OGSR/Cybersecurity, Information Technology, and Operational Technology Information

119.0725 Agency cybersecurity information; public records exemption; public meetings exemption.—

(1) As used in this section, the term:

(a) “Breach” means unauthorized access of data in electronic form containing personal information. Good faith access of personal information by an employee or agent of an agency does not constitute a breach, provided that the information is not used for a purpose unrelated to the business or subject to further unauthorized use.

(b) “Critical infrastructure” means existing and proposed information technology and operational technology systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health, or public safety.

(c) “Cybersecurity” has the same meaning as in s. 282.0041.

(d) “Data” has the same meaning as in s. 282.0041.

(e) “Incident” means a violation or imminent threat of violation, whether such violation is accidental or deliberate, of information technology resources, security, policies, or practices. As used in this paragraph, the term “imminent threat of violation” means a situation in which the agency has a factual basis for believing that a specific incident is about to occur.

(f) “Information technology” has the same meaning as in s. 282.0041.

(g)

“Operational technology” means the hardware and software that cause or detect a change through the direct monitoring or control of physical devices, systems, processes, or events.

(2) The following information held by an agency is confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution:

(a) Coverage limits and deductible or self-insurance amounts of insurance or other risk mitigation coverages acquired for the protection of information technology systems, operational technology systems, or data of an agency.

(b) Information relating to critical infrastructure.

(c) Cybersecurity incident information reported pursuant to s. 282.318 or s. 282.3185.

(d) Network schematics, hardware and software configurations, or encryption information or information that identifies detection, investigation, or response practices for suspected or confirmed cybersecurity incidents, including suspected or confirmed breaches, if the disclosure of such information would facilitate unauthorized access to or unauthorized modification, disclosure, or destruction of :

1. Data or information, whether physical or virtual; or

2. Information technology resources, which include an agency’s existing or proposed information technology systems.

(3) Any portion of a meeting that would reveal information made confidential and exempt under subsection (2) is exempt from s. 286.011 and s. 24(b), Art. I of the State Constitution. An exempt portion of a meeting may not be off the record and must be recorded and transcribed. The recording and transcript are confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution.

(4) The public records exemptions contained in this section apply to information held by an agency before, on, or after July 1, 2022.

(5)(a) Information made confidential and exempt pursuant to this section shall be made available to a law enforcement agency, the Auditor General, the Cybercrime Office of the Department of Law Enforcement, the Florida Digital Service within the Department of Management Services, and, for agencies under the jurisdiction of the Governor, the Chief Inspector General.

(b) Such confidential and exempt information may be disclosed by an agency in the furtherance of its official duties and responsibilities or to another agency or governmental entity in the furtherance of its statutory duties and responsibilities.

(6) Agencies may report information about cybersecurity incidents in the aggregate.

(7) This section is subject to the Open Government Sunset Review Act in accordance with s. 119.15 and shall stand repealed on October 2, 2026, unless reviewed and saved from repeal through reenactment by the Legislature.

119.0725 Agency cybersecurity information; public records exemption; public meetings exemption.—

(1) As used in this section, the term:

(a) “Breach” means unauthorized access of data or information. Good faith access of data or information by an employee or agent of an agency does not constitute a breach, provided that the data or information is not used for a purpose unrelated to the business or subject to further unauthorized use.

(b) “Critical infrastructure” means existing and proposed information technology and operational technology systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health, or public safety.

(c) “Cybersecurity” means the protection afforded to information technology or operational technology in order to attain the applicable objectives of preserving the confidentiality, integrity, and availability of such technologies, data, and information .

(d) “Data” has the same meaning as in s. 282.0041.

(e) “Incident” means a violation or imminent threat of violation, whether such violation is accidental or deliberate, of an agency’s cybersecurity, information technology, or operational technology . As used in this paragraph, the term “imminent threat of violation” means a situation in which the agency has a factual basis for believing that a specific incident is about to occur.

(f) “Information technology” has the same meaning as in s. 282.0041.

(g) “Login credentials” means information used to authenticate a user’s identity or otherwise authorize access when logging into a computer, computer system, computer network, electronic device, or online user account accessible over the Internet through a mobile device, a website, or any other electronic means, or for authentication or password or account recovery.

(h) “Operational technology” means the hardware and software that cause or detect a change through the direct monitoring or control of physical devices, systems, processes, or events.

(i) “Public-facing portal” means a web portal or computer application accessible by the public over the Internet, whether through a mobile device, website, or other electronic means.

(2) The following information held by an agency is confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution:

(a)

Information relating to critical infrastructure.

(b) Cybersecurity incident information reported pursuant to s. 282.318 or s. 282.3185.

(c) Network schematics, hardware and software configurations, encryption information, or any information that identifies detection, investigation, or response practices related to cybersecurity incidents, including breaches, if the disclosure of such information could facilitate unauthorized access to or unauthorized modification, disclosure, or destruction of data, information, or existing or proposed information technology or operational technology

.

(d) Information relating to processes or practices designed to protect data, information, or existing or proposed information technology or operational technology if the disclosure of such information could facilitate unauthorized access to or unauthorized modification, disclosure, or destruction of such data, information, or technology.

(e) Portions of risk assessments, evaluation, audits, and other reports of an agency’s cybersecurity program if the disclosure of such information could facilitate unauthorized access to or unauthorized modification, disclosure, or destruction of data, information, or existing or proposed information technology or operational technology.

(f) Login credentials.

(g) Internet protocol addresses, geolocation data, and other information that describes the location, computer, computer system, or computer network from which a user accesses a public-facing portal, and the dates and times that a user accesses a public-facing portal.

(h) Agency-produced data processing software that is sensitive.

