Energy, Communications & Cybersecurity Subcommittee Meeting Packet, January 25, 2024
Summary
A meeting packet for the Energy, Communications & Cybersecurity Subcommittee of the Commerce Committee of the Florida House of Representatives, for the meeting on Thursday, January 25, 2024. The agenda lists consideration of HB 1555 Cybersecurity, by Giallombardo, and HB 7047 OGSR/Utility Owned or Operated by a Unit of Local Government, followed by a cybersecurity update. The packet includes the House of Representatives staff analysis of HB 1555, which states that the bill revises the duties of the Florida Digital Service and requires state agencies to report all ransomware incidents to the Cybersecurity Operations Center. It closes with bill text for HB 7047, whose last section provides that the act takes effect October 1, 2024.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Energy, Communications & Cybersecurity Subcommittee Meeting Packet, January 25, 2024.”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2024-01-25-3226-energy-communications-cybersecurity-subcommittee-meeti-340f2e54cc/
, SHA-256 af47572886360c062b011a23407ca258a95fabef61941c4ffa62ef887bdac5cd.Full text
Energy, Communications &
Cybersecurity Subcommittee
Thursday, January 25, 2024
3:00 PM - 6:00 PM
Reed Hall (102 HOB)
Meeting Packet
Paul Renner Mike Giallombardo
Speaker Chair
The Florida House of Representatives
Commerce Committee
Energy, Communications & Cybersecurity Subcommittee
Paul Renner Mike Giallombardo
Speaker Chair
Meeting Agenda
Thursday, January 25, 2024
3:00 pm – 6:00 pm
Reed Hall (102 HOB)
I. Call to Order
II. Roll Call
III. Welcome and Opening Remarks
IV. Consideration of the following bill(s):
• HB 1555 Cybersecurity by Giallombardo
• HB 7047 OGSR/Utility Owned or Operated by a Unit of Local Government by
Ethics, Elections & Open Government Subcommittee, Porras
V. Cybersecurity Update
VI. Closing Remarks
VII. Adjournment
303 House Office Building, 402 South Monroe Street, Tallahassee, FL 32399-1300
(850) 717-4870
HB 1555
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: HB 1555 Cybersecurity
SPONSOR(S): Giallombardo
TIED BILLS: IDEN./SIM. BILLS: SB 1662
REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF
1) Energy, Communications & Cybersecurity Bauldree Keating
Subcommittee
2) State Administration & Technology
Appropriations Subcommittee
3) Commerce Committee
SUMMARY ANALYSIS
Over the last decade, cybersecurity has rapidly become a growing concern. Cyberattacks are growing in
frequency and severity. Currently, the Department of Management Services (DMS) oversees information
technology (IT) governance and security for the executive branch of state government. The Florida Digital
Service (FLDS) is housed within DMS and was established in 2020 to replace the Division of State
Technology. Through FLDS, DMS implements duties and policies for IT and cybersecurity for state agencies.
The bill:
• Revises the duties of FLDS;
• Provides definitions;
• Provides that the state chief information officer (CIO), in consultation with the Secretary of DMS, must
designate a state chief technology officer and specifies the position’s responsibilities;
• Requires FLDS to ensure independent project oversight on all state agency IT projects that have a total
project cost of $25 million or more (up from $10 million in current law);
• Provides that FLDS no longer must conduct annual assessments of state agencies to determine
compliance with IT standards and guidelines developed and published by DMS;
• Requires each state agency to designate a chief information security officer to integrate the agency’s
technical and operational cybersecurity efforts with Cybersecurity Operations Center (CSOC);
• Requires state agencies to report all ransomware incidents, regardless of severity level, to the CSOC
as soon as possible, but no later than 12 hours after a cybersecurity incident and no later than 6 hours
after the discovery of a ransomware incident;
• Requires local governments to report any cybersecurity incident determined to be level 3, 4, or 5 to the
CSOC rather than the Cybercrime Office and the sheriff who has jurisdiction over the local government;
• Requires CSOC to immediately notify the Cybercrime Office of the Florida Department of Law
Enforcement of a reported incident;
• Requires CSOC to immediately notify the state CIO and the state cyber security information officer of a
reported incident;
• Classifies certain IT security personnel as select exempt;
• Authorizes DMS to brief legislative committees on cybersecurity matters in a closed setting; and
• Requires that one of the three representatives on the Cybersecurity Advisory Council (CAC) from the
critical infrastructure sectors must be from a utility provider and requires that one of the members of the
CAC is a representative from a local government.
The bill does not have a fiscal impact on state or local government revenues or local government expenditures.
The bill may increase state expenditures. See Fiscal Analysis & Economic Impact Statement.
The bill provides an effective date of July 1, 2024.
This document does not reflect the intent or official position of the bill sponsor or House of Representatives.
STORAGE NAME: h1555.ECC
DATE: 1/24/2024
FULL ANALYSIS
I. SUBSTANTIVE ANALYSIS
A. EFFECT OF PROPOSED CHANGES:
Current Situation
Over the last decade, cybersecurity has rapidly become a growing concern. Cyberattacks are growing
in frequency and severity. Cybercrime was expected to inflict $8 trillion worth of damage globally in
2023. 1 The United States is often a target of cyberattacks, including attacks on critical infrastructure,
and has been a target of more significant cyberattacks 2 over the last 14 years than any other country. 3
The Colonial Pipeline is an example of critical infrastructure that was attacked, disrupting what is
arguably the nation’s most important fuel conduit. 4
Ransomware is a type of cybersecurity incident where malware 5 that is designed to encrypt files on a
device renders the files and the systems that rely on them unusable. In other words, critical information
is no longer accessible. During a ransomware attack, malicious actors demand a ransom in exchange
for regained access through decryption. If the ransom is not paid, the ransomware actors will often
threaten to sell or leak the data or authentication information. Even if the ransom is paid, there is no
guarantee that the bad actor will follow through with decryption.
In recent years, ransomware incidents have become increasingly prevalent among the nation’s state,
local, tribal, and territorial government entities and critical infrastructure organizations. 6 For example,
Tallahassee Memorial Hospital was hit by a ransomware attack early in 2023, and the hospital’s
systems were forced to shut down, impacting many local residents in need of medical care. 7 Likewise,
Tampa General Hospital detected a data breach in May of 2023, which may have compromised the
data of up to 1.2 million patients. 8
IT and Cybersecurity Management
The Department of Management Services (DMS) oversees information technology (IT) 9 governance
and security for the executive branch in Florida. 10 The Florida Digital Service (FLDS) is housed within
1 Cybercrime Magazine, Cybercrime to Cost the World $8 Trillion Annually in 2023, https://cybersecurityventures.com/cybercrime-to-
cost-the-world-8-trillion-annually-in-2023/ (last visited Jan. 23, 2024).
2 “Significant cyber-attacks” are defined as cyber-attacks on a country’s government agencies, defense, and high-tech companies, or
economic crimes with losses equating to more than a million dollars. FRA Conferences, Study: U.S. Largest Target for Significant
Cyber-Attacks, https://www.fraconferences.com/insights-articles/compliance/study-us-largest-target-for-significant-cyber-
attacks/#:~:text=The%20United%20States%20has%20been%20on%20the%20receiving,article%20is%20from%20FRA%27s%20sister
%20company%2C%20Compliance%20Week (last visited Jan. 23, 2024).
3 Id.
4S&P Global, Pipeline operators must start reporting cyberattacks to government: TSA orders,
https://www.spglobal.com/commodityinsights/en/market-insights/latest-news/electric-power/052721-pipeline-operators-must-start-
reporting-cyberattacks-to-government-tsa-
orders?utm_campaign=corporatepro&utm_medium=contentdigest&utm_source=esgmay2021 (last visited Jan. 23, 2024).
5 “Malware” means hardware, firmware, or software that is intentionally included or inserted in a system for a harmful purpose.
https://csrc.nist.gov/glossary/term/malware (last visited Jan. 23, 2024).
6 Cybersecurity and Infrastructure Agency, Ransomware 101, https://www.cisa.gov/stopransomware/ransomware-101 (last visited Jan.
23, 2024).
7 Tallahassee Democrat, TMH says it has taken ‘major step’ toward restoration after cybersecurity incident (Feb. 15, 2023)
https://www.tallahassee.com/story/news/local/2023/02/14/tmh-update-hospital-has-taken-major-step-toward-restoration/69904510007/
(last visited Jan. 23, 2023).
8 Alessandro Mascellino, Infosecurity Magazine, Tampa General Hospital Data Breach Impacts 1.2 Million Patients (Jul. 24, 2023),
https://www.infosecurity-magazine.com/news/tampa-hospital-data-breach/ (last visited Jan. 24, 2023).
9 The term “information technology” means equipment, hardware, software, firmware, programs, systems, networks, infrastructure,
media, and related material used to automatically, electronically, and wirelessly collect, receive, access, transmit, display, store, record,
retrieve, analyze, evaluate, process, classify, manipulate, manage, assimilate, control, communicate, exchange, convert, converge,
interface, switch, or disseminate information of any kind or form. S. 282.0041(19), F.S.
10 See s. 20.22, F.S.
STORAGE NAME: h1555.ECC PAGE: 2
DATE: 1/24/2024
DMS and was established in 2020 to replace the Division of State Technology. 11 FLDS works under
DMS to implement policies for IT and cybersecurity for state agencies. 12
The head of FLDS is appointed by the Secretary of Management Services 13 and serves as the state
chief information officer (CIO). 14 The CIO must have at least five years of experience in the
development of IT system strategic planning and IT policy and, preferably, have leadership-level
experience in the design, development, and deployment of interoperable software and data solutions. 15
FLDS must propose innovative solutions that securely modernize state government, including
technology and information services, to achieve value through digital transformation and
interoperability, and to fully support Florida’s cloud first policy. 16
DMS, through FLDS, has the following powers, duties, and functions:
• Develop IT policy for the management of the state’s IT resources;
• Develop an enterprise architecture;
• Establish project management and oversight standards with which state agencies must comply
when implementing IT projects;
• Perform project oversight on all state agency IT projects that have a total cost of $10 million or
more and that are funded in the General Appropriations Act or any other law; and
• Identify opportunities for standardization and consolidation of IT services that support
interoperability, Florida’s cloud first policy, and business functions and operations that are
common across state agencies. 17
State Cybersecurity Act
In 2021, the Legislature passed the State Cybersecurity Act, 18 which requires DMS and the heads of
the state agencies 19 to meet certain requirements to enhance the cybersecurity 20 of the state agencies.
DMS is tasked with completing the following, through FLDS:
• Establishing standards for assessing agency cybersecurity risks;
• Adopting rules to mitigate risk, support a security governance framework, and safeguard agency
digital assets, data, 21 information, and IT resources; 22
• Designating a chief information security officer (CISO);
• Developing and annually updating a statewide cybersecurity strategic plan to address matters
such as identification and mitigation of risk, protections against threats, and tactical risk
detection for cyber incidents; 23
• Developing and publishing for use by state agencies a cybersecurity governance framework;
• Assisting the state agencies in complying with the State Cybersecurity Act;
• Annually providing training on cybersecurity for managers and team members;
• Annually reviewing the strategic and operational cybersecurity plans of state agencies;
• Tracking the state agencies’ implementation of remediation plans;
11 Ch. 2020-161, L.O.F.
12 See s. 20.22(2)(b), F.S.
13 The Secretary of Management Services serves as the head of DMS and is appointed by the Governor, subject to confirmation by the
Senate. S. 20.22(1), F.S.
