment findings.
854 (e) Develop, and periodically update, written internal
855 policies and procedures, which include procedures for reporting
856 cybersecurity incidents and breaches to the Cybercrime Office of
857 the Department of Law Enforcement and the Florida Digital
858 Service within the department. Such policies and procedures must
859 be consistent with the rules, guidelines, and processes
860 established by the Florida Digital Service department to ensure
861 the security of the data, information, and information
862 technology resources of the agency. The internal policies and
863 procedures that, if disclosed, could facilitate the unauthorized
864 modification, disclosure, or destruction of data or information
865 technology resources are confidential information and exempt
866 from s. 119.07(1), except that such information shall be
867 available to the Auditor General, the Cybercrime Office of the
868 Department of Law Enforcement, the Florida Digital Service
869 within the department, and, for state agencies under the
870 jurisdiction of the Governor, the Chief Inspector General.
871 (f) Implement managerial, operational, and technical
872 safeguards and risk assessment remediation plans recommended by
873 the Florida Digital Service department to address identified
874 risks to the data, information, and information technology
875 resources of the agency. The department, through the Florida
Page 35 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
876 Digital Service, shall track implementation by state agencies
877 upon development of such remediation plans in coordination with
878 agency inspectors general.
879 (g) Ensure that periodic internal audits and evaluations
880 of the agency's cybersecurity program for the data, information,
881 and information technology resources of the agency are
882 conducted. The results of such audits and evaluations are
883 confidential information and exempt from s. 119.07(1), except
884 that such information shall be available to the Auditor General,
885 the Cybercrime Office of the Department of Law Enforcement, the
886 Florida Digital Service within the department, and, for agencies
887 under the jurisdiction of the Governor, the Chief Inspector
888 General.
889 (h) Ensure that the cybersecurity requirements in the
890 written specifications for the solicitation, contracts, and
891 service-level agreement of information technology and
892 information technology resources and services meet or exceed the
893 applicable state and federal laws, regulations, and standards
894 for cybersecurity, including the National Institute of Standards
895 and Technology Cybersecurity Framework. Service-level agreements
896 must identify service provider and state agency responsibilities
897 for privacy and security, protection of government data,
898 personnel background screening, and security deliverables with
899 associated frequencies.
900 (i) Provide cybersecurity awareness training to all state
Page 36 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
901 agency employees within 30 days after commencing employment, and
902 annually thereafter, concerning cybersecurity risks and the
903 responsibility of employees to comply with policies, standards,
904 guidelines, and operating procedures adopted by the state agency
905 to reduce those risks. The training may be provided in
906 collaboration with the Cybercrime Office of the Department of
907 Law Enforcement, a private sector entity, or an institution of
908 the State University System.
909 (j) Develop a process for detecting, reporting, and
910 responding to threats, breaches, or cybersecurity incidents
911 which is consistent with the security rules, guidelines, and
912 processes established by the department through the Florida
913 Digital Service.
914 1. All cybersecurity incidents and ransomware incidents
915 must be reported by state agencies. Such reports must comply
916 with the notification procedures and reporting timeframes
917 established pursuant to paragraph (3)(c).
918 2. For cybersecurity breaches, state agencies shall
919 provide notice in accordance with s. 501.171.
920 (k) Submit to the Florida Digital Service, within 1 week
921 after the remediation of a cybersecurity incident or ransomware
922 incident, an after-action report that summarizes the incident,
923 the incident's resolution, and any insights gained as a result
924 of the incident.
925 (7) The portions of records made confidential and exempt
Page 37 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
926 in subsections (5) and (6) shall be available to the Auditor
927 General, the Cybercrime Office of the Department of Law
928 Enforcement, the Florida Digital Service within the department,
929 and, for agencies under the jurisdiction of the Governor, the
930 Chief Inspector General. Such portions of records may be made
931 available to a local government, another state agency, or a
932 federal agency for cybersecurity purposes or in furtherance of
933 the state agency's official duties.
934 (10) Any legislative committee or subcommittee responsible
935 for policy matters relating to cybersecurity may hold meetings
936 closed by the respective legislative body under the rules of
937 such legislative body at which such committee or subcommittee is
938 briefed on records made confidential and exempt under
939 subsections (5) and (6). The committee or subcommittee must
940 maintain the confidential and exempt status of such records.
941 (11)(10) The Florida Digital Service department shall
942 adopt rules relating to cybersecurity and to administer this
943 section.
944 Section 6. Paragraph (d) of subsection (5) of section
945 282.3185, Florida Statutes, is redesignated as paragraph (c),
946 and paragraph (b) and present paragraph (c) of that subsection
947 are amended to read:
948 282.3185 Local government cybersecurity.—
949 (5) INCIDENT NOTIFICATION.—
950 (b)1. A local government shall report all ransomware
Page 38 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
951 incidents and any cybersecurity incidents incident determined by
952 the local government to be of severity level 3, 4, or 5 as
953 provided in s. 282.318(3)(c) to the Florida Digital Service, the
954 Cybersecurity Operations Center, the Cybercrime Office of the
955 Department of Law Enforcement, and the sheriff who has
956 jurisdiction over the local government as soon as possible but
957 no later than 4 48 hours after discovery of the cybersecurity
958 incident and no later than 2 12 hours after discovery of the
959 ransomware incident. The report must contain the information
960 required in paragraph (a). The Florida Digital Service shall
961 notify the Governor, the President of the Senate, and the
962 Speaker of the House of Representatives of any incident
963 discovered by a local government but not timely reported under
964 this subparagraph.
965 2. The Cybersecurity Operations Center shall notify the
966 President of the Senate and the Speaker of the House of
967 Representatives of any severity level 3, 4, or 5 incident as
968 soon as possible but no later than 12 hours after receiving a
969 local government's incident report. The notification must
970 include a high-level description of the incident and the likely
971 effects and must be provided in a secure environment.
972 (c) A local government may report a cybersecurity incident
973 determined by the local government to be of severity level 1 or
974 2 as provided in s. 282.318(3)(c) to the Cybersecurity
975 Operations Center, the Cybercrime Office of the Department of
Page 39 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
976 Law Enforcement, and the sheriff who has jurisdiction over the
977 local government. The report shall contain the information
978 required in paragraph (a).
979 Section 7. Subsections (10) through (13) of section
980 282.319, Florida Statutes, are renumbered as subsections (11)
981 through (14), respectively, paragraph (j) of subsection (4) and
982 subsection (6) are amended, and a new subsection (10) is added
983 to that section, to read:
984 282.319 Florida Cybersecurity Advisory Council.—
985 (4) The council shall be comprised of the following
986 members:
987 (j) Three representatives from critical infrastructure
988 sectors, one of whom must be from a water treatment facility,
989 appointed by the Governor.
990 (6) The state chief information officer Secretary of
991 Management Services, or his or her designee, shall serve as the
992 ex officio, nonvoting executive director of the council.
993 (10) Members of any legislative committee or subcommittee
994 responsible for policy matters relating to cybersecurity must be
995 invited to and may attend meetings of the council. A council
996 meeting at which two or more members of the Legislature are in
997 attendance may not be construed as a meeting of a legislative
998 committee or subcommittee or as a prearranged gathering between
999 more than two members of the Legislature, the purpose of which
1000 is to agree upon formal legislative action that will be taken at
Page 40 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
1001 a subsequent time.
1002 Section 8. Section 282.3195, Florida Statutes, is created
1003 to read:
1004 282.3195 State Technology Advancement Council.—
1005 (1) The State Technology Advancement Council, an advisory
1006 council as defined in s. 20.03(7), is created within the
1007 Executive Office of the Governor. Except as otherwise provided
1008 in this section, the advisory council shall operate in a manner
1009 consistent with s. 20.052.
1010 (2) The purpose of the council is to:
1011 (a) Assist state agencies and advise the Legislature on
1012 innovative technologies.
1013 (b) Improve state technology project timelines.
1014 (c) Develop efficient state technology processes.
1015 (d) Assist in the creation of development and testing
1016 environments that allow state entities to proof technology
1017 concepts before engaging in procurement and otherwise develop
1018 processes to reduce wasteful spending on inappropriate
1019 technology.
1020 (e) Assist Florida College System institutions and state
1021 universities with technology transfer processes.
1022 (f) Support research on and development of innovative
1023 technologies.
1024 (3) The state chief information officer, or his or her
1025 designee, shall serve as the executive director of the council.
Page 41 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
1026 The council shall be comprised of the following members
1027 appointed by the Governor:
1028 (a) A person with senior level experience in cloud
1029 computing technology.
1030 (b) An engineer.
1031 (c) A person with senior level experience in the space
1032 industry.
1033 (d) A data scientist.
1034 (e) Other persons with relevant experience as determined
1035 by the Governor.
1036 (4) Members shall serve for terms of 4 years; however, for
1037 the purpose of providing staggered terms, the initial
1038 appointments of two members shall be for terms of 2 years. A
1039 vacancy shall be filled for the remainder of the unexpired term
1040 in the same manner as the initial appointment. All members of
1041 the council are eligible for reappointment.
1042 (5) The state chief information officer shall serve as the
1043 ex officio, nonvoting executive director of the council.
1044 (6) Members shall serve without compensation but are
1045 entitled to receive reimbursement for per diem and travel
1046 expenses pursuant to s. 112.061.
1047 (7) Members of the council shall maintain the confidential
1048 or exempt status of information received in the performance of
1049 their duties and responsibilities as members of the council. In
1050 accordance with s. 112.313, a current or former member of the
Page 42 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
1051 council may not disclose or use information not available to the
1052 general public and gained by reason of his or her official
1053 position, except for information relating exclusively to
1054 governmental practices, for his or her personal gain or benefit
1055 or for the personal gain or benefit of any other person or
1056 business entity. Members shall sign an agreement acknowledging
1057 the provisions of this subsection.
1058 (8) The council shall meet at least quarterly.
1059 (9) Beginning June 1, 2024, and annually on June 1
1060 thereafter, the council shall submit to the Governor, the
1061 President of the Senate, and the Speaker of the House of
1062 Representatives a report describing the activities of the
1063 council and providing recommendations as appropriate.
1064 Section 9. Section 768.401, Florida Statutes, is created
1065 to read:
1066 768.401 Limitation on liability for cybersecurity
1067 incidents.—
1068 (1) A county or municipality that substantially complies
1069 with s. 282.3185 shall gain a presumption against liability in
1070 connection with a cybersecurity incident.
1071 (2) A sole proprietorship, partnership, corporation,
1072 trust, estate, cooperative, association, or other commercial
1073 entity that acquires, maintains, stores, or uses personal
1074 information shall gain a presumption against liability in
1075 connection with a cybersecurity incident if the entity
Page 43 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
1076 substantially complies with s. 501.171, if applicable, and has:
1077 (a) Adopted a cybersecurity program that substantially
1078 aligns with the current version of any of the following:
1079 1. The National Institute of Standards and Technology
1080 (NIST) Framework for Improving Critical Infrastructure
1081 Cybersecurity.
1082 2. NIST special publication 800-171.
1083 3. NIST special publications 800-53 and 800-53A.
1084 4. The Federal Risk and Authorization Management Program
1085 security assessment framework.
1086 5. CIS Critical Security Controls.
1087 6. The International Organization for
1088 Standardization/International Electrotechnical Commission 27000 -
1089 series family of standards; or
1090 (b) If regulated by the state or Federal Government, or
1091 both, or if otherwise subject to the requirements of any of the
1092 following laws and regulations, substantially complied its
1093 cybersecurity program to the current version of the following,
1094 as applicable:
1095 1. The security requirements of the Health Insurance
1096 Portability and Accountability Act of 1996, 45 C.F.R. part 164
1097 subpart C.
1098 2. Title V of the Gramm-Leach-Bliley Act of 1999, Pub. L.
1099 No. 106-102, as amended.
1100 3. The Federal Information Security Modernization Act of
Page 44 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
1101 2014, Pub. L. No. 113-283.
1102 4. The Health Information Technology for Economic and
1103 Clinical Health Act, 45 C.F.R. part 162.
1104 (3) A commercial entity that substantially complies with a
1105 combination of industry-recognized cybersecurity frameworks or
1106 standards, including the payment card industry data security
1107 standard, to gain the presumption against liability pursuant to
1108 subsection (2) must, upon the revision of two or more of the
1109 frameworks or standards with which the entity complies, adopt
1110 the revised frameworks or standards within 1 year after the
1111 latest publication date stated in the revisions.
1112 (4) This section does not establish a private cause of
1113 action. Failure of a county, municipality, or commercial entity
1114 to substantially implement a cybersecurity program that is in
1115 compliance with this section is not evidence of negligence and
1116 does not constitute negligence per se.
