OGSR/Cybersecurity

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 1 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

A bill to be entitled 1
An act relating to a review under the Open Government 2
Sunset Review Act; amending s. 119.0725, F.S.; 3
providing and revising definitions; providing an 4
exemption from public records requirements for certain 5
cybersecurity processes or practices, certain 6
cybersecurity program reports, login credentials, and 7
certain information associated with access to a 8
public-facing portal held by an agency; revising an 9
exemption from public records requirements for certain 10
cybersecurity insurance information and certain 11
cybersecurity-related information held by an agency; 12
consolidating a public record exemption for certain 13
agency-produced data processing software held by an 14
agency; expanding an exemption from public meetings 15
requirements for portions of a meeting that would 16
reveal certain cybersecurity-related information held 17
by an agency; providing for future legislative review 18
and repeal of the exemptions; amending s. 15.16, F.S.; 19
removing an exemption from public records requirements 20
for certain secure login credentials held by the 21
Department of State; amending s. 24.1051, F.S.; 22
removing an exemption from public records requirements 23
for certain cybersecurity-related information held by 24
the Department of the Lottery; amending s. 101.5607, 25

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 2 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

F.S.; conforming a provision to changes made by the 26
act; amending s. 106.0706, F.S.; removing an exemption 27
from public records requirements for certain user 28
identifications and passwords held by the Department 29
of State; amending s. 112.31446, F.S.; removing an 30
exemption from public records requirements for certain 31
secure login credentials held by the Commission on 32
Ethics; amending s. 119.07, F.S.; conforming a 33
provision to changes made by the act; amending s. 34
119.071, F.S.; removing an exemption from public 35
records requirements for certain agency-produced data 36
processing software; amending s. 119.0712, F.S.; 37
removing an exemption from public records requirements 38
for certain secure login credentials and certain 39
information associated with access to a public-facing 40
portal held by the Department of Highway Safety and 41
Motor Vehicles; amending s. 119.0713, F.S.; removing 42
an exemption from public records requirements for 43
certain cybersecurity-related information held by a 44
utility owned or operated by a unit of local 45
government; amending s. 119.0714, F.S.; conforming a 46
provision to changes made by the act; amending s. 47
282.318, F.S.; removing an exemption from public 48
records requirements for a comprehensive risk 49
assessment held by an agency; removing exemptions from 50

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 3 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

public records requirements for certain cybersecurity-51
related internal policies and procedures, certain 52
cybersecurity-related internal audits and evaluations 53
held by an agency, and certain cybersecurity-related 54
reports held by an agency; repealing s. 627.352, F.S., 55
relating to security of data and information 56
technology in Citizens Property Insurance Corporation; 57
repealing s. 1004.055, F.S., relating to security of 58
data and information technology in state postsecondary 59
education institutions; providing a statement of 60
public necessity; providing an effective date. 61
62
Be It Enacted by the Legislature of the State of Florida: 63
64
Section 1. Paragraphs (a), (c), (e), and (g) of subsection 65
(1), subsections (2) and (4), paragraph (b) of subsection (5), 66
and subsection (7) of section 119.0725, Florida Statutes, are 67
amended, and new paragraphs (g) and (i) are added to subsection 68
(1) of that section, to read: 69
119.0725 Agency cybersecurity information; public records 70
exemption; public meetings exemption.— 71
(1) As used in this section, the term: 72
(a) "Breach" means unauthorized access of data or 73
information in electronic form containing personal information. 74
Good faith access of data or information personal information by 75

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 4 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

an employee or agent of an agency does not constitute a breach, 76
provided that the data or information is not used for a purpose 77
unrelated to the business or subject to further unauthorized 78
use. 79
(c) "Cybersecurity" means the protection afforded to 80
information technology or operational technology in order to 81
attain the applicable objectives of preserving the 82
confidentiality, integrity, and availability of those 83
technologies, data, and information has the same meaning as in 84
s. 282.0041. 85
(e) "Incident" means a violation or imminent threat of 86
violation, whether such violation is accidental or deliberate, 87
of an agency's cybersecurity, information technology resources, 88
or operational technology security, policies, or practices. As 89
used in this paragraph, the term "imminent threat of violation" 90
means a situation in which the agency has a factual basis for 91
believing that a specific incident is about to occur. 92
(g) "Login credentials" means information used to 93
authenticate a user's identity or otherwise authorize access 94
when logging into a computer, computer system, computer network, 95
electronic device, or an online user account accessible over the 96
Internet through a mobile device, a website, or any other 97
electronic means, or for authentication or password or account 98
recovery. 99
(h)(g) "Operational technology" means the hardware and 100