14 S. 282.0051(2)(a), F.S.
15 Id.
16 S. 282.0051(1), F.S.
17 Id.
18 Ch. 2012-234, L.O.F.
19 For purposes of the State Cybersecurity Act, the term “state agency” includes the Department of Legal Affairs, the Department of
Agriculture and Consumer Services, and the Department of Financial Services. S. 282.318(2), F.S.
20 “Cybersecurity” means the protection afforded to an automated information system in order to attain the applicable objectives of
preserving the confidentiality, integrity, and availability of data, information, and IT resources. S. 282.0041(8), F.S.
21 “Data” means a subset of structured information in a format that allows such information to be electronically retrieved and transmitted.
S. 282.0041(9), F.S.
22 “Information technology resources” means data processing hardware and software and services, communications, supplies,
personnel, facility resources, maintenance, and training. S. 282.0041(22), F.S.
23 “Incident” means a violation or imminent threat of violation, whether such violation is accidental or deliberate, of IT resources,
security, policies, or practices. An imminent threat of violation refers to a situation in which the state agency has a factual basis for
believing that a specific incident is about to occur. S. 282.0041(19), F.S.
STORAGE NAME: h1555.ECC PAGE: 3
DATE: 1/24/2024
• Providing cybersecurity training to all state agency technology professionals that develops,
assesses, and documents competencies by role and skill level;
• Maintaining a Cybersecurity Operations Center (CSOC) led by the CISO to serve as a
clearinghouse for threat information and coordinate with FDLE to support responses to
incidents; and
• Leading an Emergency Support Function under the state emergency management plan. 24
The State Cybersecurity Act requires the head of each state agency to designate an information
security manager to administer the state agency’s cybersecurity program. 25 The head of the agency
has additional tasks in protecting against cybersecurity threats as follows:
• Establish a cybersecurity incident response team with FLDS and the Cybercrime Office in FDLE,
which must immediately report all confirmed or suspected incidents to the CISO;
• Annually submit to DMS the state agency’s strategic and operational cybersecurity plans;
• Conduct and update a comprehensive risk assessment to determine the security threats;
• Develop and update written internal policies and procedures for reporting cyber incidents;
• Implement safeguards and risk assessment remediation plans to address identified risks;
• Ensure internal audits and evaluations of the agency’s cybersecurity program are conducted;
• Ensure that the cybersecurity requirements for the solicitation, contracts, and service-level
agreement of IT and IT resources meet or exceed applicable state and federal laws, regulations,
and standards for cybersecurity, including the National Institute of Standards and Technology
(NIST) 26 cybersecurity framework;
• Provide cybersecurity training to all agency employees within 30 days of employment; and
• Develop a process that is consistent with the rules and guidelines established by FLDS for
detecting, reporting, and responding to threats, breaches, or cybersecurity incidents. 27
Florida Cybersecurity Advisory Council
The Florida Cybersecurity Advisory Council 28 (CAC) within DMS 29 assists state agencies in protecting
IT resources from cyber threats and incidents. 30 The CAC must assist FLDS in implementing best
cybersecurity practices, taking into consideration the final recommendations of the Florida
Cybersecurity Task Force – a task force created to review and assess the state’s cybersecurity
infrastructure, governance, and operations. 31 The CAC meets at least quarterly to:
• Review existing state agency cybersecurity policies;
• Assess ongoing risks to state agency IT;
• Recommend a reporting and information sharing system to notify state agencies of new risks;
• Recommend data breach simulation exercises;
• Assist FLDS in developing cybersecurity best practice recommendations; and
• Examine inconsistencies between state and federal law regarding cybersecurity. 32
24 Ch. 2021-234, L.O.F.
25 S. 282.318(4)(a), F.S.
26 NIST, otherwise known as the National Institute of Standards and Technology, “is a non-regulatory government agency that develops
technology, metrics, and standards to drive innovation and economic competitiveness at U.S.-based organizations in the science and
technology industry.” Nate Lord, What is NIST Compliance, DataInsider (Dec. 1, 2020), https://www.digitalguardian.com/blog/what-nist-
compliance (last visited Jan. 23, 2024).
27 S. 282.318(4), F.S.
28 The CAC is comprised of: the Lieutenant Governor or his or her designee; the state CIO; the state chief information security officer;
the director of the Division of Emergency Management or his or her designee; a representative of the computer crime center of the
Department of Law Enforcement, appointed by the executive director of the Department of Law Enforcement; a representative of the
Florida Fusion Center of the Department of Law Enforcement, appointed by the executive director of the Department of Law
Enforcement; the Chief Inspector General; up to two representatives from institutions of higher education located in this state,
appointed by the Governor; three representatives from critical infrastructure sectors, one of whom must be from a water treatment
facility, appointed by the Governor; four representatives of the private sector with senior level experience in cybersecurity or software
engineering from within the finance, energy, health care, and transportation sectors, appointed by the Governor; and two
representatives with expertise on emerging technology, with one appointed by the President of the Senate and one appointed by the
Speaker of the House of Representatives. S, 282.319(3), F.S.
29 S. 282.319(1), F.S.
30 S. 282.319(2), F.S.
31 S. 282.319(3), F.S.
32 S. 282.319(9), F.S.
STORAGE NAME: h1555.ECC PAGE: 4
DATE: 1/24/2024
The CAC must work with NIST and other federal agencies, private sector businesses, and private
security experts to identify which local infrastructure sectors, not covered by federal law, are at the
greatest risk of cyber-attacks and to identify categories of critical infrastructure as critical cyber
infrastructure if cyber damage to the infrastructure could result in catastrophic consequences. 33
The CAC must also prepare and submit a comprehensive report to the Governor, the President of the
Senate, and the Speaker of the House of Representatives that includes data, trends, analysis, findings,
and recommendations for state and local action regarding ransomware incidents that includes:
• Descriptive statistics, including the amount of ransom requested, duration of the incident, and
overall monetary cost to taxpayers of the incident;
• A detailed statistical analysis of the circumstances that led to the ransomware incident which
does not include the name of the state agency or local government, network information, or
system identifying information;
• Statistical analysis of the level of cybersecurity employee training and frequency of data backup
for the state agencies or local governments that reported incidents;
• Specific issues identified with current policy, procedure, rule, or statute and recommendations to
address those issues; and
• Other recommendations to prevent ransomware incidents.
Cyber Incident Response
The National Cyber Incident Response Plan (NCIRP) was developed according to the direction of
Presidential Policy Directive-41, 34 by the U.S. Department of Homeland Security. The NCIRP is part of
the broader National Preparedness System and establishes the strategic framework for a whole-of-
Nation approach to mitigating, responding to, and recovering from cybersecurity incidents posing risk to
critical infrastructure. 35 The NCIRP was developed in coordination with federal, state, local, and private
sector entities and is designed to interface with industry best practice standards for cybersecurity,
including the NIST Cybersecurity Framework.
The NCIRP adopted a schema for describing the severity of cybersecurity incidents affecting the U.S.
The schema establishes a common framework to evaluate and assess cybersecurity incidents to
ensure that all departments and agencies have a common view of the severity of a given incident;
urgency required for responding to a given incident; seniority level necessary for coordinating response
efforts; and level of investment required for response efforts. 36
The severity level of a cybersecurity incident in accordance with the NCIRP is determined as follows:
• Level 5: An emergency-level incident within the specified jurisdiction if the incident poses an
imminent threat to the provision of wide-scale critical infrastructure services; national, state, or
local security; or the lives of the country’s, state’s, or local government’s citizens.
• Level 4: A severe-level incident if the incident is likely to result in a significant impact within the
affected jurisdiction which affects the public health or safety; national, state, or local security;
economic security; or individual civil liberties.
• Level 3: A high-level incident if the incident is likely to result in a demonstrable impact in the
affected jurisdiction to public health or safety; national, state, or local security; economic
security; civil liberties; or public confidence.
• Level 2: A medium-level incident if the incident may impact public health or safety; national,
state, or local security; economic security; civil liberties; or public confidence.
33 S. 282.319(10), F.S.
34 Annex for PPD-41: U.S. Cyber Incident Coordination, available at: https://obamawhitehouse.archives.gov/the-press-
office/2016/07/26/annex-presidential-policy-directive-united-states-cyber-incident (last visited Jan. 23, 2024).
35 Cybersecurity & Infrastructure Security Agency, Cybersecurity Incident Response, available at
https://www.cisa.gov/topics/cybersecurity-best-practices/organizations-and-cyber-safety/cybersecurity-incident-
response#:~:text=%20National%20Cyber%20Incident%20Response%20Plan%20%28NCIRP%29%20The,incidents%20and%20how%
20those%20activities%20all%20fit%20together (last visited Jan. 23, 2024).
36 Id.
STORAGE NAME: h1555.ECC PAGE: 5
DATE: 1/24/2024
• Level 1: A low-level incident if the incident is unlikely to impact public health or safety; national,
state, or local security; economic security; or public confidence. 37
State agencies and local governments in Florida, must report all ransomware incidents and any
cybersecurity incidents at severity levels 3, 4, and 5 as soon as possible to the CSOC, but no later than
48 hours after discovery of a cybersecurity incident and no later than 12 hours after discovery of a
ransomware incident. 38 CSOC must notify the President of the Senate and the Speaker of the House of
Representatives of any severity level 3, 4, or 5 incident as soon as possible, but no later than 12 hours
after receiving the incident report from the state agency or local government. 39 For state agency
incidents at severity levels 1 and 2, the agency or local government must report these incidents to
CSOC and the Cybercrime Office at FDLE as soon as possible. 40
The notification must include a high-level description of the incident and the likely effects. An incident
report for a cybersecurity or ransomware incident by a state agency or local government must include,
at a minimum:
• A summary of the facts surrounding the cybersecurity or ransomware incident;
• The date on which the state agency or local government most recently backed up its data, the
physical location of the backup, if the backup was affected, and if the backup was created
using cloud computing;
• The types of data compromised by the cybersecurity or ransomware incident;
• The estimated fiscal impact of the cybersecurity or ransomware incident;
• In the case of a ransomware incident, the details of the ransom demanded; and
• If the reporting entity is a local government, a statement requesting or declining assistance
from CSOC, FDLE Cybercrime Office, or sheriff. 41
In addition, CSOC must provide consolidated incident reports to the President of the Senate, Speaker
of the House of Representatives, and the CAC on a quarterly basis. 42 The consolidated incident reports
to the CAC may not contain any state agency or local government name, network information, or
system identifying information, but must contain sufficient relevant information to allow the CAC to fulfill
its responsibilities. 43
State agencies and local governments must submit an after-action report to FLDS within one week of
the remediation of a cybersecurity or ransomware incident. 44 The report must summarize the incident,
state the resolution, and any insights from the incident.
Effect of the Bill
Definitions
The bill provides the following definitions:
• "As a service" means the contracting with or outsourcing to a third party of a defined role or
function as a means of delivery.
