Law / United States / 
Florida
State Cybersecurity Act, state agency cybersecurity incident and ransomware reporting
State Cybersecurity Act, § 282.318(3)(c)9., (4)(b), (j), (k)
In force.
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds each state agency as defined in section 282.0041 of the Florida Statutes, including the Department of Legal Affairs, the Department of Agriculture and Consumer Services and the Department of Financial Services.
- Report every ransomware incident, and every cybersecurity incident you determine to be of severity level 3, 4 or 5, to the Cybersecurity Operations Center and the Cybercrime Office of the Department of Law Enforcement as soon as possible, and no later than 48 hours after discovery of a cybersecurity incident or 12 hours after discovery of a ransomware incident.
- Report a cybersecurity incident you determine to be of severity level 1 or 2 to the same two bodies as soon as possible.
- Include in each report a summary of the facts, the date of the most recent data backup, the types of data compromised, the estimated fiscal impact, and the details of any ransom demanded.
- Have the agency cybersecurity response team immediately report all confirmed or suspected incidents to the state chief information security officer or a designee.
- Submit an after-action report to the Florida Digital Service within 1 week after the remediation of a cybersecurity incident or ransomware incident.
These lines are LexLint's reading of the law's text, as of .
What this law does
A state agency must report all ransomware incidents and any cybersecurity incident it determines to be of severity level 3, 4, or 5 to the Cybersecurity Operations Center and the Cybercrime Office of the Department of Law Enforcement as soon as possible, and no later than 48 hours after discovery of a cybersecurity incident and no later than 12 hours after discovery of a ransomware incident.
A state agency must report a cybersecurity incident it determines to be of severity level 1 or 2 to the Cybersecurity Operations Center and the Cybercrime Office of the Department of Law Enforcement as soon as possible. The incident reporting process must specify the information a state agency reports, which includes a summary of the facts, the date of the most recent data backup, the types of data compromised, the estimated fiscal impact, and the details of any ransom demanded.
The agency cybersecurity response team must immediately report all confirmed or suspected incidents to the state chief information security officer, or his or her designee. A state agency must submit an after-action report to the Florida Digital Service within 1 week after the remediation of a cybersecurity incident or ransomware incident.
The Cybersecurity Operations Center must notify the President of the Senate and the Speaker of the House of Representatives of any severity level 3, 4, or 5 incident no later than 12 hours after receiving a state agency's incident report.