Florida requires us to adopt cybersecurity standards. Can you get us there and document it?

Florida Statute 282.3185 requires local governments to adopt cybersecurity standards that safeguard their data and IT resources, consistent with generally accepted best practice such as the NIST framework. The deadlines ran by size:

• Municipalities of 25,000 or more, and counties of 75,000 or more: January 1, 2024.
• Municipalities under 25,000, and counties under 75,000: January 1, 2025.

So every city and county in Florida is past its deadline. A fair number of small ones have nothing adopted, and the usual reason is that nobody was sure what adopting a standard actually means.

It means a written document, mapped to a recognized framework, that your governing body has formally approved. Buying a firewall is not adopting a standard. What we produce:

• A gap assessment against the NIST Cybersecurity Framework, in language a council can follow, showing what is in place and what is not.
• A written standards document sized for an organization of your scale, ready to go on an agenda for adoption. A forty page policy copied from a large county is worse than useless, because you will not follow it and the gap between the policy and reality is itself a liability.
• A remediation plan in priority order with what each item costs, so it can be budgeted across cycles rather than all at once.
• An evidence file that shows the standards were adopted, the training happened and the controls exist.

Worth being straight about the incentive here. No state agency is going to show up and audit you. The two parties who will absolutely ask are your cyber insurance carrier at renewal, and, if you have an incident, whoever is looking for someone to blame. The evidence file is for them.