SB 480 — Information Technology

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 GovernmentManagement TechnologyServices, Modernizationis Councilthe isex locatedofficio withinhead DIGIT;of the council;

providing that the state chief information officer, rather than the Secretary of Management Services, is the ex officio head of the council;

Section 14.205, Florida Statutes, is created to Pageread: 14 of 102 CODING:

14.205 Division of Integrated Government Innovation and Technology.— Page 14 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 read:(1) The Division of Integrated Government Innovation and Technology is established within the Executive Office of the Governor.

14.205 Division of Integrated Government Innovation and Technology.— (1) The Division of Integrated Government Innovation and Technology is established within the Executive Office of the Governor.

Page2. 15 of 102 CODING:

Professional experience requirements.—The state chief information officer must have at least 10 years of progressively responsible experience in information technology management, Page 15 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 2.digital transformation, cybersecurity, or information technology governance, including:

Professional experience requirements.—The state chief information officer must have at least 10 years of progressively responsible experience in information technology management, digital transformation, cybersecurity, or information technology governance, including:

Information technology governance and policy development by demonstrating an understanding of statewide information Pagetechnology 16governance ofstructures, 102digital CODING:services, and information technology procurement policies;

and d.

Public sector information technology management by Page 16 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 demonstrating familiarity with government information technology governancefunding structures,models, digitalprocurement services,requirements, and legislative processes affecting information technology procurementstrategy. policies;

and d.

Public sector information technology management by demonstrating familiarity with government information technology funding models, procurement requirements, and legislative processes affecting information technology strategy.

PageSection 173. of 102 CODING:

Until a state chief information officer is appointed pursuant to s.

14.205, Florida Statutes, the current state chief information officer of the Department of Management Page 17 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 SectionServices 3.shall be transferred to the Division of Integrated Government Innovation and Technology and serve as interim state chief information officer.

Until a state chief information officer is appointed pursuant to s.

14.205, Florida Statutes, the current state chief information officer of the Department of Management Services shall be transferred to the Division of Integrated Government Innovation and Technology and serve as interim state chief information officer.

The inspector general shall prepare an annual agency information technology compliance report that assesses the adequacy of internal controls, documentation, and implementation processes to ensure conformity with statewide information Page 18 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 information technology compliance report that assesses the adequacy of internal controls, documentation, and implementation processes to ensure conformity with statewide information technology governance, security, and performance standards.

(c) The inspector general and the staff shall have access Pageto 19any records, data, and other information of 102the CODING:state agency he or she deems necessary to carry out his or her duties.

The inspector general may also request such information or Page 19 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 toassistance anyas records,may data,be andnecessary otherfrom information of the state agency he or shefrom deemsany necessaryfederal, tostate, carry out his or herlocal duties.government entity.

The inspector general may also request such information or assistance as may be necessary from the state agency or from any federal, state, or local government entity.

The agency information technology compliance reports must be submitted to the agency head, the Auditor General, and, Pagefor 20state agencies under the jurisdiction of 102the CODING:Governor, the Chief Inspector General by September 30 of each year.

2.

The Chief Inspector General shall review the annual Page 20 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 foragency stateinformation agenciestechnology compliance reports submitted by agency inspectors general under the jurisdiction of the Governor,Governor theand Chiefshall Inspectorprepare Generala byconsolidated Septemberstatewide 30information oftechnology eachcompliance year.report summarizing agency performance, findings, and recommendations for improvement.

2.

The Chief Inspector General shall review the annual agency information technology compliance reports submitted by agency inspectors general under the jurisdiction of the Governor, and shall prepare a consolidated statewide information technology compliance report summarizing agency performance, findings, and recommendations for improvement.

No later than 6 months after the Auditor General or the Office of Program Policy Analysis and Government Accountability publishes a report on the state agency, the inspector general shall provide a written response to the agency head or, for state agencies under the Page 21 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 Analysis and Government Accountability publishes a report on the state agency, the inspector general shall provide a written response to the agency head or, for state agencies under the jurisdiction of the Governor, the Chief Inspector General on the status of corrective actions taken.

97.0525 Online voter registration.— (3) (b) The division shall conduct a comprehensive risk Pageassessment 22 of 102the CODING:online voter registration system every 2 years.

The comprehensive risk assessment must comply with the risk assessment methodology developed by the Division of Page 22 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 assessmentIntegrated Government Innovation and Technology within the Executive Office of the onlineGovernor voterDepartment registrationof systemManagement everyServices 2for years.identifying security risks, determining the magnitude of such risks, and identifying areas that require safeguards.

The comprehensive risk assessment must comply with the risk assessment methodology developed by the Division of Integrated Government Innovation and Technology within the Executive Office of the Governor Department of Management Services for identifying security risks, determining the magnitude of such risks, and identifying areas that require safeguards.

112.22 Use of applications from foreign countries of concern prohibited.— Page(1) 23As ofused 102in CODING:this section, the term:

(a) “DIGIT” means the Division of Integrated Government Innovation and Technology within the Executive Office of the Page 23 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 (1)Governor As“Department” usedmeans inthe thisDepartment section,of theManagement term:Services.

(a) “DIGIT” means the Division of Integrated Government Innovation and Technology within the Executive Office of the Governor “Department” means the Department of Management Services.

943.10(1) if the use of the prohibited Pageapplication 24is necessary to protect the public safety or conduct an investigation within the scope of 102his CODING:or her employment.

2.

A public employer may request a waiver from DIGIT the Page 24 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 applicationdepartment is necessary to protectallow thedesignated publicemployees safety or conductofficers anto investigationdownload withinor theaccess scopea ofprohibited hisapplication oron hera employment.government-issued device.

