Bill Text: FL S7050 | 2016 | Regular Session | Prefiled

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: Information Technology Security

Spectrum: Committee Bill

Status: (Introduced - Dead) 2016-03-07 - Laid on Table, companion bill(s) passed, see CS/CS/CS/HB 1033 (Ch. 2016-138), CS/SB 624 (Ch. 2016-114) [S7050 Detail]

Download: Florida-2016-S7050-Prefiled.html

---

       Florida Senate - 2016                   (PROPOSED BILL) SPB 7050
       
       
        
       FOR CONSIDERATION By the Committee on Governmental Oversight and
       Accountability
       
       585-01783A-16                                         20167050pb
    1                        A bill to be entitled                      
    2         An act relating to information technology security;
    3         amending s. 20.61, F.S.; revising the membership of
    4         the Technology Advisory Council to include a
    5         cybersecurity expert; requiring the council, in
    6         coordination with the Florida Center for
    7         Cybersecurity, to identify and recommend STEM training
    8         opportunities; amending s. 282.318, F.S.; revising
    9         duties of the Agency for State Technology; providing
   10         for administration of a third-party risk assessment;
   11         providing for the establishment of computer security
   12         incident response teams within state agencies;
   13         establishing procedures for reporting information
   14         technology security incidents; providing for
   15         continuously updated agency incident response plans;
   16         providing for information technology security and
   17         cybersecurity awareness training; providing for the
   18         establishment of a collaborative STEM program for
   19         cybersecurity workforce development; establishing
   20         computer security incident response team
   21         responsibilities; requiring each state agency head to
   22         conduct a third-party administered risk assessment;
   23         establishing notification procedures and reporting
   24         timelines for an information technology security
   25         incident or breach; amending s. 1001.03, F.S.;
   26         revising entities directed to adopt a unified state
   27         plan for K-20 STEM education to include the Technology
   28         Advisory Council; amending s. 1004.444, F.S.;
   29         requiring the Florida Center for Cybersecurity to
   30         coordinate with the Technology Advisory Council;
   31         providing appropriations; providing an effective date.
   32          
   33  Be It Enacted by the Legislature of the State of Florida:
   34  
   35         Section 1. Subsection (3) of section 20.61, Florida
   36  Statutes, is amended to read:
   37         20.61 Agency for State Technology.—The Agency for State
   38  Technology is created within the Department of Management
   39  Services. The agency is a separate budget program and is not
   40  subject to control, supervision, or direction by the Department
   41  of Management Services, including, but not limited to,
   42  purchasing, transactions involving real or personal property,
   43  personnel, or budgetary matters.
   44         (3) The Technology Advisory Council, consisting of seven
   45  members, is established within the Agency for State Technology
   46  and shall be maintained pursuant to s. 20.052. Four members of
   47  the council shall be appointed by the Governor, two of whom must
   48  be from the private sector and one of whom must be a
   49  cybersecurity expert. The President of the Senate and the
   50  Speaker of the House of Representatives shall each appoint one
   51  member of the council. The Attorney General, the Commissioner of
   52  Agriculture and Consumer Services, and the Chief Financial
   53  Officer shall jointly appoint one member by agreement of a
   54  majority of these officers. Upon initial establishment of the
   55  council, two of the Governor’s appointments shall be for 2-year
   56  terms. Thereafter, all appointments shall be for 4-year terms.
   57         (a) The council shall consider and make recommendations to
   58  the executive director on such matters as enterprise information
   59  technology policies, standards, services, and architecture. The
   60  council may also identify and recommend opportunities for the
   61  establishment of public-private partnerships when considering
   62  technology infrastructure and services in order to accelerate
   63  project delivery and provide a source of new or increased
   64  project funding.
   65         (b) The executive director shall consult with the council
   66  with regard to executing the duties and responsibilities of the
   67  agency related to statewide information technology strategic
   68  planning and policy.
   69         (c) The council shall coordinate with the Florida Center
   70  for Cybersecurity to identify and recommend opportunities for
   71  establishing cutting-edge educational and training programs in
   72  science, technology, engineering, and mathematics (STEM) for
   73  students, consistent with the unified state plan adopted
   74  pursuant to s. 1001.03(17); increasing the cybersecurity
   75  workforce in the state; and preparing cybersecurity
   76  professionals to possess a wide range of expertise.
   77         (d)(c) The council shall be governed by the Code of Ethics
   78  for Public Officers and Employees as set forth in part III of
   79  chapter 112, and each member must file a statement of financial
   80  interests pursuant to s. 112.3145.
   81         Section 2. Section 282.318, Florida Statutes, is amended to