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 5 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

software that cause or detect a change through the direct 101
monitoring or control of physical devices, systems, processes, 102
or events. 103
(i) "Public-facing portal" means a web portal or computer 104
application accessible by the public over the Internet, whether 105
through a mobile device, website, or other electronic means. 106
(2) The following information held by an agency is 107
confidential and exempt from s. 119.07(1) and s. 24(a), Art. I 108
of the State Constitution: 109
(a) Coverage limits and deductible or self-insurance 110
amounts of insurance or other risk mitigation coverages acquired 111
for the protection of information technology systems, 112
operational technology systems, or data of an agency. 113
(a)(b) Information relating to critical infrastructure. 114
(b)(c) Cybersecurity incident information reported 115
pursuant to s. 282.318 or s. 282.3185. 116
(c)(d) Network schematics, hardware and software 117
configurations, or encryption information, or any information 118
that identifies detection, investigation, or response practices 119
related to for suspected or confirmed cybersecurity incidents, 120
including suspected or confirmed breaches, if the disclosure of 121
such information could would facilitate unauthorized access to 122
or unauthorized modification, disclosure, or destruction of 123
data, information, or existing or proposed information 124
technology or operational technology. 125

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 6 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

(d) Information relating to processes or practices 126
designed to protect data, information, or existing or proposed 127
information technology or operational technology if the 128
disclosure of such information could facilitate unauthorized 129
access to or unauthorized modification, disclosure, or 130
destruction of such data, information, or technology. 131
(e) Portions of risk assessments, evaluations, audits, and 132
other reports of an agency's cybersecurity program if the 133
disclosure of such information could facilitate unauthorized 134
access to or unauthorized modification, disclosure, or 135
destruction of data, information, or existing or proposed 136
information technology or operational technology. 137
(f) Login credentials. 138
(g) Internet protocol addresses, geolocation data, and 139
other information that describes the location, computer, 140
computer system, or computer network from which a user accesses 141
a public-facing portal, and the dates and times that a user 142
accesses a public-facing portal. 143
(h) Agency-produced data processing software that is 144
sensitive. 145
(i) Insurance and self-insurance coverage limits and 146
deductibles, as well as any other risk mitigation coverages, 147
acquired for the protection of information technology, 148
operational technology, or data of an agency.: 149
1. Data or information, whether physical or virtual; or 150

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 7 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

2. Information technology resources, which include an 151
agency's existing or proposed information technology systems. 152
(4) The public records exemptions contained in this 153
section apply to information held by an agency before, on, or 154
after the effective date of this act July 1, 2022. 155
(5) 156
(b) Such confidential and exempt information may be 157
disclosed by an agency in the furtherance of its official duties 158
and responsibilities or to another agency or governmental entity 159
in the furtherance of the agency's or governmental entity's 160
official its statutory duties and responsibilities. 161
(7) This section is subject to the Open Government Sunset 162
Review Act in accordance with s. 119.15 and shall stand repealed 163
on October 2, 2031 October 2, 2026, unless reviewed and saved 164
from repeal through reenactment by the Legislature. 165
Section 2. Paragraph (c) of subsection (3) of section 166
15.16, Florida Statutes, is amended to read: 167
15.16 Reproduction of records; admissibility in evidence; 168
electronic receipt and transmission of records; certification; 169
acknowledgment.— 170
(3) 171
(c)1. E-mail addresses collected by the Department of 172
State pursuant to this subsection are exempt from s. 119.07(1) 173
and s. 24(a), Art. I of the State Constitution. This exemption 174
applies to e-mail addresses held by the Department of State 175