2.

A public employer may request a waiver from DIGIT the department to allow designated employees or officers to download or access a prohibited application on a government-issued device.

Risk mitigation actions that will be taken to prevent Pageaccess 25to ofsensitive 102data, CODING:including methods to ensure that the activity does not connect to a state system, network, or server.

5.

A description of the circumstances under which the Page 25 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 accesswaiver toapplies. sensitive data, including methods to ensure that the activity does not connect to a state system, network, or server.

5.

A description of the circumstances under which the waiver applies.

Page1. 26 of 102 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 1.

Information on expenditures for 3 fiscal years (actual prior-yearPage expenditures,26 current-yearof estimated100 expenditures,CODING: and agency budget requested expenditures for the next fiscal year) by appropriation category.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 prior-year expenditures, current-year estimated expenditures, and agency budget requested expenditures for the next fiscal year) by appropriation category.

The evaluation must include an assessment of contractor performance, a comparison of anticipated service levels to actual service levels, and a comparison of estimated Pagesavings 27to ofactual 102savings CODING:achieved.

Consolidated reports issued by the Department of Management Services may be used to satisfy this requirement.

Page 27 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 savings9. to actual savings achieved.

Consolidated reports issued by the Department of Management Services may be used to satisfy this requirement.

9.

Page(a) 28The name of 102the CODING:technology system.

(b) A brief description of the purpose and function of the system.

Page 28 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 (a)(c) TheA namebrief description of the technologygoals system.of the project.

(b) A brief description of the purpose and function of the system.

(c) A brief description of the goals of the project.

Present subsections (36), (37), and (38) of section 282.0041, Florida Statutes, are redesignated as subsections (37), (38), and (39), respectively, new subsections (11) and (36) are added to that section, and subsection (1), present subsection (7), and subsections (27) and (29) of that Pagesection 29are ofamended, 102to CODING:read:

282.0041 Definitions.—As used in this chapter, the term:

(1) “Agency assessment” means the amount each customer Page 29 of 100 CODING:

Florida Senate - 2026 CS for CSSB 480 601-02525-26 2026480c1 entity must pay annually for SBservices 480from 576-02812-26the 2026480c2Department sectionof areManagement amended,Services toand read:includes administrative and data center services costs.

282.0041 Definitions.—As used in this chapter, the term:

(1) “Agency assessment” means the amount each customer entity must pay annually for services from the Department of Management Services and includes administrative and data center services costs.

282.00515 Duties of Cabinet agencies.— (1)(a) The Department of Legal Affairs, the Department of Financial Services, and the Department of Agriculture and Consumer Services shall adopt the standards, best practices, Page 30 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 (1)(a) The Department of Legal Affairs, the Department of Financial Services, and the Department of Agriculture and Consumer Services shall adopt the standards, best practices, processes, and methodologies established in s.

282.0051, such department must notify DIGIT, the Governor, the President of the Senate, and the Speaker of the House of Representatives in writing of the adoption of the alternative standards and provide a justification for adoption of the alternative standards and explain the manner in which how Page 31 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 House of Representatives in writing of the adoption of the alternative standards and provide a justification for adoption of the alternative standards and explain the manner in which how the agency will achieve the policy, standard, guideline, or best practice while promoting open data interoperability.

(5) The Department of Legal Affairs, the Department of Financial Services, and the Department of Agriculture and PageConsumer 32Services ofmay, 102but CODING:are not required to, contract with DIGIT the department to provide procurement advisory and review services for information technology projects as provided in s.

Page 32 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 Consumer282.0061(5)(a) Servicesor may,perform butany areof not required to, contract with DIGIT the departmentservices to provide procurement advisory and reviewfunctions servicesdescribed for information technology projects as provided in s.

282.0061(5)(a) or perform any of the services and functions described in s.

(b) DIGIT The department, acting through the Florida Digital Service, may not retrieve or disclose any data without a shared-data agreement in place between DIGIT the department and Page 33 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 (b) DIGIT The department, acting through the Florida Digital Service, may not retrieve or disclose any data without a shared-data agreement in place between DIGIT the department and the Department of Legal Affairs, the Department of Financial Services, or the Department of Agriculture and Consumer Services.

(9) If an information technology project implemented by a state agency must be connected to or otherwise accommodated by an information technology system administered by the Department of Legal Affairs, the Department of Financial Services, or the Department of Agriculture and Consumer Services, the state agency must consult with DIGIT regarding the risks and other effects of such project on the information technology systems of the Department of Legal Affairs, the Department of Financial Services, or the Department of Agriculture and Consumer Services, as applicable, and must work cooperatively with the Page 34 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 the Department of Legal Affairs, the Department of Financial Services, or the Department of Agriculture and Consumer Services, as applicable, and must work cooperatively with the Department of Legal Affairs, the Department of Financial Services, or the Department of Agriculture and Consumer Services, as applicable, regarding connections, interfaces, timing, or accommodations required to implement such project.

DIGIT shall develop and publish information technology policy that aligns with Pageindustry 35best practices for the management of 102the CODING:state’s information technology resources.

The policy must be updated as necessary to meet the requirements of this chapter and Page 35 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 industryadvancements bestin practicestechnology. for the management of the state’s information technology resources.

The policy must be updated as necessary to meet the requirements of this chapter and advancements in technology.

Page12. 36 of 102 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 12.

15.Page 36 of 100 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 15.

282.0061 Pagepursuant 37to ofthe 102schedule CODING:adopted.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 pursuant to the schedule adopted.

3.Page 37 of 100 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 3.

Total amount of expenditures for cloud data center services with a separate amount for expenditures for state data Pagecenter 38services. of 102 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 center services.