1117 Section 10. Paragraph (k) of subsection (1) of section
1118 1004.649, Florida Statutes, is amended to read:
1119 1004.649 Northwest Regional Data Center.—
1120 (1) For the purpose of providing data center services to
1121 its state agency customers, the Northwest Regional Data Center
1122 is designated as a state data center for all state agencies and
1123 shall:
1124 (k) Prepare and submit state agency customer invoices to
1125 the Florida Digital Service Department of Management Services
Page 45 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1511 2023
1126 for approval. Upon approval or by default pursuant to s.
1127 282.201(5), submit invoices to state agency customers.
1128 Section 11. This act shall take effect July 1, 2023.
Page 46 of 46
CODING: Words stricken are deletions; words underlined are additions.
hb1511-00
Energy, Communications & Cybersecurity Subcommittee
HB 1511 by Rep. Giallombardo
Cybersecurity
AMENDMENT SUMMARY
March 21, 2023
Amendment 1 by Rep. Giallombardo (strike-all):
• Removes language from the bill that shifted authority related to cybersecurity
governance from the Department of Management Services (DMS) to the Florida
Digital Service (FLDS).
• Clarifies, adds, and removes definitions.
• Removes language that lowered the reporting and oversight requirement for
technology projects.
• Gives DMS additional responsibilities for technology project oversight and
provides what oversight entails.
• Changes the date DMS, acting through FLDS, must provide recommendations
for standardization and consolidation of information technology services that
support interoperability and cloud-first policy.
• Specifies that the quarterly report for project oversight must be submitted by the
15th day following the end of each quarter.
• Specifies a date that alternative standards are due, if applicable.
• Changes the members of the operations committee created by the bill.
• Requires the state chief information officer to designate a state chief technology
officer and outlines the responsibilities of the position.
• Requires the entity assuming the responsibilities of the State Data Center (SDC)
to fully integrate with the Cybersecurity Operations Center.
• Specifies what information the SDC must report to DMS and FLDS.
• Requires that FLDS submit an annual comprehensive risk assessment facilitated
by DMS and includes criteria for this assessment.
• Removes the State Technology Advancement Council created by the bill.
• Creates an exemption to the requirements of ch. 110 relating to state
employment for personnel employed by or reporting to certain officers.
• Clarifies application of a presumption against liability.
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
COMMITTEE/SUBCOMMITTEE ACTION
ADOPTED (Y/N)
ADOPTED AS AMENDED (Y/N)
ADOPTED W/O OBJECTION (Y/N)
FAILED TO ADOPT (Y/N)
WITHDRAWN (Y/N)
OTHER
1 Committee/Subcommittee hearing bill: Energy, Communications &
2 Cybersecurity Subcommittee
3 Representative Giallombardo offered the following:
4
5 Amendment (with title amendment)
6 Remove everything after the enacting clause and insert:
7 Section 1. This act may be cited as the "Florida Cyber
8 Protection Act."
9 Section 2. Paragraph (y) is added to subsection (2) of
10 section 110.205, Florida Statutes, to read:
11 110.205 Career service; exemptions.—
12 (2) EXEMPT POSITIONS.—The exempt positions that are not
13 covered by this part include the following:
14 (y) Personnel employed by or reporting to the state chief
15 information security officer, the state chief data officer, a
16 chief information security officer, and an agency information
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 1 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
17 security manager.
18 Section 3. Subsections (3) through (5), (6) through (19),
19 and (20) through (38) of section 282.0041, Florida Statutes, are
20 renumbered as subsections (4) through (6), (8) through (21), and
21 (24) through (42), respectively, present subsection (19) is
22 amended, and new subsections (3), (7), (22), and (23) are added
23 to that section, to read:
24 282.0041 Definitions.—As used in this chapter, the term:
25 (3) "As a service" means the contracting with or
26 outsourcing to a third-party of a defined role or function as a
27 means of delivery.
28 (7) "Cloud provider" has the same meaning as provided in
29 Special Publication 800-145 issued by the National Institute of
30 Standards and Technology.
31 (21)(19) "Incident" means a violation or an imminent
32 threat of violation, whether such violation is accidental or
33 deliberate, of information technology resources, security,
34 policies, or practices, or which may jeopardize the
35 confidentiality, integrity, or availability of an information
36 technology system or the information the system processes,
37 stores, or transmits. An imminent threat of violation refers to
38 a situation in which a state agency, county, or municipality has
39 a factual basis for believing that a specific incident is about
40 to occur.
41 (22) "Independent" means, for an entity providing
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 2 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
42 independent verification and validation, having no technical,
43 managerial, or financial interest in the relevant technology
44 project; no relationship to the relevant agency; and no
45 responsibility for or participation in any aspect of the
46 project, which includes project oversight by the Florida Digital
47 Service.
48 (23) "Independent verification and validation" means
49 third-party support services that provide a completely
50 independent and impartial assessment of the progress and work
51 products of a technology project from concept to business case
52 and throughout the project lifecycle.
53 Section 4. Section 282.0051, Florida Statutes, is amended
54 to read:
55 282.0051 Department of Management Services; Florida
56 Digital Service; powers, duties, and functions.—
57 (1) The Florida Digital Service is has been created within
58 the department to propose innovative solutions that securely
59 modernize state government, including technology and information
60 services, to achieve value through digital transformation and
61 interoperability, and to fully support the cloud-first policy as
62 specified in s. 282.206. The department, through the Florida
63 Digital Service, shall have the following powers, duties, and
64 functions:
65 (a) Develop and publish information technology policy for
66 the management of the state's information technology resources.
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 3 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
67 (b) Develop an enterprise architecture that:
68 1. Acknowledges the unique needs of the entities within
69 the enterprise in the development and publication of standards
70 and terminologies to facilitate digital interoperability;
71 2. Supports the cloud-first policy as specified in s.
72 282.206; and
73 3. Addresses how information technology infrastructure may
74 be modernized to achieve cloud-first objectives.
75 (c) Establish project management and oversight standards
76 with which state agencies must comply when implementing
77 information technology projects. The department, acting through
78 the Florida Digital Service, shall provide training
79 opportunities to state agencies to assist in the adoption of the
80 project management and oversight standards. To support data-
81 driven decisionmaking, the standards must include, but are not
82 limited to:
83 1. Performance measurements and metrics that objectively
84 reflect the status of an information technology project based on
85 a defined and documented project scope, cost, and schedule.
86 2. Methodologies for calculating acceptable variances in
87 the projected versus actual scope, schedule, or cost of an
88 information technology project.
89 3. Reporting requirements, including requirements designed
90 to alert all defined stakeholders that an information technology
91 project has exceeded acceptable variances defined and documented
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 4 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
92 in a project plan.
93 4. Content, format, and frequency of project updates.
94 5. Technical standards to ensure an information technology
95 project complies with the enterprise architecture.
96 (d) Ensure that independent Perform project oversight on
97 all state agency information technology projects that have total
98 project costs of $10 million or more and that are funded in the
99 General Appropriations Act or any other law is performed and in
100 compliance with applicable state and federal law.
101 1. The department may not be considered independent for
102 purposes of project oversight under this paragraph on a project
103 for which the department has provided or may be asked to provide
104 any operational or technical support, including, but not limited
105 to, providing advice or conducting any review.
106 2. The department shall establish an appropriate contract
107 vehicle to facilitate procurement of project oversight as a
108 service by the enterprise and ensure that the contract vehicle
109 includes offerings that incorporate the ability to comply with
110 applicable state and federal law, including any independent
111 verification and validation requirements. An entity that
112 provides project oversight as a service must provide a project
113 oversight report to the department.
114 3. An agency may request the department to procure project
115 oversight as a service for a project that is subject to this
116 paragraph. Such procurement by the department does not violate
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 5 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
117 the requirement that the project oversight must be independent.
118 4. The department, acting through the Florida Digital
119 Service, shall at least quarterly review received project
120 oversight reports and, upon acceptance of the contents of such
121 reports, provide the reports to the Executive Office of the
122 Governor, the President of the Senate, and the Speaker of the
123 House of Representatives.
124 5. The department, acting through the Florida Digital
125 Service, shall report at least quarterly to the Executive Office
126 of the Governor, the President of the Senate, and the Speaker of
127 the House of Representatives on any information technology
128 project that the department identifies as high-risk due to the
129 project exceeding acceptable variance ranges defined and
130 documented in a project plan. The report must include a risk
131 assessment, including fiscal risks, associated with proceeding
132 to the next stage of the project, and a recommendation for
133 corrective actions required, including suspension or termination
134 of the project.
135 (e) Identify opportunities for standardization and
136 consolidation of information technology services that support
137 interoperability and the cloud-first policy, as specified in s.
138 282.206, and business functions and operations, including
139 administrative functions such as purchasing, accounting and
140 reporting, cash management, and personnel, and that are common
141 across state agencies. The department, acting through the
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 6 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
142 Florida Digital Service, shall biennially on January 15 1 of
143 each even-numbered year provide recommendations for
144 standardization and consolidation to the Executive Office of the
145 Governor, the President of the Senate, and the Speaker of the
146 House of Representatives.
147 (f) Establish best practices for the procurement of
148 information technology products and cloud-computing services in
149 order to reduce costs, increase the quality of data center
150 services, or improve government services.
151 (g) Develop standards for information technology reports
152 and updates, including, but not limited to, operational work
153 plans, project spend plans, and project status reports, for use
154 by state agencies.
155 (h) Upon request, assist state agencies in the development
156 of information technology-related legislative budget requests.
157 (i) Conduct annual assessments of state agencies to
158 determine compliance with all information technology standards
159 and guidelines developed and published by the department and
160 provide results of the assessments to the Executive Office of
161 the Governor, the President of the Senate, and the Speaker of
162 the House of Representatives.
163 (j) Conduct a market analysis not less frequently than
164 every 3 years beginning in 2021 to determine whether the
165 information technology resources within the enterprise are
166 utilized in the most cost-effective and cost-efficient manner,
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 7 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
167 while recognizing that the replacement of certain legacy
168 information technology systems within the enterprise may be cost
169 prohibitive or cost inefficient due to the remaining useful life
170 of those resources; whether the enterprise is complying with the
171 cloud-first policy specified in s. 282.206; and whether the
172 enterprise is utilizing best practices with respect to
173 information technology, information services, and the
174 acquisition of emerging technologies and information services.
175 Each market analysis shall be used to prepare a strategic plan
176 for continued and future information technology and information
177 services for the enterprise, including, but not limited to,
178 proposed acquisition of new services or technologies and
179 approaches to the implementation of any new services or
180 technologies. Copies of each market analysis and accompanying
181 strategic plan must be submitted to the Executive Office o f the
182 Governor, the President of the Senate, and the Speaker of the
183 House of Representatives not later than December 31 of each year
184 that a market analysis is conducted.
185 (k) Recommend other information technology services that
186 should be designed, delivered, and managed as enterprise
187 information technology services. Recommendations must include
188 the identification of existing information technology resources
189 associated with the services, if existing services must be
190 transferred as a result of being delivered and managed as
191 enterprise information technology services.
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 8 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
192 (l) In consultation with state agencies, propose a
193 methodology and approach for identifying and collecting both
194 current and planned information technology expenditure data at
195 the state agency level.
196 (m)1. Notwithstanding any other law, provide project
197 oversight on any information technology project of the
198 Department of Financial Services, the Department of Legal
199 Affairs, and the Department of Agriculture and Consumer Services
200 which has a total project cost of $20 million or more. Such
201 information technology projects must also comply with the
202 applicable information technology architecture, project
203 management and oversight, and reporting standards established by
204 the department, acting through the Florida Digital Service.
205 2. When performing the project oversight function
206 specified in subparagraph 1., report by the 15th day after the
207 end of each quarter at least quarterly to the Executive Office
208 of the Governor, the President of the Senate, and the Speaker of
209 the House of Representatives on any information technology
210 project that the department, acting through the Florida Digital
211 Service, identifies as high-risk due to the project exceeding
212 acceptable variance ranges defined and documented in the p roject
213 plan. The report shall include a risk assessment, including
214 fiscal risks, associated with proceeding to the next stage of
215 the project and a recommendation for corrective actions
216 required, including suspension or termination of the project.
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 9 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
217 (n) If an information technology project implemented by a
218 state agency must be connected to or otherwise accommodated by
219 an information technology system administered by the Department
220 of Financial Services, the Department of Legal Affairs, or the
221 Department of Agriculture and Consumer Services, consult with
222 these departments regarding the risks and other effects of such
223 projects on their information technology systems and work
224 cooperatively with these departments regarding the connections,
225 interfaces, timing, or accommodations required to implement such
226 projects.