• "Cloud provider" means an entity that provides cloud-computing services.
The bill also defines “enterprise digital data” as information held by a state agency in electronic form
that is deemed to be data owned by the state and held for state purposes by the state agency. The bill
provides that enterprise digital data that is subject to statutory requirements for particular types of
sensitive data or to contractual limitations for data marked as trade secrets or sensitive corporate data
held by state agencies shall be treated in accordance with such requirements or limitations. Under the
37 S. 282.318(3)(c)9.a, F.S.
38 S. 282.318(3)(c)9.c, F.S.
39 S. 282.318(3)(c)9.c.(II), F.S.
40 S. 282.318(3)(c)(9)(d), F.S.
41 S. 282.318(3)(c)9.b, F.S.
42 S. 282.318(3)(c)9.e, F.S.
43 Id.
44 S. 282.318(4)(k), F.S.
STORAGE NAME: h1555.ECC PAGE: 6
DATE: 1/24/2024
bill, DMS must maintain personnel with appropriate licenses, certifications, or classifications to steward
such enterprise digital data, as necessary.
DMS and FLDS Duties
The bill revises the duties of FLDS to include:
• Leading enterprise IT and cybersecurity efforts.
• Safeguarding enterprise digital data.
• Testing, developing, and deploying innovative solutions that securely modernize state
government.
The bill provides that the state CIO, in consultation with the Secretary of DMS, must designate a state
chief technology officer who is responsible for the following:
• Establishing and maintaining an enterprise architecture framework that ensures IT investments
align with the state’s strategic objectives and initiatives.
• Conducting comprehensive evaluations of potential technological solutions and cultivating
strategic partnerships, internally with state enterprise agencies and externally with the private
sector, to leverage collective expertise, foster collaboration, and advance the state’s
technological capabilities.
• Supervising program management of certain enterprise IT initiatives; providing advisory support
and oversight for technology-related projects; and continuously identifying and recommending
best practices to optimize outcomes of technology projects and enhance the enterprise’s
technological efficiency and effectiveness.
Under the bill, all confirmed or suspected incidents or threats to state IT resources must be reported by
the state CIO, in consultation with the state CISO, to the Governor.
The bill provides that chief information security officers, information security managers, and personnel
employed by or reporting to the state CIO, the state chief data officer, or an agency information security
manager are designated as Selected Exempt Service and that the salary and benefits for these
positions will be set accordingly. 45 The bill provides that DMS shall set the salary and benefits of the
state chief technology officer in accordance with the rules of the Senior Management Service. 46
The bill requires FLDS to ensure project oversight independent of the state agency on all state agency
IT projects that have a total project cost of $25 million or more (up from $10 million per current law),
and that the projects are performed in compliance with applicable state and federal law. The bill
provides that when FLDS ensures performance of its project oversight function for the Department of
Financial Services, the Department of Legal Affairs, or the Department of Agriculture and Consumer
Services, FLDS must report within 30 days after the end of each quarter on any IT projects that FLDS
identifies as high-risk.
Under the bill, FLDS no longer must conduct annual assessments of state agencies to determine
compliance with all IT standards and guidelines developed and published by DMS. The bill removes a
prohibition on FLDS retrieving or disclosing any data without a shared data agreement in place
between DMS and the enterprise entity that has primary custodial responsibility of, or data sharing
responsibility for, that data. The bill gives FLDS the authority to obtain immediate access to public or
private infrastructure hosting enterprise digital data and to direct, in consultation with the state agency
that holds the particular data, measures to assess, monitor, and safeguard such data.
The bill provides that DMS may brief any legislative committee or subcommittee responsible for
cybersecurity policy in a meeting or other setting closed by the respective body. Such legislative
committee or subcommittee must maintain the confidential and exempt status of records made
45 The Selected Exempt Service is a separate system of personnel administration for specified positions in state government. S.
110.602, F.S.
46 The Senior Management Service is created as a separate system of personnel administration for positions in the executive branch
the duties and responsibilities of which are primarily and essentially policymaking or managerial in nature. S. 110.402(1), F.S.
STORAGE NAME: h1555.ECC PAGE: 7
DATE: 1/24/2024
confidential and exempt under current law. The bill states that a legislator serving on such legislative
committee or subcommittee may also attend meetings of the Florida Cybersecurity Advisory Council.
Cybersecurity Operations Center Duties (CSOC)
The bill creates a new reporting requirement for CSOC. Under the bill, CSOC must immediately notify
the Cybercrime Office of FDLE of a reported incident and provide regular reports on the status of the
incident, preserve forensic data to support the subsequent investigation, and provide aid to the
investigative efforts of the Cybercrime Office, upon request, if the state CISO finds that the investigation
does not impede remediation of the incident and that there is no risk to the public and no risk to critical
state functions.
Under the bill, the CSOC must also immediately notify the state CIO and the state CISO of a reported
incident. The bill requires that the state CISO notify the President of the Senate and the Speaker of the
House of Representatives within 24 hours after receiving report of the incident and the notification must
be provided in a secure environment. The bill requires that within 30 days after the end of each quarter,
CSOC must provide a consolidated incident report to the Governor, Attorney General, the executive
director of the Department of Law Enforcement, President of the Senate, Speaker of the House of
Representatives, and the CAC.
State Agency Duties
The bill requires state agencies to report all ransomware incidents, regardless of severity level, to
CSOC as soon as possible, but no later than 12 hours after a cybersecurity incident and no later than 6
hours after the discovery of a ransomware incident.
The bill requires each state agency to designate a chief information security officer to integrate the
agency’s technical and operational cybersecurity efforts with CSOC. The bill requires that each agency
shall provide this designation to the FLDS annually in writing. Each agency’s designated chief
information security officer is under the supervision of the given agency’s department head for
administrative purposes but must report to the state CISO. An agency may request that DMS procure a
chief information security officer as a service to fulfill the agency’s duty to designate one. Under the bill,
each agency’s information security manager must coordinate with the agency’s chief information
security officer and CSOC and ensure compliance with cybersecurity governance and with the state’s
enterprise security program and incident response plan.
Florida Cybersecurity Advisory Council (CAC)
The bill requires that one of the three representatives on the CAC from the critical infrastructure sectors
must be from a utility provider. The bill removes the requirement that one CAC member must be from a
water treatment facility. The bill also adds a requirement that one of the members of the CAC is a
representative from a local government.
Local Government Duties
The bill removes the requirement that a local government must report any cybersecurity incident
determined to be level 3, 4, or 5 to the Cybercrime Office of FDLE and the sheriff who has jurisdiction
over the local government. The bill requires a local government to report a cybersecurity incident to
CSOC within 12 hours of discovery and to report a ransomware incident within 6 hours after discovery.
Under the bill, after CSOC receives a report of a cybersecurity or ransomware incident, CSOC must
immediately notify the Cybercrime Office of FDLE and the sheriff who has jurisdiction over the local
government. CSOC must provide these entities with regular reports on the status of the incident,
preserve forensic data to support a subsequent investigation, and provide aid to the investigative efforts
of the Cybercrime Office upon the office’s request if the state CISO finds that the investigation does not
impede remediation of the incident and that there is no risk to the public and no risk to critical state
functions. The bill also requires that CSOC immediately notify the state CISO of the reported incident.
STORAGE NAME: h1555.ECC PAGE: 8
DATE: 1/24/2024
The state CISO shall notify the President of the Senate and the Speaker of the House of
Representatives no later than 24 hours after receiving report of the incident and must do so in a secure
environment.
Under the bill, if CSOC receives a report from a local government of a level 1 or 2 cybersecurity
incident, CSOC must immediately notify the Cybercrime Office and the sheriff who has jurisdiction over
the local government, and CSOC shall provide regular reports on the status of the incident, preserve
forensic data to support a subsequent investigation, and provide aid to the investigative efforts of the
Cybercrime Office upon the office’s request if the state CISO finds that the investigation does not
impede remediation of the incident and that there is no risk to the public and no risk to critical state
functions.
The bill provides an effective date of July 1, 2024.
B. SECTION DIRECTORY:
Section 1: Amends s. 110.205, F.S., relating to career service; exemptions.
Section 2: Amends s. 282.0041, F.S., relating to definitions.
Section 3: Amends s. 282.0051, F.S., relating to Department of Management Services; Florida Digital
Service; power, duties, and functions.
Section 4: Amends s. 282.00515, F.S., relating to duties of cabinet agencies.
Section 5: Amends s. 282.318, F.S., relating to cybersecurity.
Section 6: Amends s. 282.3185, F.S., relating to local government cybersecurity.
Section 7: Amends s. 282.319, F.S., relating to Florida Cybersecurity Advisory Council.
Section 8: Provides an effective date.
II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT
A. FISCAL IMPACT ON STATE GOVERNMENT:
1. Revenues:
None.
2. Expenditures:
Indeterminate. The bill may increase state expenditures because it elevates state agency CISO’s,
information security managers and other related personnel to Selected Exempt Service status and
requires each state agency to designate a chief information security officer.
B. FISCAL IMPACT ON LOCAL GOVERNMENTS:
1. Revenues:
None.
2. Expenditures:
None.
C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
STORAGE NAME: h1555.ECC PAGE: 9
DATE: 1/24/2024
None.
D. FISCAL COMMENTS:
None.
III. COMMENTS
A. CONSTITUTIONAL ISSUES:
1. Applicability of Municipality/County Mandates Provision:
Not Applicable. This bill does not appear to require counties or municipalities to spend funds or take
action requiring the expenditures of funds; reduce the authority that counties or municipalities have
to raise revenues in the aggregate; or reduce the percentage of state tax shared with counties or
municipalities.
2. Other:
None.
B. RULE-MAKING AUTHORITY:
The bill does not require or authorize rulemaking.
C. DRAFTING ISSUES OR OTHER COMMENTS:
None.
IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES
Not applicable.