Consolidated information for the previous fiscal year aboutPage state38 informationof technology100 projects,CODING: which must include, at a minimum, the following information:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 about state information technology projects, which must include, at a minimum, the following information:

Recommendations must include the identification of existing information technology resources associated with the services, if existing services must be Pagetransferred 39as a result of 102being CODING:delivered and managed as enterprise information technology services, and which entity is best suited to manage the service.

Page 39 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 transferred(c)1. as a result of being delivered and managed as enterprise information technology services, and which entity is best suited to manage the service.

(c)1.

Each market analysis must be used to prepare a strategic plan for continued and future information technology and information services, including, but not limited to, proposed acquisitionsacquisition of new services or technologies and approaches to the implementation of any new services or technologies.

The online library must be accessible and searchable by all state agencies and the Department of Legal Affairs, the Department of Financial Services, and the Department of Agriculture and Consumer PageServices 40through ofa 102secure CODING:authentication system.

The library must include standardized checklists organized by technical subject areas to assist state agencies in measuring compliance Page 40 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 Serviceswith throughthe ainformation securetechnology authenticationpolicies, system.standards, guidelines, and best practices.

The library must include standardized checklists organized by technical subject areas to assist state agencies in measuring compliance with the information technology policies, standards, guidelines, and best practices.

The state agency requesting an exemptionexception must submit a formal justification to DIGIT detailing all of the following:

Pageb. 41 of 102 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 b.

d.Page 41 of 100 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 d.

(2) NEEDS ASSESSMENTS.— (a) By January 1, 2029, DIGIT shall conduct full baseline needs assessments of state agencies to document their respective technical environments, existing technical debt, security risks, Page 42 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 (a) By January 1, 2029, DIGIT shall conduct full baseline needs assessments of state agencies to document their respective technical environments, existing technical debt, security risks, and compliance with all information technology standards and guidelines developed and published by DIGIT.

(d) DIGIT shall support state agency strategic planning efforts and assist state agencies with the production of a phased roadmap to address known technology gaps and deficiencies Page 43 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 (d) DIGIT shall support state agency strategic planning efforts and assist state agencies with the production of a phased roadmap to address known technology gaps and deficiencies as identified in the needs assessments.

(c) Review all state agency information technology legislative budget requests for compliance with the enterprise architecture, project planning standards, and cybersecurity,cybersecurity and provide a report of the findings to the Executive Office of the Governor’s Office of Policy and Budget for consideration for Pagefunding 44decisions ofin 102the CODING:Governor’s recommended budget.

(4) DATA MANAGEMENT.— (a) DIGIT shall develop standards for use by state agencies Page 44 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 fundingwhich decisionssupport inbest practices for master data management at the Governor’sstate recommendedagency budget.level to facilitate enterprise data sharing and interoperability.

(4) DATA MANAGEMENT.— (a) DIGIT shall develop standards for use by state agencies which support best practices for master data management at the state agency level to facilitate enterprise data sharing and interoperability.

(b) Establish best practices and procurement processes,processes and develop metrics to support these processes for the procurement of information technology products and services in order to reduce costs or improve the provision of government services.

(c) Upon request, assist state agencies in the development Pageof 45information oftechnology-related 102legislative CODING:budget requests.

(d) Develop standards and accountability measures for information technology project planning and implementation, Page 45 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 ofincluding informationcriteria technology-relatedfor legislativeeffective budgetproject requests.management and oversight.

(d) Develop standards and accountability measures for information technology project planning and implementation, including criteria for effective project management and oversight.

Reporting requirements that ensure timely notifications to all defined stakeholders when an information technology project exceeds acceptable variances defined and documented in a project plan, including any variance that results in a schedule delay of 1 month or more,more or a cost increase of $1 million or more, and that establish procedures for escalating critical issues to appropriate individuals.

Technical reporting metrics to determine if an information technology project complies with the enterprise Pagearchitecture 46standards. of 102 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 architecture standards.

(e)Page Develop46 aof framework100 thatCODING: provides processes, activities, and deliverables state agencies must comply with when planning an information technology project.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 (e) Develop a framework that provides processes, activities, and deliverables state agencies must comply with when planning an information technology project.

PageReporting 47standards must include content, format, and frequency of 102project CODING:updates.

(g) Develop and provide training specific to information Page 47 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 Reportingtechnology standardsproject mustmanagement includeand content,oversight format,which supplements and frequencyenhances ofthe projecttraining updates.offered by the department and the Chief Financial Officer under s.

(g) Develop and provide training specific to information technology project management and oversight which supplements and enhances the training offered by the department and the Chief Financial Officer under s.

(i) Establish a streamlined reporting process with clear timelines and escalation procedures for notifying a state agency Pageof 48noncompliance ofwith 102the CODING:standards developed and adopted by DIGIT.

(6) INFORMATION TECHNOLOGY FINANCIAL DATA.— Page 48 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 of(a) noncomplianceIn consultation with thestate standardsagencies, developedDIGIT shall create a methodology, an approach, and adoptedapplicable bytemplates DIGIT.and formats for identifying and collecting both current and planned information technology expenditure data at the state agency level.

(j) Develop and maintain standards, performance metrics, and evaluation tools to measure the performance of information technology vendors that provide information technology commodities or services to the state.

The standards, metrics, and tools must:

1.

Be organized by vendor category, reflecting the different roles, services, and risk profiles of information technology vendors, including, but not limited to, software, cloud services, infrastructure, cybersecurity, systems integration, and professional services.

2.

Include objective, measurable criteria to assess vendor performance, which criteria may include timeliness, quality of deliverables, cost control, compliance with contract requirements, security and privacy practices, responsiveness, and customer satisfaction.

