Law / United States / 
Florida
Local Government Cybersecurity Act, cybersecurity incident and ransomware reporting
Local Government Cybersecurity Act, § 282.3185(5), (6)
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds each county and each municipality (section 282.3185(2)).
- Report every ransomware incident, and every cybersecurity incident you determine to be of severity level 3, 4 or 5, to the Cybersecurity Operations Center, the Cybercrime Office of the Department of Law Enforcement and the sheriff who has jurisdiction over the local government, as soon as possible and no later than 48 hours after discovery of a cybersecurity incident or 12 hours after discovery of a ransomware incident.
- You may report a cybersecurity incident of severity level 1 or 2 to the same three recipients.
- Include in each notification a summary of the facts, the date of the most recent data backup, the types of data compromised, the estimated fiscal impact, the details of any ransom demanded, and a statement requesting or declining assistance.
- Submit an after-action report to the Florida Digital Service within 1 week after the remediation of a cybersecurity incident or ransomware incident.
These lines are LexLint's reading of the law's text, as of .
What this law does
A local government must report all ransomware incidents and any cybersecurity incident it determines to be of severity level 3, 4, or 5 to the Cybersecurity Operations Center, the Cybercrime Office of the Department of Law Enforcement, and the sheriff who has jurisdiction over the local government as soon as possible, and no later than 48 hours after discovery of a cybersecurity incident and no later than 12 hours after discovery of a ransomware incident.
A local government may report a cybersecurity incident it determines to be of severity level 1 or 2 to the same three recipients. Each notification must include a summary of the facts, the date of the most recent data backup, the types of data compromised, the estimated fiscal impact, the details of any ransom demanded, and a statement requesting or declining assistance.
A local government must submit an after-action report to the Florida Digital Service within 1 week after the remediation of a cybersecurity incident or ransomware incident.