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 8 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

before, on, or after the effective date of the exemption. 176
2. Secure login credentials held by the Department of 177
State for the purpose of allowing a person to electronically 178
file records under this subsection are exempt from s. 119.07(1) 179
and s. 24(a), Art. I of the State Constitution. This exemption 180
applies to secure login credentials held by the Department of 181
State before, on, or after the effective date of the exemption. 182
For purposes of this subparagraph, the term "secure login 183
credentials" means information held by the department for 184
purposes of authenticating a user logging into a user account on 185
a computer, a computer system, a computer network, or an 186
electronic device; an online user account accessible over the 187
Internet, whether through a mobile device, a website, or any 188
other electronic means; or information used for authentication 189
or password recovery. 190
2.3. This paragraph is subject to the Open Government 191
Sunset Review Act in accordance with s. 119.15 and shall stand 192
repealed on October 2, 2028, unless reviewed and saved from 193
repeal through reenactment by the Legislature. 194
Section 3. Paragraph (a) of subsection (1) of section 195
24.1051, Florida Statutes, is amended to read: 196
24.1051 Exemptions from inspection or copying of public 197
records.— 198
(1)(a) The following information held by the department is 199
confidential and exempt from s. 119.07(1) and s. 24(a), Art. I 200

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 9 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

of the State Constitution: 201
1. Information that, if released, could harm the security 202
or integrity of the department, including: 203
a. Information relating to the security of the 204
department's technologies, processes, and practices designed to 205
protect networks, computers, data processing software, data, and 206
data systems from attack, damage, or unauthorized access. This 207
sub-subparagraph is subject to the Open Government Sunset Review 208
Act in accordance with s. 119.15 and shall stand repealed on 209
October 2, 2027, unless reviewed and saved from repeal through 210
reenactment by the Legislature. 211
a.b. Security information or information that would reveal 212
security measures of the department, whether physical or 213
virtual. 214
b.c. Information about lottery games, promotions, tickets, 215
and ticket stock, including information concerning the 216
description, design, production, printing, packaging, shipping, 217
delivery, storage, and validation of such games, promotions, 218
tickets, and stock. 219
c.d. Information concerning terminals, machines, and 220
devices that issue tickets. 221
2. Information that must be maintained as confidential in 222
order for the department to participate in a multistate lottery 223
association or game. 224
3. Personal identifying information obtained by the 225

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 10 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

department when processing background investigations of current 226
or potential retailers or vendors. 227
4. Financial information about an entity which is not 228
publicly available and is provided to the department in 229
connection with its review of the financial responsibility of 230
the entity pursuant to s. 24.111 or s. 24.112, provided that the 231
entity marks such information as confidential. However, 232
financial information related to any contract or agreement, or 233
an addendum thereto, with the department, including the amount 234
of money paid, any payment structure or plan, expenditures, 235
incentives, bonuses, fees, and penalties, shall be public 236
record. 237
Section 4. Paragraph (d) of subsection (1) of section 238
101.5607, Florida Statutes, is amended to read: 239
101.5607 Department of State to maintain voting system 240
information; prepare software.— 241
(1) 242
(d) Section 119.0725(2)(h) Section 119.071(1)(f) applies 243
to all software on file with the Department of State. 244
Section 5. Section 106.0706, Florida Statutes, is amended 245
to read: 246
106.0706 Electronic filing of campaign finance reports; 247
public records exemption.— 248
(1) All user identifications and passwords held by the 249
Department of State pursuant to s. 106.0705 are confidential and 250

