The Florida Senate
BILL ANALYSIS AND FISCAL IMPACT STATEMENT
(This document is based on the provisions contained in the legislation as of the latest date listed below.)
Prepared By: The Professional Staff of the Committee on Appropriations
BILL: SB 2508
INTRODUCER: Appropriations Committee
SUBJECT: State Cybersecurity Operations
DATE: March 29, 2023 REVISED:
ANALYST STAFF DIRECTOR REFERENCE ACTION
Hunter Sadberry AP Submitted as Comm. Bill/Fav
I. Summary:
SB 2508 transfers the Cybersecurity Operations Center (CSOC) and its associated duties,
responsibilities, contracts, unexpended balances of appropriations, allocations, and positions
from the Florida Digital Service (FDS) within the Department of Management Services (DMS)
to the Florida Department of Law Enforcement (FDLE) via a type two transfer. The FDS
maintains primary responsibility for establishing enterprise cybersecurity policies and guidelines
in consultation with the state chief information security officer. The FDS is also tasked with
assessing and monitoring agency compliance with the cybersecurity governance framework. In
accordance with the recommendations of the February 1, 2021, Florida Cybersecurity Task Force
Final Report, the bill also requires state agencies to conduct comprehensive risk assessments on
an annual basis instead of once every three years.
The bill takes effect July 1, 2023.
II. Present Situation:
Over the last decade, cybersecurity has rapidly become a growing concern. The cyberattacks are
growing in frequency and severity. Cybercrime is expected to inflict $8 trillion worth of damage
globally in 2023.1 The United States is often a target of cyberattacks, including attacks on critical
infrastructure, and has been a target of more significant cyberattacks2 over the last 14 years than
1
Cybercrime Magazine, Cybercrime to Cost the World $8 Trillion Annually in 2023, Cybercrime To Cost The World 8
Trillion Annually In 2023 (cybersecurityventures.com) (last visited March 21, 2023).
2
“Significant cyber-attacks” are defined as cyber-attacks on a country’s government agencies, defense and high-tech
companies, or economic crimes with losses equating to more than a million dollars. FRA Conferences, Study: U.S. Largest
Target for Significant Cyber-Attacks, https://www.fraconferences.com/insights-articles/compliance/study-us-largest-target-
for-significant-cyber-
attacks/#:~:text=The%20United%20States%20has%20been%20on%20the%20receiving,article%20is%20from%20FRA%27s
%20sister%20company%2C%20Compliance%20Week (last visited March 21, 2023).
BILL: SB 2508 Page 2
any other country.3 The Colonial Pipeline is an example of critical infrastructure that was
attacked, disrupting what is arguably the nation’s most important fuel conduit.4
Ransomware is a type of cybersecurity incident where malware5 that is designed to encrypt files
on a device and renders the files and the systems that rely on them unusable. In other words,
critical information is no longer accessible. During a ransomware attack, malicious actors
demand a ransom in exchange for regained access through decryption. If the ransom is not paid,
the ransomware actors will often threaten to sell or leak the data or authentication information.
Even if the ransom is paid, there is no guarantee that the bad actor will follow through with
decryption.
In recent years, ransomware incidents have become increasingly prevalent among the nation’s
state, local, tribal, and territorial government entities and critical infrastructure organizations.6
For example, Tallahassee Memorial Hospital was hit by a ransomware attack February 2023, and
the hospital’s systems were forced to shut down, impacting many local residents in need of
medical care.7
Information Technology and Cybersecurity Management
The Department of Management Services (DMS) oversees information technology (IT)8
governance and security for the executive branch in Florida.9 The Florida Digital Service (FDS)
is housed within the DMS and was established in 2020 to replace the Division of State
Technology.10 The FDS works under the DMS to implement policies for information technology
and cybersecurity for state agencies.11
The head of the FDS is appointed by the Secretary of Management Services12 and serves as the
state chief information officer (CIO).13 The CIO must have at least five years of experience in
3
Id.
4
S&P Global, Pipeline operators must start reporting cyberattacks to government: TSA orders,
https://www.spglobal.com/commodityinsights/en/market-insights/latest-news/electric-power/052721-pipeline-operators-
must-start-reporting-cyberattacks-to-government-tsa-
orders?utm_campaign=corporatepro&utm_medium=contentdigest&utm_source=esgmay2021 (last visited March 21, 2023).
5
“Malware” means hardware, firmware, or software that is intentionally included or inserted in a system for a harmful
purpose. malware - Glossary | CSRC (nist.gov) (last visited March 21, 2023).
6
Cybersecurity and Infrastructure Agency, Ransomware 101, https://www.cisa.gov/stopransomware/ransomware-101 (last
visited March 21, 2023).