3.

Provide for the collection and analysis of performance data across state agencies to support consistent and comparable evaluations.

4.

Support a scoring mechanism that may be used in procurement and contract management processes, including the identification of vendors eligible for inclusion on a preferred vendors list established by DIGIT.

5.

Provide for the public availability of the preferred vendors list, including vendor rankings by category, in a manner determined by DIGIT.

6.

Require that, to the extent permitted by law, priority consideration in future procurements be given to vendors on the Page 49 of 102 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 preferred vendors list based on performance ranking and cost, as applicable to the procurement method used.

7.

Be periodically reviewed and updated to reflect evolving technology, market conditions, and state needs.

(6) INFORMATION TECHNOLOGY FINANCIAL DATA.— (a) In consultation with state agencies, DIGIT shall create a methodology, an approach, and applicable templates and formats for identifying and collecting both current and planned information technology expenditure data at the state agency level.

282.0062 DIGIT workgroups.—The following workgroups are established within DIGIT to facilitate coordination with state Pageagencies: 50 of 102 CODING:

(1) CHIEF INFORMATION OFFICER WORKGROUP.— (a) The chief information officer workgroup, composed of all state agency chief information officers, shall consider and make recommendations to the state chief information officer and Page 49 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 agencies:the state chief information architect on such matters as enterprise information technology policies, standards, services, and architecture.

(1) CHIEF INFORMATION OFFICER WORKGROUP.— (a) The chief information officer workgroup, composed of all state agency chief information officers, shall consider and make recommendations to the state chief information officer and the state chief information architect on such matters as enterprise information technology policies, standards, services, and architecture.

(3) ENTERPRISE SECURITY WORKGROUP.— (a) The enterprise security workgroup, composed of chief information security officer representatives from all state agencies, shall consider and make recommendations to the state chief information security officer on such matters as Page 5150 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 (3) ENTERPRISE SECURITY WORKGROUP.— (a) The enterprise security workgroup, composed of chief information security officer representatives from all state agencies, shall consider and make recommendations to the state chief information security officer on such matters as cybersecurity policies, standards, services, and architecture that promote the protection of state assets.

(5) ENTERPRISE INFORMATION TECHNOLOGY PROJECT MANAGEMENT WORKGROUP.— (a) The enterprise information technology project management workgroup, composed of information technology project manager representatives from all state agencies, shall consider and make recommendations to the state chief technology officer on such matters as information technology project management policies, standards, accountability measures, and services that Page 5251 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 management workgroup, composed of information technology project manager representatives from all state agencies, shall consider and make recommendations to the state chief technology officer on such matters as information technology project management policies, standards, accountability measures, and services that promote project governance and standardization across the enterprise.

(7) DEPARTMENT OF LEGAL AFFAIRS, DEPARTMENT OF FINANCIAL SERVICES, AND DEPARTMENT OF AGRICULTURE AND CONSUMER SERVICES INFORMATION TECHNOLOGY STAFF.—Appropriate information technology staff of the Department of Legal Affairs, the Department of Financial Services, and the Department of Agriculture and Consumer Services shall participate in the workgroups created under subsections (1), (2), and (3) and may participate in any other workgroups as authorized by their respective elected Page 5352 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 staff of the Department of Legal Affairs, the Department of Financial Services, and the Department of Agriculture and Consumer Services shall participate in the workgroups created under subsections (1), (2), and (3) and may participate in any other workgroups as authorized by their respective elected official.

(e) Develop strategies to recruit and retain information Pagetechnology 54professionals, ofincluding 102internship CODING:programs, apprenticeships, partnerships with educational institutions, scholarships for service, and initiatives to attract diverse talent.

(2) DIGIT shall consult with CareerSource Florida, Inc., Page 53 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 technologythe professionals,Department includingof internshipCommerce, programs,and apprenticeships,the partnershipsDepartment withof educationalEducation institutions,in scholarshipsthe forimplementation service,of andthis initiativessection. to attract diverse talent.

(2) DIGIT shall consult with CareerSource Florida, Inc., the Department of Commerce, and the Department of Education in the implementation of this section.

Page(b) 55Requirements ofto 102be CODING:included in solicitations.

(c) At a minimum, a requirement that any contract for information technology commodities or services meet the requirements of the enterprise architecture and National Institute of Standards and Technology Cybersecurity Framework.

Page 54 of 100 CODING:

Florida Senate - 2026 CS for CSSB 480 601-02525-26 2026480c1 (4) The policy must include the following requirements for SBany 480information 576-02812-26technology 2026480c2project (b)that Requirementsrequires toproject beoversight includedthrough inindependent solicitations.verification and validation:

(c) At a minimum, a requirement that any contract for information technology commodities or services meet the requirements of the enterprise architecture and National Institute of Standards and Technology Cybersecurity Framework.

(4) The policy must include the following requirements for any information technology project that requires project oversight through independent verification and validation:

The value of services delivered is commensurate with Pageproject 56costs. of 102 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 project costs.

(c) The entity performing independent verification and validation shall provide regular reports and assessments directlyPage to55 theof designated100 oversightCODING: body, identifying risks, deficiencies, and recommendations for corrective actions to ensure project success and compliance with statutory requirements.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 directly to the designated oversight body, identifying risks, deficiencies, and recommendations for corrective actions to ensure project success and compliance with statutory requirements.

282.00515, and explain the manner in which the department will Pageachieve 57the ofinformation 102technology CODING:policy.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 achieve the information technology policy.

