CS for SB 1708 - Florida Cyber Protection Act

• Creates a state chief information officer position appointed by the Governor and confirmed by the Senate, with authority over the Florida Digital Service and cybersecurity matters.

• Requires state agencies to report all ransomware and cybersecurity incidents to the Florida Digital Service within 4 hours (2 hours for ransomware), with the Florida Digital Service notifying the Governor and Legislature of unreported incidents.

• Mandates independent project oversight for state technology projects costing $10 million or more, with oversight procured as a service and quarterly reports provided to executive and legislative leadership.

• Establishes a Cybersecurity Operations Committee composed of heads of major state departments to coordinate cybersecurity preparedness and response efforts across agencies.

• Provides liability protection for counties, municipalities, and commercial entities that substantially comply with cybersecurity standards based on NIST frameworks, HIPAA, Gramm-Leach-Bliley Act, or similar recognized standards, with defendants bearing the burden of proving compliance.