(i) Insurance and self-insurance coverage limits and deductibles, as well as any other risk mitigation coverages acquired for the protection of information technology, operational technology, or data of an agency.

(3) Any portion of a meeting that would reveal information made confidential and exempt under subsection (2) is exempt from s. 286.011 and s. 24(b), Art. I of the State Constitution. An exempt portion of a meeting may not be off the record and must be recorded and transcribed. The recording and transcript are confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution.

(4) The public records exemptions contained in this section apply to information held by an agency before, on, or after the effective date of the exemptions .

(5)(a) Information made confidential and exempt pursuant to this section shall be made available to a law enforcement agency, the Auditor General, the Cybercrime Office of the Department of Law Enforcement, the Florida Digital Service within the Department of Management Services, and, for agencies under the jurisdiction of the Governor, the Chief Inspector General.

(b) Such confidential and exempt information may be disclosed by an agency in the furtherance of its official duties and responsibilities or to another agency or governmental entity in the furtherance of the agency’s or governmental entity’s official duties and responsibilities.

(6) Agencies may report information about cybersecurity incidents in the aggregate.

(7) This section is subject to the Open Government Sunset Review Act in accordance with s. 119.15 and shall stand repealed on October 2, 2031 , unless reviewed and saved from repeal through reenactment by the Legislature.

15.16 Reproduction of records; admissibility in evidence; electronic receipt and transmission of records; certification; acknowledgment.—

(3)(a) The Department of State may cause to be received electronically any records that are required or authorized to be filed with it pursuant to chapter 48, chapter 55, chapter 117, chapter 118, chapter 495, chapter 605, chapter 606, chapter 607, chapter 610, chapter 617, chapter 620, chapter 621, chapter 679, chapter 713, or chapter 865, through facsimile or other electronic transfers, for the purpose of filing such records. The originals of all such electronically transmitted records must be executed in the manner provided in paragraph (5)(b). The receipt of such electronic transfer constitutes delivery to the department as required by law. The department may use electronic transmissions for purposes of notice in the administration of chapters 48, 55, 117, 118, 495, 605, 606, 607, 610, 617, 620, 621, 679, and 713 and s. 865.09. The Department of State may collect e-mail addresses for purposes of notice and communication in the performance of its duties and may require filers and registrants to furnish such e-mail addresses when presenting documents for filing.

(b) The department may implement a password-protected system for any record electronically received pursuant to paragraph (a) and may require filers to produce supplemental materials to use such system, including, but not limited to, an original signature of the filer and verification of credentials. The department may also implement a password-protected system that allows entities organized under the chapters specified in paragraph (a) to identify authorized account holders for the purpose of electronically filing records related to the entity. If the department implements such a system, it must send to each e-mail address on file with the Division of Corporations on January 1, 2024, a code to participate in a password-protected system. The department may require verification of the identity of an authorized account holder before the account holder is authorized to electronically file a record with the department.

(c)1. E-mail addresses collected by the Department of State pursuant to this subsection are exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution. This exemption applies to e-mail addresses held by the Department of State before, on, or after the effective date of the exemption.

2. Secure login credentials held by the Department of State for the purpose of allowing a person to electronically file records under this subsection are exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution. This exemption applies to secure login credentials held by the Department of State before, on, or after the effective date of the exemption. For purposes of this subparagraph, the term “secure login credentials” means information held by the department for purposes of authenticating a user logging into a user account on a computer, a computer system, a computer network, or an electronic device; an online user account accessible over the Internet, whether through a mobile device, a website, or any other electronic means; or information used for authentication or password recovery.

3. This paragraph is subject to the Open Government Sunset Review Act in accordance with s. 119.15 and shall stand repealed on October 2, 2028, unless reviewed and saved from repeal through reenactment by the Legislature.

15.16 Reproduction of records; admissibility in evidence; electronic receipt and transmission of records; certification; acknowledgment.—

(3)(a) The Department of State may cause to be received electronically any records that are required or authorized to be filed with it pursuant to chapter 48, chapter 55, chapter 117, chapter 118, chapter 495, chapter 605, chapter 606, chapter 607, chapter 610, chapter 617, chapter 620, chapter 621, chapter 679, chapter 713, or chapter 865, through facsimile or other electronic transfers, for the purpose of filing such records. The originals of all such electronically transmitted records must be executed in the manner provided in paragraph (5)(b). The receipt of such electronic transfer constitutes delivery to the department as required by law. The department may use electronic transmissions for purposes of notice in the administration of chapters 48, 55, 117, 118, 495, 605, 606, 607, 610, 617, 620, 621, 679, and 713 and s. 865.09. The Department of State may collect e-mail addresses for purposes of notice and communication in the performance of its duties and may require filers and registrants to furnish such e-mail addresses when presenting documents for filing.

(b) The department may implement a password-protected system for any record electronically received pursuant to paragraph (a) and may require filers to produce supplemental materials to use such system, including, but not limited to, an original signature of the filer and verification of credentials. The department may also implement a password-protected system that allows entities organized under the chapters specified in paragraph (a) to identify authorized account holders for the purpose of electronically filing records related to the entity. If the department implements such a system, it must send to each e-mail address on file with the Division of Corporations on January 1, 2024, a code to participate in a password-protected system. The department may require verification of the identity of an authorized account holder before the account holder is authorized to electronically file a record with the department.

(c)1. E-mail addresses collected by the Department of State pursuant to this subsection are exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution. This exemption applies to e-mail addresses held by the Department of State before, on, or after the effective date of the exemption.

2.

This paragraph is subject to the Open Government Sunset Review Act in accordance with s. 119.15 and shall stand repealed on October 2, 2028, unless reviewed and saved from repeal through reenactment by the Legislature.