282.318 Cybersecurity.— (3) DIGIT The department, acting through the Florida DigitalPage Service,56 isof the100 leadCODING: entity responsible for establishing standards and processes for assessing state agency cybersecurity risks and determining appropriate security measures that comply with the latest national and state data compliance security standards.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 Digital Service, is the lead entity responsible for establishing standards and processes for assessing state agency cybersecurity risks and determining appropriate security measures that comply with the latest national and state data compliance security standards.

The state chief information security officer must shall be notified of all confirmed or suspected incidents Pageor 58threats of 102state CODING:agency information technology resources and must report such incidents or threats to the state chief information officer and the Governor.

(b) Develop, and annually update by February 1, a statewide cybersecurity strategic plan that includes security goals and Page 57 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 orobjectives threatsfor ofcybersecurity, stateincluding agencythe informationidentification technologyand resourcesmitigation andof mustrisk, reportproactive suchprotections incidentsagainst orthreats, threatstactical torisk thedetection, statethreat chiefreporting, informationand officerresponse and therecovery Governor.protocols for a cyber incident.

(b) Develop, and annually update by February 1, a statewide cybersecurity strategic plan that includes security goals and objectives for cybersecurity, including the identification and mitigation of risk, proactive protections against threats, tactical risk detection, threat reporting, and response and recovery protocols for a cyber incident.

Identifying protection procedures to manage the protection of an agency’s information, data, and information Pagetechnology 59resources. of 102 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 technology resources.

Detecting threats through proactive monitoring of events,Page continuous58 securityof monitoring,100 andCODING: defined detection processes.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 events, continuous security monitoring, and defined detection processes.

Page(III) 60Level of3 102is CODING:a high-level incident that is likely to result in a demonstrable impact in the affected jurisdiction to public health or safety;

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 (III) Level 3 is a high-level incident that is likely to result in a demonstrable impact in the affected jurisdiction to public health or safety;

(IV) Level 2 is a medium-level incident that may impact publicPage health59 orof safety;100 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 public health or safety;

c.(I) A state agency shall report all ransomware incidents and any cybersecurity incident determined by the state agency to be of severity level 3, 4, or 5 to the state chief information security officer Cybersecurity Operations Center and the Cybercrime Office of the Department of Law Enforcement as soon as possible but no later than 48 hours after discovery of the cybersecurity incident and no later than 12 hours after Page 6160 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 be of severity level 3, 4, or 5 to the state chief information security officer Cybersecurity Operations Center and the Cybercrime Office of the Department of Law Enforcement as soon as possible but no later than 48 hours after discovery of the cybersecurity incident and no later than 12 hours after discovery of the ransomware incident.

The state chief information security officer PageCybersecurity 62Operations Center shall provide a consolidated incident report on a quarterly basis to the President of 102the CODING:Senate and, the Speaker of the House of Representatives, and the Florida Cybersecurity Advisory Council.

The report provided to the Florida Cybersecurity Advisory Council may not contain the Page 61 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 Cybersecurityname Operationsof Centerany shallagency, providenetwork ainformation, consolidatedor incidentsystem reportidentifying oninformation abut quarterlymust basiscontain tosufficient therelevant Presidentinformation ofto theallow Senate and, the SpeakerFlorida ofCybersecurity theAdvisory HouseCouncil ofto Representatives,fulfill andits theresponsibilities Floridaas Cybersecurityrequired Advisoryin Council.s.

The report provided to the Florida Cybersecurity Advisory Council may not contain the name of any agency, network information, or system identifying information but must contain sufficient relevant information to allow the Florida Cybersecurity Advisory Council to fulfill its responsibilities as required in s.

(e) In collaboration with the Cybercrime Office of the PageDepartment 63 of 102Law CODING:Enforcement, annually provide training for state agency information security managers and computer security incident response team members that contains training on cybersecurity, including cybersecurity threats, trends, and best practices.

Page 62 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 Department(f) ofAnnually Lawreview Enforcement,the annuallystrategic provide training for state agency information security managers and computeroperational security incident response team members that contains training on cybersecurity, including cybersecurity threats,plans trends,of andstate bestagencies. practices.

(f) Annually review the strategic and operational cybersecurity plans of state agencies.

Page(a) 64Designate an information security manager to administer the cybersecurity program of 102the CODING:state agency.

This designation must be provided annually in writing to DIGIT the department by January 1.

A state agency’s information security manager, for purposes of these information security duties, shall report Page 63 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 (a)directly Designate an information security manager to administer the cybersecurityagency programhead. of the state agency.

This designation must be provided annually in writing to DIGIT the department by January 1.

A state agency’s information security manager, for purposes of these information security duties, shall report directly to the agency head.

The plan must be based on the statewide cybersecurity strategic plan created by the state chief Pageinformation 65security officer department and include performance metrics that can be objectively measured to reflect the status of 102the CODING:state agency’s progress in meeting security goals and objectives identified in the agency’s strategic information security plan.

Page 64 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 information2. security officer department and include performance metrics that can be objectively measured to reflect the status of the state agency’s progress in meeting security goals and objectives identified in the agency’s strategic information security plan.

2.

If an independent third party a private sector vendor is used to complete a comprehensive risk assessment, it must attest to the validity of the risk Pageassessment 66findings. of 102 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 assessment findings.

The results of vulnerability and penetration tests on any Internet website or mobile application that processes any sensitive personal information or confidential information,information and a planPage to65 addressof any100 vulnerabilityCODING: identified in the tests.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 plan to address any vulnerability identified in the tests.

A written acknowledgment that the executive director or the secretary of the agency, the chief financial officer of the agency, and each executive manager as designated by the state agency,agency have been made aware of the risks revealed during the preparation of the agency’s operations cybersecurity plan and the comprehensive risk assessment.

