HB 1183 Florida House · 2025 Regular Session

Cybersecurity Incident Liability

Summary

Cybersecurity Incident Liability; Provides county, municipality, other political subdivision of state, covered entity, or third-party agent that complies with certain requirements is not liable in connection with cybersecurity incident; requires covered entities & third-party agents to implement revised frameworks, standards, laws, or regulations within specified time period; provides private cause of action is not established; provides that fact that specified defendant could have obtained liability shield or presumption against liability is not admissible as evidence of negligence, does not constitute negligence per se, & cannot be used as evidence of fault; specifies defendant in certain actions has certain burden of proof.

Issues: ✓ Technology

Bill status died 1 of 4 stages cleared

Introduction

Feb 2025

Committee Review

Floor Vote

Governor

Introduced Feb 26, 2025 Last action Jun 16, 2025

Maddy AI version diff · 2 comparisons

What changed between versions

H 1183 c1 → H 1183 c2 · 4 edits

MODERATE

The bill was revised to update cybersecurity standards references and clarify liability protections. The most significant change is updating the NIST framework reference from the original version to NIST Cybersecurity Framework 2.0, ensuring the law aligns with current industry standards. Additionally, the definition of 'personal information' was modified to reference a different Florida statute section, potentially changing what data is covered under the law's protections.

Scope change

The bill's scope was modified to reference updated cybersecurity standards and potentially alter which types of personal information are protected under the liability limitations.

REQUIREMENT

Updated the referenced cybersecurity framework from the original NIST Framework to NIST Cybersecurity Framework 2.0, ensuring compliance with current industry standards.

Added language clarifying that evidence of a defendant's ability to obtain liability shields or presumptions against liability cannot be used as proof of negligence.

Removed language about certain failures not being evidence of negligence, which was replaced with more specific language about liability shields and presumptions.

DEFINITION

Changed the definition of 'personal information' to reference a different Florida statute section (501.171(1) instead of 501.171(3)-(6)), which may alter what data qualifies for protection.

H 1183 Filed → H 1183 c1 · 6 edits

MODERATE

The bill was amended to clarify liability protections for cybersecurity incidents and update compliance requirements. Key changes include redefining 'covered entities' to include political subdivisions, adding new definitions for 'disaster recovery' and 'personal information', and modifying the liability framework to create a presumption against liability for covered entities that implement specific cybersecurity programs. The amendments also streamline compliance requirements by allowing entities regulated by federal or state laws to demonstrate compliance through existing regulatory frameworks rather than adopting new industry standards.

Scope change

Expanded scope to explicitly include political subdivisions (counties and municipalities) in the liability limitation provisions, and added new definitions for disaster recovery and personal information to clarify applicability.

DEFINITION

Added new definitions for 'disaster recovery' and 'personal information' to clarify what terms mean in the context of this bill.

ELIGIBILITY

Changed 'covered entity' definition to explicitly include political subdivisions alongside sole proprietorships, partnerships, corporations, and other commercial entities.

REQUIREMENT

Modified liability provisions to create a presumption against liability for covered entities that implement cybersecurity programs meeting specific standards, rather than requiring strict compliance with particular frameworks.

Updated compliance requirements to allow entities regulated by federal or state laws to demonstrate compliance through existing regulatory frameworks rather than requiring adoption of specific industry standards.

Removed specific requirement for counties and municipalities to apply to the Local Government Cybersecurity Grant Program and share telemetry data with the state's cybersecurity operations center.

TECHNICAL

Changed language from 'adopted or implemented' to 'implemented' for cybersecurity programs, and updated numbering and formatting throughout the document.

Floor votes

How they voted

No floor votes recorded yet.

Full legislative history

Actions timeline

Total actions

Key actions

Committee

Apr 4, 2025

Lower · Passed

Now in State Affairs Committee

lower

Apr 4, 2025

Committee

Referred to State Affairs Committee

lower

Apr 3, 2025

Lower · Passed

Reported out of Civil Justice & Claims Subcommittee

lower

Apr 3, 2025

Lower · Passed

Favorable with CS by Civil Justice & Claims Subcommittee

lower

Apr 1, 2025

Lower · Passed

Added to Civil Justice & Claims Subcommittee agenda

lower

Mar 26, 2025

Lower · Passed

Now in Civil Justice & Claims Subcommittee

lower

Mar 26, 2025

Committee

Referred to State Affairs Committee

lower

Mar 26, 2025

Committee

Referred to Civil Justice & Claims Subcommittee

lower

Mar 25, 2025

Lower · Passed

Reported out of Information Technology Budget & Policy Subcommittee

lower

Mar 25, 2025

Lower · Passed

Favorable with CS by Information Technology Budget & Policy Subcommittee

lower

Mar 21, 2025

Lower · Passed

Added to Information Technology Budget & Policy Subcommittee agenda

lower

Mar 5, 2025

Lower · Passed

Now in Information Technology Budget & Policy Subcommittee

lower

Mar 5, 2025

Committee

Referred to State Affairs Committee

lower

Mar 5, 2025

Committee

Referred to Civil Justice & Claims Subcommittee

lower

Mar 5, 2025

Committee

Referred to Information Technology Budget & Policy Subcommittee

lower

1 primary · 3 co-sponsors