227 (o) If adherence to standards or policies adopted by or
228 established pursuant to this section causes conflict with
229 federal regulations or requirements imposed on an entity within
230 the enterprise and results in adverse action against an entity
231 or federal funding, work with the entity to provide alternative
232 standards, policies, or requirements that do not conflict with
233 the federal regulation or requirement. The department, acting
234 through the Florida Digital Service, shall annually by January
235 15 report such alternative standards to the Executive Office of
236 the Governor, the President of the Senate, and the Speaker of
237 the House of Representatives.
238 (p)1. Establish an information technology policy for all
239 information technology-related state contracts, including state
240 term contracts for information technology commodities,
241 consultant services, and staff augmentation services. The
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 10 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
242 information technology policy must include:
243 a. Identification of the information technology product
244 and service categories to be included in state term contracts.
245 b. Requirements to be included in solicitations for state
246 term contracts.
247 c. Evaluation criteria for the award of information
248 technology-related state term contracts.
249 d. The term of each information technology-related state
250 term contract.
251 e. The maximum number of vendors authorized on each state
252 term contract.
253 f. At a minimum, a requirement that any contract for
254 information technology commodities or services meet the National
255 Institute of Standards and Technology Cybersecurity Framework.
256 g. For an information technology project wherein project
257 oversight is required pursuant to paragraph (d) or paragraph
258 (m), a requirement that independent verification and validation
259 be employed throughout the project life cycle with the primary
260 objective of independent verification and validation being to
261 provide an objective assessment of products and processes
262 throughout the project life cycle. An entity providing
263 independent verification and validation may not have technical,
264 managerial, or financial interest in the project and may not
265 have responsibility for, or participate in, any other aspect of
266 the project.
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 11 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
267 2. Evaluate vendor responses for information technology -
268 related state term contract solicitations and invitations to
269 negotiate.
270 3. Answer vendor questions on information technology -
271 related state term contract solicitations.
272 4. Ensure that the information technology policy
273 established pursuant to subparagraph 1. is included in all
274 solicitations and contracts that are administratively executed
275 by the department.
276 (q) Recommend potential methods for standardizing data
277 across state agencies which will promote interoperability and
278 reduce the collection of duplicative data.
279 (r) Recommend open data technical standards and
280 terminologies for use by the enterprise.
281 (s) Ensure that enterprise information technology
282 solutions are capable of utilizing an electronic credential and
283 comply with the enterprise architecture standards.
284 (t) Establish an operations committee that shall meet as
285 necessary for the purpose of developing collaborative efforts
286 between agencies and other governmental entities relating to
287 cybersecurity issues, including the coordination of preparedness
288 and response efforts relating to cybersecurity incidents and
289 issues relating to the interoperability of agency projects. The
290 Secretary of Management Services shall serve as the executive
291 director of the committee. The committee shall be composed of
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 12 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
292 the following members:
293 1. The state chief information officer, or his or her
294 designee.
295 2. The Attorney General, or his or her designee.
296 3. The Secretary of State, or his or her designee.
297 4. The executive director of the Department of Law
298 Enforcement, or his or her designee.
299 5. The Secretary of Transportation, or his or her
300 designee.
301 6. The director of the Division of Emergency Management,
302 or his or her designee.
303 7. The Secretary of Health Care Administration, or his or
304 her designee.
305 8. The Commissioner of Education, or his or her designee.
306 9. The executive director of the Department of Highway
307 Safety and Motor Vehicles, or his or her designee.
308 10. The chair of the Public Service Commission, or his or
309 her designee.
310 11. The director of the Florida State Guard, or his or her
311 designee.
312 12. The Adjutant General of the Florida National Guard, or
313 his or her designee.
314 13. Any other agency head appointed by the Governor.
315 (2)(a) The Governor shall appoint Secretary of Management
316 Services shall designate a state chief information officer,
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 13 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
317 subject to confirmation by the Senate, who shall administer the
318 Florida Digital Service. The state chief information officer,
319 before prior to appointment, must have at least 5 years of
320 experience in the development of information system strategic
321 planning and development or information technology policy, and,
322 preferably, have leadership-level experience in the design,
323 development, and deployment of interoperable software and data
324 solutions.
325 (b) The state chief information officer, in consultation
326 with the Secretary of Management Services, shall designate a
327 state chief data officer. The chief data officer must be a
328 proven and effective administrator who must have significant and
329 substantive experience in data management, data governance,
330 interoperability, and security.
331 (c) The state chief information officer shall designate a
332 state chief technology officer who shall be responsible for:
333 1. Exploring technology solutions to meet the enterprise
334 need;
335 2. The deployments of adopted enterprise solutions;
336 3. Compliance with Florida’s Cloud First policy;
337 4. Recommending best practices to increase the likelihood
338 of technology project success;
339 5. Developing strategic partnerships with the private
340 sector; and
341 6. Directly supporting enterprise cybersecurity and data
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 14 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
342 interoperability initiatives.
343
344 The chief cloud officer may acquire cloud migration as a service
345 to comply with this section as it pertains to the implementation
346 across the enterprise of Florida’s Cloud First policy.
347 (3) The department, acting through the Florida Digital
348 Service and from funds appropriated to the Florida Digital
349 Service, shall:
350 (a) Create, not later than December 1, 2022, and maintain
351 a comprehensive indexed data catalog in collaboration with the
352 enterprise that lists the data elements housed within the
353 enterprise and the legacy system or application in which these
354 data elements are located. The data catalog must, at a minimum,
355 specifically identify all data that is restricted from public
356 disclosure based on federal or state laws and regulations and
357 require that all such information be protected in accordance
358 with s. 282.318.
359 (b) Develop and publish, not later than December 1, 2022,
360 in collaboration with the enterprise, a data dictionary for each
361 agency that reflects the nomenclature in the comprehensive
362 indexed data catalog.
363 (c) Adopt, by rule, standards that support the creation
364 and deployment of an application programming interface to
365 facilitate integration throughout the enterprise.
366 (d) Adopt, by rule, standards necessary to facilitate a
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 15 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
367 secure ecosystem of data interoperability that is compliant with
368 the enterprise architecture.
369 (e) Adopt, by rule, standards that facilitate the
370 deployment of applications or solutions to the existing
371 enterprise system in a controlled and phased approach.
372 (f) After submission of documented use cases developed in
373 conjunction with the affected agencies, assist the affected
374 agencies with the deployment, contingent upon a specific
375 appropriation therefor, of new interoperable applications and
376 solutions:
377 1. For the Department of Health, the Agency for Health
378 Care Administration, the Agency for Persons with Disabilities,
379 the Department of Education, the Department of Elderly Affairs,
380 and the Department of Children and Families.
381 2. To support military members, veterans, and their
382 families.
383 (4) For information technology projects that have a total
384 project costs cost of $10 million or more:
385 (a) State agencies must provide the Florida Digital
386 Service with written notice of any planned procurement of an
387 information technology project.
388 (b) The Florida Digital Service must participate in the
389 development of specifications and recommend modifications to any
390 planned procurement of an information technology project by
391 state agencies so that the procurement complies with the
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 16 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
392 enterprise architecture.
393 (c) The Florida Digital Service must participate in post-
394 award contract monitoring.
395 (5) The department, acting through the Florida Digital
396 Service, may not retrieve or disclose any data without a shared-
397 data agreement in place between the department and the
398 enterprise entity that has primary custodial responsibility of,
399 or data-sharing responsibility for, that data.
400 (6) The department, acting through the Florida Digital
401 Service, shall adopt rules to administer this section.
402 Section 5. Section 282.201, Florida Statutes, is amended
403 to read:
404 282.201 State data center.—The state data center is
405 established within the department and shall be overseen by and
406 accountable to the department in consultation with the state
407 chief information officer, the state chief data officer, the
408 state chief information security officer, and the state chief
409 technology officer. Any procurement or purchase of enterprise
410 architecture which is comparable to a project that would be
411 subject to requirements under s. 282.0051(4) if the total
412 project cost was $10 million or more and which may be consumed
413 by an enterprise must be provided to the department and the
414 Florida Digital Service for review before publication. The
415 provision of data center services must comply with applicable
416 state and federal laws, regulations, and policies, including all
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 17 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
417 applicable security, privacy, and auditing requirements. The
418 Florida Digital Service department shall appoint a director of
419 the state data center who has experience in leading data center
420 facilities and has expertise in cloud-computing management.
421 (1) STATE DATA CENTER DUTIES.—The state data center shall:
422 (a) Offer, develop, and support the services and
423 applications defined in service-level agreements executed with
424 its customer entities.
425 (b) Maintain performance of the state data center by
426 ensuring proper data backup; data backup recovery; disaster
427 recovery; and appropriate security, power, cooling, fire
428 suppression, and capacity.
429 (c) Develop and implement business continuity and disaster
430 recovery plans, and annually conduct a live exercise of each
431 plan.
432 (d) Enter into a service-level agreement with each
433 customer entity to provide the required type and level of
434 service or services. If a customer entity fails to execute an
435 agreement within 60 days after commencement of a service, the
436 state data center may cease service. A service-level agreement
437 may not have a term exceeding 3 years and at a minimum must:
438 1. Identify the parties and their roles, duties, and
439 responsibilities under the agreement.
440 2. State the duration of the contract term and specify the
441 conditions for renewal.
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 18 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
442 3. Identify the scope of work.
443 4. Identify the products or services to be delivered with
444 sufficient specificity to permit an external financial or
445 performance audit.
446 5. Establish the services to be provided, the business
447 standards that must be met for each service, the cost of each
448 service by agency application, and the metrics and processes by
449 which the business standards for each service are to be
450 objectively measured and reported.
451 6. Provide a timely billing methodology to recover the
452 costs of services provided to the customer entity pursuant to s.
453 215.422.
454 7. Provide a procedure for modifying the service-level
455 agreement based on changes in the type, level, and cost of a
456 service.
457 8. Include a right-to-audit clause to ensure that the
458 parties to the agreement have access to records for audit
459 purposes during the term of the service-level agreement.
460 9. Provide that a service-level agreement may be
461 terminated by either party for cause only after giving the other
462 party and the department notice in writing of the cause for
463 termination and an opportunity for the other party to resolve
464 the identified cause within a reasonable period.
465 10. Provide for mediation of disputes by the Division of
466 Administrative Hearings pursuant to s. 120.573.
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 19 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
467 (e) For purposes of chapter 273, be the custodian of
468 resources and equipment located in and operated, supported, and
469 managed by the state data center.
470 (f) Assume administrative access rights to resources and
471 equipment, including servers, network components, and other
472 devices, consolidated into the state data center.
473 1. Upon consolidation, a state agency shall relinquish
474 administrative rights to consolidated resources and equipment.
475 State agencies required to comply with federal and state
476 criminal justice information security rules and policies shall
477 retain administrative access rights sufficient to comply with
478 the management control provisions of those rules and policies;
479 however, the state data center shall have the appropriate type
480 or level of rights to allow the center to comply with its duties
481 pursuant to this section. The Department of Law Enforcement
482 shall serve as the arbiter of disputes pertaining to the
483 appropriate type and level of administrative access rights
484 pertaining to the provision of management control in accordance
485 with the federal criminal justice information guidelines.
486 2. The state data center shall provide customer entities
487 with access to applications, servers, network components, and
488 other devices necessary for entities to perform business
489 activities and functions, and as defined and documented in a
490 service-level agreement.
491 (g) In its procurement process, show preference for cloud -
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 20 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
492 computing solutions that minimize or do not require the
493 purchasing, financing, or leasing of state data center
494 infrastructure, and that meet the needs of customer agencies,
495 that reduce costs, and that meet or exceed the applicable state
496 and federal laws, regulations, and standards for cybersecurity.
497 (h) Assist customer entities in transitioning from state
498 data center services to the Northwest Regional Data Center or
499 other third-party cloud-computing services procured by a
500 customer entity or by the Northwest Regional Data Center on
501 behalf of a customer entity.
502 (2) USE OF THE STATE DATA CENTER.—The following are exempt
503 from the use of the state data center: the Department of Law
504 Enforcement, the Department of the Lottery's Gaming System,
505 Systems Design and Development in the Office of Policy and
506 Budget, the regional traffic management centers as described in
507 s. 335.14(2) and the Office of Toll Operations of the Department
508 of Transportation, the State Board of Administration, state
509 attorneys, public defenders, criminal conflict and civil
510 regional counsel, capital collateral regional counsel, and the
511 Florida Housing Finance Corporation.
512 (3) AGENCY LIMITATIONS.—Unless exempt from the use of the
513 state data center pursuant to this section or authorized by the
514 Legislature, a state agency may not:
515 (a) Create a new agency computing facility or data center,
516 or expand the capability to support additional computer
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 21 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
517 equipment in an existing agency computing facility or data
518 center; or
519 (b) Terminate services with the state data center without
520 giving written notice of intent to terminate services 180 days
521 before such termination.
