SB 770 — Cybersecurity

Summary

Cybersecurity; Exempting the state chief technology officer from the Career Service System; requiring the Florida Digital Service to support state agencies with the use of electronic credentials in compliance with specified standards; revising the standards and processes for assessing state agency cybersecurity risks of the Department of Management Services, acting through the Florida Digital Service; requiring the Cybersecurity Operations Center to notify immediately the state chief information officer and the state chief information security officer of a reported incident, etc.

Bill Text

• Introduced S 770 Filed Current pdf

AI-generated reading aid from the bill's amendatory text — verify against the official bill.

This bill implements various changes to Florida's cybersecurity and digital service regulations, including exemptions from the Career Service System, revising definitions, and establishing new reporting requirements.

• Section 110.205

  The state chief information officer, the state chief data officer, and the state chief information security officer. → The state chief information officer, the state chief data officer, the state chief technology officer, and the state chief information security officer.

  Adds the state chief technology officer to the list of exempt positions from the Career Service System.

• Section 282.0041

  “Enterprise digital data” means information in electronic form which is deemed to be data owned by a state agency and held for state purposes by the state agency.

  Defines 'enterprise digital data' for clarity in cybersecurity and information management.

• Section 282.0041

  “Open data” is a subset of “data” and means data collected or created by a state agency, the Department of Legal Affairs, the Department of Financial Services, and the Department of Agriculture and Consumer Services, and structured in a way that enables the data to be fully discoverable and usable by the public. → “Open data” is a subset of “data” and means data collected or created by a state agency, the Department of Legal Affairs, the Department of Financial Services, and the Department of Agriculture and Consumer Services, and structured in a way that enables the data to be fully discoverable and usable by the public. The term does not include data that are restricted from public disclosure based on federal or state laws and regulations, including, but not limited to, those related to privacy, confidentiality, security, personal health, business or trade secret information, and exemptions from state public records laws; or data for which a state agency... is statutorily authorized to assess a fee for its distribution.

  Clarifies the definition of 'open data', including what is excluded from public disclosure.

• Section 282.0051

  The Florida Digital Service is established has been created within the department to lead the creation of enterprise information technology and cybersecurity standards... → The Florida Digital Service is established within the department to lead the creation of enterprise information technology and cybersecurity standards...

  Corrects the phrasing regarding the establishment of the Florida Digital Service.

• Section 282.0051

  The department, acting through the Florida Digital Service, shall provide training opportunities to state agencies to assist in the adoption of the project management and oversight standards.

  Requires the Florida Digital Service to provide training opportunities to aid state agencies in adopting cybersecurity standards.

• Section 282.0051

  The department, acting through the Florida Digital Service, shall report, by the 30th day after the end of each quarter... → The department, acting through the Florida Digital Service, shall report at least quarterly to the Executive Office of the Governor, the President of the Senate, and the Speaker of the House of Representatives on any information technology project that the department identifies as high-risk...

  Specifies quarterly reporting on high-risk information technology projects by the Florida Digital Service.

• Section 282.318

  State agencies shall report all ransomware and cybersecurity incidents to the Cybersecurity Operations Center and the Cybercrime Office.

  Introduces a requirement for state agencies to report all ransomware and cybersecurity incidents.

• Section 282.318

  The Cybersecurity Operations Center must notify the state chief information officer and the state chief information security officer immediately of a reported incident.

  Mandates immediate notification to key officials regarding reported cybersecurity incidents.

• Section 282.3185

  A local government must report a discovery of all ransomware incidents and certain cybersecurity incidents within specified timeframes.

  Establishes timeframes for local governments to report cybersecurity incidents.

• Section 282.319

  Revising the membership of the Florida Cybersecurity Advisory Council.

  Updates the membership structure of the Florida Cybersecurity Advisory Council.

Action History

1. June 16, 2025

   Died in Governmental Oversight and Accountability

2. May 03, 2025

   Indefinitely postponed and withdrawn from consideration

3. March 04, 2025

   Introduced

4. February 28, 2025

   Referred to Governmental Oversight and Accountability; Appropriations Committee on Agriculture, Environment, and General Government; Fiscal Policy

5. February 14, 2025

   Filed

Sponsors

• Gayle Harrell · Primary

Subjects