We have to report incidents to the state fast. Who makes that call and files it?

Florida Statute 282.3185 sets the clock. For an incident your agency determines to be severity level 3, 4 or 5, you report within 48 hours of discovery to the Cybersecurity Operations Center, the Department of Law Enforcement Cybercrime Office, and your sheriff. For a ransomware incident the window is 12 hours, and it includes reporting the details of the ransom demanded. Level 1 and 2 incidents may be reported voluntarily. An after action report follows within a week of remediation.

Two things people get wrong about this.

The severity determination is the agency's, not the vendor's. We are not going to classify your incident for you and we would be overstepping if we did. What we do is give you the facts the determination rests on, in writing, fast: what was accessed, whether data left, how many systems, whether anything is still active. And we will tell you what we think the severity is and why. The decision, and the filing, belong to the agency.

The clock starts at discovery, not at confirmation. Waiting until you fully understand the incident will blow the window, because at 12 hours into a ransomware event nobody fully understands it. You report what you know and supplement later.

What to do before you need it, which takes an afternoon:

• Name the person who makes the severity call, and a backup. Put it in writing.
• Put the reporting contacts and your own key phone numbers on paper, in a binder, at home as well as at the office. In a real event your email and your files are exactly what you cannot reach.
• Agree in advance how you reach us out of hours, and how we reach you.
• Tell your attorney and your insurance carrier they are in the first hour, not the second day. Most carriers require notification and many will direct the response.

We will sit down and build that one page with you, and we would rather do it on a quiet Tuesday than at two in the morning.