STORAGE NAME: h1555.ECC PAGE: 10
DATE: 1/24/2024
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
1 A bill to be entitled
2 An act relating to cybersecurity; amending s. 110.205,
3 F.S.; exempting certain personnel from the career
4 service; providing for the establishment of salary and
5 benefits for certain positions; amending s. 282.0041,
6 F.S.; providing definitions; amending s. 282.0051,
7 F.S.; revising the purposes for which the Florida
8 Digital Service is established; requiring the Florida
9 Digital Service to ensure that independent project
10 oversight on certain state agency information
11 technology projects is performed in a certain manner;
12 revising the date by which the Department of
13 Management Services, acting through the Florida
14 Digital Service, must provide certain recommendations
15 to the Executive Office of the Governor and the
16 Legislature; removing certain duties of the Florida
17 Digital Service; revising the total project cost of
18 certain projects for which the Florida Digital Service
19 must provide project oversight; specifying the date by
20 which the Florida Digital Service must provide certain
21 reports; requiring the state chief information
22 officer, in consultation with the Secretary of
23 Management Services, to designate a state chief
24 technology officer; providing duties of the state
25 chief technology officer; revising the total project
Page 1 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
26 cost of certain projects for which certain procurem ent
27 actions must be taken; removing provisions prohibiting
28 the department, acting through the Florida Digital
29 Service, from retrieving or disclosing certain data in
30 certain circumstances; amending s. 282.00515, F.S.;
31 conforming a cross-reference; amending s. 282.318,
32 F.S.; providing that the Florida Digital Service is
33 the lead entity for a certain purpose; requiring the
34 Cybersecurity Operations Center to provide certain
35 notifications; requiring the state chief information
36 officer to make certain reports in consultation with
37 the state chief information security officer;
38 requiring a state agency to report ransomware and
39 cybersecurity incidents within certain time periods;
40 requiring the Cybersecurity Operations Center to
41 immediately notify certain entities of reported
42 incidents and take certain actions; requiring the
43 state chief information security officer to notify the
44 Legislature of certain incidents within a certain
45 period; requiring certain notification to be provided
46 in a secure environment; requiring the Cybersecurity
47 Operations Center to provide a certain report to
48 certain entities by a specified date; requiring the
49 Florida Digital Service to provide cybersecurity
50 briefings to certain legislative committees;
Page 2 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
51 authorizing the Florida Digital Service to obtain
52 certain access to certain infrastructure and direct
53 certain measures; requiring a state agency head to
54 annually designate a chief information security
55 officer by a specified date; revising the purpose of
56 an agency's information security manager and the date
57 by which he or she must be designated; authorizing the
58 department to brief certain legislative committees in
59 a closed setting on certain records that are
60 confidential and exempt from public records
61 requirements; requiring such legislative committees t o
62 maintain the confidential and exempt status of certain
63 records; authorizing certain legislators to attend
64 meetings of the Florida Cybersecurity Advisory
65 Council; amending s. 282.3185, F.S.; requiring a local
66 government to report ransomware and certain
67 cybersecurity incidents to the Cybersecurity
68 Operations Center within certain time periods;
69 requiring the Cybersecurity Operations Center to
70 immediately notify certain entities of certain
71 incidents and take certain actions; requiring certain
72 notification to be provided in a secure environment;
73 amending s. 282.319, F.S.; revising the membership of
74 the Florida Cybersecurity Advisory Council; providing
75 an effective date.
Page 3 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
76
77 Be It Enacted by the Legislature of the State of Florida:
78
79 Section 1. Paragraph (e) of subsection (2) of section
80 110.205, Florida Statutes, is amended, and paragraph (y) is
81 added to subsection (2) of that section, to read:
82 110.205 Career service; exemptions.—
83 (2) EXEMPT POSITIONS.—The exempt positions that are not
84 covered by this part include the following:
85 (e) The state chief information officer, the state chief
86 data officer, the state chief technology officer, and the state
87 chief information security officer. The Department of Management
88 Services shall set the salary and benefits of these positions in
89 accordance with the rules of the Senior Management Service.
90 (y) Chief information security officers, information
91 security managers designated pursuant to s. 282.318(4), and
92 personnel employed by or reporting to the state chief
93 information security officer, the state chief data officer, or
94 an agency information security manager. Unless otherwise fixed
95 by law, the department shall establish the salary and benefits
96 for these positions in accordance with the rules of the Selected
97 Exempt Service, except that the salary and benefits for the
98 agency information security manager shall be established by the
99 department in accordance with the rules of the Senior Management
100 Service.
Page 4 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
101 Section 2. Subsections (3) through (5), (6) through (16),
102 and (17) through (38) of section 282.0041, Florida Statutes, are
103 renumbered as subsections (4) through (6), (8) through (18), and
104 (20) through (41), respectively, and new subsections (3), (7),
105 and (19) are added to that section to read:
106 282.0041 Definitions.—As used in this chapter, the term:
107 (3) "As a service" means the contracting with or
108 outsourcing to a third party of a defined role or function as a
109 means of delivery.
110 (7) "Cloud provider" means an entity that provides cloud-
111 computing services.
112 (19) "Enterprise digital data" means information held by a
113 state agency in electronic form that is deemed to be data owned
114 by the state and held for state purposes by the state agency.
115 Enterprise digital data that is subject to statutory
116 requirements for particular types of sensitive data or to
117 contractual limitations for data marked as trade secrets or
118 sensitive corporate data held by state agencies shall be treated
119 in accordance with such requirements or limitations. The
120 department must maintain personnel with appropriate licenses,
121 certifications, or classifications to steward such enterprise
122 digital data, as necessary. Enterprise digital data must be
123 maintained in accordance with chapter 119. This subsection may
124 not be construed to create or expand an exemption from public
125 records requirements under s. 119.07(1) or s. 24(a), Art. I of
Page 5 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
126 the State Constitution.
127 Section 3. Subsection (6) of section 282.0051, Florida
128 Statutes, is renumbered as subsection (5), subsections (1) and
129 (4) and present subsection (5) are amended, and paragraph (c) is
130 added to subsection (2) of that section, to read:
131 282.0051 Department of Management Services; Florida
132 Digital Service; powers, duties, and functions.—
133 (1) The Florida Digital Service is established has been
134 created within the department to lead enterprise information
135 technology and cybersecurity efforts, to safeguard enterprise
136 digital data, to propose, test, develop, and deploy innovative
137 solutions that securely modernize state government, including
138 technology and information services, to achieve value through
139 digital transformation and interoperability, and to fully
140 support the cloud-first policy as specified in s. 282.206. The
141 department, through the Florida Digital Service, shall have the
142 following powers, duties, and functions:
143 (a) Develop and publish information technology policy for
144 the management of the state's information technology resources.
145 (b) Develop an enterprise architecture that:
146 1. Acknowledges the unique needs of the entities within
147 the enterprise in the development and publication of standards
148 and terminologies to facilitate digital interoperability;
149 2. Supports the cloud-first policy as specified in s.
150 282.206; and
Page 6 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
151 3. Addresses how information technology infrastructure may
152 be modernized to achieve cloud-first objectives.
153 (c) Establish project management and oversight standards
154 with which state agencies must comply when implementing
155 information technology projects. The department, acting through
156 the Florida Digital Service, shall provide training
157 opportunities to state agencies to assist in the adoption of the
158 project management and oversight standards. To support data-
159 driven decisionmaking, the standards must include, but are not
160 limited to:
161 1. Performance measurements and metrics that objec tively
162 reflect the status of an information technology project based on
163 a defined and documented project scope, cost, and schedule.
164 2. Methodologies for calculating acceptable variances in
165 the projected versus actual scope, schedule, or cost of an
166 information technology project.
167 3. Reporting requirements, including requirements designed
168 to alert all defined stakeholders that an information technology
169 project has exceeded acceptable variances defined and documented
170 in a project plan.
171 4. Content, format, and frequency of project updates.
172 5. Technical standards to ensure an information technology
173 project complies with the enterprise architecture.
174 (d) Ensure that independent Perform project oversight on
175 all state agency information technology projects that have total
Page 7 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
176 project costs of $25 $10 million or more and that are funded in
177 the General Appropriations Act or any other law is performed in
178 compliance with applicable state and federal law. The
179 department, acting through the Florida Digital Service, sh all
180 report at least quarterly to the Executive Office of the
181 Governor, the President of the Senate, and the Speaker of the
182 House of Representatives on any information technology project
183 that the department identifies as high-risk due to the project
184 exceeding acceptable variance ranges defined and documented in a
185 project plan. The report must include a risk assessment,
186 including fiscal risks, associated with proceeding to the next
187 stage of the project, and a recommendation for corrective
188 actions required, including suspension or termination of the
189 project.
190 (e) Identify opportunities for standardization and
191 consolidation of information technology services that support
192 interoperability and the cloud-first policy, as specified in s.
193 282.206, and business functions and operations, including
194 administrative functions such as purchasing, accounting and
195 reporting, cash management, and personnel, and that are common
196 across state agencies. The department, acting through the
197 Florida Digital Service, shall biennially on January 15 1 of
198 each even-numbered year provide recommendations for
199 standardization and consolidation to the Executive Office of the
200 Governor, the President of the Senate, and the Speaker of the
Page 8 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
201 House of Representatives.
202 (f) Establish best practices for the procurement of
203 information technology products and cloud-computing services in
204 order to reduce costs, increase the quality of data center
205 services, or improve government services.
206 (g) Develop standards for information technology reports
207 and updates, including, but not limited to, operational work
208 plans, project spend plans, and project status reports, for use
209 by state agencies.
210 (h) Upon request, assist state agencies in the development
211 of information technology-related legislative budget requests.
212 (i) Conduct annual assessments of state agencies to
213 determine compliance with all information technology standards
214 and guidelines developed and published by the department and
215 provide results of the assessments to the Executive Office of
216 the Governor, the President of the Senate, and the Speaker of
217 the House of Representatives.
218 (i)(j) Conduct a market analysis not less frequently than
219 every 3 years beginning in 2021 to determine whether the
220 information technology resources within the enterprise are
221 utilized in the most cost-effective and cost-efficient manner,
222 while recognizing that the replacement of certain legacy
223 information technology systems within the enterprise may be cost
224 prohibitive or cost inefficient due to the remaining useful life
225 of those resources; whether the enterprise is complying with the
Page 9 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
226 cloud-first policy specified in s. 282.206; and whether the
227 enterprise is utilizing best practices with respect to
228 information technology, information services, and the
229 acquisition of emerging technologies and information services.
230 Each market analysis shall be used to prepare a strategic plan
231 for continued and future information technology and information
232 services for the enterprise, including, but not limited to,
233 proposed acquisition of new services or technologies and
234 approaches to the implementation of any new services or
235 technologies. Copies of each market analysis and accompanying
236 strategic plan must be submitted to the Executive Office of the
237 Governor, the President of the Senate, and the Speaker of the
238 House of Representatives not later than December 31 of each year
239 that a market analysis is conducted.
240 (j)(k) Recommend other information technology services
241 that should be designed, delivered, and managed as enterprise
242 information technology services. Recommendations must include
243 the identification of existing information technology resources
244 associated with the services, if existing services must be
245 transferred as a result of being delivered and managed as
246 enterprise information technology services.
247 (k)(l) In consultation with state agencies, propose a
248 methodology and approach for identifying and collecting both
249 current and planned information technology expenditure data at
250 the state agency level.
Page 10 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
251 (l)(m)1. Notwithstanding any other law, provide project
252 oversight on any information technology project of the
253 Department of Financial Services, the Department of Legal
254 Affairs, and the Department of Agriculture and Consumer Services
255 which has a total project cost of $25 $20 million or more. Such
256 information technology projects must also comply with the
257 applicable information technology architecture, project
258 management and oversight, and reporting standards established by
259 the department, acting through the Florida Digital Service.
260 2. When ensuring performance of performing the project
261 oversight function specified in subparagraph 1., report by the
262 30th day after the end of each quarter at least quarterly to the
263 Executive Office of the Governor, the President of the Senate,
264 and the Speaker of the House of Representatives on any
265 information technology project that the department, acting
266 through the Florida Digital Service, identifies as high -risk due
267 to the project exceeding acceptable variance ranges defined and
268 documented in the project plan. The report shall include a risk
269 assessment, including fiscal risks, associated with proceeding
270 to the next stage of the project and a recommendation for
271 corrective actions required, including suspension or termination
272 of the project.