119.07(1), except that such information must shall be available to the Auditor General, the Cybercrime Office of the Department of Law Enforcement, the state chief information security officer the Florida Digital Service within the department, and, for state agencies under the jurisdiction Pageof 67the ofGovernor, 102the CODING:Chief Inspector General.

(f) Implement managerial, operational, and technical safeguards and risk assessment remediation plans recommended by DIGIT the department to address identified risks to the data, information, and information technology resources of the agency.

Page 66 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 ofThe thestate Governor,chief information security officer department, through the ChiefFlorida InspectorDigital General.Service, shall track implementation by state agencies upon development of such remediation plans in coordination with agency inspectors general.

(f) Implement managerial, operational, and technical safeguards and risk assessment remediation plans recommended by DIGIT the department to address identified risks to the data, information, and information technology resources of the agency.

The state chief information security officer department, through the Florida Digital Service, shall track implementation by state agencies upon development of such remediation plans in coordination with agency inspectors general.

Service-level agreements must identify service provider and state agency responsibilities for privacy and security, protection of government data, Pagepersonnel 68background ofscreening, 102and CODING:security deliverables with associated frequencies.

(i) Provide cybersecurity awareness training to all state agency employees within 30 days after commencing employment, and annually thereafter, concerning cybersecurity risks and the Page 67 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 personnelresponsibility backgroundof screening,employees to comply with policies, standards, guidelines, and securityoperating deliverablesprocedures withadopted associatedby frequencies.the state agency to reduce those risks.

(i) Provide cybersecurity awareness training to all state agency employees within 30 days after commencing employment, and annually thereafter, concerning cybersecurity risks and the responsibility of employees to comply with policies, standards, guidelines, and operating procedures adopted by the state agency to reduce those risks.

(7) The portions of records made confidential and exempt in subsections (5) and (6) must shall be available to the Auditor PageGeneral, 69the Cybercrime Office of 102the CODING:Department of Law Enforcement, the state chief information security officer, the Legislature Florida Digital Service within the department, and, for agencies under the jurisdiction of the Governor, the Chief Inspector General.

Such portions of records may be made Page 68 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 General,available theto Cybercrimea Officelocal ofgovernment, theanother Department of Law Enforcement, the state chiefagency, informationor securitya officer,federal theagency Legislature Florida Digital Service within the department, and, for agenciescybersecurity underpurposes theor jurisdictionin furtherance of the Governor,state theagency’s Chiefofficial Inspectorduties. General.

Such portions of records may be made available to a local government, another state agency, or a federal agency for cybersecurity purposes or in furtherance of the state agency’s official duties.

(b) The state chief information security officer Florida PageDigital 70Service may provide the cybersecurity training required by this subsection in collaboration with the Cybercrime Office of 102the CODING:Department of Law Enforcement, a private sector entity, or an institution of the State University System.

(4) CYBERSECURITY STANDARDS.— Page 69 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 Digital(a) ServiceEach maylocal providegovernment theshall adopt cybersecurity trainingstandards requiredthat bysafeguard thisits subsectiondata, ininformation collaborationtechnology, withand theinformation Cybercrimetechnology Officeresources ofto theensure Departmentavailability, ofconfidentiality, Lawand Enforcement,integrity. a private sector entity, or an institution of the State University System.

(4) CYBERSECURITY STANDARDS.— (a) Each local government shall adopt cybersecurity standards that safeguard its data, information technology, and information technology resources to ensure availability, confidentiality, and integrity.

(5) INCIDENT NOTIFICATION.— (a) A local government shall provide notification of a cybersecurity incident or ransomware incident to the state chief information security officer Cybersecurity Operations Center, Pagethe 71Cybercrime Office of 102the CODING:Department of Law Enforcement, and the sheriff who has jurisdiction over the local government in accordance with paragraph (b).

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 the Cybercrime Office of the Department of Law Enforcement, and the sheriff who has jurisdiction over the local government in accordance with paragraph (b).

A summary of the facts surrounding the cybersecurity incidentPage or70 ransomwareof incident.100 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 incident or ransomware incident.

282.318(3)(c) to the state chief information security officer Cybersecurity Operations Center, the Cybercrime Office of the Department of Law Enforcement, and the sheriff who has jurisdiction over the local government as soon as possible but no later than 12 48 hours after discovery of the cybersecurity incident and no later than 6 12 hours after discovery of the Pageransomware 72incident. of 102 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 ransomware incident.

The state chief information security officer Cybersecurity Operations Center shall notify the President of the Senate and the Speaker of the House of Representatives of anyPage severity71 levelof 3,100 4,CODING: or 5 incident as soon as possible but no later than 12 hours after receiving a local government’s incident report.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 any severity level 3, 4, or 5 incident as soon as possible but no later than 12 hours after receiving a local government’s incident report.

(6) AFTER-ACTION REPORT.—A local government shall must submit to the state chief information security officer Florida PageDigital 73Service, within 1 week after the remediation of 102a CODING:cybersecurity incident or ransomware incident, an after-action report that summarizes the incident, the incident’s resolution, and any insights gained as a result of the incident.

By December 1, 2022, the Florida Digital Service shall establish guidelines Page 72 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 Digitaland Service,processes withinfor 1submitting week after the remediation of a cybersecurity incident or ransomware incident, an after-action reportreport. that summarizes the incident, the incident’s resolution, and any insights gained as a result of the incident.

By December 1, 2022, the Florida Digital Service shall establish guidelines and processes for submitting an after-action report.

(c) Develop and implement business continuity and disaster Pagerecovery 74plans, and annually conduct a live exercise of 102each CODING:plan.

