Florida Administrative Code › 60 - DEPARTMENT OF MANAGEMENT SERVICES › 60GG - Florida Digital Service › Chapter 60GG-2 - STATE OF FLORIDA CYBERSECURITY STANDARDS › Section 60GG-2.001 - Purpose and Applicability; Definitions; Agency Requirements

Current through Reg. 50, No. 138; July 16, 2024
(1) Purpose and Applicability.
(a) Rules 60GG-2.001 through 60GG-2.006,
				F.A.C., will be known as the State of Florida Cybersecurity Standards
				(SFCS).
(b) These rules establish
				cybersecurity standards for information technology (IT) resources. Agencies
				must comply with these standards in the management and operation of state IT
				resources. This rule is modeled after the National Institute of Standards and
				Technology (NIST) Framework for Improving Critical Infrastructure
				Cybersecurity, Version 1.1, and the Federal Information Security Management Act
				of 2002 (44 U.S.C. §
											3541, et seq.). For the convenience of the reader
				cross-references to these documents and Special Publications issued by the NIST
				are provided throughout the SFCS as they may be helpful to Agencies when
				drafting their cybersecurity procedures. For procurement of IT commodities and
				services, the commodity or service must comply with the NIST Framework for
				Improving Critical Infrastructure Cybersecurity, Version 1.1 (April 2018). The
				SFCS:
1. Establish minimum standards to be
				used by Agencies to secure IT resources. The SFCS consists of five high-level
				functions: Identify, Protect, Detect, Respond, and Recover. These functions
				support lifecycle management of IT risk. The functions identify underlying key
				categories and subcategories for each function. Subcategories contain specific
				IT controls. The SFCS are visually represented as follows:
Function Unique Identifier
Function
Category Unique Identifier
Category
ID
Identify
ID.AM
Asset Management
ID.BE
Business Environment
ID.GV
Governance
ID.RA
Risk Assessment
ID.RM
Risk Management Strategy
ID.SC
Supply Chain Risk Management
PR
Protect
PR.AC
Identity Management and Access Control
PR.AT
Awareness & Training
PR.DS
Data Security
PR.IP
Information Protection Processes &
							 Procedures
PR.MA
Maintenance
PR.PT
Protective Technology
DE
Detect
DE.AE
Anomalies & Events
DE.CM
Security Continuous Monitoring
DE.DP
Detection Processes
RS
Respond
RS.RP
Response Planning
RS.CO
Communications
RS.AN
Analysis
RS.MI
Mitigation
RS.IM
Improvements
RC
Recover
RC.RP
Recovery Planning
RC.IM
Improvements
RC.CO
Communications
Category Unique Identifier subcategory references are
				  detailed in Rules 60GG-2.002 - 60GG-2.006, F.A.C., and are used throughout the
				  SFCS as applicable.
2.
				Define minimum management, operational, and technical security controls to be
				used by Agencies to secure IT resources.
3. Allow authorizing officials to employ
				compensating security controls or deviate from minimum standards when the
				Agency is unable to implement a security standard, or the standard is not
				cost-effective due to the specific nature of a system or its environment. The
				Agency shall document the reasons why the minimum standards cannot be satisfied
				and the Compensating Controls to be employed. After the Agency analyzes the
				issue and related risk, a compensating security control or deviation may be
				employed if the Agency documents the analysis and risk steering workgroup, as
				outlined in subsection 60GG-2.002(5), F.A.C., accepts the associated risk. This
				documentation is exempt from section
				 119.07(1),
				F.S., pursuant to sections
				 282.318 (4)(d), and
				(4)(e), F.S., and upon acceptance by the risk
				steering workgroup, shall be securely submitted to the Florida Digital Service
				(FL[DS]).
(c) The NIST
				Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1
				(April 2018), maintained at:
https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
,
				is hereby incorporated by reference into this rule:
http://www.flrules.org/Gateway/reference.asp?No=Ref-14659
.