522 (4) DEPARTMENT RESPONSIBILITIES.—The department shall
523 provide operational management and oversight of the state data
524 center, which includes:
525 (a) Implementing industry standards and best practices for
526 the state data center's facilities, operations, maintenance,
527 planning, and management processes.
528 (b) Developing and implementing cost-recovery mechanisms
529 that recover the full direct and indirect cost of services
530 through charges to applicable customer entities. Such cost -
531 recovery mechanisms must comply with applicable state and
532 federal regulations concerning distribution and use of funds and
533 must ensure that, for any fiscal year, no service or customer
534 entity subsidizes another service or customer entity. The
535 department may recommend other payment mechanisms to the
536 Executive Office of the Governor, the President of the Senate,
537 and the Speaker of the House of Representatives. Such mechanisms
538 may be implemented only if specifically authorized by the
539 Legislature.
540 (c) Developing and implementing appropriate operating
541 guidelines and procedures necessary for the state data center to
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 22 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
542 perform its duties pursuant to subsection (1). The guidelines
543 and procedures must comply with applicable state and federal
544 laws, regulations, and policies and conform to generally
545 accepted governmental accounting and auditing standards. The
546 guidelines and procedures must include, but need not be limited
547 to:
548 1. Implementing a consolidated administrative support
549 structure responsible for providing financial management,
550 procurement, transactions involving real or personal property,
551 human resources, and operational support.
552 2. Implementing an annual reconciliation process to ensure
553 that each customer entity is paying for the full direct and
554 indirect cost of each service as determined by the customer
555 entity's use of each service.
556 3. Providing rebates that may be credited against future
557 billings to customer entities when revenues exceed costs.
558 4. Requiring customer entities to validate that sufficient
559 funds exist before implementation of a customer entity's request
560 for a change in the type or level of service provided, if such
561 change results in a net increase to the customer entity's cost
562 for that fiscal year.
563 5. By November 15 of each year, providing to the Office of
564 Policy and Budget in the Executive Office of the Governor and to
565 the chairs of the legislative appropriations committees the
566 projected costs of providing data center services for the
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 23 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
567 following fiscal year.
568 6. Providing a plan for consideration by the Legislative
569 Budget Commission if the cost of a service is increased for a
570 reason other than a customer entity's request made pursuant to
571 subparagraph 4. Such a plan is required only if the service cost
572 increase results in a net increase to a customer entity for that
573 fiscal year.
574 7. Standardizing and consolidating procurement and
575 contracting practices.
576 (d) In collaboration with the Department of Law
577 Enforcement and the Florida Digital Service, developing and
578 implementing a process for detecting, reporting, and responding
579 to cybersecurity incidents, breaches, and threats.
580 (e) Adopting rules relating to the operation of the state
581 data center, including, but not limited to, budgeting and
582 accounting procedures, cost-recovery methodologies, and
583 operating procedures.
584 (5) NORTHWEST REGIONAL DATA CENTER CONTRACT.—In order for
585 the department to carry out its duties and responsibilities
586 relating to the state data center, the state chief information
587 officer shall assume responsibility for the contract entered
588 into by the secretary of the department shall contract by July
589 1, 2022, with the Northwest Regional Data Center pursuant to s.
590 287.057(11). The contract shall provide that the Northwest
591 Regional Data Center will manage the operations of the state
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 24 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
592 data center and provide data center services to state agencies.
593 Notwithstanding the terms of the contract, the Northwest
594 Regional Data Center must provide the Florida Digital Service
595 with access to information regarding the operations of the state
596 data center.
597 (a) The department shall provide contract oversight,
598 including, but not limited to, reviewing invoices provided by
599 the Northwest Regional Data Center for services provided to
600 state agency customers.
601 (b) The department shall approve or request updates to
602 invoices within 10 business days after receipt. If the
603 department does not respond to the Northwest Regional Data
604 Center, the invoice will be approved by default. The Northwest
605 Regional Data Center must submit approved invoices directly to
606 state agency customers.
607 (6) FLORIDA DIGITAL SERVICE ACCESS.—The state data center,
608 and any successor entity assuming the responsibilities of the
609 state data center including, but not limited to, the Northwest
610 Regional Data Center, shall provide the Florida Digital Service
611 with full access to any infrastructure, system, application, or
612 other means that hosts, supports, or manages data in the custody
613 of an enterprise. For any such infrastructure, system,
614 application, or other means, the state data center or a
615 successor entity shall fully integrate with the Cybersecurity
616 Operations Center.
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 25 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
617 (7) STATE DATA CENTER REPORT.—Subject to s. 119.0725, the
618 state data center and any successor entity must submit to the
619 department and the Florida Digital Service a quarterly report
620 that provides, relating to infrastructure servicing enterprise
621 customers and data, the number of:
622 (a) Technology assets which are within 1 year of end of
623 life as defined by the manufacturer.
624 (b) Technology assets which are beyond end of life as
625 defined by the manufacturer.
626 (c) Technology assets which are within 2 years of being
627 unsupported by the manufacturer.
628 (d) Technology assets which are currently unsupported by
629 the manufacturer.
630 (e) Workloads which are hosted by a commercial cloud
631 service provider as defined in the National Institute of
632 Standards and Technology, publication 500-292.
633 (f) Workloads which are not hosted by a commercial entity
634 which is a cloud service provider as defined in the National
635 Institute of Standards and Technology, publication 500-292.
636 (g) Service level disruptions and average duration of
637 disruption.
638 Section 6. Subsection (10) of section 282.318, Florida
639 Statutes, is renumbered as subsection (11), subsections (3) and
640 (4) are amended, and a new subsection (10) is added to that
641 section, to read:
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 26 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
642 282.318 Cybersecurity.—
643 (3) The department, acting through the Florida Digital
644 Service, is the lead entity responsible for establishing
645 standards and processes for assessing state agency cybersecurity
646 risks and determining appropriate security measures. Such
647 standards and processes must be consistent with generally
648 accepted technology best practices, including the National
649 Institute for Standards and Technology Cybersecurity Framework,
650 for cybersecurity. The department, acting through the Florida
651 Digital Service, shall adopt rules that mitigate risks;
652 safeguard state agency digital assets, data, information, and
653 information technology resources to ensure availability,
654 confidentiality, and integrity; and support a security
655 governance framework. The department, acting through the Florida
656 Digital Service, shall also:
657 (a) Designate an employee of the Florida Digital Service
658 as the state chief information security officer. The state chief
659 information security officer must have experience and expertise
660 in security and risk management for communications and
661 information technology resources. The state chief information
662 security officer is responsible for the development, operation,
663 and oversight of cybersecurity for state technology systems. The
664 state chief information security officer shall be notified of
665 all confirmed or suspected incidents or threats of state agency
666 information technology resources and must report such incidents
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 27 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
667 or threats to the state chief information officer and the
668 Governor.
669 (b) Develop, and annually update by February 1, a
670 statewide cybersecurity strategic plan that includes security
671 goals and objectives for cybersecurity, including the
672 identification and mitigation of risk, proactive protections
673 against threats, tactical risk detection, threat reporting, and
674 response and recovery protocols for a cyber incident.
675 (c) Develop and publish for use by state agencies a
676 cybersecurity governance framework that, at a minimum, includes
677 guidelines and processes for:
678 1. Establishing asset management procedures to ensure that
679 an agency's information technology resources are identified and
680 managed consistent with their relative importance to the
681 agency's business objectives.
682 2. Using a standard risk assessment methodology that
683 includes the identification of an agency's priorities,
684 constraints, risk tolerances, and assumptions necessary to
685 support operational risk decisions.
686 3. Completing comprehensive risk assessments and
687 cybersecurity audits, which may be completed by a private sector
688 vendor, and submitting completed assessments and audits to the
689 department.
690 4. Identifying protection procedures to manage the
691 protection of an agency's information, data, and information
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 28 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
692 technology resources.
693 5. Establishing procedures for accessing information and
694 data to ensure the confidentiality, integrity, and availability
695 of such information and data.
696 6. Detecting threats through proactive monitoring of
697 events, continuous security monitoring, and defined detection
698 processes.
699 7. Establishing agency cybersecurity incident response
700 teams and describing their responsibilities for responding to
701 cybersecurity incidents, including breaches of personal
702 information containing confidential or exempt data.
703 8. Recovering information and data in response to a
704 cybersecurity incident. The recovery may include recommended
705 improvements to the agency processes, policies, or guidelines.
706 9. Establishing a cybersecurity incident reporting process
707 that includes procedures for notifying the department and the
708 Department of Law Enforcement of cybersecurity incidents.
709 a. The level of severity of the cybersecurity incident is
710 defined by the National Cyber Incident Response Plan of the
711 United States Department of Homeland Security as follows:
712 (I) Level 5 is an emergency-level incident within the
713 specified jurisdiction that poses an imminent threat to the
714 provision of wide-scale critical infrastructure services;
715 national, state, or local government security; or the lives of
716 the country's, state's, or local government's residents.
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 29 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
717 (II) Level 4 is a severe-level incident that is likely to
718 result in a significant impact in the affected jurisdiction to
719 public health or safety; national, state, or local security;
720 economic security; or civil liberties.
721 (III) Level 3 is a high-level incident that is likely to
722 result in a demonstrable impact in the affected jurisdiction to
723 public health or safety; national, state, or local security;
724 economic security; civil liberties; or public confidence.
725 (IV) Level 2 is a medium-level incident that may impact
726 public health or safety; national, state, or local security;
727 economic security; civil liberties; or public confidence.
728 (V) Level 1 is a low-level incident that is unlikely to
729 impact public health or safety; national, state, or local
730 security; economic security; civil liberties; or public
731 confidence.
732 b. The cybersecurity incident reporting process must
733 specify the information that must be reported by a state agency
734 following a cybersecurity incident or ransomware incident,
735 which, at a minimum, must include the following:
736 (I) A summary of the facts surrounding the cybersecurity
737 incident or ransomware incident.
738 (II) The date on which the state agency most recently
739 backed up its data; the physical location of the backup, if the
740 backup was affected; and if the backup was created using cloud
741 computing.
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 30 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
742 (III) The types of data compromised by the cybersecurity
743 incident or ransomware incident.
744 (IV) The estimated fiscal impact of the cybersecurity
745 incident or ransomware incident.
746 (V) In the case of a ransomware incident, the details of
747 the ransom demanded.
748 c.(I) A state agency shall report all ransomware incidents
749 and any cybersecurity incidents incident determined by the state
750 agency to be of severity level 3, 4, or 5 to the Florida Digital
751 Service, the Cybersecurity Operations Center, and the Cybercrime
752 Office of the Department of Law Enforcement as soon as possible
753 but no later than 4 48 hours after discovery of the
754 cybersecurity incident and no later than 2 12 hours after
755 discovery of the ransomware incident. The report must contain
756 the information required in sub-subparagraph b. The Florida
757 Digital Service shall notify the Governor, the President of the
758 Senate, and the Speaker of the House of Representatives of any
759 incident discovered by a state agency but not timely reported
760 under this sub-sub-subparagraph.
761 (II) The Cybersecurity Operations Center shall notify the
762 President of the Senate and the Speaker of the House of
763 Representatives of any severity level 3, 4, or 5 incident as
764 soon as possible but no later than 12 hours after receiving a
765 state agency's incident report. The notification must include a
766 high-level description of the incident and the likely effects
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 31 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
767 and must be provided in a secure environment.
768 d. A state agency shall report a cybersecurity incident
769 determined by the state agency to be of severity level 1 or 2 to
770 the Cybersecurity Operations Center and the Cybercrime Office of
771 the Department of Law Enforcement as soon as possible. The
772 report must contain the information required in sub -subparagraph
773 b.
774 e. The Cybersecurity Operations Center shall provide a
775 consolidated incident report by the 15th day after the end of
776 each quarter on a quarterly basis to the President of the
777 Senate, the Speaker of the House of Representatives, and the
778 Florida Cybersecurity Advisory Council. The report provided to
779 the Florida Cybersecurity Advisory Council may not contain the
780 name of any agency, network information, or system identifying
781 information but must contain sufficient relevant information to
782 allow the Florida Cybersecurity Advisory Council to f ulfill its
783 responsibilities as required in s. 282.319(9).
784 10. Incorporating information obtained through detection
785 and response activities into the agency's cybersecurity incident
786 response plans.
787 11. Developing agency strategic and operational
788 cybersecurity plans required pursuant to this section.
