Florida HB 635: Child Care and Early Learning Providers

Bill Text

CS/HB 635 2026

CODING: Words stricken are deletions; words underlined are additions.
hb635-01-c1
Page 1 of 7
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

A bill to be entitled 1
An act relating to cybersecurity standards and 2
liability; amending s. 282.3185, F.S.; prohibiting 3
local governments from imposing certain cybersecurity 4
standards or processes on vendors; providing an 5
exception; defining the term "vendor"; prohibiting 6
local governments from adopting or enforcing certain 7
cybersecurity standards or processes; creating s. 8
768.401, F.S.; providing definitions; providing that a 9
local government, a covered entity, or a third-party 10
agent that complies with certain requirements is not 11
liable in connection with a cybersecurity incident 12
under certain circumstances; requiring covered 13
entities and third-party agents to implement revised 14
frameworks, standards, laws, or regulations within a 15
specified time period; providing that a private cause 16
of action is not established; providing that the fact 17
that a specified defendant could have obtained a 18
liability shield or a presumption against liability is 19
not admissible as evidence of negligence, does not 20
constitute negligence per se, and may not be used as 21
evidence of fault; specifying that the defendant in 22
certain actions has a certain burden of proof; 23
providing applicability; providing a directive to the 24
Division of Law Revision; providing an effective date. 25

CS/HB 635 2026

CODING: Words stricken are deletions; words underlined are additions.
hb635-01-c1
Page 2 of 7
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

26
Be It Enacted by the Legislature of the State of Florida: 27
28
Section 1. Paragraph (a) of subsection (4) of section 29
282.3185, Florida Statutes, is amended to read: 30
282.3185 Local government cybersecurity.— 31
(4) CYBERSECURITY STANDARDS.— 32
(a)1. Each local government shall adopt cybersecurity 33
standards that safeguard its data, information technology, and 34
information technology resources to ensure availability, 35
confidentiality, and integrity. The cybersecurity standards must 36
be consistent with generally accepted best practices for 37
cybersecurity, including the National Institute of Standards and 38
Technology Cybersecurity Framework. 39
2. A local government may not impose cybersecurity 40
standards or processes on a vendor that exceed the standards or 41
processes established under this paragraph, except as necessary 42
to comply with state or federal laws, or with industry-specific 43
requirements applicable to regulated sectors. For purposes of 44
this paragraph, the term "vendor" means a sole proprietorship, 45
partnership, corporation, trust, estate, cooperative, 46
association, or other commercial entity that contracts with a 47
local government to provide information technology commodities 48
or services. 49
3. A local government may not adopt or enforce any 50

CS/HB 635 2026

CODING: Words stricken are deletions; words underlined are additions.
hb635-01-c1
Page 3 of 7
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

cybersecurity standards or processes that are inconsistent with 51
this paragraph for contracts entered into or amended on or after 52
July 1, 2026. 53
Section 2. Section 768.401, Florida Statutes, is created 54
to read: 55
768.401 Limitation on liability for cybersecurity 56
incidents.— 57
(1) As used in this section, the term: 58
(a) "Covered entity" means a sole proprietorship, 59
partnership, corporation, trust, estate, cooperative, 60
association, or other commercial entity. 61
(b) "Cybersecurity standards or frameworks" means one or 62
more of the following: 63
1. The National Institute of Standards and Technology 64
(NIST) Cybersecurity Framework 2.0; 65
2. NIST special publication 800-171; 66
3. NIST special publications 800-53 and 800-53A; 67
4. The Federal Risk and Authorization Management Program 68
security assessment framework; 69
5. The Center for Internet Security (CIS) Critical 70
Security Controls; 71
6. The International Organization for 72
Standardization/International Electrotechnical Commission 27000 73
series (ISO/IEC 27000) family of standards; 74
7. HITRUST Common Security Framework (CSF); 75

CS/HB 635 2026

CODING: Words stricken are deletions; words underlined are additions.
hb635-01-c1
Page 4 of 7
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

8. Service Organization Control Type 2 Framework (SOC 2); 76
9. Secure Controls Framework; or 77
10. Other similar industry frameworks or standards. 78
(c) "Disaster recovery" has the same meaning as in s. 79
282.0041. 80
(d) "Local government" means a county, municipality, or 81
other political subdivision of this state. 82
(e) "Personal information" has the same meaning as in s. 83
501.171(1). 84
(f) "Third-party agent" means an entity that has been 85
contracted to maintain, store, or process personal information 86
on behalf of a c