273 (m)(n) If an information technology project implemented by
274 a state agency must be connected to or otherwise accommodated by
275 an information technology system administered by the Department
Page 11 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
276 of Financial Services, the Department of Legal Affairs, or the
277 Department of Agriculture and Consumer Services, consult with
278 these departments regarding the risks and other effects of such
279 projects on their information technology systems and work
280 cooperatively with these departments regarding the connections,
281 interfaces, timing, or accommodations required to implement such
282 projects.
283 (n)(o) If adherence to standards or policies adopted by or
284 established pursuant to this section causes conflict with
285 federal regulations or requirements imposed on an entity within
286 the enterprise and results in adverse action against an entity
287 or federal funding, work with the entity to provide alternative
288 standards, policies, or requirements that do not conflict with
289 the federal regulation or requirement. The department, acting
290 through the Florida Digital Service, shall annually by January
291 15 report such alternative standards to the Executive Office of
292 the Governor, the President of the Senate, and the Speaker of
293 the House of Representatives.
294 (o)(p)1. Establish an information technology policy for
295 all information technology-related state contracts, including
296 state term contracts for information technology commodities,
297 consultant services, and staff augmentation services. The
298 information technology policy must include:
299 a. Identification of the information technology produc t
300 and service categories to be included in state term contracts.
Page 12 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
301 b. Requirements to be included in solicitations for state
302 term contracts.
303 c. Evaluation criteria for the award of information
304 technology-related state term contracts.
305 d. The term of each information technology-related state
306 term contract.
307 e. The maximum number of vendors authorized on each state
308 term contract.
309 f. At a minimum, a requirement that any contract for
310 information technology commodities or services meet the National
311 Institute of Standards and Technology Cybersecurity Framework.
312 g. For an information technology project wherein project
313 oversight is required pursuant to paragraph (d) or paragraph (l)
314 (m), a requirement that independent verification and validation
315 be employed throughout the project life cycle with the primary
316 objective of independent verification and validation being to
317 provide an objective assessment of products and processes
318 throughout the project life cycle. An entity providing
319 independent verification and validation may not have technical,
320 managerial, or financial interest in the project and may not
321 have responsibility for, or participate in, any other aspect of
322 the project.
323 2. Evaluate vendor responses for information technology -
324 related state term contract solicitations and invitations to
325 negotiate.
Page 13 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
326 3. Answer vendor questions on information technology -
327 related state term contract solicitations.
328 4. Ensure that the information technology policy
329 established pursuant to subparagraph 1. is included in all
330 solicitations and contracts that are administratively executed
331 by the department.
332 (p)(q) Recommend potential methods for standardizing data
333 across state agencies which will promote interoperability and
334 reduce the collection of duplicative data.
335 (q)(r) Recommend open data technical standards and
336 terminologies for use by the enterprise.
337 (r)(s) Ensure that enterprise information technology
338 solutions are capable of utilizing an electronic credential and
339 comply with the enterprise architecture standards.
340 (2)
341 (c) The state chief information officer, in consultation
342 with the Secretary of Management Services, shall designate a
343 state chief technology officer who shall be responsible for all
344 of the following:
345 1. Establishing and maintaining an enterprise architecture
346 framework that ensures information technology investments align
347 with the state's strategic objectives and initiatives pursuant
348 to paragraph (1)(b).
349 2. Conducting comprehensive evaluations of potential
350 technological solutions and cultivating strategic partnerships,
Page 14 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
351 internally with state enterprise agencies and externally with
352 the private sector, to leverage collective expertise, foster
353 collaboration, and advance the state's technological
354 capabilities.
355 3. Supervising program management of enterprise
356 information technology initiatives pursuant to paragraphs
357 (1)(c), (d), and (l); providing advisory support and oversight
358 for technology-related projects; and continuously identifying
359 and recommending best practices to optimize outcomes of
360 technology projects and enhance the enterprise's technological
361 efficiency and effectiveness.
362 (4) For information technology projects that have a total
363 project cost of $25 $10 million or more:
364 (a) State agencies must provide the Florida Digital
365 Service with written notice of any planned procurement of an
366 information technology project.
367 (b) The Florida Digital Service must participate in the
368 development of specifications and recommend modifications to any
369 planned procurement of an information technology project by
370 state agencies so that the procurement complies with the
371 enterprise architecture.
372 (c) The Florida Digital Service must participate in post-
373 award contract monitoring.
374 (5) The department, acting through the Florida Digital
375 Service, may not retrieve or disclose any data without a shared-
Page 15 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
376 data agreement in place between the department and the
377 enterprise entity that has primary custodial responsibility of,
378 or data-sharing responsibility for, that data.
379 Section 4. Subsection (1) of section 282.00515, Florida
380 Statutes, is amended to read:
381 282.00515 Duties of Cabinet agencies.—
382 (1) The Department of Legal Affairs, the Department of
383 Financial Services, and the Department of Agriculture and
384 Consumer Services shall adopt the standards established in s.
385 282.0051(1)(b), (c), and (q) (r) and (3)(e) or adopt alternative
386 standards based on best practices and industry standards that
387 allow for open data interoperability.
388 Section 5. Paragraphs (a) through (k) of subsection (4) of
389 section 282.318, Florida Statutes, are redesignated as
390 paragraphs (b) through (l), respectively, subsection (10) is
391 renumbered as subsection (11), subsection (3) and present
392 paragraph (a) of subsection (4) are amended, a new paragraph (a)
393 is added to subsection (4), and a new subsection (10) is added
394 to that section, to read:
395 282.318 Cybersecurity.—
396 (3) The department, acting through the Florida Digital
397 Service, is the lead entity responsible for leading enterprise
398 information technology and cybersecurity efforts, safeguarding
399 enterprise digital data, establishing standards and processes
400 for assessing state agency cybersecurity risks, and determining
Page 16 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
401 appropriate security measures. Such standards and processes must
402 be consistent with generally accepted technology best practices,
403 including the National Institute for Standards and Technology
404 Cybersecurity Framework, for cybersecurity. The department,
405 acting through the Florida Digital Service, shall adopt rules
406 that mitigate risks; safeguard state agency digital assets,
407 data, information, and information technology resources to
408 ensure availability, confidentiality, and integrity; and support
409 a security governance framework. The department, acting through
410 the Florida Digital Service, shall also:
411 (a) Designate an employee of the Florida Digital Service
412 as the state chief information security officer. The state chief
413 information security officer must have experience and expertise
414 in security and risk management for communications and
415 information technology resources. The state chief information
416 security officer is responsible for the development, operation,
417 and oversight of cybersecurity for state technology systems. The
418 Cybersecurity Operations Center shall immediately notify the
419 state chief information officer and the state chief information
420 security officer shall be notified of all confirmed or suspected
421 incidents or threats of state agency information technology
422 resources. The state chief information officer, in consultation
423 with the state chief information security officer, and must
424 report such incidents or threats to the state chief information
425 officer and the Governor.
Page 17 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
426 (b) Develop, and annually update by February 1, a
427 statewide cybersecurity strategic plan that includes security
428 goals and objectives for cybersecurity, including the
429 identification and mitigation of risk, proactive protections
430 against threats, tactical risk detection, threat reporting, and
431 response and recovery protocols for a cyber incident.
432 (c) Develop and publish for use by state agencies a
433 cybersecurity governance framework that, at a minimum, includes
434 guidelines and processes for:
435 1. Establishing asset management procedures to ensure that
436 an agency's information technology resources are identified and
437 managed consistent with their relative importance to the
438 agency's business objectives.
439 2. Using a standard risk assessment methodology that
440 includes the identification of an agency's priorities,
441 constraints, risk tolerances, and assumptions necessary to
442 support operational risk decisions.
443 3. Completing comprehensive risk assessments and
444 cybersecurity audits, which may be completed by a private sector
445 vendor, and submitting completed assessments and audits to the
446 department.
447 4. Identifying protection procedures to manage the
448 protection of an agency's information, data, and information
449 technology resources.
450 5. Establishing procedures for accessing information and
Page 18 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
451 data to ensure the confidentiality, integrity, and availability
452 of such information and data.
453 6. Detecting threats through proactive monitoring of
454 events, continuous security monitoring, and defined detection
455 processes.
456 7. Establishing agency cybersecurity incident response
457 teams and describing their responsibilities for responding to
458 cybersecurity incidents, including breaches of personal
459 information containing confidential or exempt data.
460 8. Recovering information and data in response to a
461 cybersecurity incident. The recovery may include recommended
462 improvements to the agency processes, policies, or guidelines.
463 9. Establishing a cybersecurity incident reporting process
464 that includes procedures for notifying the department and the
465 Department of Law Enforcement of cybersecurity incidents.
466 a. The level of severity of the cybersecurity incident is
467 defined by the National Cyber Incident Response Plan of the
468 United States Department of Homeland Security as follows:
469 (I) Level 5 is an emergency-level incident within the
470 specified jurisdiction that poses an imminent threat to the
471 provision of wide-scale critical infrastructure services;
472 national, state, or local government security; or the lives of
473 the country's, state's, or local government's residents.
474 (II) Level 4 is a severe-level incident that is likely to
475 result in a significant impact in the affected jurisdiction to
Page 19 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
476 public health or safety; national, state, or local security;
477 economic security; or civil liberties.
478 (III) Level 3 is a high-level incident that is likely to
479 result in a demonstrable impact in the affected jurisdiction to
480 public health or safety; national, state, or local security;
481 economic security; civil liberties; or public confidence.
482 (IV) Level 2 is a medium-level incident that may impact
483 public health or safety; national, state, or local security;
484 economic security; civil liberties; or public confidence.
485 (V) Level 1 is a low-level incident that is unlikely to
486 impact public health or safety; national, state, or local
487 security; economic security; civil liberties; or public
488 confidence.
489 b. The cybersecurity incident reporting process must
490 specify the information that must be reported by a state agency
491 following a cybersecurity incident or ransomware incident,
492 which, at a minimum, must include the following:
493 (I) A summary of the facts surrounding the cybersecurity
494 incident or ransomware incident.
495 (II) The date on which the state agency most recently
496 backed up its data; the physical location of the backup, if the
497 backup was affected; and if the backup was created using cloud
498 computing.
499 (III) The types of data compromised by the cybersecurity
500 incident or ransomware incident.
Page 20 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
501 (IV) The estimated fiscal impact of the cybersecurity
502 incident or ransomware incident.
503 (V) In the case of a ransomware incident, the details of
504 the ransom demanded.
505 c.(I) A state agency shall report all ransomware incidents
506 and any cybersecurity incidents incident determined by the state
507 agency to be of severity level 3, 4, or 5 to the Cybersecurity
508 Operations Center and the Cybercrime Office of the Department of
509 Law Enforcement as soon as possible but no later than 12 48
510 hours after discovery of the cybersecurity incident and no later
511 than 6 12 hours after discovery of the ransomware incident. The
512 report must contain the information required in sub -subparagraph
513 b.
514 (II) The Cybersecurity Operations Center shall:
515 (A) Immediately notify the Cybercrime Office of the
516 Department of Law Enforcement of a reported incident and provide
517 to the Cybercrime Office of the Department of Law Enforcement
518 regular reports on the status of the incident, preserve forensic
519 data to support a subsequent investigation, and provide aid to
520 the investigative efforts of the Cybercrime Office of the
521 Department of Law Enforcement upon the office's request if the
522 state chief information security officer finds that the
523 investigation does not impede remediation of the incide nt and
524 that there is no risk to the public and no risk to critical
525 state functions.