   82  read:
   83         282.318 Security of data and information technology.—
   84         (1) This section may be cited as the “Information
   85  Technology Security Act.”
   86         (2) As used in this section, the term “state agency” has
   87  the same meaning as provided in s. 282.0041, except that the
   88  term includes the Department of Legal Affairs, the Department of
   89  Agriculture and Consumer Services, and the Department of
   90  Financial Services.
   91         (3) The Agency for State Technology is responsible for
   92  establishing standards and processes consistent with generally
   93  accepted best practices for information technology security and
   94  cybersecurity and adopting rules that safeguard an agency’s
   95  data, information, and information technology resources to
   96  ensure availability, confidentiality, and integrity and to
   97  mitigate risks. The agency shall also:
   98         (a) Develop, and annually update by February 1, a statewide
   99  information technology security strategic plan that includes
  100  security goals and objectives for the strategic issues of
  101  information technology security policy, risk management,
  102  training, incident management, and disaster recovery planning.
  103         (b) Develop and publish for use by state agencies an
  104  information technology security framework that, at a minimum,
  105  includes guidelines and processes for:
  106         1. Establishing asset management procedures to ensure that
  107  an agency’s information technology resources are identified and
  108  managed consistent with their relative importance to the
  109  agency’s business objectives.
  110         2. Using a standard risk assessment methodology that
  111  includes the identification of an agency’s priorities,
  112  constraints, risk tolerances, and assumptions necessary to
  113  support operational risk decisions.
  114         3. Completing comprehensive risk assessments and
  115  information technology security audits and submitting completed
  116  assessments and audits to the Agency for State Technology.
  117         4. Completing risk assessments administered by a third
  118  party and submitting completed assessments to the Agency for
  119  State Technology.
  120         5.4. Identifying protection procedures to manage the
  121  protection of an agency’s information, data, and information
  122  technology resources.
  123         6.5. Establishing procedures for accessing information and
  124  data to ensure the confidentiality, integrity, and availability
  125  of such information and data.
  126         7.6. Detecting threats through proactive monitoring of
  127  events, continuous security monitoring, and defined detection
  128  processes.
  129         8.7. Establishing a computer security incident response
  130  team to respond to suspected Responding to information
  131  technology security incidents, including breaches of personal
  132  information containing confidential or exempt data. An agency’s
  133  computer security incident response team must convene as soon as
  134  practicable upon notice of a suspected security incident and
  135  shall determine the appropriate response.
  136         9.8. Recovering information and data in response to an
  137  information technology security incident. The recovery may
  138  include recommended improvements to the agency processes,
  139  policies, or guidelines.
  140         10. Establishing an information technology security
  141  incident reporting process, which must include a procedure for
  142  notification of the Agency for State Technology and the
  143  Cybercrime Office of the Department of Law Enforcement. The
  144  notification procedure must provide for tiered reporting
  145  timeframes, with incidents of critical impact reported
  146  immediately upon discovery, incidents of high impact reported
  147  within 4 hours of discovery, and incidents of low impact
  148  reported within 5 business days of discovery.
  149         11. Incorporating lessons learned through detection and
  150  response activities into agency incident response plans to
  151  continuously improve organizational response activities.
  152         12.9. Developing agency strategic and operational
  153  information technology security plans required pursuant to this
  154  section.
  155         13.10. Establishing the managerial, operational, and
  156  technical safeguards for protecting state government data and
  157  information technology resources that align with the state
  158  agency risk management strategy and that protect the
  159  confidentiality, integrity, and availability of information and
  160  data.
  161         14. Providing all agency employees with information
  162  technology security and cybersecurity awareness education and
  163  training within 30 days after commencing employment.
  164         (c) Assist state agencies in complying with this section.
  165         (d) In collaboration with the Cybercrime Office of the
  166  Department of Law Enforcement, provide training that must
  167  include training on cybersecurity threats, trends, and best
  168  practices for state agency information security managers and
  169  computer security incident response team members at least
  170  annually.
  171         (e) Annually review the strategic and operational
  172  information technology security plans of executive branch
  173  agencies.
  174         (f) Develop and establish a cutting-edge internship or
  175  work-study program in science, technology, engineering, and
  176  mathematics (STEM), which will produce a more skilled
  177  cybersecurity workforce in the state. The program must be a