789 12. Establishing the managerial, operational, and
790 technical safeguards for protecting state government data and
791 information technology resources that align with the state
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 32 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
792 agency risk management strategy and that protect the
793 confidentiality, integrity, and availability of information and
794 data.
795 13. Establishing procedures for procuring information
796 technology commodities and services that require the commodity
797 or service to meet the National Institute of Standards and
798 Technology Cybersecurity Framework.
799 14. Submitting after-action reports following a
800 cybersecurity incident or ransomware incident. Such guidelines
801 and processes for submitting after-action reports must be
802 developed and published by December 1, 2022.
803 (d) Assist state agencies in complying with this section.
804 (e) In collaboration with the Cybercrime Office of the
805 Department of Law Enforcement, annually provide training for
806 state agency information security managers and computer security
807 incident response team members that contains training on
808 cybersecurity, including cybersecurity threats, trends, and best
809 practices.
810 (f) Annually review the strategic and operational
811 cybersecurity plans of state agencies.
812 (g) Annually provide cybersecurity training to all state
813 agency technology professionals and employees with access to
814 highly sensitive information which develops, assesses, and
815 documents competencies by role and skill level. The
816 cybersecurity training curriculum must include training on the
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 33 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
817 identification of each cybersecurity incident severity level
818 referenced in sub-subparagraph (c)9.a. The training may be
819 provided in collaboration with the Cybercrime Office of the
820 Department of Law Enforcement, a private sector entity, or an
821 institution of the State University System.
822 (h) Operate and maintain a Cybersecurity Operations Center
823 led by the state chief information security officer, which must
824 be primarily virtual and staffed with tactical detection and
825 incident response personnel. The Cybersecurity Operations Center
826 shall serve as a clearinghouse for threat information and
827 coordinate with the Department of Law Enforcement to support
828 state agencies and their response to any confirmed or suspected
829 cybersecurity incident.
830 (i) Lead an Emergency Support Function, ESF CYBER and
831 DIGITAL, under the state comprehensive emergency management plan
832 as described in s. 252.35.
833 (j) Provide cybersecurity briefings to the members of any
834 legislative committee or subcommittee responsible for policy
835 matters relating to cybersecurity.
836 (k) Have the authority to respond to any state agency
837 cybersecurity incident.
838 (4) Each state agency head shall, at a minimum:
839 (a) Designate a chief information security officer to
840 integrate the agency's technical and operational cybersecurity
841 efforts with the Cybersecurity Operations Center. This
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 34 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
842 designation must be provided annually in writing to the Florida
843 Digital Service by January 1. An agency's chief information
844 security officer shall report to the agency's chief information
845 officer. An agency may request the department to procure a chief
846 information security officer as a service to fulfill the
847 agency's duties under this paragraph.
848 (b)(a) Designate an information security manager to ensure
849 compliance with cybersecurity governance, manage risk, and
850 ensure compliance with the state's incident response plan
851 administer the cybersecurity program of the state agency . This
852 designation must be provided annually in writing to the
853 department by January 15 1. A state agency's information
854 security manager, for purposes of these information security
855 duties, shall report directly to the agency head.
856 (c)(b) In consultation with the department, through the
857 Florida Digital Service, and the Cybercrime Office of the
858 Department of Law Enforcement, and incorporating the resources
859 of the Florida State Guard as appropriate, establish an agency
860 cybersecurity response team to respond to a cybersecurity
861 incident. The agency cybersecurity response team shall convene
862 upon notification of a cybersecurity incident and must
863 immediately report all confirmed or suspected incidents to the
864 state chief information security officer, or his or her
865 designee, and comply with all applicable guidelines and
866 processes established pursuant to paragraph (3)(c).
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 35 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
867 (d)(c) Submit to the department annually by July 31, the
868 state agency's strategic and operational cybersecurity plans
869 developed pursuant to rules and guidelines established by the
870 department, through the Florida Digital Service.
871 1. The state agency strategic cybersecurity plan must
872 cover a 3-year period and, at a minimum, define security goals,
873 intermediate objectives, and projected agency costs for the
874 strategic issues of agency information security policy, risk
875 management, security training, security incident response, and
876 disaster recovery. The plan must be based on the statewide
877 cybersecurity strategic plan created by the department and
878 include performance metrics that can be objectively measured to
879 reflect the status of the state agency's progress in meeti ng
880 security goals and objectives identified in the agency's
881 strategic information security plan.
882 2. The state agency operational cybersecurity plan must
883 include a progress report that objectively measures progress
884 made towards the prior operational cybersecurity plan and a
885 project plan that includes activities, timelines, and
886 deliverables for security objectives that the state agency will
887 implement during the current fiscal year.
888 (e)(d) Conduct, and update annually by April 30 every 3
889 years, a comprehensive risk assessment, which may be facilitated
890 by the department or completed by a private sector vendor, to
891 determine the security threats to the data, information, and
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 36 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
892 information technology resources, including mobile devices and
893 print environments, of the agency. The risk assessment must
894 comply with the risk assessment criteria, methodology, and scope
895 developed by the state chief information security officer. The
896 risk assessment findings must be signed by the agency head or
897 the agency head's designee and the Florida Digital Service. The
898 risk assessment methodology developed by the department and is
899 confidential and exempt from s. 119.07(1), except that such
900 information shall be available to the Auditor General, the
901 Florida Digital Service within the department, the Cybercrime
902 Office of the Department of Law Enforcement, and, for state
903 agencies under the jurisdiction of the Governor, the Chief
904 Inspector General. If a private sector vendor is used to
905 complete a comprehensive risk assessment, it must attest to the
906 validity of the risk assessment findings.
907 (f)(e) Develop, and periodically update, written internal
908 policies and procedures, which include procedures for reporting
909 cybersecurity incidents and breaches to the Cybercrime Office of
910 the Department of Law Enforcement and the Florida Digital
911 Service within the department. Such policies and procedures must
912 be consistent with the rules, guidelines, and processes
913 established by the department to ensure the security of the
914 data, information, and information technology resources of the
915 agency. The internal policies and procedures that, if disclosed,
916 could facilitate the unauthorized modification, disclosure, or
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 37 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
917 destruction of data or information technology resources are
918 confidential information and exempt from s. 119.07(1), except
919 that such information shall be available to the Auditor General,
920 the Cybercrime Office of the Department of Law Enforcement, the
921 Florida Digital Service within the department, and, for state
922 agencies under the jurisdiction of the Governor, the Chief
923 Inspector General.
924 (g)(f) Implement managerial, operational, and technical
925 safeguards and risk assessment remediation plans recommended by
926 the department to address identified risks to the data,
927 information, and information technology resources of the agency.
928 The department, through the Florida Digital Service, shall track
929 implementation by state agencies upon development of such
930 remediation plans in coordination with agency inspectors
931 general.
932 (h)(g) Ensure that periodic internal audits and
933 evaluations of the agency's cybersecurity program for the data,
934 information, and information technology resources of the agency
935 are conducted. The results of such audits and evaluations are
936 confidential information and exempt from s. 119.07(1), except
937 that such information shall be available to the Auditor General,
938 the Cybercrime Office of the Department of Law Enforcement, the
939 Florida Digital Service within the department, and, for agencies
940 under the jurisdiction of the Governor, the Chief Inspector
941 General.
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 38 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
942 (i)(h) Ensure that the cybersecurity requirements in the
943 written specifications for the solicitation, contracts, and
944 service-level agreement of information technology and
945 information technology resources and services meet or exceed the
946 applicable state and federal laws, regulations, and standards
947 for cybersecurity, including the National Institute of Standards
948 and Technology Cybersecurity Framework. Service-level agreements
949 must identify service provider and state agency responsibilities
950 for privacy and security, protection of government data,
951 personnel background screening, and security deliverables with
952 associated frequencies.
953 (j)(i) Provide cybersecurity awareness training to all
954 state agency employees within 30 days after commencing
955 employment, and annually thereafter, concerning cybersecurity
956 risks and the responsibility of employees to comply with
957 policies, standards, guidelines, and operating procedures
958 adopted by the state agency to reduce those risks. The training
959 may be provided in collaboration with the Cybercrime Office of
960 the Department of Law Enforcement, a private sector entity, or
961 an institution of the State University System.
962 (k)(j) Develop a process for detecting, reporting, and
963 responding to threats, breaches, or cybersecurity incidents
964 which is consistent with the security rules, guidelines, and
965 processes established by the department through the Florida
966 Digital Service.
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 39 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
967 1. All cybersecurity incidents and ransomware incidents
968 must be reported by state agencies. Such reports must comply
969 with the notification procedures and reporting timeframes
970 established pursuant to paragraph (3)(c).
971 2. For cybersecurity breaches, state agencies shall
972 provide notice in accordance with s. 501.171.
973 (l)(k) Submit to the Florida Digital Service, within 1
974 week after the remediation of a cybersecurity incident or
975 ransomware incident, an after-action report that summarizes the
976 incident, the incident's resolution, and any insights gained as
977 a result of the incident.
978 (10) Any legislative committee or subcommittee responsible
979 for policy matters relating to cybersecurity may hold meetings
980 closed by the respective legislative body under the rules of
981 such legislative body at which such committee or subcommittee is
982 briefed on records made confidential and exempt under
983 subsections (5) and (6). The committee or subcommittee must
984 maintain the confidential and exempt status of such records.
985 Section 7. Paragraph (d) of subsection (5) of section
986 282.3185, Florida Statutes, is redesignated as paragraph (c),
987 and paragraph (b) and present paragraph (c) of that subsection
988 are amended to read:
989 282.3185 Local government cybersecurity.—
990 (5) INCIDENT NOTIFICATION.—
991 (b)1. A local government shall report all ransomware
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 40 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
992 incidents and any cybersecurity incidents incident determined by
993 the local government to be of severity level 3, 4, or 5 as
994 provided in s. 282.318(3)(c) to the Florida Digital Service, the
995 Cybersecurity Operations Center, the Cybercrime Office of the
996 Department of Law Enforcement, and the sheriff who has
997 jurisdiction over the local government as soon as possible but
998 no later than 4 48 hours after discovery of the cybersecurity
999 incident and no later than 2 12 hours after discovery of the
1000 ransomware incident. The report must contain the information
1001 required in paragraph (a). The Florida Digital Service shall
1002 notify the Governor, the President of the Senate, and the
1003 Speaker of the House of Representatives of any incident
1004 discovered by a local government but not timely reported under
1005 this subparagraph.
1006 2. The Cybersecurity Operations Center shall notify the
1007 President of the Senate and the Speaker of the House of
1008 Representatives of any severity level 3, 4, or 5 incident as
1009 soon as possible but no later than 12 hours after receiving a
1010 local government's incident report. The notification must
1011 include a high-level description of the incident and the likely
1012 effects and must be provided in a secure environment.
1013 (c) A local government may report a cybersecurity incident
1014 determined by the local government to be of severity level 1 or
1015 2 as provided in s. 282.318(3)(c) to the Cybersecurity
1016 Operations Center, the Cybercrime Office of the Department of
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 41 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
1017 Law Enforcement, and the sheriff who has jurisdiction over the
1018 local government. The report shall contain the information
1019 required in paragraph (a).
1020 Section 8. Paragraph (j) of subsection (4) of section
1021 282.319, Florida Statutes, is amended to read:
1022 282.319 Florida Cybersecurity Advisory Council.—
1023 (4) The council shall be comprised of the following
1024 members:
1025 (j) Three representatives from critical infrastructure
1026 sectors, one of whom must be from a water treatment facility,
1027 appointed by the Governor.
1028 Section 9. Section 768.401, Florida Statutes, is created
1029 to read:
1030 768.401 Limitation on liability for cybersecurity
1031 incidents.—
1032 (1) A county or municipality that substantially complies
1033 with s. 282.3185 shall not be liable in connection with a
1034 cybersecurity incident.
1035 (2) A sole proprietorship, partnership, corporation,
1036 trust, estate, cooperative, association, or other commercial
1037 entity that acquires, maintains, stores, or uses personal
1038 information shall not be liable in connection with a
1039 cybersecurity incident if the entity substantially complies with
1040 s. 501.171, if applicable, and has:
1041 (a) Adopted a cybersecurity program that substantially
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 42 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
1042 aligns with the current version of any of the following
1043 standards:
1044 1. The National Institute of Standards and Technology
1045 (NIST) Framework for Improving Critical Infrastructure
1046 Cybersecurity.
1047 2. NIST special publication 800-171.
1048 3. NIST special publications 800-53 and 800-53A.
1049 4. The Federal Risk and Authorization Management Program
1050 security assessment framework.
1051 5. CIS Critical Security Controls.