Page 21 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
526 (B) Immediately notify the state chief information officer
527 and the state chief information security officer of a reported
528 incident. The state chief information security officer shall
529 notify the President of the Senate and the Speaker of the House
530 of Representatives of any severity level 3, 4, or 5 incident as
531 soon as possible but no later than 24 12 hours after receiving a
532 state agency's incident report. The notification must include a
533 high-level description of the incident and the likely effects
534 and must be provided in a secure environment.
535 d. A state agency shall report a cybersecurity incident
536 determined by the state agency to be of severity level 1 or 2 to
537 the Cybersecurity Operations Center and the Cybercrime Office of
538 the Department of Law Enforcement as soon as possible. The
539 report must contain the information required in sub -subparagraph
540 b.
541 d.e. The Cybersecurity Operations Center shall provide a
542 consolidated incident report by the 30th day after the end of
543 each quarter on a quarterly basis to the Governor, the Attorney
544 General, the executive director of the Department of Law
545 Enforcement, the President of the Senate, the Speaker of the
546 House of Representatives, and the Florida Cybersecurity Advisory
547 Council. The report provided to the Florida Cybersecurity
548 Advisory Council may not contain the name of any agency, network
549 information, or system identifying information but must contain
550 sufficient relevant information to allow the Florida
Page 22 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
551 Cybersecurity Advisory Council to fulfill its responsibilities
552 as required in s. 282.319(9).
553 10. Incorporating information obtained through detection
554 and response activities into the agency's cybersecurity incident
555 response plans.
556 11. Developing agency strategic and operational
557 cybersecurity plans required pursuant to this section.
558 12. Establishing the managerial, operational, and
559 technical safeguards for protecting state government data and
560 information technology resources that align with the state
561 agency risk management strategy and that protect the
562 confidentiality, integrity, and availability of information and
563 data.
564 13. Establishing procedures for procuring information
565 technology commodities and services that require the commodity
566 or service to meet the National Institute of Standards and
567 Technology Cybersecurity Framework.
568 14. Submitting after-action reports following a
569 cybersecurity incident or ransomware incident. Such guidelines
570 and processes for submitting after-action reports must be
571 developed and published by December 1, 2022.
572 (d) Assist state agencies in complying with this section.
573 (e) In collaboration with the Cybercrime Office of the
574 Department of Law Enforcement, annually provide training for
575 state agency information security managers and computer security
Page 23 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
576 incident response team members that contains training on
577 cybersecurity, including cybersecurity threats, trends, and best
578 practices.
579 (f) Annually review the strategic and operational
580 cybersecurity plans of state agencies.
581 (g) Annually provide cybersecurity training to all state
582 agency technology professionals and employees with access to
583 highly sensitive information which develops, assesses, and
584 documents competencies by role and skill level. The
585 cybersecurity training curriculum must include training on the
586 identification of each cybersecurity incident severity level
587 referenced in sub-subparagraph (c)9.a. The training may be
588 provided in collaboration with the Cybercrime Office of the
589 Department of Law Enforcement, a private sector entity, or an
590 institution of the State University System.
591 (h) Operate and maintain a Cybersecurity Operations Center
592 led by the state chief information security officer, which must
593 be primarily virtual and staffed with tactical detection and
594 incident response personnel. The Cybersecurity Operations Center
595 shall serve as a clearinghouse for threat information and
596 coordinate with the Department of Law Enforcement to support
597 state agencies and their response to any confirmed or suspected
598 cybersecurity incident.
599 (i) Lead an Emergency Support Function, ESF-20 ESF CYBER,
600 under the state comprehensive emergency management plan as
Page 24 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
601 described in s. 252.35.
602 (j) Provide cybersecurity briefings to the members of any
603 legislative committee or subcommittee responsible for policy
604 matters relating to cybersecurity.
605 (k) Have the authority to obtain immediate access to
606 public or private infrastructure hosting enterprise digital data
607 and to direct, in consultation with the state agency that holds
608 the particular enterprise digital data, measures to assess,
609 monitor, and safeguard the enterprise digital data.
610 (4) Each state agency head shall, at a minimum:
611 (a) Designate a chief information security officer to
612 integrate the agency's technical and operational cybersecurity
613 efforts with the Cybersecurity Operations Center. This
614 designation must be provided annually in writing to the Florida
615 Digital Service by January 15. For a state agency under the
616 jurisdiction of the Governor, the agency's chief information
617 security officer shall be under the general supervision of the
618 agency head or designee for administrative purposes but shall
619 report to the state chief information officer. An agency may
620 request that the department procure a chief information security
621 officer as a service to fulfill the agency's duties under this
622 paragraph.
623 (b)(a) Designate an information security manager to ensure
624 compliance with cybersecurity governance and with the state's
625 enterprise security program and incident response plan. The
Page 25 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
626 information security manager must coordinate with the agency's
627 chief information security officer and the Cybersecurity
628 Operations Center to ensure that the unique needs of the agency
629 are met administer the cybersecurity program of the state
630 agency. This designation must be provided annually in writing to
631 the department by January 15 1. A state agency's information
632 security manager, for purposes of these information security
633 duties, shall work in collaboration with the agency's chief
634 information security officer and report directly to the agency
635 head.
636 (10) The department may brief any legislative committee or
637 subcommittee responsible for cybersecurity policy in a meeting
638 or other setting closed by the respective body under the rules
639 of such legislative body at which the legislative committee or
640 subcommittee is briefed on records made confidential and exempt
641 under subsections (5) and (6). The legislative committee or
642 subcommittee must maintain the confidential and exempt status of
643 such records. A legislator serving on a legislative committee or
644 subcommittee responsible for cybersecurity policy may also
645 attend meetings of the Florida Cybersecurity Advisory Council,
646 including any portions of such meetings that are exempt from s.
647 286.011 and s. 24(b), Art. I of the State Constitution.
648 Section 6. Paragraph (d) of subsection (5) of section
649 282.3185, Florida Statutes, is redesignated as paragraph (c),
650 and paragraph (b) and present paragraph (c) of that subsection
Page 26 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
651 are amended to read:
652 282.3185 Local government cybersecurity.—
653 (5) INCIDENT NOTIFICATION.—
654 (b)1. A local government shall report all ransomware
655 incidents and any cybersecurity incident determined by the local
656 government to be of severity level 3, 4, or 5 as provided in s.
657 282.318(3)(c) to the Cybersecurity Operations Center, the
658 Cybercrime Office of the Department of Law Enforcement, and the
659 sheriff who has jurisdiction over the local government as soon
660 as possible but no later than 12 48 hours after discovery of the
661 cybersecurity incident and no later than 6 12 hours after
662 discovery of the ransomware incident. The report must contain
663 the information required in paragraph (a).
664 2. The Cybersecurity Operations Center shall:
665 a. Immediately notify the Cybercrime Office of the
666 Department of Law Enforcement and the sheriff who has
667 jurisdiction over the local government of a reported incident
668 and provide to the Cybercrime Office of the Department of Law
669 Enforcement and the sheriff who has jurisdiction over the local
670 government regular reports on the status of the incident,
671 preserve forensic data to support a subsequent investigation,
672 and provide aid to the investigative efforts of the Cybercrime
673 Office of the Department of Law Enforcement upon the office's
674 request if the state chief information security officer finds
675 that the investigation does not impede remediation of the
Page 27 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
676 incident and that there is no risk to the public and no risk to
677 critical state functions.
678 b. Immediately notify the state chief information security
679 officer of a reported incident. The state chief information
680 security officer shall notify the President of the Senate and
681 the Speaker of the House of Representatives of any severity
682 level 3, 4, or 5 incident as soon as possible but no later than
683 24 12 hours after receiving a local government's incident
684 report. The notification must include a high-level description
685 of the incident and the likely effects and must be provided in a
686 secure environment.
687 (c) A local government may report a cybersecurity incident
688 determined by the local government to be of severity level 1 or
689 2 as provided in s. 282.318(3)(c) to the Cybersecurity
690 Operations Center, the Cybercrime Office of the Department of
691 Law Enforcement, and the sheriff who has jurisdiction over the
692 local government. The report shall contain the information
693 required in paragraph (a). The Cybersecurity Operations Center
694 shall immediately notify the Cybercrime Office of the Department
695 of Law Enforcement and the sheriff who has jurisdiction over the
696 local government of a reported incident and provide regular
697 reports on the status of the cybersecurity incident, preserve
698 forensic data to support a subsequent investigation, and provide
699 aid to the investigative efforts of the Cybercrime Office of the
700 Department of Law Enforcement upon request if the state chief
Page 28 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 1555 2024
701 information security officer finds that the investigation does
702 not impede remediation of the cybersecurity incident and that
703 there is no risk to the public and no risk to critical state
704 functions.
705 Section 7. Paragraph (j) of subsection (4) of section
706 282.319, Florida Statutes, is amended, and paragraph (m) is
707 added to that subsection, to read:
708 282.319 Florida Cybersecurity Advisory Council.—
709 (4) The council shall be comprised of the following
710 members:
711 (j) Three representatives from critical infrastructure
712 sectors, one of whom must be from a utility provider water
713 treatment facility, appointed by the Governor.
714 (m) A representative of local government.
715 Section 8. This act shall take effect July 1, 2024.
Page 29 of 29
CODING: Words stricken are deletions; words underlined are additions.
hb1555-00
Energy, Communications & Cybersecurity Subcommittee
HB 1555 by Rep. Giallombardo
Cybersecurity
AMENDMENT SUMMARY
January 25, 2024
Amendment 1 by Giallombardo (line 90):
• Removes provisions of the bill that designate certain information security
personnel positions as select exempt positions.
Amendment 2 by Giallombardo (line 611):
• Removes provisions of the bill that require each state agency head to designate
a chief information security officer (CISO) and that specify how an agency’s
information security manager must interact with the agency CISO.
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1555 (2024)
Amendment No. 1
COMMITTEE/SUBCOMMITTEE ACTION
ADOPTED (Y/N)
ADOPTED AS AMENDED (Y/N)
ADOPTED W/O OBJECTION (Y/N)
FAILED TO ADOPT (Y/N)
WITHDRAWN (Y/N)
OTHER
1 Committee/Subcommittee hearing bill: Energy, Communications &
2 Cybersecurity Subcommittee
3 Representative Giallombardo offered the following:
4
5 Amendment (with title amendment)
6 Remove lines 90-100
7
8
9 -----------------------------------------------------
10 T I T L E A M E N D M E N T
11 Remove lines 2-5 and insert:
12 An act relating to cybersecurity; amending s. 282.0041,
214605 - h1555-line90.docx
Published On: 1/24/2024 7:47:00 PM
Page 1 of 1
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1555 (2024)
Amendment No. 2
COMMITTEE/SUBCOMMITTEE ACTION
ADOPTED (Y/N)
ADOPTED AS AMENDED (Y/N)
ADOPTED W/O OBJECTION (Y/N)
FAILED TO ADOPT (Y/N)
WITHDRAWN (Y/N)
OTHER
1 Committee/Subcommittee hearing bill: Energy, Communications &
2 Cybersecurity Subcommittee
3 Representative Giallombardo offered the following:
4
5 Amendment (with title amendment)
6 Remove lines 611-635 and insert:
7 (a) Designate an information security manager to ensure
8 compliance with cybersecurity governance and with the state's
9 enterprise security program and incident response plan. The
10 information security manager must coordinate with the agency's
11 information security personnel and the Cybersecurity Operations
12 Center to ensure that the unique needs of the agency
13 are met administer the cybersecurity program of the state
14 agency. This designation must be provided annually in writing to
15 the department by January 15 1. A state agency's information
434595 - h1555-line611.docx
Published On: 1/24/2024 7:47:58 PM
Page 1 of 2
COMMITTEE/SUBCOMMITTEE AMENDMENT
Bill No. HB 1555 (2024)
Amendment No. 2
16 security manager, for purposes of these information security
17 duties, shall report directly to the agency head.
