Florida League of Cities

Cybersecurity (Monitor) – Failed 

CS/HB 1511 (Giallombardo) and CS/SB 1708 (DiCeglie) make several changes to the Local Government Cybersecurity (Act). The bills revise the definition of “cyber incident” and revise timelines for local governments to report cybersecurity incidents. The bills would require local governments to report cybersecurity incidents within four hours of discovery; current law allows for 48 hours. Ransomware incidents would be required to be reported within two hours of discovery; current law allows for 12 hours. Incidents would be reported to Florida Digital Service, the Cybersecurity Operations Center, the Cybercrime Office of the Department of Law Enforcement and the sheriff who has jurisdiction. The bills establish an operations committee within the Florida Digital Service to assist with collaboration between state agencies and local governments. The bills also provide municipalities with a presumption from liability in connection with a cybersecurity incident for entities that are substantially compliant with the Act. The bills do clarify that they do not establish a private cause of action, and failure of a municipality to implement a cybersecurity program does not constitute negligence. (Taggart)