1052 6. The International Organization for
1053 Standardization/International Electrotechnical Commission 27000 -
1054 series family of standards; or
1055 (b) If regulated by the state or Federal Government, or
1056 both, or if otherwise subject to the requirements of any of the
1057 following laws and regulations, substantially complied its
1058 cybersecurity program to the current version of the following,
1059 as applicable:
1060 1. The security requirements of the Health Insurance
1061 Portability and Accountability Act of 1996, 45 C.F.R. part 164
1062 subpart C.
1063 2. Title V of the Gramm-Leach-Bliley Act of 1999, Pub. L.
1064 No. 106-102, as amended.
1065 3. The Federal Information Security Modernization Act of
1066 2014, Pub. L. No. 113-283.
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 43 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
1067 4. The Health Information Technology for Economic and
1068 Clinical Health Act, 45 C.F.R. part 162.
1069 (c) The scale and scope of compliance with a program or
1070 standard under paragraphs (a) or (b) by a covered entity, as
1071 applicable, is appropriate if it is based on all of the
1072 following factors:
1073 1. The size and complexity of the covered entity;
1074 2. The nature and scope of the activities of the covered
1075 entity; and
1076 3. The sensitivity of the information to be protected.
1077 (3) Any commercial entity covered by subsection (2) that
1078 substantially complies with a combination of industry -recognized
1079 cybersecurity frameworks or standards, including the payment
1080 card industry data security standard, to gain the presumption
1081 against liability pursuant to subsection (2) must, upon the
1082 revision of two or more of the frameworks or standards with
1083 which the entity complies, adopt the revised frameworks or
1084 standards within 1 year after the latest publication date stated
1085 in the revisions.
1086 (4) This section does not establish a private cause of
1087 action. Failure of a county, municipality, or commercial entity
1088 to substantially implement a cybersecurity program that is in
1089 compliance with this section is not evidence of negligence and
1090 does not constitute negligence per se.
1091 (5) In an action in connection with a cybersecurity
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 44 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
1092 incident, if the defendant is an entity covered by subsection s
1093 (1) or (2), the defendant has the burden of proof to establish
1094 substantial compliance.
1095 Section 10. This act shall take effect July 1, 2023.
1096
1097 -----------------------------------------------------
1098 T I T L E A M E N D M E N T
1099 Remove everything before the enacting clause and insert:
1100 A bill to be entitled
1101 An act relating to cybersecurity; providing a short
1102 title; amending s. 110.205, F.S.; exempting certain
1103 personnel from the career service; amending s.
1104 282.0041, F.S.; providing and revising definitions;
1105 amending s. 282.0051, F.S.; requiring the Florida
1106 Digital Service to ensure that independent project
1107 oversight is performed in a certain manner and take
1108 certain actions relating to the procurement of project
1109 oversight as a service; requiring the Florida Digital
1110 Service to provide certain reports by certain dates;
1111 requiring the Florida Digital Service to establish an
1112 operations committee for a certain purpose and
1113 composed of certain members; requiring the Governor to
1114 appoint a state chief information officer subject to
1115 confirmation by the Senate; requiring the state chief
1116 information officer to designate a state chief
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 45 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
1117 technology officer; amending s. 282.201, F.S.;
1118 providing that the state data center shall be overseen
1119 by and accountable to the Department of Management
1120 Services in consultation with certain officers;
1121 providing requirements for certain state data center
1122 procurements; requiring the Florida Digital Service to
1123 be provided with full access to state data center
1124 infrastructure, systems, applications, and other means
1125 of hosting, supporting, and managing certain data;
1126 requiring the state data center to submit a certain
1127 report to the department and the Florida Digital
1128 Service; amending s. 282.318, F.S.; requiring a state
1129 agency to report ransomware and cybersecurity
1130 incidents within a certain time period; requiring the
1131 Florida Digital Service to notify the Governor and
1132 Legislature of certain incidents; providing that
1133 certain notification must be provided in a secure
1134 environment; requiring the Florida Digital Service to
1135 provide cybersecurity briefings to certain legislative
1136 committees; authorizing the Florida Digital Service to
1137 respond to certain cybersecurity incidents; requiring
1138 a state agency head to designate a chief information
1139 security officer for the agency; revising the purpose
1140 of an agency's information security manager; revising
1141 the frequency of a comprehensive risk assessment;
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 46 of 47
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1511 (2023)
Amendment No. 1
1142 authorizing certain legislative committees to hold
1143 closed meetings to receive certain briefings;
1144 requiring such committees to maintain the confidential
1145 and exempt status of certain records; amending s.
1146 282.3185, F.S.; requiring a local government to report
1147 ransomware and cybersecurity incidents within a
1148 certain time period; requiring the Florida Digital
1149 Service to notify the Governor and Legislature of
1150 certain incidents; providing that certain notification
1151 must be provided in a secure environment; amending s.
1152 282.319, F.S.; revising the membership of the Florida
1153 Cybersecurity Advisory Council; creating s. 768.401,
1154 F.S.; providing a presumption against liability in
1155 connection with a cybersecurity incident for a county,
1156 municipality, or commercial entity that complies with
1157 certain requirements; requiring certain entities to
1158 adopt certain revised frameworks or standards within a
1159 specified time period; providing that a private cause
1160 of action is not established; providing that certain
1161 failures are not evidence of negligence and do not
1162 constitute negligence per se; providing an effective
1163 date.
635201 - h1511-strike.docx
Published On: 3/20/2023 10:04:30 PM
Page 47 of 47
PCS for HB 1025
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: PCS for HB 1025 Government Vehicles
SPONSOR(S): Energy, Communications & Cybersecurity Subcommittee
TIED BILLS: IDEN./SIM. BILLS: CS/CS/SB 284
REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF
Orig. Comm.: Energy, Communications & Walsh Keating
Cybersecurity Subcommittee
SUMMARY ANALYSIS
Current law requires state agencies that wish to procure commodities or contractual services in excess of
$35,000 to use a competitive solicitation process. A competitive solicitation is the process of requesting and
receiving two or more sealed bids, proposals, or replies submitted by responsive vendors in accordance with
the terms of a competitive process.
State agencies, in many circumstances, are required to take specified actions to promote energy efficiency and
other environmental benefits when conducting public business. When procuring new vehicles, state agencies,
state universities, community colleges, and local governments under a state purchasing plan must first define
the intended purpose for the vehicle and determine which statutorily listed use class applies. Vehicles must be
selected for the greatest fuel efficiency available for the determined class when fuel economy data is available.
Under the bill, any governmental entity that purchases under the state purchasing plan must select vehicles
based on the lowest lifetime ownership costs, including costs for fuel, operations, and maintenance.
The bill strikes the requirement under current law that state agencies use ethanol and biodiesel fuel when
available, and the bill removes the requirement that state agencies that administer central fueling operations
for state-owned vehicles procure biofuels for fleet needs to the greatest extent practicable.
The bill requires DMS to make recommendations before July 1, 2024, to state agencies and local governments
regarding the procurement of electric vehicles and natural gas fuel vehicles.
The bill has no impact state or local government revenues or expenditures.
The bill provides an effective date of July 1, 2023.
This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives .
STORAGE NAME: pcs1025.ECC
DATE: 3/19/2023
FULL ANALYSIS
I. SUBSTANTIVE ANALYSIS
A. EFFECT OF PROPOSED CHANGES:
Present Situation
Procurement of Commodities or Contractual Services
Current law specifies the procedures for procurement of commodities or contractual services. 1 The
Department of Management Services (DMS) provides uniform commodity and contractual service
procurement policies, rules, procedures, and forms for use by agencies and eligible users, 2 and
establishes purchasing agreements and procures state term contracts for commodities and contractual
services.3
DMS is required to consider the life-cycle cost of commodities purchased by the state, when applicable
and feasible.4 When calculating the life-cycle cost, the agency may consider the acquisition cost of the
product; the energy consumption and the projected cost of energy over the useful life of the product;
and the anticipated trade-in, resale, or salvage value of the product.5 The agency is authorized to
establish by rule energy-efficiency standards for major energy-consuming products.6
Florida law requires state agencies that wish to procure commodities or contractual services in excess
of $35,0007 to use a competitive solicitation process.8 Competitive solicitation is the process of
requesting and receiving two or more sealed bids, proposals, or replies submitted by responsive
vendors in accordance with the terms of a competitive process, regardless of procurement method. 9
Commodities or contractual services available only from a single source may be exempt from the
competitive solicitation requirement.10 Current law specifies the processes an agency must follow in this
circumstance.11
Climate-friendly Public Business
Current law requires state agencies, in many circumstances, to take specified actions to promote
energy efficiency and other environmental benefits when conducting public business. 12 These actions
include:
Consulting the Florida Climate-Friendly Preferred Products List13 when procuring products from
state term contracts 14 and procuring such products if the price is comparable;15
Contracting for meeting and conference space only with facilities that have received a special
designation from the Department of Environmental Protection for best practices in water,
1 Ch. 287, F.S.
2 S. 287.032, F.S.
3 S. 287.042(2)(a), F.S.
4 S. 287.083(1), F.S.
5 S. 287.083(5), F.S.
6 S. 287.083(3)(a), F.S.
7 S. 287.017(2), F.S.
8 S. 287.057(1), F.S.
9 S. 287.012(6), F.S.
10 S. 287.057(3)(c), F.S.
11 Id.
12 S. 286.29, F.S.
13 The Florida Climate-Friendly Preferred Products List is developed by DMS, which works with the Department of
Environmental Protection to continually assess the list. The list identifies specific products and vendors that offer energy
efficiency or other environmental benefits over competing products. See s. 286.29(1), F.S.
14 A state term contract is a contract for commodities or contractual services that is competitively procured by DMS and is
used by agencies and other eligible users. See ss. 287.012(28), F.S. and 287.042(2)(a), F.S.
15 S. 286.29(1), F.S.
STORAGE NAME: pcs1025.ECC PAGE: 2
DATE: 3/19/2023
energy, and waste efficiency standards, absent a determination from the agency head no other
viable alternative exists;16
Ensuring all maintained vehicles meet minimum maintenance schedules shown to reduce fuel
consumption and reporting compliance to DMS; 17 and
Using ethanol and biodiesel blended fuels when available. State agencies administering central
fueling operations for state-owned vehicles shall procure biofuels for fleet needs to the greatest
extent practicable.18
Additionally, state agencies, state universities, community colleges, and local governments that
purchase vehicles under a state purchasing plan must first define the intended purpose for the vehicle
and determine which statutorily listed use class 19 the vehicle is being procured for.20 These vehicles
must be selected for the greatest fuel efficiency available for the determined use class when fuel
economy data is available.21 Exceptions may be made for emergency response vehicles in certain
circumstances.22
Effect of the Bill
The bill requires any governmental entity that purchases under the state purchasing plan to select
vehicles for each use class based on the lowest lifetime ownership costs, including costs for fuel,
operations, and maintenance, rather than based on the greatest fuel efficiency.
The bill strikes the requirement under current law that state agencies use ethanol and biodiesel fuel
when available. It also removes the requirement that state agencies that administer central fueling
operations for state-owned vehicles procure biofuels for fleet needs to the greatest extent practicable.
The bill requires DMS to make recommendations before July 1, 2024, to state agencies, state colleges
and universities, and local governments regarding the procurement of electric vehicles and natural gas
fuel vehicles and the best practices for integrating those vehicles into existing fleets.
The bill provides an effective date of July 1, 2023.
B. SECTION DIRECTORY:
Section 1: Amends s. 286.29, F.S., relating to climate-friendly public business.
Section 2: Requires DMS to make specified recommendations.
Section 3: Provides an effective date of July 1, 2023.
II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT
A. FISCAL IMPACT ON STATE GOVERNMENT:
1. Revenues:
None.
16 S. 286.29(2), F.S.
17 S. 286.29(3), F.S.
18 S. 286.29(5), F.S.
19 Listed vehicle use classes are the following: state business travel, designated operator; state business travel, pool
operators; construction, agricultural, or maintenance work; conveyance of passengers; conveyance of building or
maintenance materials and supplies; off-road vehicle, motorcycle, or all-terrain vehicle; emergency response; or other.
See s. 286.29(4), F.S.
20 S. 286.29(4), F.S.
21 Id.
22 Id.
STORAGE NAME: pcs1025.ECC PAGE: 3
DATE: 3/19/2023
2. Expenditures:
None.
B. FISCAL IMPACT ON LOCAL GOVERNMENTS:
1. Revenues:
None.
2. Expenditures:
None.
C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
None.
D. FISCAL COMMENTS:
None.