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 11 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

exempt from s. 119.07(1) and s. 24(a), Art. I of the State 251
Constitution. 252
(1)(2)(a) Information entered in the electronic filing 253
system for purposes of generating a report pursuant to s. 254
106.0705 is exempt from s. 119.07(1) and s. 24(a), Art. I of the 255
State Constitution. 256
(2)(b) Information entered in the electronic filing system 257
is no longer exempt once the report is generated and filed with 258
the Division of Elections. 259
Section 6. Subsection (6) of section 112.31446, Florida 260
Statutes, is amended to read: 261
112.31446 Electronic filing system for financial 262
disclosure.— 263
(6)(a) All secure login credentials held by the commission 264
for the purpose of allowing access to the electronic filing 265
system are exempt from s. 119.07(1) and s. 24(a), Art. I of the 266
State Constitution. 267
(b) Information entered in the electronic filing system 268
for purposes of financial disclosure is exempt from s. 119.07(1) 269
and s. 24(a), Art. I of the State Constitution. Information 270
entered in the electronic filing system is no longer exempt once 271
the disclosure of financial interests or statement of financial 272
interests is submitted to the commission or, in the case of a 273
candidate, filed with a qualifying officer, whichever occurs 274
first. 275

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 12 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

Section 7. Paragraph (g) of subsection (1) of section 276
119.07, Florida Statutes, is amended to read: 277
119.07 Inspection and copying of records; photographing 278
public records; fees; exemptions.— 279
(1) 280
(g) In any civil action in which an exemption to this 281
section is asserted, if the exemption is alleged to exist under 282
or by virtue of s. 119.071(1)(d) or (f), (2)(d), (e), or (f), or 283
(4)(c) or s. 119.0725(2)(h), the public record or part thereof 284
in question shall be submitted to the court for an inspection in 285
camera. If an exemption is alleged to exist under or by virtue 286
of s. 119.071(2)(c), an inspection in camera is discretionary 287
with the court. If the court finds that the asserted exemption 288
is not applicable, it shall order the public record or part 289
thereof in question to be immediately produced for inspection or 290
copying as requested by the person seeking such access. 291
Section 8. Paragraph (f) of subsection (1) of section 292
119.071, Florida Statutes, is amended to read: 293
119.071 General exemptions from inspection or copying of 294
public records.— 295
(1) AGENCY ADMINISTRATION.— 296
(f) Agency-produced data processing software that is 297
sensitive is exempt from s. 119.07(1) and s. 24(a), Art. I of 298
the State Constitution. The designation of agency-produced 299
software as sensitive does not prohibit an agency head from 300

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 13 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

sharing or exchanging such software with another public agency. 301
Section 9. Paragraph (f) of subsection (2) of section 302
119.0712, Florida Statutes, is amended to read: 303
119.0712 Executive branch agency-specific exemptions from 304
inspection or copying of public records.— 305
(2) DEPARTMENT OF HIGHWAY SAFETY AND MOTOR VEHICLES.— 306
(f)1. Secure login credentials held by the Department of 307
Highway Safety and Motor Vehicles are exempt from s. 119.07(1) 308
and s. 24(a), Art. I of the State Constitution. This exemption 309
applies to secure login credentials held by the department 310
before, on, or after the effective date of the exemption. For 311
purposes of this subparagraph, the term "secure login 312
credentials" means information held by the department for 313
purposes of authenticating a user logging into a user account on 314
a computer, a computer system, a computer network, or an 315
electronic device; an online user account accessible over the 316
Internet, whether through a mobile device, a website, or any 317
other electronic means; or information used for authentication 318
or password recovery. 319
2. Internet protocol addresses, geolocation data, and 320
other information held by the Department of Highway Safety and 321
Motor Vehicles which describes the location, computer, computer 322
system, or computer network from which a user accesses a public-323
facing portal, and the dates and times that a user accesses a 324
public-facing portal, are exempt from s. 119.07(1) and s. 24(a), 325

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 14 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