7
Tallahassee Democrat, TMH says it has taken ‘major step’ toward restoration after cybersecurity incident (February 15,
2023) https://www.tallahassee.com/story/news/local/2023/02/14/tmh-update-hospital-has-taken-major-step-toward-
restoration/69904510007/ (last visited March 21, 2023).
8
The term “information technology” means equipment, hardware, software, firmware, programs, systems, networks,
infrastructure, media, and related material used to automatically, electronically, and wirelessly collect, receive, access,
transmit, display, store, record, retrieve, analyze, evaluate, process, classify, manipulate, manage, assimilate, control,
communicate, exchange, convert, converge, interface, switch, or disseminate information of any kind or form. Section
282.0041(19), F.S.
9
See s. 20.22, F.S.
10
Chapter 2020-161, L.O.F.
11
See s. 20.22(2)(b), F.S.
12
The Secretary of Management Services serves as the head of the DMS and is appointed by the Governor, subject to
confirmation by the Senate. Section 20.22(1), F.S.
13
Section 282.0051(2)(a), F.S.
BILL: SB 2508 Page 3
the development of IT system strategic planning and IT policy and, preferably, have leadership-
level experience in the design, development, and deployment of interoperable software and data
solutions.14 The FDS must propose innovative solutions that securely modernize state
government, including technology and information services, to achieve value through digital
transformation and interoperability, and to fully support Florida’s cloud first policy.15
The DMS, through the FDS, has the following powers, duties, and functions:
Develop IT policy for the management of the state’s IT resources;
Develop an enterprise architecture;
Establish project management and oversight standards with which state agencies must
comply when implementing IT projects;
Perform project oversight on all state agency IT projects that have a total cost of $10 million
or more and that are funded in the General Appropriations Act or any other law; and
Identify opportunities for standardization and consolidation of IT services that support
interoperability, Florida’s cloud first policy, and business functions and operations that are
common across state agencies.16
Information Technology Security Act
In 2021, the Legislature passed the IT Security Act,17 which requires the DMS and the state
agency18 heads to meet certain requirements in order to enhance the IT security of state agencies.
Specifically, the IT Security Act provides that the DMS is responsible for establishing standards
and processes consistent with accepted best practices for IT security,19 including cybersecurity,
and adopting rules that help agencies safeguard their data, information, and IT resources to
ensure availability, confidentiality, integrity, and to mitigate risks.20 In addition, the DMS must:
Designate a state chief information security officer (CISO) to oversee state IT security;
Develop, and annually update, a statewide IT security strategic plan;
Develop and publish an IT security governance framework for use by state agencies;
Collaborate with the Cybercrime Office within the Florida Department of Law Enforcement
(FDLE) to provide training; and
Annually review the strategic and operational IT security plans of executive branch
agencies.21
14
Id.
15
Section 282.0051 (1), F.S.
16
Id.
17
Section 282.318, F.S.
18
The term “state agency” means any official, officer, commission, board, authority, council, committee, or department of
the executive branch of state government; the Justice Administrative Commission; and the Public Service Commission. The
term does not include university boards of trustees or state universities. S. 282.0041(33), F.S. For purposes of the IT Security
Act, the term includes the Department of Legal Affairs, the Department of Agriculture and Consumer Services, and the
Department of Financial Services. Section 282.318(2), F.S.
19
The term “information technology security” means the protection afforded to an automated information system in order to
attain the applicable objectives of preserving the integrity, availability, and confidentiality of data, information, and
information technology resources. Section 282.0041(22), F.S.
20
Section 292.318(3), F.S.
21
Id.
BILL: SB 2508 Page 4
State Cybersecurity Act
In 2022, the Legislature passed the State Cybersecurity Act,22 which requires the DMS and the
heads of the state agencies23 to meet certain requirements to enhance the cybersecurity24 of the
state agencies.
The DMS through FDS is tasked with completing the following:
Establishing standards for assessing agency cybersecurity risks;
Adopting rules to mitigate risk, support a security governance framework, and safeguard
agency digital assets, data,25 information, and IT resources;26
Designating a chief information security officer (CISO);
Developing and annually updating a statewide cybersecurity strategic plan such as
identification and mitigation of risk, protections against threats, and tactical risk detection for
cyber incidents;27
Developing and publishing for use by state agencies a cybersecurity governance framework;
Assisting the state agencies in complying with the State Cybersecurity Act;
Annually providing training on cybersecurity for managers and team members;
Annually reviewing the strategic and operational cybersecurity plans of state agencies;
Tracking the state agencies’ implementation of remediation plans;
Providing cybersecurity training to all state agency technology professionals that develops,
assesses, and documents competencies by role and skill level;
Maintaining a Cybersecurity Operations Center (CSOC) led by the CISO to serve as a
clearinghouse for threat information and coordinate with the FDLE to support responses to
incidents; and
Leading an Emergency Support Function under the state emergency management plan.28
The State Cybersecurity Act requires the head of each state agency to designate an information
security manager to administer the state agency’s cybersecurity program.29 The head of the
agency has additional tasks in protecting against cybersecurity threats as follows:
Establish a cybersecurity incident response team with the FLDS and the Cybercrime Office,
which must immediately report all confirmed or suspected incidents to the CISO;
Annually submit to the DMS the state agency’s strategic and operational cybersecurity plans;
22
Section 282.318, F.S.