18
19 -----------------------------------------------------
20 T I T L E A M E N D M E N T
21 Remove lines 53-55 and insert:
22 certain measures; revising the purpose of
23
434595 - h1555-line611.docx
Published On: 1/24/2024 7:47:58 PM
Page 2 of 2
HB 7047
HOUSE OF REPRESENTATIVES STAFF ANALYSIS
BILL #: HB 7047 PCB EEG 24-07 OGSR/Utility Owned or Operated by a Unit of Local
Government
SPONSOR(S): Ethics, Elections & Open Government Subcommittee, Porras
TIED BILLS: IDEN./SIM. BILLS: SB 7006
REFERENCE ACTION ANALYST STAFF DIRECTOR or
BUDGET/POLICY CHIEF
Orig. Comm.: Ethics, Elections & Open 16 Y, 0 N Poreda Toliver
Government Subcommittee
1) Energy, Communications & Cybersecurity Phelps Keating
Subcommittee
2) State Affairs Committee
SUMMARY ANALYSIS
The Open Government Sunset Review (OGSR) Act requires the Legislature to review each public record
exemption and each public meeting exemption five years after enactment. If the Legislature does not reenact
the exemption, it automatically repeals on October 2nd of the fifth year after enactment.
Municipalities are authorized by general law to provide water and sewer utility services , as well as electric and
natural gas utility services. Counties are authorized to provide water and sewer utility services both within their
individual boundaries and in adjoining counties. Current law provides public record exemptions for the
following information held by a utility owned or operated by a unit of local government (local government utility):
Information related to the security of a local government utility's technology, processes, and practices
designed to protect the utility’s networks, computers, programs, and data from attack, damage, or
unauthorized access that, if disclosed, would facilitate the alteration, disclosure, or destruction of such
data or information technology (I.T.) resources.
Information related to the security of a local government utility’s existing or proposed I.T. systems or
industrial control technology systems that, if disclosed, would facilitate unauthorized access to, and
alteration or destruction of, such systems in a manner that would adversely impact the safe and reliable
operations of the systems and the utility.
Customer meter-derived data and billing information in increments of less than one billing cycle.
Current law also provides a public meeting exemption for the portions of meetings held by a local government
utility that would reveal information exempt from disclosure by the public records exemptions discussed above.
The exemption requires that all closed portions be recorded and transcribed and that such recordings and
transcripts are confidential and exempt from disclosure as public records.
In 2022, the Legislature created a general public record exemption, applicable to all agencies, for certain
information related to cybersecurity. Pursuant to the OGSR Act, the exemption for cybersecurity information
will repeal on October 2, 2027, unless reviewed and saved from repeal by the Legislature.
The bill extends the repeal date for the public record exemptions related to I.T. security and the public meeting
exemption to October 2, 2027, to coincide with the future OGSR repeal date of the general cybersecurity
exemption in statute. The bill saves from repeal the public record exemption related to customer meter-derived
data and billing information. Each of the exemptions will repeal on October 2, 2024, if this bill does not become
law.
The bill does not appear to have a fiscal impact on state government or local governments.
This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives .
STORAGE NAME: h7047.ECC
DATE: 1/23/2024
FULL ANALYSIS
I. SUBSTANTIVE ANALYSIS
A. EFFECT OF PROPOSED CHANGES:
Background
Open Government Sunset Review Act
The Open Government Sunset Review Act (OGSR Act) 1 sets forth a legislative review process for
newly created or substantially amended public record or public meeting exemptions. It requires an
automatic repeal of the exemption on October 2nd of the fifth year after creation or substantial
amendment, unless the Legislature reenacts the exemption.2
The OGSR Act provides that a public record or public meeting exemption may be created or
maintained only if it serves an identifiable public purpose. In addition, it may be no broader than is
necessary to meet one of the following purposes:
Allow the state or its political subdivisions to effectively and efficiently administer a
governmental program, which administration would be significantly impaired without the
exemption.
Protect sensitive personal information that, if released, would be defamatory or would
jeopardize an individual’s safety; however, only the identity of an individual may be exempted
under this provision.
Protect trade or business secrets.3
If, and only if, in reenacting an exemption that will repeal, the exemption is expanded, then a public
necessity statement and a two-thirds vote for passage are required. If the exemption is reenacted with
grammatical or stylistic changes that do not expand the exemption, if the exemption is narrowed, or if
an exception to the exemption is created, then a public necessity statement and a two-thirds vote are
not required.4
Local Government Utilities
The Florida Constitution grants municipalities the governmental, corporate, and proprietary powers
necessary to enable them to conduct municipal government, perform municipal functions, and render
municipal services, and permits them to exercise any power for municipal purposes, except when
expressly prohibited by law.5
Counties not operating under a charter have the power of self-government as provided by general or
special law, while charter counties have all powers of self-government not inconsistent with general law
or with special law approved by the county electors. 6 Counties are authorized by general law to
provide water and sewer utility services both within their individual boundaries and in adjoining
counties.7 Municipalities are authorized by general law to provide water and sewer utility services 8 as
well natural gas services 9 and electric and gas utilities 10
Florida Public Service Commission
1
S. 119.15, F.S.
2 S. 119.15(3), F.S.
3 S. 119.15(6)(b), F.S.
4 Article I, s. 24(c), Fla. Const.
5 Article VIII,
s. 2(b), Fla. Const.
6 Article VIII,
s. 1(f)-(g), Fla. Const.
7 Ss. 125.01(1)(k)1., F.S. and 153.03, F.S.
8 Pursuant to s. 180.06, F.S., a municipality may “provide water and alternative water supplies;” “provide for the collection a nd disposal
of sewage, including wastewater reuse, and other liquid wastes;” and “construct reservoirs, sewerage systems, trunk se wers,
intercepting sewers, pumping stations, wells, siphons, intakes, pipelines, distribution systems, purification works, collecti on systems,
treatment and disposal works” to accomplish these purposes.
9 S. 180.06(8), F.S.
10 Ch. 366, F.S.
STORAGE NAME: h7047.ECC PAGE: 2
DATE: 1/23/2024
The Florida Public Service Commission (PSC) ensures Florida’s consumers receive utility services,
including electric, natural gas, telephone, water, and wastewater, “in a safe, affordable, and reliable
manner.”11 The PSC primarily regulates investor owned utilities but is able to exercise limited authority
over publicly owned utilities in the following areas:12
Rate base or economic regulation.
Competitive market oversight.
Monitoring of safety, reliability and service.
Utility Customer Consumption Data
Traditional, analog utility meters record consumption at a utility customer’s premises. On a regular,
periodic basis, the meter is “read” in person by a utility employee to determine how much of the utility’s
service — electric, natural gas, or water/wastewater — was used at the premises since the last meter
reading. This data is used by the utility for purposes of customer billing. In recent years, utilities have
deployed, to varying degrees, newer “smart meter” 13 technologies that measure a utility customer’s
consumption on a more frequent basis (e.g., hourly) and transmit this data automatically and wirelessly
to the utility. The utility still uses this data for billing purposes but can also use it to monitor its system
and identify and locate problems more quickly.14
Cybersecurity Public Record Exemption
In 2022, the Legislature passed CS/HB 7057, which created a general public record exemption —
applicable to all agencies 15 — for the certain information related to cybersecurity.16 Specifically, CS/HB
7057, which was codified as s. 119.0725, F.S., protected the following information:
Information related to critical infrastructure.17
Network schematics, hardware and software configurations, or encryption information or
information that identifies detection, investigation, or response practices for suspected or
confirmed cybersecurity incidents, including suspected or confirmed breaches, if the disclosure
of such information would facilitate unauthorized access to or unauthorized modification,
disclosure, or destruction of:
o Data or information, whether physical or virtual; or
o Information technology (I.T.) resources, which include an agency’s existing or proposed
I.T. systems.
Coverage limits and deductible or self-insurance amounts of insurance or other risk mitigation
coverages acquired for the protection of I.T. systems, operational technology systems, or data
of an agency.
Cybersecurity incident information contained in certain reports.
CS/HB 7057 (2022) also created a public meeting exemption for any portion of a meeting that would
reveal the confidential and exempt information; however, any portion of an exempt meeting must be
recorded and transcribed.18 The recording and transcript are confidential and exempt from public record
requirements.19
11 Florida Public Service Commission, Ab out, available at https://www.psc.state.fl.us/about (last visited Jan. 15, 2024).
12 Florida Public Service Commission, 2022 Annual Report, available at https://www.floridapsc.com/pscfiles/website-
files/PDF/Publications/Reports/General/AnnualReports/2022.pdf (last visited January 16, 2024)
13
See Florida Public Service Commission, Smart Meters, availab le at https://www.floridapsc.com/pscfiles/website-
files/pdf/Utilities/Electricgas/SmartMeters/SmartMeter.pdf (last visited January 16, 2 024).
14 Id.
15 “Agency” means any state, county, district, authority, or municipal officer, department, division, board, bureau, commission, or other
separate unit of government created or established by law including, for the purposes of ch. 119, F.S., the Commission on Ethics, the
Public Service Commission, and the Office of Public Counsel, and any other public or private agency, person, partnership, cor poration,
or business entity acting on behalf of any public agency. S. 119.011(2), F.S.
16 See s. 119.0725, F.S.
17 “Critical infrastructure” means existing and proposed information technology and operation technology systems and assets, whe ther
physical and virtual, the incapacity or destruction of which would negatively affect security, economic security, p ublic health, or public
safety. S. 119.0725(1)(b), F.S.
18 S. 119.0725(3), F.S.
19 Id.
STORAGE NAME: h7047.ECC PAGE: 3
DATE: 1/23/2024
Public Record and Public Meeting Exemptions under Review
In 2016, the Legislature created a public record exemption that made the following information held by
a utility20 owned or operated by a unit of local government (local government utility) confidential and
exempt21 from public record requirements:
Information related to the security of a local government utility's technology, processes, and
practices designed to protect the utility’s networks, computers, programs, and data from attack,
damage, or unauthorized access that, if disclosed, would facilitate the alteration, disclosure, or
destruction of such data or I.T. resources.
