Law / United States / 
Florida
State Cybersecurity Act, state agency cybersecurity program duties
State Cybersecurity Act, § 282.318(4)
In force.
A sector security regimes rule binding government bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds each state agency as defined in section 282.0041 of the Florida Statutes, including the Department of Legal Affairs, the Department of Agriculture and Consumer Services and the Department of Financial Services, through its agency head.
- Designate an information security manager to administer the agency's cybersecurity program, who reports directly to the agency head, and give the department that designation in writing each year by January 1.
- Establish an agency cybersecurity response team to respond to a cybersecurity incident, and follow the guidelines and processes the department sets.
- Submit the agency's strategic cybersecurity plan, which covers a 3-year period, and its operational cybersecurity plan to the department each year by July 31.
- Conduct, and update every 3 years, a comprehensive risk assessment that follows the department's methodology, and implement the safeguards and remediation plans the department recommends.
- Have periodic internal audits and evaluations of the agency's cybersecurity program carried out, and keep written internal policies and procedures consistent with the department's rules.
- Provide cybersecurity awareness training to all agency employees within 30 days after commencing employment, and annually thereafter.
- Write cybersecurity requirements that meet or exceed applicable state and federal laws, regulations and standards for cybersecurity, including the NIST Cybersecurity Framework, into information technology solicitations, contracts and service-level agreements.
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 282.318 of the Florida Statutes, the State Cybersecurity Act, reaches each state agency as defined in section 282.0041, and the term includes the Department of Legal Affairs, the Department of Agriculture and Consumer Services, and the Department of Financial Services.
The department, acting through the Florida Digital Service, is the lead entity responsible for establishing standards and processes for assessing state agency cybersecurity risks and determining appropriate security measures. Each state agency head must designate an information security manager to administer the cybersecurity program of the state agency. Each state agency head must establish an agency cybersecurity response team to respond to a cybersecurity incident.
Each state agency head must submit the strategic and operational cybersecurity plans of the state agency to the department annually by July 31. Each state agency head must conduct, and update every 3 years, a comprehensive risk assessment of the security threats to the data, information, and information technology resources of the agency.
Each state agency head must provide cybersecurity awareness training to all state agency employees within 30 days after commencing employment, and annually thereafter.
Each state agency head must ensure that the cybersecurity requirements in the written specifications for the solicitation, contracts, and service-level agreement of information technology meet or exceed the applicable state and federal laws, regulations, and standards for cybersecurity, including the National Institute of Standards and Technology Cybersecurity Framework.