Art. I of the State Constitution. This exemption applies to such 326
information held by the department before, on, or after the 327
effective date of the exemption. For purposes of this 328
subparagraph, the term "public-facing portal" means a web portal 329
or computer application accessible by the public over the 330
Internet, whether through a mobile device, website, or other 331
electronic means, which is established for administering chapter 332
319, chapter 320, chapter 322, chapter 328, or any other 333
provision of law conferring duties upon the department. 334
3. This paragraph is subject to the Open Government Sunset 335
Review Act in accordance with s. 119.15 and shall stand repealed 336
on October 2, 2026, unless reviewed and saved from repeal 337
through reenactment by the Legislature. 338
Section 10. Subsection (5) of section 119.0713, Florida 339
Statutes, is amended to read: 340
119.0713 Local government agency exemptions from 341
inspection or copying of public records.— 342
(5)(a) Customer meter-derived data and billing information 343
in increments less than one billing cycle The following 344
information held by a utility owned or operated by a unit of 345
local government is exempt from s. 119.07(1) and s. 24(a), Art. 346
I of the State Constitution.: 347
1. Information related to the security of the technology, 348
processes, or practices of a utility owned or operated by a unit 349
of local government that are designed to protect the utility's 350

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 15 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

networks, computers, programs, and data from attack, damage, or 351
unauthorized access, which information, if disclosed, would 352
facilitate the alteration, disclosure, or destruction of such 353
data or information technology resources. 354
2. Information related to the security of existing or 355
proposed information technology systems or industrial control 356
technology systems of a utility owned or operated by a unit of 357
local government, which, if disclosed, would facilitate 358
unauthorized access to, and alteration or destruction of, such 359
systems in a manner that would adversely impact the safe and 360
reliable operation of the systems and the utility. 361
3. Customer meter-derived data and billing information in 362
increments less than one billing cycle. 363
(b) This exemption applies to such information held by a 364
utility owned or operated by a unit of local government before, 365
on, or after the effective date of this exemption. 366
(c) This subsection is Subparagraphs (a)1. and 2. are 367
subject to the Open Government Sunset Review Act in accordance 368
with s. 119.15 and shall stand repealed on October 2, 2027, 369
unless reviewed and saved from repeal through reenactment by the 370
Legislature. 371
Section 11. Paragraph (b) of subsection (1) of section 372
119.0714, Florida Statutes, is amended to read: 373
119.0714 Court files; court records; official records.— 374
(1) COURT FILES.—Nothing in this chapter shall be 375

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 16 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

construed to exempt from s. 119.07(1) a public record that was 376
made a part of a court file and that is not specifically closed 377
by order of court, except: 378
(b) Data processing software as provided in s. 379
119.0725(2)(h) s. 119.071(1)(f). 380
Section 12. Subsection (10) of section 282.318, Florida 381
Statutes, is renumbered as subsection (5), and paragraphs (d), 382
(e), and (g) of subsection (4) and present subsections (5) 383
through (9) of that section are amended, to read: 384
282.318 Cybersecurity.— 385
(4) Each state agency head shall, at a minimum: 386
(d) Conduct, and update every 3 years, a comprehensive 387
risk assessment, which may be completed by a private sector 388
vendor, to determine the security threats to the data, 389
information, and information technology resources, including 390
mobile devices and print environments, of the agency. The risk 391
assessment must comply with the risk assessment methodology 392
developed by the department and is confidential and exempt from 393
s. 119.07(1), except that such information shall be available to 394
the Auditor General, the Florida Digital Service within the 395
department, the Cybercrime Office of the Department of Law 396
Enforcement, and, for state agencies under the jurisdiction of 397
the Governor, the Chief Inspector General. If a private sector 398
vendor is used to complete a comprehensive risk assessment, it 399
must attest to the validity of the risk assessment findings. 400

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 17 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

(e) Develop, and periodically update, written internal 401
policies and procedures, which include procedures for reporting 402
cybersecurity incidents and breaches to the Cybercrime Office of 403
the Department of Law Enforcement and the Florida Digital 404
Service within the department. Such policies and procedures must 405
be consistent with the rules, guidelines, and processes 406
established by the department to ensure the security of the 407
data, information, and information technology resources of the 408
agency. The internal policies and procedures that, if disclosed, 409
could facilitate the unauthorized modification, disclosure, or 410
destruction of data or information technology resources are 411
confidential information and exempt from s. 119.07(1), except 412
that such information shall be available to the Auditor General, 413
the Cybercrime Office of the Department of Law Enforcement, the 414
Florida Digital Service within the department, and, for state 415
agencies under the jurisdiction of the Governor, the Chief 416
Inspector General. 417
(g) Ensure that periodic internal audits and evaluations 418
of the agency's cybersecurity program for the data, information, 419
and information technology resources of the agency are 420
conducted. The results of such audits and evaluations are 421
confidential information and exempt from s. 119.07(1), except 422
that such information shall be available to the Auditor General, 423
the Cybercrime Office of the Department of Law Enforcement, the 424
Florida Digital Service within the department, and, for agencies 425