(d) Enter into a service-level agreement with each customer entity to provide the required type and level of service or services.

If a customer entity fails to execute an agreement Page 73 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 recoverywithin plans,60 anddays annuallyafter conductcommencement of a liveservice, exercisethe ofstate eachdata plan.center may cease service.

(d) Enter into a service-level agreement with each customer entity to provide the required type and level of service or services.

If a customer entity fails to execute an agreement within 60 days after commencement of a service, the state data center may cease service.

Include a right-to-audit clause to ensure that the parties to the agreement have access to records for audit Pagepurposes 75during the term of 102the CODING:service-level agreement.

9.

Provide that a service-level agreement may be terminated by either party for cause only after giving the other party and the department notice in writing of the cause for termination and an opportunity for the other party to resolve the identified Page 74 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 purposescause duringwithin thea termreasonable ofperiod. the service-level agreement.

9.

Provide that a service-level agreement may be terminated by either party for cause only after giving the other party and the department notice in writing of the cause for termination and an opportunity for the other party to resolve the identified cause within a reasonable period.

The state data center shall provide customer entities with access to applications, servers, network components, and Pageother 76devices ofnecessary 102for CODING:entities to perform business activities and functions, and as defined and documented in a service-level agreement.

(g) In its procurement process, show preference for cloud- computing solutions that minimize or do not require the Page 75 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 otherpurchasing, devicesfinancing, necessaryor forleasing entitiesof tostate performdata businesscenter activitiesinfrastructure, and functions,that meet the needs of customer agencies, that reduce costs, and asthat definedmeet or exceed the applicable state and documentedfederal inlaws, aregulations, service-leveland agreement.standards for cybersecurity.

(g) In its procurement process, show preference for cloud- computing solutions that minimize or do not require the purchasing, financing, or leasing of state data center infrastructure, and that meet the needs of customer agencies, that reduce costs, and that meet or exceed the applicable state and federal laws, regulations, and standards for cybersecurity.

Page(2)(3) 77AGENCY LIMITATIONS.—Unless exempt from the use of 102the CODING:state data center pursuant to this section or authorized by the Legislature, a state agency may not:

(a) Create a new agency computing facility or data center, or expand the capability to support additional computer Page 76 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 (2)(3)equipment AGENCYin LIMITATIONS.—Unlessan exemptexisting fromagency thecomputing usefacility ofor the state data centercenter; pursuant to this section or authorized by the Legislature, a state agency may not:

(a) Create a new agency computing facility or data center, or expand the capability to support additional computer equipment in an existing agency computing facility or data center;

(c) Developing and implementing appropriate operating Pageguidelines 78and ofprocedures 102necessary CODING:for the state data center to perform its duties pursuant to subsection (1).

The guidelines and procedures must comply with applicable state and federal laws, regulations, and policies and conform to generally accepted governmental accounting and auditing standards.

The Page 77 of 100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 guidelines and procedures necessarymust forinclude, thebut stateneed datanot centerbe tolimited performto: its duties pursuant to subsection (1).

The guidelines and procedures must comply with applicable state and federal laws, regulations, and policies and conform to generally accepted governmental accounting and auditing standards.

The guidelines and procedures must include, but need not be limited to:

Providing a plan for consideration by the Legislative Budget Commission if the cost of a service is increased for a Pagereason 79other ofthan 102a CODING:customer entity’s request made pursuant to subparagraph 4.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 reason other than a customer entity’s request made pursuant to subparagraph 4.

Standardizing and consolidating procurement and contractingPage practices.78 of 100 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 contracting practices.

If the department does not respond to the Northwest Regional Data PageCenter, 80the ofinvoice 102will CODING:be approved by default.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 Center, the invoice will be approved by default.

282.2011Page Northwest79 Regional Data Center.— (1) For the purpose of providing100 dataCODING: center services to its state agency customers, the Northwest Regional Data Center is designated as the state data center for all state agencies, except as otherwise provided by law, and shall:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 282.2011 Northwest Regional Data Center.— (1) For the purpose of providing data center services to its state agency customers, the Northwest Regional Data Center is designated as the state data center for all state agencies, except as otherwise provided by law, and shall:

State the duration of the agreement term, which may not exceed 3 years, and specify the conditions for up to two optional 1-year renewals of the agreement before execution of a Pagenew 81agreement; of 102 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 new agreement;

Establish the services to be provided, the business standards that must be met for each service, the cost of each service, and the process by which the business standards for eachPage service80 areof to100 beCODING: objectively measured and reported;

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for SB 480 601-02525-26 2026480c1 each service are to be objectively measured and reported;

(d) ForIn purposesits ofprocurement chapterprocess, 273,show bepreference for cloud- computing solutions that minimize or do not require the custodianpurchasing or financing of resourcesstate anddata equipmentcenter locatedinfrastructure, inthat andmeet operated,the supported,needs of state agency customer entities, that reduce costs, and managedthat bymeet or exceed the applicable state dataand center.federal laws, regulations, and standards for cybersecurity.

(e) Assist state agency customer entities in transitioning from state data center services to other third-party cloud- Page 8281 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 (e)computing Assumeservices administrativeprocured accessby rightsa tocustomer resourcesentity andor equipment,by includingthe servers,Northwest networkRegional components,Data andCenter otheron devices,behalf consolidatedof into the statecustomer dataentity. center.

1.(f) Provide to the Board of Governors the total annual budget by major expenditure category, including, but not limited to, salaries, expenses, operating capital outlay, contracted services, or other personnel services, by July 30 each fiscal year.

Upon(g) consolidation,Provide ato each state agency shallcustomer relinquishits administrativeprojected rightsannual tocost consolidatedfor resourcesproviding andthe equipment.agreed-upon data center services by September 1 each fiscal year.

