Florida SB 692: Cybersecurity Standards and Liability

Bill Text

692 
Cybersecurity Standards and Liability 
2026-01-27T06:03:06Z 
Prohibiting local governments from imposing certain cybersecurity standards or processes on vendors; providing that a local government, a covered entity, or a third-party agent that complies with certain requirements is not liable in connection with a cybersecurity incident under certain circumstances; requiring covered entities and third-party agents to implement revised frameworks, standards, laws, or regulations within a specified timeframe in order to retain protection from liability, etc. 
Committee Substitute 1 
2026 
S 
GB 
General Bill 
c1 

 Florida Senate - 2026 CS for SB 692 

 By the Committee on Governmental Oversight and Accountability; 
 and Senator Leek 

 585-02205-26 2026692c1 
 1 A bill to be entitled 
 2 An act relating to cybersecurity standards and 
 3 liability; amending s. 282.3185, F.S.; prohibiting 
 4 local governments from imposing certain cybersecurity 
 5 standards or processes on vendors; defining the term 
 6 “vendor”; prohibiting local governments from adopting 
 7 or enforcing certain cybersecurity standards or 
 8 processes; creating s. 768.401, F.S.; defining terms; 
 9 providing that a local government, a covered entity, 
 10 or a third-party agent that complies with certain 
 11 requirements is not liable in connection with a 
 12 cybersecurity incident under certain circumstances; 
 13 requiring covered entities and third-party agents to 
 14 implement revised frameworks, standards, laws, or 
 15 regulations within a specified timeframe in order to 
 16 retain protection from liability; providing that a 
 17 private cause of action is not established; providing 
 18 that the fact that a specified defendant could have 
 19 obtained a liability shield or a presumption against 
 20 liability is not admissible as evidence of negligence, 
 21 does not constitute negligence per se, and may not be 
 22 used as evidence of fault; specifying that the 
 23 defendant in certain actions has a certain burden of 
 24 proof; providing applicability; providing a directive 
 25 to the Division of Law Revision; providing an 
 26 effective date. 
 27 
 28 Be It Enacted by the Legislature of the State of Florida: 
 29 
 30 Section 1. Paragraph (a) of subsection (4) of section 
 31 282.3185, Florida Statutes, is amended to read: 
 32 282.3185 Local government cybersecurity.— 
 33 (4) CYBERSECURITY STANDARDS.— 
 34 (a)1. Each local government shall adopt cybersecurity 
 35 standards that safeguard its data, information technology, and 
 36 information technology resources to ensure availability, 
 37 confidentiality, and integrity. The cybersecurity standards must 
 38 be consistent with generally accepted best practices for 
 39 cybersecurity, including the National Institute of Standards and 
 40 Technology Cybersecurity Framework. 
 41 2. A local government may not impose cybersecurity 
 42 standards or processes on a vendor which exceed the standards or 
 43 processes established under this paragraph, except as necessary 
 44 to comply with state or federal laws, or with industry-specific 
 45 requirements applicable to regulated sectors. For purposes of 
 46 this paragraph, “vendor” means a sole proprietorship, 
 47 partnership, corporation, trust, estate, cooperative, 
 48 association, or other commercial entity that contracts with a 
 49 local government to provide information technology commodities 
 50 or services. 
 51 3. A local government may not adopt or enforce any 
 52 cybersecurity standards or processes that are inconsistent with 
 53 this paragraph for contracts entered into or amended on or after 
 54 July 1, 2026. 
 55 Section 2. Section 768.401, Florida Statutes, is created to 
 56 read: 
 57 768.401 Limitation on liability for cybersecurity 
 58 incidents.— 
 59 (1) As used in this section, the term: 
 60 (a) “Covered entity” means a sole proprietorship, 
 61 partnership, corporation, trust, estate, cooperative, 
 62 association, or other commercial entity. 
 63 (b) “Cybersecurity standards or frameworks” means one or 
 64 more of the following: 
 65 1. The National Institute of Standards and Technology 
 66 (NIST) Cybersecurity Framework 2.0; 
 67 2. NIST special publication 800-171; 
 68 3. NIST special publications 800-53 and 800-53A; 
 69 4. The Federal Risk and Authorization Management Program 
 70 security assessment framework; 
 71 5. The Center for Internet Security (CIS) Critical Security 
 72 Controls; 
 73 6. The International Organization for 
 74 Standardization/International Electrotechnical Commission 27000 
 75 series (ISO/IEC 27000) family of standards; 
 76 7. HITRUST Common Security Framework (CSF); 
 77 8. Service Organization Control Type 2 Framework (SOC 2); 
 78 9. Secure Controls Framework; or 
 79 10. Other similar industry frameworks or standards. 
 80 (c) “Disaster recovery” has the same meaning as in s. 
 81 282.0041. 
 82 (d) “Local government” means a county, a municipality,