Florida 2022 Regular Session Status: In Committee

SB 828 — Critical Infrastructure

Last action — Died in Military and Veterans Affairs, Space, and Domestic Security

Track this bill free

No card. One bill, free forever — alerts when it moves.

  1. ✓
    Introduced
  2. 2
    In Committee
  3. 3
    Passed Senate
  4. 4
    Passed House
  5. 5
    To Executive
  6. 6
    Enacted

This bill died with 2022 Regular Session. It reached “In Committee” and never advanced before the session ended, so it can no longer move — a new version would have to be reintroduced in the current session.

This bill is no longer active — its legislative session has ended, so there is no live prognosis. It would have to be reintroduced in the current session to move again.

Summary

Critical Infrastructure; Creating the "Critical Infrastructure Standards and Procedures Act"; requiring a local government asset owner procuring certain components, services, or solutions or entering into certain contracts to require conformance with certain standards, beginning on a specified date; requiring such a local government asset owner to ensure that certain contracts require that certain components meet certain minimum standards, etc.

Bill Text

What changed in the latest version

127 added · 206 removed

127 line(s) added, 206 removed.

→
Previous
Latest
Florida Senate - 2022 SB 828 By Senator Hutson 7-00350-22 2022828__ A bill to be entitled An act relating to critical infrastructure;
Florida Senate - 2022 CS for SB 828 By the Committee on Governmental Oversight and Accountability;
providing a short title;
and Senator Hutson 585-02668-22 2022828c1 A bill to be entitled An act relating to critical infrastructure standards and procedures;
943.6873, F.S.;
282.32, F.S.;
providing a short title;
defining terms;
providing definitions;
requiring that, beginning on a specified date, asset owners ensure that the operation and maintenance of operational technology comply with specified standards and practices;
requiring a local government asset owner procuring certain components, services, or solutions or entering into certain contracts to require conformance with certain standards, beginning on a specified date;
requiring, beginning on a specified date, asset owners to require that certain components, services, and solutions conform to such standards and practices;
requiring such a local government asset owner to ensure that certain contracts require that certain components meet certain minimum standards;
requiring that certain contracts for critical infrastructure meet specified minimum standards;
requiring the Florida Digital Service, in consultation with the Florida Cybersecurity Advisory Council, to adopt rules;
providing requirements and procedures relating to civil actions based on cybersecurity- breach-related claims;
authorizing a court to take specified action upon a showing that a business, a service provider, or another person or entity violates the act;
authorizing the Department of Law Enforcement to institute appropriate legal proceedings against a business, a service provider, or another person or entity that violates the act;
providing procedures for such legal proceedings;
providing for departmental actions;
requiring the department to adopt rules;
WHEREAS, the operational technologies that automate the critical infrastructure of and commercial facilities in this state are experiencing a rapid increase in cybersecurity incidents, and the impact is serious, affecting daily life, Page 1 of 7 CODING:
WHEREAS, the operational technologies that automate the critical infrastructure of daily life are experiencing a rapid increase in cybersecurity incidents, and the impact of such incidents affect life, safety, the environment, and economic viability across sectors, and WHEREAS, the recent cybersecurity hacking and shutdown of the Colonial Pipeline by the criminal enterprise DarkSide in 2021;
the infiltration of the Bowman Avenue Dam in Rye Brook, New York, by Iranian hackers in 2013;
and the intrusion of numerous federal agencies by suspected Russian hackers underscore the need to provide the public and private sectors with clarity and support on how to improve the cybersecurity of control systems, NOW, THEREFORE, Page 1 of 4 CODING:
Florida Senate - 2022 SB 828 7-00350-22 2022828__ public safety, the environment, and economic viability across sectors, and WHEREAS, the recent cybersecurity intrusion of the public water system in Oldsmar, the hacking and shutdown of the Colonial Pipeline by the criminal enterprise Darkside, the infiltration of the Bowman Dam in Rye Brook, New York, by Iranian hackers in 2013, and the intrusion of numerous federal agencies by suspected Russian hackers underscore the need to provide the public and private sectors with clarity and support in improving control systems cybersecurity, NOW, THEREFORE, Be It Enacted by the Legislature of the State of Florida:
Florida Senate - 2022 CS for SB 828 585-02668-22 2022828c1 Be It Enacted by the Legislature of the State of Florida:
This act may be cited as the “Critical Infrastructure Standards and Procedures Act.” Section 2.
Section 282.32, Florida Statutes, is created to read:
Section 943.6873, Florida Statutes, is created to read:
282.32 Critical infrastructure standards and procedures.— (1) This section may be cited as the “Critical Infrastructure Standards and Procedures Act.” (2) The Legislature finds that standard definitions of the security capabilities of system components are necessary to provide a common language for product suppliers and other control system stakeholders and to simplify the procurement and integration processes for the computers, applications, network equipment, and control devices that make up a control system.
943.6873 Critical infrastructure standards;
The United States National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), which references several relevant cybersecurity standards, including the International Society of Automation ISA 62443 series of standards, is an appropriate resource for use in establishing such standard definitions.