III. COMMENTS
A. CONSTITUTIONAL ISSUES:
1. Applicability of Municipality/County Mandates Provision:
Not applicable. This bill does not appear to require counties or municipalities to spend funds or take
action requiring the expenditures of funds; reduce the authority that counties or municipalities have
to raise revenues in the aggregate; or reduce the percentage of state tax shared with counties or
municipalities.
2. Other:
None.
B. RULE-MAKING AUTHORITY:
None.
C. DRAFTING ISSUES OR OTHER COMMENTS:
None.
IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES
STORAGE NAME: pcs1025.ECC PAGE: 4
DATE: 3/19/2023
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
PCS for HB 1025 2023
1 A bill to be entitled
2 An act relating to government vehicles; amending s.
3 286.29, F.S.; revising the selection criteria for
4 purchasing or leasing vehicles for state agencies,
5 state universities, community colleges, and local
6 governments under a state purchasing plan; deleting a
7 provision requiring the use and procurement of ethanol
8 and biodiesel blended fuels; requiring the Department
9 of Management Services, before a specified date, to
10 make recommendations to state agencies, state
11 universities, community colleges, and local
12 governments relating to the procurement and
13 integration of electric and natural gas fuel vehicles;
14 providing an effective date.
15
16 Be It Enacted by the Legislature of the State of Florida:
17
18 Section 1. Subsections (4) and (5) of section 286.29,
19 Florida Statutes, are amended to read:
20 286.29 Climate-friendly public business.—The Legislature
21 recognizes the importance of leadership by state government in
22 the area of energy efficiency and in reducing the greenhouse gas
23 emissions of state government operations. The following shall
24 pertain to all state agencies when conducting public business:
25 (4) When procuring new vehicles, all state agencies, state
Page 1 of 3
CODING: Words stricken are deletions; words underlined are additions.
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
PCS for HB 1025 2023
26 universities, community colleges, and local governments that
27 purchase vehicles under a state purchasing plan shall first
28 define the intended purpose for the vehicle and determine which
29 of the following use classes for which the vehicle is being
30 procured:
31 (a) State business travel, designated operator;
32 (b) State business travel, pool operators;
33 (c) Construction, agricultural, or maintenance work;
34 (d) Conveyance of passengers;
35 (e) Conveyance of building or maintenance materials and
36 supplies;
37 (f) Off-road vehicle, motorcycle, or all-terrain vehicle;
38 (g) Emergency response; or
39 (h) Other.
40
41 Vehicles described in paragraphs (a) through (h), when being
42 processed for purchase or leasing agreements, must be selected
43 based on the lowest lifetime ownership costs, including costs
44 for fuel, operations, and maintenance, for the greatest fuel
45 efficiency available for a given use class when fuel economy
46 data are available. Exceptions may be made for individual
47 vehicles in paragraph (g) when accompanied, during the
48 procurement process, by documentation indicating that the
49 operator or operators will exclusively be emergency first
50 responders or have special documented need for exceptional
Page 2 of 3
CODING: Words stricken are deletions; words underlined are additions.
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
PCS for HB 1025 2023
51 vehicle performance characteristics. Any request for an
52 exception must be approved by the purchasing agency head and any
53 exceptional performance characteristics denoted as a part of the
54 procurement process prior to purchase.
55 (5) All state agencies shall use ethanol and biodiesel
56 blended fuels when available. State agencies administering
57 central fueling operations for state-owned vehicles shall
58 procure biofuels for fleet needs to the greatest extent
59 practicable.
60 Section 2. Before July 1, 2024, the Department of
61 Management Services shall make recommendations to state
62 agencies, state universities, community colleges, and local
63 governments regarding the procurement of electric and natural
64 gas fuel vehicles and best practices for integrating such
65 vehicles into existing fleets.
66 Section 3. This act shall take effect July 1, 2023.
Page 3 of 3
CODING: Words stricken are deletions; words underlined are additions.
PCS for HB 1331
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: PCS for HB 1331 Municipal Utilities
SPONSOR(S): Energy, Communications & Cybersecurity Subcommittee
TIED BILLS: IDEN./SIM. BILLS:
REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF
Orig. Comm.: Energy, Communications & Walsh Keating
Cybersecurity Subcommittee
SUMMARY ANALYSIS
Pursuant to s. 2(b), Art. VIII of the State Constitution, municipalities have the governmental, corporate, and
proprietary powers to enable them to conduct municipal government, perform municipal functions, and render
municipal services. Under their home rule power and as otherwise provided or limited by law or agreement,
municipalities may provide utilities to citizens and entities within the municipality’s corporate boundaries, in
unincorporated areas, and even in other municipalities.
Many municipalities own and operate electric utilities and natural gas utilities and govern the operation of those
utilities through ordinance, code, or policies. Municipalities are also authorized by general law to provide water
and sewer utility services. A municipality that operates a water or sewer utility outside of its municipal
boundaries may impose higher rates, fees, and charges on consumers receiving service outside of its
corporate boundaries as compared to the rates, fees, and charges imposed on consumers within its
boundaries. Municipalities routinely transfer a portion of their utility earnings to their general funds for non-utility
purposes, though the amounts and percentages may vary widely among municipalities .
The bill places limits on the portion of municipal utility revenues that may be used to fund or finance a
municipality’s non-utility related general government functions. In doing so, the bill limits the rate of transfer for
municipal electric, natural gas, and water or wastewater utilities. Under the bill, the greater the proportion of
customers outside of the city boundaries that a municipal utility serves, the lower the cap is on transfers.
However, if a municipal utility is governed by a utility authority board that, through the election of voting
members from outside the municipal boundaries, provides for representation of retail customers located
outside the municipal boundaries approximately proportionate to the percentage of such customers , then
transfers of revenue are not subject to a reduced cap.
The bill removes a provision allowing water or sewer utilities to add, for consumers outside of its boundaries, a
surcharge of up to 25 percent of the rates, fees, and charges imposed on consumers within its boundaries.
Furthermore, the bill changes the limit on the rates, fees, and charges such utility can impose on customers
outside of municipal boundaries to no more than 25 percent above the total amount the municipal water or
sewer utility charges customers within the municipal boundaries, provided rates for outside customers are set
in a public hearing using the same methods as rates for other customers.
The bill limits the rates, fees, and charges that a municipal water or sewer utility that provides service to
consumers within the boundaries of a separate municipality, using a water treatment plant or sewer treatment
plant located within the boundaries of that separate municipality, by requiring that such charges are no more
that the rates, fees, and charges imposed on consumers inside its own municipal boundaries.
The bill will not impact state government revenues and state or local government expenditures. The bill may
have a negative fiscal impact on certain local revenues. See Fiscal Analysis & Economic Impact Statement.
The bill provides an effective date of July 1, 2024.
This bill may be a county or municipality mandate requiring a two-thirds vote of the membership of the
House. See Section III.A.1 of the analysis.
This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives .
STORAGE NAME: pcs1331.ECC
DATE: 3/20/2023
FULL ANALYSIS
I. SUBSTANTIVE ANALYSIS
A. EFFECT OF PROPOSED CHANGES:
Present Situation
Local Government Utility Services
Pursuant to s. 2(b), Art. VIII of the State Constitution, municipalities have the governmental, corporate,
and proprietary powers to enable them to conduct municipal government, perform municipal functions,
and render municipal services. Municipalities may exercise any power for municipal purposes, except
when expressly prohibited by law.1 The legislative body of each municipality has the power to enact
legislation on any subject upon which the state Legislature may act with certain exceptions. 2 Under
their home rule power and as otherwise provided or limited by law or agreement, municipalities may
provide utilities to citizens and entities within the municipality’s corporate boundaries, in unincorporated
areas, and even in other municipalities.
Many municipalities own and operate electric utilities and natural gas utilities and govern the operation
of those utilities through ordinance, code, or policies. Currently, there are 33 municipal electric utilities
in the state.3 Municipal electric and natural gas utility rates are not directly regulated by the Florida
Public Service Commission (PSC), however, the PSC does have jurisdiction over municipal electric
utilities for matters related to rate structure, power plant transmission line site certification, general
reporting jurisdiction, service territory and territory disputes, energy efficiency reporting, ten year site
plans, reporting on system hardening and resiliency, reporting on net metering, audits related to
regulatory assessment fees, monitoring renewable energy, reporting on facilities inspection and
vegetation management, and grid bill jurisdiction.4
Municipalities are authorized by general law to provide water and sewer utility services. 5 With respect
to public works projects, including water and sewer utility services, 6 municipalities may extend and
execute their corporate powers outside of their corporate limits as “desirable or necessary for the
promotion of the public health, safety and welfare.”7 A municipality may not extend or apply these
corporate powers within the corporate limits of another municipality.8 However, it may permit any other
municipality and the owners of lands outside its corporate limits or within the limits of another
municipality to connect with its water and sewer utility facilities and use its services upon agreed terms
and conditions.9 An informal study conducted in 2014 indicated that approximately 250 municipalities
provide water service and approximately 220 municipalities provide wastewater service. Of these
municipalities, the study found that approximately 140 provide water and/or waste water services to
1 Section 166.021(2), F.S., provides that any activity or power which may be exercised by the state or its political
subdivisions is considered a municipal purpose.
2 Pursuant to s. 166.021(3), F.S., a municipality may not enact legislation on the following: the subjects of annexation,
merger, and exercise of extraterritorial power, which require general law or special law; any subject expressly prohibited
by the constitution; any subject expressly preempted to state or county government by the constitution or by general law;
and any subject preempted to a county pursuant to a county charter adopted under the authority of the State constitution.
3 Presentation on Florida Public Power, Florida Municipal Electric Association (Feb. 9, 2023), slide 2, available at
https://www.myfloridahouse.gov/Sections/Documents/loaddoc.aspx?PublicationType=Committees& CommitteeId= 3226&S
ession=2023&DocumentType=Meeting+Packets&FileName=ecc+2-9-23.pdf.
4 Id. at slide 3.
5 Pursuant to s. 180.06, F.S., a municipality may “provide water and alternative water supplies;” “provide for the collection
and disposal of sewage, including wastewater reuse, and other liquid wastes; ” and “construct reservoirs, sewerage
systems, trunk sewers, intercepting sewers, pumping stations, wells, siphons, intakes, pipelines, distribution systems,
purification works, collection systems, treatment and disposal works ” to accomplish these purposes.
6 Other public works projects authorized under s. 180.06, F.S., include alternative water supplies, maintenance of water
flow and bodies of water for sanitary purposes, garbage collection and disposal, airports, hospitals, jails, golf courses, ga s
plants and distribution systems, and related facilities.
7 S. 180.02(2), F.S.
8 Id.
9 S. 180.19, F.S.
STORAGE NAME: pcs1331.ECC PAGE: 2
DATE: 3/20/2023
customers outside of their municipal boundaries, which may include customers in unincorporated areas
of counties or in other municipalities.10 These utility systems are exempt from PSC jurisdiction.
A municipality that operates a water or sewer utility outside of its municipal boundaries may impose
higher rates, fees, and charges on consumers receiving service outside of its corporate boundaries as
compared to the rates, fees, and charges imposed on consumers within its boundaries. The
municipality can accomplish this in two ways:
First, for consumers outside of its boundaries, it may add a surcharge of up to 25 percent of the
rates, fees, and charges imposed on consumers within its boundaries. This mechanism does
not require a public hearing.11
Second, it may set separate rates, fees, and charges for consumers outside its boundaries
based on the same factors used to set rates for consumers within its boundaries. It may add a
surcharge of up to 25 percent of these charges, provided that the total of all such rates, fees,
and charges for service to consumers outside its boundaries may not exceed the total charges
to consumers within its boundaries by more than 50 percent for corresponding service. Rates
set in this manner require a public hearing at which all users served or to be served by the
water or sewer utilities and all other interested persons will have an opportunity to be heard
concerning the proposed rates.12
There is no central repository for information concerning municipal water or sewer service rates that
identifies municipalities that impose higher rates on consumers outside of the municipal boundaries, the
specific mechanism used by such municipalities to establish such rates, or the level of any additional
charge or surcharge imposed.
Most municipal utility systems are governed by the municipality’s governing body (i.e., the city
commission). Six municipal electric utility systems in Florida are governed by separate utility boards, or
“authorities,” which are typically appointed by the municipality’s governing body.13 These utility
authorities vary in structure, though the charter documents for each generally address the powers and
duties of the authority (including terms related to rate-setting, financing, acquisitions, and eminent
domain), the selection process for authority members (including qualifications and terms of office), the
management and personnel of the authority, the transfer of revenues from utility operations to the
municipality, and the degree of continuing oversight by the municipal governing body.