Information related to the security of a local government utility’s existing or proposed I.T.
systems or industrial control technology systems that, if disclosed, would facilitate unauthorized
access to, and alteration or destruction of, such systems in a manner that would adversely
impact the safe and reliable operations of the systems and the utility.22
In 2019, the Legislature created a public record exemption that made customer meter-derived data and
billing information in increments of less than one billing cycle held by a local government utility
confidential and exempt from public record requirements. 23 Additionally, in that same year, the
Legislature created a public meeting exemption for any portion of a meeting held by a local government
utility that would reveal information made exempt pursuant to the local government utility’s public record
exemption.24 All closed portions of such a meeting must be recorded and transcribed and such
recording or transcription are exempt from public record requirements.25
The 2016 public necessity statement26 for the public record exemptions for certain I.T. security
information provided that:
[M]any utilities have adopted technologies, processes, and practices designed to
secure data, information technology systems, and industrial control technology
systems. Disclosure of sensitive information related to these security measures
could result in the identification of vulnerabilities that allow a security breach that
damages utility systems and disrupts the safe and reliable operation of such
systems, adversely impacting the public health and safety and the economic well-
being of the state. Because of the interconnected nature of utility systems, a
security breach may also impact national security concerns.27
The 2019 public necessity statement for the public record exemption for customer meter-derived data
and billing information provided that:
Smart meters, which can record and transmit detailed data on a customer's use of
utility services, present unique security concerns. These concerns were addressed
in a report released in October 2010 by the United States Department of Energy
titled “Data Access and Privacy Issues related to Smart Grid Technologies.” The
20
“Utility” means a person or entity that provides electricity, natural gas, telecommunications, water, chilled water, reuse wa ter, or
wastewater. S. 119.011(15), F.S.
21 There is a difference between records the Legislature designates exempt from public record requirements and those the Legislature
designates confidential and exempt. A record classified as exempt from public disclosure may be disclosed under certain
circumstances. See WFTV, Inc. v. Sch. Bd. of Seminole, 874 So.2d 48, 53 (Fla. 5th DCA 2004), review denied, 892 So.2d 1015 (Fla.
2004); State v. Wooten, 260 So. 3d 1060, 1070 (Fla. 4th DCA 2018); City of Rivera Beach v. Barfield, 642 So.2d 1135 (Fla. 4th DCA
1994); Williams v. City of Minneola, 575 So.2d 683, 687 (Fla. 5th DCA 1991). If the Legislature designates a record as confidential and
exempt from public disclosure, such record may not be released by the custodian of public records to anyone other than th e persons or
entities specifically designated in statute. See Op. Att’y Gen. Fla. 04- 09 (2004).
22 Chapter 2016-95, L.O.F., codified as s. 119.0713(5), F.S.
23 Chapter 2019-38, LO.F., codified as s. 119.0713(5)(a)3., F.S.
24 Chapter 2019-37, L.O.F., codified as s. 286.0113(3), F.S.
25 S. 286.0113(3)(a), F.S. However, a court of competent jurisdiction, following an in -camera review, may determine that the meeting
was not restricted to the discussion of data and information made exempt, and in that event, the p ortion of the recording or transcript
which reveals nonexempt data and information may be disclosed to a third party.
26 Article I, s. 24(c), FLA. C ONST., requires each public record exemption to “state with specificity the public necessity justifying the
exemption.”
27 Ch. 2016-95, L.O.F.
STORAGE NAME: h7047.ECC PAGE: 4
DATE: 1/23/2024
report recommended that customer data be protected from release to third parties.
This detailed customer data can be used to specifically identify minute-by-minute
usage patterns, including the exact appliance or service being used. This
information creates significant security issues for both businesses and
homeowners.28
The 2019 public necessity statement for the public meeting exemption provided that:
[A]s utility system infrastructure becomes more connected and integrated through
information and communications technology, the exposure to damage from attacks
through such technology grows. These attacks may result in the disruption of utility
services and damage to utility systems. Maintaining safe and reliable utility
systems is vital to protecting the public health and safety and to ensuring the
economic well-being of this state.29
Pursuant to the OGSR Act, each of the above exemptions will repeal on October 2, 2024, unless
reenacted by the Legislature.
During the 2023 interim, House and Senate committee staff jointly developed a questionnaire and sent
the questionnaires to city and county governments. In total, staff received 39 responses from those
entities.30 Most respondents indicated that they were unaware of any litigation concerning the
exemptions and had not encountered any issues interpreting or applying the exemptions. The vast
majority of respondents indicated that the exemptions be reenacted as is and no respondent
recommended eliminating the public record or public meeting exemptions. As a part of the
questionnaire, respondents were asked to consider whether the local government utility I.T. security
exemptions were duplicative of the general cybersecurity exemption in s. 119.0725, F.S. Some
respondents noted that there may be some overlap between the exemption.
Effect of the Bill
The bill extends the repeal date for the public record exemptions related to local government utility I.T.
security and the public meeting exemption to October 2, 2027, to coincide with the future OGSR repeal
date of the general cybersecurity exemption in s. 119.0725, F.S. The bill saves from repeal the public
record exemption for customer meter-derived data and billing information in increments of less than
one billing cycle held by a local government utility. Each of the exemptions under review will repeal on
October 2, 2024, if this bill does not become law
B. SECTION DIRECTORY:
Section 1 amends s. 119.0713, F.S., relating to local government agency exemptions from inspection
or copying of public records.
Section 2 amends s. 286.0113, F.S., relating to general exemptions from public meetings.
Section 3 provides an effective date of October 1, 2024.
II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT
A. FISCAL IMPACT ON STATE GOVERNMENT:
1. Revenues:
None.
28 Ch. 2019-38, L.O.F.
29 Ch. 2019-37, L.O.F.
30 Open Government Sunset Review Questionnaire, Public Records and Public Meetings Related to utilities owned or operated by a
unit of local government, responses on file with the Ethics, Elections & Open Government Subcommittee.
STORAGE NAME: h7047.ECC PAGE: 5
DATE: 1/23/2024
2. Expenditures:
None.
B. FISCAL IMPACT ON LOCAL GOVERNMENTS:
1. Revenues:
None.
2. Expenditures:
None.
C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR:
None.
D. FISCAL COMMENTS:
None.
III. COMMENTS
A. CONSTITUTIONAL ISSUES:
1. Applicability of Municipality/County Mandates Provision:
Not applicable. The bill does not appear to require counties or municipalities to spend funds or take
action requiring the expenditure of funds; reduce the authority that counties and municipalities have
to raise revenues in the aggregate; or reduce the percentage of state tax shared with counties and
municipalities.
2. Other:
None.
B. RULE-MAKING AUTHORITY:
The bill does not require rulemaking nor confer rulemaking authority.
C. DRAFTING ISSUES OR OTHER COMMENTS:
None.
IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES
Not applicable.
STORAGE NAME: h7047.ECC PAGE: 6
DATE: 1/23/2024
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 7047 2024
1 A bill to be entitled
2 An act relating to a review under the Open Government
3 Sunset Review Act; amending s. 119.0713, F.S., which
4 provides exemptions from public records requirements
5 for information related to the security of certain
6 technology, processes, practices, information
7 technology systems, and industrial control technology
8 systems and certain customer meter-derived data and
9 billing information held by a utility owned or
10 operated by a unit of local government; extending the
11 date of scheduled repeal of the public records
12 exemptions for such information; removing the
13 scheduled repeal of the public records exemption for
14 such customer meter-derived data and billing
15 information; amending s. 286.0113, F.S., which
16 provides an exemption from public meetings
17 requirements for portions of meetings held by a
18 utility owned or operated by a unit of local
19 government that would reveal certain information;
20 extending the date of scheduled repeal of the public
21 meetings exemption; providing an effective date.
22
23 Be It Enacted by the Legislature of the State of Florida:
24
25 Section 1. Subsection (5) of section 119.0713, Florida
Page 1 of 4
CODING: Words stricken are deletions; words underlined are additions.
hb7047-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 7047 2024
26 Statutes, is amended to read:
27 119.0713 Local government agency exemptions from
28 inspection or copying of public records.—
29 (5)(a) The following information held by a utility owned
30 or operated by a unit of local government is exempt from s.
31 119.07(1) and s. 24(a), Art. I of the State Constitution:
32 1. Information related to the security of the technology,
33 processes, or practices of a utility owned or operated by a unit
34 of local government that are designed to protect the utility's
35 networks, computers, programs, and data from attack, damage, or
36 unauthorized access, which information, if disclosed, would
37 facilitate the alteration, disclosure, or destruction of such
38 data or information technology resources.
39 2. Information related to the security of existing or
40 proposed information technology systems or industrial control
41 technology systems of a utility owned or operated by a unit of
42 local government, which, if disclosed, would facilitate
43 unauthorized access to, and alteration or destruction of, such
44 systems in a manner that would adversely impact the safe and
45 reliable operation of the systems and the utility.
46 3. Customer meter-derived data and billing information in
47 increments less than one billing cycle.
48 (b) This exemption applies to such information held by a
49 utility owned or operated by a unit of local government before,
50 on, or after the effective date of this exemption.
Page 2 of 4
CODING: Words stricken are deletions; words underlined are additions.
hb7047-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 7047 2024
51 (c) Subparagraphs (a)1. and 2. are This subsection is
52 subject to the Open Government Sunset Review Act in accordance
53 with s. 119.15 and shall stand repealed on October 2, 2027 2024,
54 unless reviewed and saved from repeal through reenactment by the
55 Legislature.
56 Section 2. Subsection (3) of section 286.0113, Florida
57 Statutes, is amended to read:
58 286.0113 General exemptions from public meetings. —
59 (3)(a) That portion of a meeting held by a utility owne d
60 or operated by a unit of local government which would reveal
61 information that is exempt under s. 119.0713(5) is exempt from
62 s. 286.011 and s. 24(b), Art. I of the State Constitution. All
63 exempt portions of such a meeting must be recorded and
64 transcribed. The recording and transcript of the meeting are
65 exempt from disclosure under s. 119.07(1) and s. 24(a), Art. I
66 of the State Constitution unless a court of competent
67 jurisdiction, following an in camera review, determines that the
68 meeting was not restricted to the discussion of data and
69 information made exempt by this section. In the event of such a
70 judicial determination, only the portion of the recording or
71 transcript which reveals nonexempt data and information may be
72 disclosed to a third party.
73 (b) This subsection is subject to the Open Government
74 Sunset Review Act in accordance with s. 119.15 and shall stand
75 repealed on October 2, 2027 2024, unless reviewed and saved from
Page 3 of 4
CODING: Words stricken are deletions; words underlined are additions.
hb7047-00
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S
HB 7047 2024
76 repeal through reenactment by the Legislature.
77 Section 3. This act shall take effect October 1, 2024.
Page 4 of 4
CODING: Words stricken are deletions; words underlined are additions.
hb7047-00
File and source
- File
- 2024-01-25_3226_energy-communications-cybersecurity-subcommittee_meeting-packets_mtg14234.pdf
- Size
- 1,102,132 bytes
- SHA-256
- af47572886360c062b011a23407ca258a95fabef61941c4ffa62ef887bdac5cd
- Our copy
- 2024-01-25_3226_energy-communications-cybersecurity-subcommittee_meeting-packets_mtg14234.pdf
- Original
- No public link identified.