F L O R I D A H O U S E O F R E P R E S E N T A T I V E S CS/CS/HB473CS/HB473 2024 A bill to be entitled An act relating to cybersecurity incident liability;
providing definitions;that a county, municipality, other political subdivision of the state, commercial entity, or third-party agent that complies with certain requirements is not liable in connection with a cybersecurity incident;
providingrequiring thatcertain aentities county,to municipality,adopt othercertain politicalrevised subdivisionframeworks of the state, covered entity, or third-standards partywithin agent that complies with certain requirements is not liable in connection with a cybersecurityspecified incident;time period;
requiring covered entities and third-party agents to adopt revised frameworks, standards, laws, or regulations within a specified time period;
providing applicability;
768.401 Limitation on liability for cybersecurity incidents.— (1) AsA usedcounty inor thismunicipality section,that thesubstantially term:complies with s.
(a) "Covered entity" means a sole proprietorship, Page 1of 5 CODING:
Words strickenare deletions;
words underlined are additions.
hb0473-02-c2 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S CS/CS/HB473 2024 partnership, corporation, trust, estate, cooperative, association, or other commercial entity.
(b) "Third-party agent" means an entity that has been contracted to maintain, store, or process personal information on behalf of a covered entity.
(2) A county or municipality that substantially complies with s.
282.3185 on a voluntary basis, is not liable in connection with a cybersecurityPage incident.1of 4 CODING:
(3) A covered entity or third-party agent that acquires, maintains, stores, processes, or uses personal information is not liable in connection with a cybersecurity incident if the covered entity or third-party agent does all of the following, as applicable:
(a) Substantially complies with s.
501.171(3)-(6), as applicable.
(b)1.
Has adopted a cybersecurity program that substantially aligns with the current version of any standards, guidelines, or regulations that implement any of the following:
a.
The National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity;
b.
NIST special publication 800-171;
c.
NIST special publications 800-53 and 800-53A;
Page 2of 5 CODING:
hb0473-02-c2hb0473-01-c1 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S CS/CS/HB473CS/HB473 2024 d.cybersecurity incident.
The(2) FederalA Risksole andproprietorship, Authorizationpartnership, Managementcorporation, Programtrust, securityestate, assessmentcooperative, framework;association, or other commercial entity or third-party agent that acquires, maintains, stores, or uses personal information is not liable in connection with a cybersecurity incident if the entity substantially complies with s.
e.501.171, if applicable, and has:
The(a) CenterAdopted fora Internetcybersecurity Securityprogram (CIS)that Criticalsubstantially Securityaligns Controls;with the current version of any standards, guidelines, or regulations that implement any of the following:
f.1.
The National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity.
2.
NIST special publication 800-171.
3.
NIST special publications 800-53 and 800-53A.
4.
The Federal Risk and Authorization Management Program security assessment framework.
5.
The Center for Internet Security (CIS) Critical Security Controls.
6.
g.or (b) If regulated by the state or Federal Government, or both, or if otherwise subject to the requirements of any of the following laws and regulations, substantially aligned its Page 2of 4 CODING:
HITRUSTWords Commonstrickenare Securitydeletions; Framework (CSF);
h.words underlined are additions.
Servicehb0473-01-c1 OrganizationF ControlL TypeO 2R (SOCI 2)D Framework;A H O U S E O F R E P R E S E N T A T I V E S CS/HB473 2024 cybersecurity program to the current version of the following, as applicable:
i.1.
Secure Controls Framework;
or j.
Other similar industry frameworks or standards;
or 2.
If regulated by the state or Federal Government, or both, or if otherwise subject to the requirements of any of the following laws and regulations, has adopted a cybersecurity program that substantially aligns with the current version of the following, as applicable:
a.
b.2.
c.3.
d.4.
Page(3) 3ofThe 5scale CODING:and scope of substantial alignment with a standard, law, or regulation under paragraph (2)(a) or paragraph (2)(b) by a covered entity or third-party agent, as applicable, is appropriate if it is based on all of the following factors:
Words strickenare deletions;
words underlined are additions.
hb0473-02-c2 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S CS/CS/HB473 2024 e.
The Criminal Justice Information Services (CJIS) Security Policy.
f.
Other similar requirements mandated by state or federal law or regulation.
(4) A covered entity's or third-party agent's substantial alignment with a framework or standard under subparagraph (3)(b)1.
or with a law or regulation under subparagraph (3)(b)2.
may be demonstrated by providing documentation or other evidence of an assessment, conducted internally or by a third-party, reflecting that the covered entity's or third-party agent's cybersecurity program is substantially aligned with the relevant framework or standard or with the applicable state or federal law or regulation.
In determining whether a covered entity's or third-party agent's cybersecurity program is in substantial alignment, all of the following factors must be considered:
(5)(4) Any coveredcommercial entity or third-party agent mustcovered substantiallyby alignsubsection its(2) cybersecuritythat programsubstantially complies with anya revisionscombination of relevantindustry-recognized cybersecurity frameworks or standards orto ofgain applicablethe statepresumption oragainst federalliability lawspursuant orto regulationssubsection within(2) 1must, yearupon after the latestrevision publicationof datetwo statedor inmore anyof suchthe revisionsframeworks inor order to retain Page 4of3of 54 CODING:
hb0473-02-c2hb0473-01-c1 F L O R I D A H O U S E O F R E P R E S E N T A T I V E S CS/CS/HB473CS/HB473 2024 protectionstandards fromwith liability.which the entity complies, adopt the revised frameworks or standards within 1 year after the latest publication date stated in the revisions and, if applicable, comply with the Payment Card Industry Data Security Standard (PCI DSS).
(6)(5) This section does not establish a private cause of action.
(7) Failure of a county, municipality, other political subdivision of the state, covered entity, or third-partycommercial agententity to substantially implement a cybersecurity program that is in compliance with this section is not evidence of negligence and does not constitute negligence per se.
(8)(6) In an action relatingin toconnection with a cybersecurity incident, if the defendant is aan county,entity municipality, or political subdivision covered by subsection (2)(1) or a covered entity or third-party agent covered by subsection (3),(2), the defendant has the burden of proof to establish substantial compliance.
The amendments made by this act apply to any suit filed on or after the effective date of this act and to any putative class action not certified on or before the effective date of this act.
Section 3.
Page 5of4of 54 CODING:
hb0473-02-c2hb0473-01-c1