Florida Administrative Code › 60 - DEPARTMENT OF MANAGEMENT SERVICES › 60GG - Florida Digital Service › Chapter 60GG-2 - STATE OF FLORIDA CYBERSECURITY STANDARDS › Section 60GG-2.008 - Prohibited Applications

Current through Reg. 50, No. 138; July 16, 2024
(1)
				Definitions. Capitalized terms used herein will have the meanings ascribed in
				section  112.22, F.S. "Form" will mean
				the Form FL[DS]-02, Prohibited Application Waiver Request Form, eff. 12/23, and
				available at
http://www.flrules.org/Gateway/reference.asp?No=Ref-16158
,
				which is hereby incorporated by reference herein.
(2) Prohibited Applications List. Pursuant to
				section  112.22, F.S., the Department is
				required to compile and maintain a list of Prohibited Applications, publish the
				list on its website, and update the list quarterly. In order to provide notice
				of the initial list and any list updates to Public Employers, the Department
				will publish a notice in the "Miscellaneous" section of the Florida
				Administrative Register that specifies the link at which the initial and
				updated list can be found on the Department's website. Pursuant to section
				 112.22, F.S., unless a waiver is
				granted or the exception in section 112.22(2)(b)1., F.S., is met, a Public
				Employer is required to remove, delete, or uninstall any Prohibited
				Applications from Government-Issued Devices within fifteen (15) calendar days
				of issuance or updates to the published list.
(3) Waiver Process.
(a) Submission of Waiver Request. A Public
				Employer that desires a waiver to permit downloading or accessing a Prohibited
				Application on a Government-Issued Device must submit the waiver request to the
				Department on the Form. If the Public Employer requires a decision on the
				waiver within fifteen (15) calendar days of issuance or updates to the
				published list, then the Public Employer shall submit the Form to the
				Department no later than five (5) calendar days following publication of the
				notice in the Florida Administrative Register.
(b) Waiver Determination.
1. Forms Submitted within 5 Calendar Days. If
				the Department receives the Form from the Public Employer within five (5)
				calendar days of publication of the notice in the Florida Administrative
				Register, then the Department will provide notice to the Public Employer of its
				decision to either grant or deny the waiver request by e-mail to the e-mail
				address provided on the Form within ten (10) calendar days of receipt of the
				waiver request. The Department may contact the Public Employer Employee listed
				on the Form to request any clarification on the information submitted in the
				Form that is necessary for the Department to make its determination. The Public
				Employer must provide such clarification within one (1) business day, which is
				deemed to be Monday through Friday, inclusive, excluding state holidays
				observed in accordance with section
				 110.117, F.S. Failure to provide
				such requested clarification may result in denial of the waiver
				request.
2. Forms submitted at
				Other Times. If the Department receives the Form from the Public Employer at
				any other time, the Department will provide notice to the Public Employer of
				its decision to either grant or deny the waiver request by e-mail to the e-mail
				address provided on the Form within thirty (30) calendar days of receipt of the
				waiver request. The Department may contact the Public Employer Employee listed
				on the Form to request any clarification on the information submitted in the
				Form that is necessary for the Department to make its determination. The Public
				Employer must provide such clarification within five (5) business days, which
				are deemed to be Monday through Friday, inclusive, excluding state holidays
				observed in accordance with section
				 110.117, F.S. Failure to provide
				such requested clarification may result in denial of the waiver
				request.
(c) Waiver
				Criteria. The Department will make its waiver decision in accordance with the
				following criteria:
1. Evaluation of the
				completed Form.
2. As represented
				on the Form, the waiver is necessary for:
a.
				Public safety, law enforcement, or other investigatory purposes, including
				investigations relating to licensure or disciplinary actions, where the purpose
				does not meet the exception for law enforcement officers in section
				112.22(2)(b)1., F.S.;
b. Research
				on hardware, operating systems, software, communications systems and protocols,
				components, and data practices for the purpose of understanding the existence
				and extent of potential threats, vulnerabilities, and mitigations thereto;
				or
c. A recognized state interest,
				including the Public Employer's performance of its essential
				functions.
3. Risk
				mitigation is appropriate for the Prohibited Application and purpose of the
				waiver.
4. The employee submitting
				the request on behalf of the Public Employer has indicated that he/she has
				authority to do so.
(d)
				Waiver Extensions. Pursuant to section 112.22(3)(b)3., F.S., any waivers
				granted must be limited to a timeframe of no more than 1 year unless the
				Department approves an extension. Unless a rule waiver is submitted to the
				Department in accordance with section
				 120.542, F.S., a Public Employer
				that desires an extension of a previously approved waiver must submit the
				extension request to the Department no later than sixty (60) days prior to
				expiration of the waiver. The Public Employer must submit the request on the
				Form.