  178  collaborative effort involving negotiations between the Agency
  179  for State Technology, relevant Agency for State Technology
  180  partners, and the Florida Center for Cybersecurity.
  181         (4) Each state agency head shall, at a minimum:
  182         (a) Designate an information security manager to administer
  183  the information technology security program of the state agency.
  184  This designation must be provided annually in writing to the
  185  Agency for State Technology by January 1. A state agency’s
  186  information security manager, for purposes of these information
  187  security duties, shall report directly to the agency head.
  188         1. The information security manager shall establish a
  189  computer security incident response team to respond to a
  190  suspected computer security incident.
  191         2. Computer security incident response team members shall
  192  convene as soon as practicable upon notice of a suspected
  193  security incident.
  194         3. Computer security incident response team members shall
  195  determine the appropriate response for a suspected computer
  196  security incident. An appropriate response includes taking
  197  action to prevent expansion or recurrence of an incident,
  198  mitigating the effects of an incident, and eradicating an
  199  incident. Newly identified risks must be mitigated or documented
  200  as an accepted risk by computer security incident response team
  201  members.
  202         (b) Submit to the Agency for State Technology annually by
  203  July 31, the state agency’s strategic and operational
  204  information technology security plans developed pursuant to
  205  rules and guidelines established by the Agency for State
  206  Technology.
  207         1. The state agency strategic information technology
  208  security plan must cover a 3-year period and, at a minimum,
  209  define security goals, intermediate objectives, and projected
  210  agency costs for the strategic issues of agency information
  211  security policy, risk management, security training, security
  212  incident response, and disaster recovery. The plan must be based
  213  on the statewide information technology security strategic plan
  214  created by the Agency for State Technology and include
  215  performance metrics that can be objectively measured to reflect
  216  the status of the state agency’s progress in meeting security
  217  goals and objectives identified in the agency’s strategic
  218  information security plan.
  219         2. The state agency operational information technology
  220  security plan must include a progress report that objectively
  221  measures progress made towards the prior operational information
  222  technology security plan and a project plan that includes
  223  activities, timelines, and deliverables for security objectives
  224  that the state agency will implement during the current fiscal
  225  year.
  226         (c) Conduct, and update every 3 years, a comprehensive risk
  227  assessment to determine the security threats to the data,
  228  information, and information technology resources of the agency.
  229  The risk assessment must comply with the risk assessment
  230  methodology developed by the Agency for State Technology and is
  231  confidential and exempt from s. 119.07(1), except that such
  232  information shall be available to the Auditor General, the
  233  Agency for State Technology, the Cybercrime Office of the
  234  Department of Law Enforcement, and, for state agencies under the
  235  jurisdiction of the Governor, the Chief Inspector General.
  236         (d) Subject to annual legislative appropriation, conduct a
  237  risk assessment that must be administered by a third party
  238  consistent with the guidelines and processes prescribed by the
  239  Agency for State Technology. An initial risk assessment must be
  240  completed by July 31, 2017. Additional risk assessments shall be
  241  completed periodically consistent with the guidelines and
  242  processes prescribed by the Agency for State Technology.
  243         (e)(d) Develop, and periodically update, written internal
  244  policies and procedures, which include procedures for reporting
  245  information technology security incidents and breaches to the
  246  Cybercrime Office of the Department of Law Enforcement and the
  247  Agency for State Technology. Procedures for reporting
  248  information technology security incidents and breaches must
  249  include notification procedures and reporting timeframes. Such
  250  policies and procedures must be consistent with the rules,
  251  guidelines, and processes established by the Agency for State
  252  Technology to ensure the security of the data, information, and
  253  information technology resources of the agency. The internal
  254  policies and procedures that, if disclosed, could facilitate the
  255  unauthorized modification, disclosure, or destruction of data or
  256  information technology resources are confidential information
  257  and exempt from s. 119.07(1), except that such information shall
  258  be available to the Auditor General, the Cybercrime Office of
  259  the Department of Law Enforcement, the Agency for State
  260  Technology, and, for state agencies under the jurisdiction of
  261  the Governor, the Chief Inspector General.
  262         (f)(e) Implement managerial, operational, and technical
  263  safeguards established by the Agency for State Technology to
  264  address identified risks to the data, information, and
  265  information technology resources of the agency.
  266         (g)(f) Ensure that periodic internal audits and evaluations