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 18 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

under the jurisdiction of the Governor, the Chief Inspector 426
General. 427
(5) The portions of risk assessments, evaluations, 428
external audits, and other reports of a state agency's 429
cybersecurity program for the data, information, and information 430
technology resources of the state agency which are held by a 431
state agency are confidential and exempt from s. 119.07(1) and 432
s. 24(a), Art. I of the State Constitution if the disclosure of 433
such portions of records would facilitate unauthorized access to 434
or the unauthorized modification, disclosure, or destruction of: 435
(a) Data or information, whether physical or virtual; or 436
(b) Information technology resources, which include: 437
1. Information relating to the security of the agency's 438
technologies, processes, and practices designed to protect 439
networks, computers, data processing software, and data from 440
attack, damage, or unauthorized access; or 441
2. Security information, whether physical or virtual, 442
which relates to the agency's existing or proposed information 443
technology systems. 444
445
For purposes of this subsection, "external audit" means an audit 446
that is conducted by an entity other than the state agency that 447
is the subject of the audit. 448
(6) Those portions of a public meeting as specified in s. 449
286.011 which would reveal records which are confidential and 450

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 19 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

exempt under subsection (5) are exempt from s. 286.011 and s. 451
24(b), Art. I of the State Constitution. No exempt portion of an 452
exempt meeting may be off the record. All exempt portions of 453
such meeting shall be recorded and transcribed. Such recordings 454
and transcripts are confidential and exempt from disclosure 455
under s. 119.07(1) and s. 24(a), Art. I of the State 456
Constitution unless a court of competent jurisdiction, after an 457
in camera review, determines that the meeting was not restricted 458
to the discussion of data and information made confidential and 459
exempt by this section. In the event of such a judicial 460
determination, only that portion of the recording and transcript 461
which reveals nonexempt data and information may be disclosed to 462
a third party. 463
(7) The portions of records made confidential and exempt 464
in subsections (5) and (6) shall be available to the Auditor 465
General, the Cybercrime Office of the Department of Law 466
Enforcement, the Florida Digital Service within the department, 467
and, for agencies under the jurisdiction of the Governor, the 468
Chief Inspector General. Such portions of records may be made 469
available to a local government, another state agency, or a 470
federal agency for cybersecurity purposes or in furtherance of 471
the state agency's official duties. 472
(8) The exemptions contained in subsections (5) and (6) 473
apply to records held by a state agency before, on, or after the 474
effective date of this exemption. 475

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 20 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

(9) Subsections (5) and (6) are subject to the Open 476
Government Sunset Review Act in accordance with s. 119.15 and 477
shall stand repealed on October 2, 2026, unless reviewed and 478
saved from repeal through reenactment by the Legislature. 479
Section 13. Section 627.352, Florida Statutes, is 480
repealed. 481
Section 14. Section 1004.055, Florida Statutes, is 482
repealed. 483
Section 15. (1) The Legislature finds that it is a public 484
necessity that the following information held by an agency be 485
made confidential and exempt from s. 119.07(1), Florida 486
Statutes, and s. 24(a), Article I of the State Constitution: 487
(a) Network schematics, hardware and software 488
configurations, encryption information, or any information that 489
identifies detection, investigation, or response practices 490
relating to cybersecurity incidents, including breaches, if the 491
disclosure of such information could facilitate unauthorized 492
access to or unauthorized modification, disclosure, or 493
destruction of data, information, or existing or proposed 494
information technology or operational technology. 495
(b) Information relating to processes or practices 496
designed to protect data, information, or existing or proposed 497
information technology or operational technology if the 498
disclosure of such information could facilitate unauthorized 499
access to or unauthorized modification, disclosure, or 500