civil actions.— (1) The Legislature finds that a standard definition of the security capabilities for system components will provide a common language for product suppliers and all other control system stakeholders, simplifying the procurement and integration processes for the computers, applications, network equipment, and control devices that make up a control system.
(3) As used in this section, the term:
The United States National Institute of Standards and Technology (NIST) published the NIST Cybersecurity Framework, which references several relevant cybersecurity standards, including the internationally recognized ISA/IEC 62443 series of standards.
(a) “Automation and control system” means the personnel, hardware, software, and policies involved in the operation of critical infrastructure which may affect or influence such critical infrastructure’s safe, secure, and reliable operation.
These standards define a set of measures and benchmarks Page 2 of 7 CODING:
(b) “Automation and control system component” means control systems and complementary hardware and software components that are installed and configured to operate in an automation and control system.
For purposes of this section, the term “control systems” includes, but is not limited to:
Page 2 of 4 CODING:
Florida Senate - 2022 SB 828 7-00350-22 2022828__ specifically built to guide organizations through the process of assessing the risk associated with a particular automation and control system and in identifying and applying security countermeasures to reduce that risk.
Florida Senate - 2022 CS for SB 828 585-02668-22 2022828c1 1.
(2) As used in this section, the term:
Distributed control systems, programmable logic controllers, remote terminal units, intelligent electronic devices, supervisory control and data acquisition, networked electronic sensing and control, monitoring and diagnostic systems, and process control systems, including basic process control system and safety-instrumented system functions, regardless of whether such functions are physically separate or integrated.
(a) “Asset owner” means the public or private owner of, or the entity accountable and responsible for operation of, the critical infrastructure and the automation and control system.
The asset owner is also the operator of the automation and control system components and the equipment under its control.
(b) “Automation and control system” means a collection of personnel, hardware, software, and policies associated with the operation of the critical infrastructure which can affect or influence its safe, secure, and reliable operation.
(c) “Automation and control system component” means control systems and any complementary hardware and software components installed and configured to operate in an automation and control system.
These systems include, but are not limited to:
1.
Control systems, including distributed control systems, programmable logic controllers, remote terminal units, intelligent electronic devices, supervisory control and data acquisition, networked electronic sensing and control, monitoring and diagnostic systems, and process control systems that include physically separate or integrated basic process control system and safety-instrumented system functions;
Associated information systems, such as advanced or multivariable control, online optimizers, dedicated equipment monitors, graphical interfaces, process historians, manufacturing execution systems, and plant information Page 3 of 7 CODING:
Associated information and analytic systems, including advanced or multivariable control, online optimizers, dedicated equipment monitors, graphical interfaces, process historians, manufacturing execution systems, and plant information management systems.
Words stricken are deletions;
words underlined are additions.
Florida Senate - 2022 SB 828 7-00350-22 2022828__ management systems;
and 3.
Show all 88 changed rows (48 more)
Previous
Latest
Associated internal, human, network, or machine interfaces used to provide control, safety, and manufacturing operations functionality to continuous, batch, discrete, and other processes as defined by the International Society of Automation ISA/IEC 62443 series of standards as referenced by the NIST Cybersecurity Framework.
(d) “Critical infrastructure” means all physical and virtual assets, systems, and networks considered vital and vulnerable to cybersecurity attacks, as determined by the department in consultation with the Florida Digital Service and the Florida Cybersecurity Advisory Council.
Critical infrastructure includes, but is not limited to, public transportation as defined in s.
163.566;
water and wastewater treatment facilities, public utilities, and public services subject to the jurisdiction, supervision, powers, and duties of the Florida Public Service Commission;
public buildings, including those operated by the State University System;
hospitals and public health facilities;
and financial services organizations regulated by the Department of Financial Services.
(e) “Cybersecurity-breach-related claim” means a legal proceeding or civil action against an asset owner for failure to meet the minimum standards required by this section.
(f) “Department” means the Department of Law Enforcement.
(g) “Operation technology” means the hardware and software that detects or causes a change through the direct monitoring or control of physical devices and systems, processes, and events in the critical infrastructure.
(3) Beginning on July 1, 2024, the asset owner shall ensure Page 4 of 7 CODING:
Words stricken are deletions;
words underlined are additions.
Florida Senate - 2022 SB 828 7-00350-22 2022828__ that the operation and maintenance of operational technology, including critical infrastructure, automation control systems, and automation control system components, are compliant with the standards and practices defined in the ISA/IEC 62443 series of standards as referenced by the NIST Cybersecurity Framework, including annual risk assessments and creation of a mitigation plan.