Current law authorizes municipalities to raise amounts of money which are necessary for the conduct of
the municipal government. A municipality may do so by taxation and licenses authorized by Florida’s
constitution or general law, or by user charges or fees authorized by ordinance. 14 Municipalities
routinely transfer a portion of their utility earnings to their general funds for non-utility purposes, though
the amounts and percentages may vary widely among municipalities.15 These transfers may be limited
in some circumstances by ordinance, but they are not governed by state law.
Effect of the Bill
The bill places limits on the portion of municipal utility revenues that may be used to fund or finance a
municipality’s non-utility related general government functions. In doing so, the bill limits the rate of
transfer for municipal electric, natural gas, and water or wastewater utilities. Under the bill, the greater
the proportion of customers outside of the city boundaries that a municipal utility serves, the lower the
cap is on transfers.
10 Analysis of House Bill 813 (2014), Florida House of Representatives.
11 S. 180.191(1)(a), F.S.
12 S. 180.191(1)(b), F.S.
13 The Keys Energy Services Utility Board is the only utility authority in the state with elected board members. Key West
has an elected board, with 2 of the 5 members from outside the city limits. Presentation on Florida Public Power, Florida
Municipal Electric Association supra n. 6, slide 8.
14 S. 166.201, F.S.
15 Presentation on Florida Public Power, Florida Municipal Electric Association supra n. 6, slide 6.
STORAGE NAME: pcs1331.ECC PAGE: 3
DATE: 3/20/2023
Under the bill, revenues transferred to fund or finance non-utility governmental functions, which were
generated by a municipal electric utility, may not exceed a rate equal to the amount derived by applying
the average of the midpoints of the rates of return on equity approved by the PSC for each investor-
owned electric utility in the state.
Similarly, the bill limits revenues transferred to fund or finance non-utility governmental functions, which
were generated by a municipal natural gas utility by capping the transfer at a rate equal to the amount
derived by applying the average of the midpoints of the rates of return on equity approved by the PSC
for each investor-owned natural gas utility in the state.
Under the bill, revenues generated from a municipal water or wastewater utility may only be transferred
at a rate equal to the amount derived by applying the rate of return on equity established by the PSC
under s. 367.081(4)(f), F.S.16
The bill provides for reduction to these transfer caps based on the percentage of utility customers
outside the city boundaries, as measured by total meters served. Under the bill, if more than:
15 percent of a municipal utility’s customers are located outside of municipal boundaries, then
the transfer rate applied to utility revenues will be reduced by 150 basis points. 17
30 percent of a municipal utility’s customers are located outside of municipal boundaries, then
the transfer rate applied to utility revenues will be reduced by 300 basis points.
45 percent of a municipal utility’s customers are located outside of municipal boundaries, then
the transfer rate applied to utility revenues will be reduced by 450 basis points.
However, if a municipal utility is governed by a utility authority board that, through the election of voting
members from outside the municipal boundaries, provides for representation of retail customers located
outside the municipal boundaries approximately proportionate to the percentage of such customers, as
measured by total meters served, then transfers of revenue are not subject to the above reductions.
The bill removes the provision allowing water or sewer utilities to add, for consumers outside of its
boundaries, a surcharge of up to 25 percent of the rates, fees, and charges imposed on consumers
within its boundaries. Furthermore, the bill changes the limit on the rates, fees, and charges such utility
can impose on customers outside of municipal boundaries to no more than 25 percent above the total
amount the municipal water or sewer utility charges customers within the municipal boundaries,
provided rates for outside customers are set in a public hearing using the same methods as rates for
other customers.
The bill limits the rates, fees, and charges that a municipal water or sewer utility that provides service to
consumers within the boundaries of a separate municipality, using a water treatment plant or sewer
treatment plant located within the boundaries of that separate municipality, by requiring that such
charges are no more that the rates, fees, and charges imposed on consumers inside its own municipal
boundaries.
The bill provides an effective date of July 1, 2024.
B. SECTION DIRECTORY:
Section 1: Amends s. 166.201, F.S., relating to taxes and charges.
Section 2: Amends s. 180.191, F.S., relating to limitation on rates charged consumer outside city limits.
16 Section 367.081, F.S., permits the PSC to establish a leverage formula that reasonably reflect the range of returns on
common equity for an average water or wastewater utility and which must be used to calculate the last authorized rate of
return on equity for any utility which otherwise would have no established rate of return on equity.
17 Basis points are commonly used to measure interest rates and percentages in finance, showing the change in the value
or rate of a financial instrument, such as 1% change equals a change of 100 basis points and 0.01% change equals one
basis point. Jason Fernando, Basis Point (BPS) Explained for Interest Rates and Investments (Jul. 5, 2022), Investopedia,
https://www.investopedia.com/terms/b/basispoint.asp (last visited Mar. 20, 2023).
STORAGE NAME: pcs1331.ECC PAGE: 4
DATE: 3/20/2023
Section 3: Provides an effective date of July 1, 2024.
II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT
A. FISCAL IMPACT ON STATE GOVERNMENT:
1. Revenues:
None.
2. Expenditures:
None.
B. FISCAL IMPACT ON LOCAL GOVERNMENTS:
1. Revenues:
The bill will likely have a negative fiscal impact on local governments which own and operate water
or wastewater utilities, as it reduces the maximum amount that municipal water and sewer utilities
can charge customers outside the municipal boundaries.
2. Expenditures:
None.
C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
None.
D. FISCAL COMMENTS:
None.
III. COMMENTS
A. CONSTITUTIONAL ISSUES:
1. Applicability of Municipality/County Mandates Provision:
The county/municipality mandates provision of Art. VII, section 18(b), of the Florida Constitution may
apply because this bill reduces the maximum amount that municipal water and sewer utilities can
charge customers outside the municipal boundaries. If the bill does qualify as a mandate, final
passage must be approved by two-thirds of the membership of each house of the Legislature.
2. Other:
None.
B. RULE-MAKING AUTHORITY:
None.
C. DRAFTING ISSUES OR OTHER COMMENTS:
None.
IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES
STORAGE NAME: pcs1331.ECC PAGE: 5
DATE: 3/20/2023
STORAGE NAME: pcs1331.ECC PAGE: 6
DATE: 3/20/2023
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
PCS for HB 1331 2023
1 A bill to be entitled
2 An act relating to municipal utilities; amending s.
3 166.201, F.S.; authorizing a municipality to fund or
4 finance general government functions with a portion of
5 revenues from utility operations; establishing limits
6 on utility revenue transfers for municipal utilities
7 that serve customers located outside the municipal
8 boundaries; amending s. 180.1291, F.S.; modifying
9 provisions relating to permissible rates, fees, and
10 charges imposed by municipal water and sewer utilities
11 on customers located outside the municipal boundaries;
12 providing an effective date.
13
14 Be It Enacted by the Legislature of the State of Florida:
15
16 Section 1. Section 166.201, Florida Statutes, is amended
17 to read:
18 166.201 Taxes and charges.—
19 (1) A municipality may raise, by taxation and licenses
20 authorized by the constitution or general law, or by user
21 charges or fees authorized by ordinance, amounts of money which
22 are necessary for the conduct of municipal government and may
23 enforce their receipt and collection in the manner prescribed by
24 ordinance not inconsistent with law.
25 (2)(a) A municipality that owns and operates an electric,
Page 1 of 5
CODING: Words stricken are deletions; words underlined are additions.
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
PCS for HB 1331 2023
26 natural gas, water, or wastewater utility may fund or finance
27 general government functions using a portion of the revenues
28 generated from rates, fees, and charges for the provision of
29 such utility service. The portion of utility revenues that may
30 be used during a fiscal year to fund or finance general
31 government functions, after payment of all utility expenses, may
32 not exceed:
33 1. For revenues generated from electric utility
34 operations, a transfer rate equal to the amount derived by
35 applying the average of the midpoints of the rates of return on
36 equity approved by the Public Service Commission for each
37 investor-owned electric utility in the state to the municipal
38 electric utility’s revenues.
39 2. For revenues generated from natural gas utility
40 operations, a transfer rate equal to the amount derived by
41 applying the average of the midpoints of the rates of return on
42 equity approved by the Public Service Commission for each
43 investor-owned natural gas utility in the state to the municipal
44 natural gas utility’s revenues.
45 3. For revenues generated from water or wastewater
46 operations, a transfer rate equal to the amount derived by
47 applying the rate of return on equity established by the Public
48 Service Commission under s. 367.081(4)(f) to the municipal water
49 or wastewater utility’s revenues.
50 (b) Except as provided in paragraph (c), the transfer rate
Page 2 of 5
CODING: Words stricken are deletions; words underlined are additions.
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
PCS for HB 1331 2023
51 applied to municipal utility revenues under subparagraphs (a)1.-
52 3. shall be reduced as follows:
53 1. If more than 15 percent of a municipal utility’s retail
54 customers, as measured by total meters served, are located
55 outside the municipal boundaries, the transfer rate applied to
56 utility revenues shall be reduced by 150 basis points.
57 2. If more than 30 percent of a municipal utility’s retail
58 customers, as measured by total meters served, are located
59 outside the municipal boundaries, the transfer rate applied to
60 utility revenues shall be reduced by 300 basis points.
61 3. If more than 45 percent of a municipal utility’s retail
62 customers, as measured by total meters served, are located
63 outside the municipal boundaries, the transfer rate applied to
64 utility revenues shall be reduced by 450 basis points.
65 (c) The reductions specified in paragraph (b) shall not
66 apply to a municipal utility service if the utility service is
67 governed by a utility authority board that, through the election
68 of voting members from outside the municipal boundaries,
69 provides for representation of retail customers located outside
70 the municipal boundaries approximately proportionate to the
71 percentage of such customers, as measured by total meters
72 served, that receive service from the utility.
73 Section 2. Subsection (1) of section 180.191, Florida
74 Statutes, is amended to read:
75 180.191 Limitation on rates charged consumer outside city
Page 3 of 5
CODING: Words stricken are deletions; words underlined are additions.
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
PCS for HB 1331 2023
76 limits.—
77 (1) Any municipality within the state operating a water or
78 sewer utility outside of the boundaries of such municipality
79 shall charge consumers outside the boundaries rates, fees, and
80 charges determined in one of the following manners:
81 (a) It may charge the same rates, fees, and charges as
82 consumers inside the municipal boundaries. However, in addition
83 thereto, the municipality may add a surcharge of not mo re than
84 25 percent of such rates, fees, and charges to consumers outside
85 the boundaries. Fixing of such rates, fees, and charges in this
86 manner shall not require a public hearing except as may be
87 provided for service to consumers inside the municipality.
88 (b)1. It may charge rates, fees, and charges that are just
89 and equitable and which are based on the same factors used in
90 fixing the rates, fees, and charges for consumers inside the
91 municipal boundaries. In addition thereto, the municipality may
92 add a surcharge not to exceed 25 percent of such rates, fees,
93 and charges for said services to consumers outside the
94 boundaries. However, the total of all such Such rates, fees, and
95 charges for the services to consumers outside the boundaries
96 shall not be more than 25 50 percent greater than in excess of
97 the total amount the municipality charges consumers served
98 within the municipality for corresponding service. No such
99 rates, fees, and charges shall be fixed until after a public
100 hearing at which all of the users of the water or sewer systems;
Page 4 of 5
CODING: Words stricken are deletions; words underlined are additions.
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
PCS for HB 1331 2023
101 owners, tenants, or occupants of property served or to be served
102 thereby; and all others interested shall have an opportunity to
103 be heard concerning the proposed rates, fees, and charges. Any
104 change or revision of such rates, fees, or charges may be made
105 in the same manner as such rates, fees, or charges were
106 originally established, but if such change or revision is to be
107 made substantially pro rata as to all classes of service, both
108 inside and outside the municipality, no hearing or notice shall
109 be required.
110 (2) Any municipality within the state operating a water or
111 sewer utility that provides service to consumers within the
112 boundaries of a separate municipality through the use of a water
113 treatment plant or sewer treatment plant located within the
114 boundaries of that separate municipality may charge consumers in
115 the separate municipality no more than the rates, fees, and
116 charges imposed on consumers inside its own municipal
117 boundaries.
118 Section 3. This act shall take effect July 1, 2024.
Page 5 of 5
CODING: Words stricken are deletions; words underlined are additions.
File and source
- File
- 2023-03-21_3226_energy-communications-cybersecurity-subcommittee_meeting-packets_fn-ecc-3-21-23.pdf
- Size
- 2,409,944 bytes
- SHA-256
- e00f5d90127a54606d9d7cc8016853af458f96b38a0d5874a320f3d69c0ac98a
- Our copy
- 2023-03-21_3226_energy-communications-cybersecurity-subcommittee_meeting-packets_fn-ecc-3-21-23.pdf
- Original
- No public link identified.