  267  of the agency’s information technology security program for the
  268  data, information, and information technology resources of the
  269  agency are conducted. The results of such audits and evaluations
  270  are confidential information and exempt from s. 119.07(1),
  271  except that such information shall be available to the Auditor
  272  General, the Cybercrime Office of the Department of Law
  273  Enforcement, the Agency for State Technology, and, for agencies
  274  under the jurisdiction of the Governor, the Chief Inspector
  275  General.
  276         (h)(g) Include appropriate information technology security
  277  requirements in the written specifications for the solicitation
  278  of information technology and information technology resources
  279  and services, which are consistent with the rules and guidelines
  280  established by the Agency for State Technology in collaboration
  281  with the Department of Management Services.
  282         (i)(h) Provide information technology security and
  283  cybersecurity awareness training to all state agency employees
  284  in the first 30 days after commencing employment concerning
  285  information technology security risks and the responsibility of
  286  employees to comply with policies, standards, guidelines, and
  287  operating procedures adopted by the state agency to attain an
  288  appropriate level of cyber literacy and reduce those risks. The
  289  training may be provided in collaboration with the Cybercrime
  290  Office of the Department of Law Enforcement. Agencies shall
  291  ensure that privileged users, third-party stakeholders, senior
  292  executives, and physical and information security personnel
  293  understand their roles and responsibilities.
  294         (j) In collaboration with the Cybercrime Office of the
  295  Department of Law Enforcement, provide training on cybersecurity
  296  threats, trends, and best practices to computer security
  297  incident response team members at least annually.
  298         (k)(i) Develop a process for detecting, reporting, and
  299  responding to threats, breaches, or information technology
  300  security incidents that are consistent with the security rules,
  301  guidelines, and processes established by the Agency for State
  302  Technology.
  303         1. All information technology security incidents and
  304  breaches must be reported to the Agency for State Technology.
  305  Procedures for reporting information technology security
  306  incidents and breaches must include notification procedures.
  307         2. For information technology security breaches, state
  308  agencies shall provide notice in accordance with s. 501.171.
  309         (l) Improve organizational response activities by
  310  incorporating lessons learned from current and previous
  311  detection and response activities into response plans.
  312         (5) The Agency for State Technology shall adopt rules
  313  relating to information technology security and to administer
  314  this section.
  315         Section 3. Subsection (17) of section 1001.03, Florida
  316  Statutes, is amended to read:
  317         1001.03 Specific powers of State Board of Education.—
  318         (17) UNIFIED STATE PLAN FOR SCIENCE, TECHNOLOGY,
  319  ENGINEERING, AND MATHEMATICS (STEM).—The State Board of
  320  Education, in consultation with the Board of Governors, the
  321  Technology Advisory Council, and the Department of Economic
  322  Opportunity, shall adopt a unified state plan to improve K-20
  323  STEM education and prepare students for high-skill, high-wage,
  324  and high-demand employment in STEM and STEM-related fields.
  325         Section 4. Section 1004.444, Florida Statutes, is amended
  326  to read:
  327         1004.444 Florida Center for Cybersecurity.—
  328         (1) The Florida Center for Cybersecurity is established
  329  within the University of South Florida.
  330         (2) The goals of the center are to:
  331         (a) Position Florida as the national leader in
  332  cybersecurity and its related workforce through education,
  333  research, and community engagement. The center shall coordinate
  334  with the Technology Advisory Council in pursuit of this goal.
  335         (b) Assist in the creation of jobs in the state’s
  336  cybersecurity industry and enhance the existing cybersecurity
  337  workforce. The center shall coordinate with the Technology
  338  Advisory Council in pursuit of this goal.
  339         (c) Act as a cooperative facilitator for state business and
  340  higher education communities to share cybersecurity knowledge,
  341  resources, and training. The center shall coordinate with the
  342  Technology Advisory Council in pursuit of this goal.
  343         (d) Seek out partnerships with major military installations
  344  to assist, when possible, in homeland cybersecurity defense
  345  initiatives.
  346         (e) Attract cybersecurity companies to the state with an
  347  emphasis on defense, finance, health care, transportation, and
  348  utility sectors.
  349         Section 5. For the 2016-2017 fiscal year, the sums of
  350  $650,000 in nonrecurring funds and $50,000 in recurring funds
  351  are appropriated from the General Revenue Fund to the Agency for
  352  State Technology to conduct training exercises in coordination
  353  with the Florida National Guard.
  354         Section 6. For the 2016-2017 fiscal year, the sum of $12
  355  million is appropriated from the General Revenue Fund to the
  356  Agency for State Technology for the purpose of implementing this
  357  act.
  358         Section 7. This act shall take effect July 1, 2016.