23
For purposes of the State Cybersecurity Act, the term “state agency” includes the Department of Legal Affairs, the
Department of Agriculture and Consumer Services, and the Department of Financial Services. Section 282.318(2), F.S.
24
“Cybersecurity” means the protection afforded to an automated information system in order to attain the applicable
objectives of preserving the confidentiality, integrity, and availability of data, information, and information technology
resources. Section 282.0041(8), F.S.
25
“Data” means a subset of structured information in a format that allows such information to be electronically retrieved and
transmitted. Section 282.0041(9), F.S.
26
“Information technology resources” means data processing hardware and software and services, communications, supplies,
personnel, facility resources, maintenance, and training. Section 282.0041(22), F.S.
27
“Incident” means a violation or imminent threat of violation, whether such violation is accidental or deliberate, of
information technology resources, security, policies, or practices. An imminent threat of violation refers to a situation in
which the state agency has a factual basis for believing that a specific incident is about to occur. Section 282.0041(19), F.S.
28
Section 282.318(3), F.S.
29
Section 282.318(4)(a), F.S.
BILL: SB 2508 Page 5
Conduct and update a comprehensive risk assessment to determine the security threats once
every three years;
Develop and update written internal policies and procedures for reporting cyber incidents;
Implement safeguards and risk assessment remediation plans to address identified risks;
Ensure internal audits and evaluations of the agency’s cybersecurity program are conducted;
Ensure that the cybersecurity requirements for the solicitation, contracts, and service-level
agreement of IT and IT resources meet or exceed applicable state and federal laws,
regulations, and standards for cybersecurity, including the National Institute of Standards and
Technology (NIST)30 cybersecurity framework;
Provide cybersecurity training to all agency employees within 30 days of employment; and
Develop a process that is consistent with the rules and guidelines established by the FDS for
detecting, reporting, and responding to threats, breaches, or cybersecurity incidents.31
Florida Cybersecurity Advisory Council
The Florida Cybersecurity Advisory Council32 (CAC) within the DMS33 assists state agencies in
protecting IT resources from cyber threats and incidents.34 The CAC must assist the FDS in
implementing best cybersecurity practices, taking into consideration the final recommendations
of the Florida Cybersecurity Task Force – a task force created to review and assess the state’s
cybersecurity infrastructure, governance, and operations.35 The CAC meets at least quarterly to:
Review existing state agency cybersecurity policies;
Assess ongoing risks to state agency IT;
Recommend a reporting and information sharing system to notify state agencies of new risks;
Recommend data breach simulation exercises;
Assist the FDS in developing cybersecurity best practice recommendations; and
Examine inconsistencies between state and federal law regarding cybersecurity. 36
The CAC must work with NIST and other federal agencies, private sector businesses, and private
security experts to identify which local infrastructure sectors, not covered by federal law, are at
the greatest risk of cyber-attacks and to identify categories of critical infrastructure as critical
cyber infrastructure if cyber damage to the infrastructure could result in catastrophic
consequences.37
30
NIST, otherwise known as the National Institute of Standards and Technology, “is a non-regulatory government agency
that develops technology, metrics, and standards to drive innovation and economic competitiveness at U.S.-based
organizations in the science and technology industry.” Nate Lord, What is NIST Compliance, DataInsider (Dec. 1, 2020),
https://www.digitalguardian.com/blog/what-nist-compliance (last visited March 17, 2023).
31
Section 282.318(4), F.S.
32
Under Florida law, an “advisory council” means an advisory body created by specific statutory enactment and appointed to
function on a continuing basis. Generally, an advisory council is enacted to study the problems arising in a specified
functional or program area of state government and to provide recommendations and policy alternatives. Section 20.03(7),
F.S.; See also s. 20.052, F.S.
33
Section 282.319(1), F.S.
34
Section 282.319(2), F.S.
35
Section 282.319(3), F.S.
36
Section 282.319(9), F.S.
37
Section 282.319(10), F.S.
BILL: SB 2508 Page 6
The CAC must also prepare and submit a comprehensive report to the Governor, the President of<