State(h) agenciesBy requiredNovember 15 of each year, provide to complythe withOffice federalof Policy and stateBudget criminalin justicethe informationExecutive securityOffice rulesof the Governor and policiesto shallthe retainchairs administrativeof accessthe rightslegislative sufficientappropriations tocommittees complythe withprojected costs of providing data center services for the managementfollowing controlfiscal provisionsyear offor thoseeach rulesstate andagency policies;customer.

however, the state data center shall have the appropriate type or level of rights to allow the center to comply with its duties pursuant to this section.

The Department of Law Enforcement shall serve as the arbiter of disputes pertaining to the appropriate type and level of administrative access rights pertaining to the provision of management control in accordance with the federal criminal justice information guidelines.

2.

The state data center shall provide customer entities with access to applications, servers, network components, and other devices necessary for entities to perform business activities and functions, and as defined and documented in a service-level agreement.

(f) In its procurement process, show preference for cloud- computing solutions that minimize or do not require the purchasing or financing of state data center infrastructure, that meet the needs of state agency customer entities, that reduce costs, and that meet or exceed the applicable state and federal laws, regulations, and standards for cybersecurity.

(g) Assist state agency customer entities in transitioning from state data center services to other third-party cloud- Page 83 of 102 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2026 CS for CS for SB 480 576-02812-26 2026480c2 computing services procured by a customer entity or by the Northwest Regional Data Center on behalf of the customer entity.

(h) Provide to the Board of Governors the total annual budget by major expenditure category, including, but not limited to, salaries, expenses, operating capital outlay, contracted services, or other personnel services, by July 30 each fiscal year.

(i) Provide to each state agency customer its projected annual cost for providing the agreed-upon data center services by September 1 each fiscal year.

(j) By November 15 of each year, provide to the Office of Policy and Budget in the Executive Office of the Governor and to the chairs of the legislative appropriations committees the projected costs of providing data center services for the following fiscal year for each state agency customer.

(k)(i) Provide a plan for consideration by the Legislative Budget Commission if the governing body of the center approves the use of a billing rate schedule after the start of the fiscal year which increases any state agency customer’s costs for that fiscal year.

(l)(j) Provide data center services that comply with applicable state and federal laws, regulations, and policies, including all applicable security, privacy, and auditing requirements.

(m)(k) Maintain performance of the data center facilities by ensuring proper data backup;

disaster Page 8482 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 recovery;

(n)(l) Submit invoices to state agency customers.

(o)(m) As funded in the General Appropriations Act, provide data center services to state agencies from multiple facilities.

Page 8583 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 (a) The purpose of the data repository is to create a centralized system for:

A proposed governance structure to oversee the Page 8684 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 implementation and operations of the repository.

Subsection (4) of section 282.206, Florida Page 8785 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 Statutes, is amended to read:

(b) Maintain an appropriate cost-allocation methodology that accurately bills state agency customers based solely on the Page 8886 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 actual direct and indirect costs of the services provided to state agency customers and ensures that, for any fiscal year, state agency customers are not subsidizing other customers of the data center.

Identify the products or services to be delivered with Page 8987 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 sufficient specificity to permit an external financial or performance audit;

(g) Provide to each state agency customer its projected annual cost for providing the agreed-upon data center services Page 9088 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 by September 1 each fiscal year.

Page 9189 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 (c) Exceed 30 days from receipt of approved invoices to remit payment for state data center services provided by the Northwest Regional Data Center.

Enhance the collection and coordination of treatment and Page 9290 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 outcome information as an ongoing evidence base for research and education related to behavioral health.

The structure and process that will be used to create an annual analysis and report that gives state agencies and the Page 9391 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 Legislature a better general understanding of trends and issues in the state’s behavioral health systems of care and the trends and issues in behavioral health systems related to criminal justice treatment, diversion, and incarceration.

287.0583 Contract requirements for information technology commodities or services.—A contract for information technology commodities or services involving the development, customization, implementation, integration, support, or maintenance of software systems, applications, platforms, or related services must include provisions ensuring all of the Page 9492 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 following:

(c)(3) The department may execute a state term contract for information technology commodities, consultant services, or staff augmentation contractual services that exceeds the 48- month requirement if the Secretary of Management Services and Page 9593 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 the state chief information officer certify in writing to the Executive Office of the Governor that a longer contract term is in the best interest of the state.

(b) The agency shall maintain a copy of the request for Page 9694 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 quote, the identity of the vendors that were sent the request for quote, and any vendor response to the request for quote for 2 years after the date of issuance of the purchase order.

(6)(a) Beginning October 1, 2021, and Each October 1 thereafter, the department shall prequalify firms and Page 9795 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 individuals to provide information technology staff augmentation contractual services and information technology commodities on state term contract.

Page 9896 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 (f)(g) Division of Retirement.

Evaluate common standards for artificial intelligence safety and security measures, including the benefits of requiring disclosure of the digital provenance for all images and audio created using generative artificial intelligence as a Page 9997 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 means of revealing the origin and edit of the image or audio, as well as the best methods for such disclosure.

Protect Floridians from bad actors who use artificial Page 10098 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 intelligence.

(5) Consult with the state chief information security Page 10199 of 102100 CODING:

Florida Senate - 2026 CS for CS for SB 480 576-02812-26601-02525-26 2026480c22026480c1 officer of the Division of Integrated Government Innovation and Technology within the Executive Office of the Governor Florida Digital Service within the Department of Management Services in the adoption of rules relating to the information technology security provisions in s.

Page 102100 of 102100 CODING: