SB 658 — Cybersecurity Incident Liability

Florida Senate - 2024 CS for SB 658 By Senatorthe DiCeglieCommittee 18-00891-24on 2024658__Governmental AOversight billand toAccountability; be entitled An act relating to cybersecurity incident liability;

and Senator DiCeglie 585-03019-24 2024658c1 A bill to be entitled An act relating to cybersecurity incident liability;

providing that a county, municipality, other political subdivision of the state, commercial entity, or third-party agent that complies with certain requirements is not liable in connection with a cybersecurity incident;

282.3185282.3185, isand notany liableother inpolitical connectionsubdivision withof athe cybersecuritystate incident.that substantially complies with s.

(2)282.3185 Aon solea proprietorship,voluntary partnership,basis, corporation, trust, estate, cooperative, association, or other commercial entity or third-party agent that acquires, maintains, stores, or uses personal information is not liable in connection with a cybersecurity incidentincident. if the entity substantially complies with s.

501.171,(2) ifA applicable,sole andproprietorship, has:partnership, corporation, trust, estate, cooperative, association, or other commercial entity or third-party agent that acquires, maintains, stores, or uses Page 1 of 4 CODING:

Page 1 of 3 CODING:

Florida Senate - 2024 CS for SB 658 18-00891-24585-03019-24 2024658__2024658c1 (a)personal Adoptedinformation ais cybersecuritynot programliable thatin substantiallyconnection aligns with thea currentcybersecurity versionincident ofif anythe standards,entity guidelines,substantially orcomplies regulationswith thats. implement any of the following:

501.171, if applicable, and has:

(a) Adopted a cybersecurity program that substantially aligns with the current version of any standards, guidelines, or regulations that implement any of the following:

part 160 and part 164,164 subparts A and C.

The Federal Information Security Modernization Act of 2014,Page Pub.2 of 4 CODING:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2024 CS for SB 658 585-03019-24 2024658c1 2014, Pub.

Page(3) 2The scale and scope of 3substantial CODING:alignment with a standard, law, or regulation under paragraph (2)(a) or paragraph (2)(b) by a covered entity or third-party agent, as applicable, is appropriate if it is based on all of the following factors:

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2024 SB 658 18-00891-24 2024658__ (3) The scale and scope of substantial alignment with a standard, law, or regulation under paragraph (2)(a) or paragraph (2)(b) by a covered entity or third-party agent, as applicable, is appropriate if it is based on all of the following factors:

(4) Any commercial entity or third-party agent covered by subsection (2) whichthat substantially complies with a combination of industry-recognized cybersecurity frameworks or standards to gain the presumption against liability pursuant to subsection (2) must, upon the revision of two or more of the frameworks or standards with which the entity complies, adopt the revised frameworks or standards within 1 year after the latest publication date stated in the revisions and, if applicable, comply with the Payment Card Industry Data Security Standard (PCI DSS).

Failure of a county, municipality, other political subdivision of the state, or commercial entity to substantially implement a cybersecurity program that is in compliance with this section is not evidence of negligence and does not constitute negligence per se.

(6) In an action in connection with a cybersecurity incident,Page if3 the defendant is an entity covered by subsection (1) or subsection (2), the defendant has the burden of proof4 toCODING: establish substantial compliance.

Words stricken are deletions;

words underlined are additions.

Florida Senate - 2024 CS for SB 658 585-03019-24 2024658c1 incident, if the defendant is an entity covered by subsection (1) or subsection (2), the defendant has the burden of proof to establish substantial compliance.

Page 34 of 34 CODING: