SB 2508: State Cybersecurity Operations

• Transfers the Cybersecurity Operations Center and the state chief information security officer position from the Department of Management Services (Florida Digital Service) to the Department of Law Enforcement via type two transfer.

• Designates the Department of Law Enforcement as the lead entity for enterprise cybersecurity operations and requires it to develop and annually update a state cybersecurity strategic plan by February 1.

• Requires the Department of Law Enforcement to operate and maintain the Cybersecurity Operations Center as part of the Florida Fusion Center and to review and approve cybersecurity governance frameworks and training before publication.

• Establishes incident reporting requirements for state agencies and local governments to notify the Cybersecurity Operations Center, Cybercrime Office, and Florida Digital Service of cybersecurity and ransomware incidents within specified timeframes (48 hours for most incidents, 12 hours for ransomware).

• Requires state agencies to conduct annual comprehensive risk assessments, submit corrective action plans for confirmed findings within 90 days, and submit after-action reports within one week of incident remediation; includes provisions protecting confidential cybersecurity records from public disclosure.