(4) Beginning on July 1, 2026, when procuring automation and control system components, services, or solutions, or when contracting for facility upgrades or the construction of critical infrastructure facilities, an asset owner shall require that those components, services, or solutions conform to the ISA/IEC 62443 series of standards as referenced by the NIST Cybersecurity Framework for defining measures to assure conformance.
All contracts awarded for construction, reconstruction, alteration, design, or commissioning of facilities identified as critical infrastructure must require that installed automation and control components meet the minimum standards for cybersecurity as defined by the ISA/IEC 62443 series of standards as referenced by the NIST Cybersecurity Framework.
(5) In any civil action based on a cybersecurity-breach- related claim, including a civil action brought by the department pursuant to subsection (6):
(a) A court shall determine as a matter of law whether the defendant made a good faith effort to comply with subsection (3) or subsection (4), as applicable.
(b) If the court determines that the defendant made such a good faith effort, the defendant is immune from civil liability.
Page 5 of 7 CODING:
Words stricken are deletions;
words underlined are additions.
Florida Senate - 2022 SB 828 7-00350-22 2022828__ (c) If the court determines that the defendant did not make such a good faith effort, the plaintiff may proceed with the action.
(d) The trial court, upon a showing that any business, service provider, or other person or entity is in violation of this section, may take any of the following actions:
1.
Issue a temporary or permanent injunction.
2.
Impose a civil penalty of not more than $2,500 for each unintentional violation or $7,500 for each intentional violation.
Award reasonable costs of enforcement, including reasonable attorney fees and costs.
Associated internal, human, network, or machine interfaces used to provide control, safety, and manufacturing operations functionality to continuous, batch, discrete, and other processes as defined in the ISA 62443 series of standards as referenced by the NIST CSF.
4.
(c) “Critical infrastructure” means infrastructure for which all assets, systems, and networks, regardless of whether physical or virtual, are considered vital and vulnerable to cybersecurity attacks as determined by the Florida Digital Service in consultation with the Florida Cybersecurity Advisory Council.
Grant any other relief as the court deems appropriate.
The term includes, but is not limited to, public transportation as defined in s.
(6) If the department has reason to believe that any business, service provider, or other person or entity is in violation of this section and that proceedings would be in the public interest, the department may institute an appropriate legal proceeding, which may include a civil action, against such party.
163.566(8);
(a) After the department has notified a business in writing of an alleged violation, the department may grant the business, service provider, or other person or entity a 30-day period to cure the alleged violation.
water and wastewater treatment facilities;
The department may consider the number of violations, the substantial likelihood of injury to the public, or the safety of persons or property in determining whether to grant the 30-day period to cure an alleged violation.
public utilities and services subject to the jurisdiction, supervision, powers, and duties of the Public Service Commission;
(b) If the business, service provider, or other person or entity cures the alleged violation to the satisfaction of the department and provides proof of such cure to the department, Page 6 of 7 CODING:
public buildings, including buildings operated by the state university system;
hospitals and public Page 3 of 4 CODING:
Florida Senate - 2022 SB 828 7-00350-22 2022828__ the department may issue a letter of guidance to the business, service provider, or other person or entity which indicates that the business, service provider, or other person or entity will not be offered a 30-day cure period for any future violation.
Florida Senate - 2022 CS for SB 828 585-02668-22 2022828c1 health facilities;
If the business, service provider, or other person or entity fails to cure the violation within 30 days, the department may bring a legal proceeding against the business for the alleged violation.
and financial services organizations.
(7) The department shall adopt rules, in consultation with the Florida Digital Service and the Florida Cybersecurity Advisory Council, to implement and administer this section.
(d) “Local government asset owner” means the local government owner or entity accountable and responsible for operation of critical infrastructure and its automation and control system.
The term includes the operator of the automation and control system and the equipment under control.
(e) “Operational technology” means the hardware and software that cause or detect a change through the direct monitoring or control of physical devices, systems, processes, or events in critical infrastructure.
(4) Beginning July 1, 2022, a local government asset owner procuring automation and control system components, services, or solutions or entering into a contract for the construction, reconstruction, alteration, or design of a critical infrastructure facility must require that such components, services, and solutions conform to the ISA 62443 series of standards as referenced by the NIST CSF.
Such local government asset owner shall ensure that all contracts for the construction, reconstruction, alteration, or design of a critical infrastructure facility require that installed automation and control system components meet the minimum standards for cybersecurity as defined in the ISA 62443 series of standards as referenced by the NIST CSF.
Section 2.
The Florida Digital Service shall, in consultation with the Florida Cybersecurity Advisory Council, adopt rules to implement this act.
This act shall take effect October 1, 2022.
This act shall take effect July 1, 2022.
Page 7 of 7 CODING:
Page 4 of 4 CODING:
⬇ Download PDF
View plain text versions (2)