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 21 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

destruction of such data, information, or technology. 501
(c) Portions of risk assessments, evaluations, audits, and 502
other reports of an agency's cybersecurity program if the 503
disclosure of such information could facilitate unauthorized 504
access to or unauthorized modification, disclosure, or 505
destruction of data, information, or existing or proposed 506
information technology or operational technology. 507
(d) Login credentials. 508
(e) Internet protocol addresses, geolocation data, and 509
other information that describes the location, computer, 510
computer system, or computer network from which a user accesses 511
a public-facing portal, and the dates and times that a user 512
accesses a public-facing portal. 513
(f) Agency-produced data processing software that is 514
sensitive. 515
(g) Insurance and self-insurance coverage limits and 516
deductibles, as well as any other risk mitigation coverages, 517
acquired for the protection of information technology, 518
operational technology, or data of an agency. 519
520
Release of such information could place an agency at greater 521
risk of breaches, cybersecurity incidents, and ransomware 522
attacks. Network schematics, hardware and software 523
configurations, encryption information, or any information that 524
identifies detection, investigation, or response practices for 525

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 22 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

cybersecurity incidents, including breaches reveal how an 526
agency's information technology and operational technology 527
systems are structured and defended. Disclosure of such 528
information could enable a malicious actor to map system 529
architecture, identify vulnerabilities, and bypass security 530
controls. Information describing processes or practices designed 531
to protect data, information, or existing or proposed 532
information technology or operational technology could similarly 533
be used to exploit weaknesses and predict defensive actions. 534
Portions of risk assessments, evaluations, audits, and other 535
reports of an agency's cybersecurity program routinely include 536
descriptions of vulnerabilities, testing results, and 537
recommendations. Disclosure of such information would 538
substantially increase the likelihood of a successful 539
cyberattack. Login credentials are a foundational security 540
control and disclosure of such information could allow malicious 541
actors to authenticate into government systems, impersonate 542
legitimate users, and access personal identifying and other 543
sensitive information. Internet protocol addresses, geolocation 544
data, and other information which describes the location, 545
computer, computer system, or computer network from which a user 546
accesses a public-facing portal, and the dates and times that a 547
user accesses a public-facing portal could be used to track 548
usage patterns, identify remote access points, or monitor portal 549
vulnerabilities. Sensitive agency-produced data processing 550

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 23 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

software can reveal the inner workings of security controls, 551
authentication mechanisms, or automated processes that malicious 552
actors can use to exploit weaknesses in security measures. If 553
information related to coverage limits and deductibles of 554
cybersecurity insurance were disclosed, it could give 555
cybercriminals an understanding of the monetary sum an agency 556
can afford or may be willing to pay as a result of a ransomware 557
attack at the expense of the taxpayer. Accordingly, the 558
Legislature finds that the disclosure of such sensitive 559
cybersecurity-related information would significantly impair the 560
administration of vital governmental programs. 561
(2) The Legislature also finds that it is a public 562
necessity that any portion of a meeting that would reveal the 563
confidential and exempt information by made exempt from s. 564
286.011, Florida Statutes, and s. 24(b), Article I of the State 565
Constitution, and that any recordings and transcripts of the 566
closed portion of a meeting be made confidential and exempt from 567
s. 119.07(1), Florida Statutes, and s. 24(a), Article I of the 568
State Constitution. The failure to close that portion of a 569
meeting at which confidential and exempt information would be 570
revealed, and prevent the disclosure of the recordings and 571
transcripts of those portions of a meeting, would defeat the 572
purpose of the underlying public records exemption and could 573
result in the release of highly sensitive information related to 574
the cybersecurity of an agency system. 575

HB 7023 2026

CODING: Words stricken are deletions; words underlined are additions.
hb7023-00
Page 24 of 24
F L O R I D A H O U S E O F R E P R E S E N T A T I V E S

(3) For these reasons, the Legislature finds that these 576
public records and public meetings exemptions are of the utmost 577
importance and are a public necessity. 578
Section 16. This act shall take effect upon becoming a 579
law. 580