Action History

  1. Died in Military and Veterans Affairs, Space, and Domestic Security

  2. Indefinitely postponed and withdrawn from consideration

  3. CS by Governmental Oversight and Accountability read 1st time

  4. Now in Military and Veterans Affairs, Space, and Domestic Security

  5. Pending reference review under Rule 4.7(2) - (Committee Substitute)

  6. CS by Governmental Oversight and Accountability; YEAS 5 NAYS 0

  7. On Committee agenda-- Governmental Oversight and Accountability, 02/02/22, 11:00 am, 37 Senate Building

  8. Introduced

  9. Referred to Governmental Oversight and Accountability; Military and Veterans Affairs, Space, and Domestic Security; Rules

  10. Filed

Sponsors

  • Governmental Oversight and Accountability · Primary
  • Hutson · Primary

Sponsorship breakdown

Export CSV (upgrade) →

2 sponsors · 0 co-sponsors · 162 not signed on

Sponsors (2)

  • Governmental Oversight and Accountability
  • Hutson

Co-sponsors (0)

None.

Not signed on (162)

162 members have not signed on to this bill.

Show all 162 →

"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.

Whip count is in markup. Polling the chamber and every recorded vote this session. Only the first open is slow. It’s instant for you after this. Calling the roll · Tallying · Engrossing

Votes

Subjects

public-safety technology
Cross-referencing the record. Reading this bill against every other bill in the corpus by meaning, not keywords. Only the first open is slow. It’s instant for you after this. Matching · Ranking · Engrossing

Frequently asked questions

What does SB 828 do?
Critical Infrastructure; Creating the "Critical Infrastructure Standards and Procedures Act"; requiring a local government asset owner procuring certain components, services, or solutions or entering into certain contracts to require conformance with certain standards, beginning on a specified date; requiring such a local government asset owner to ensure that certain contracts require that certain components meet certain minimum standards, etc.
Who sponsors SB 828?
SB 828 is sponsored by Governmental Oversight and Accountability and Hutson.
What is the current status of SB 828?
This bill died with 2022 Regular Session. It reached “In Committee” and never advanced before the session ended, so it can no longer move — a new version would have to be reintroduced in the current session.
Where can I track SB 828?
Track SB 828 free on One Click Politics — get push/email alerts when it moves.

Make your voice heard on SB 828

Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.

Find my representatives → Run a campaign

Stay ahead of SB 828

Last checked for changes 2 months ago · updated continuously

One Click Politics tracks every bill in Congress and all 50 states.

Track this bill →