Most new laws that touch local government IT arrive with a list of things you now have to do. This one is different. Florida's HB 1085, signed by the Governor on May 22 and in effect as of July 1, mostly gives local governments something.
The bill creates the Local Government Cybersecurity Protection Program, run by the Florida Digital Service (FLDS). Its purpose, in plain terms, is to help cities and counties defend against cyber threats, ransomware in particular, by putting state-procured security tools and services in their hands.
It passed the House 104 to 1. That kind of margin tells you something about how lawmakers in both parties see the problem.
What the program actually does
Here's the short version, based on the Florida Senate's bill analysis.
FLDS will contract for cybersecurity products and services, then award them to local governments based on objective eligibility and evaluation criteria. Awards are made each year by December 1. Fiscally constrained counties get preference.
Local governments that don't win an award can still buy from the contracts FLDS manages. That matters. A small city that has struggled to get decent pricing on endpoint protection or monitoring now has a state-negotiated option to look at.
Participants will also enter data-sharing agreements with FLDS so the state can help detect and respond to incidents. FLDS can apply for federal money to support the program, and it has to report results to lawmakers each year starting December 15, 2027. The program sunsets on July 1, 2031, unless the Legislature renews it.
What hasn't changed
If you work in a Florida city or county, you already have cybersecurity obligations. Most of them date back to 2022, when HB 7055 became law. We wrote about that bill on this blog when it passed, and it's worth a refresher because HB 1085 builds on top of it rather than replacing it.
Under current law, local governments must:
- Train every employee with network access in basic cybersecurity within 30 days of hire and every year after. Technology staff and anyone handling highly sensitive data need advanced training on the same schedule.
- Adopt cybersecurity standards that align with the NIST Cybersecurity Framework and notify FLDS once they're adopted.
- Report ransomware incidents within 12 hours of discovery, and other serious incidents within 48 hours, to the state Cybersecurity Operations Center, FDLE's Cybercrime Office and the local sheriff.
- Submit an after-action report to FLDS within a week of remediation.
That 12-hour ransomware clock is the one that catches people. In the middle of an incident, nobody wants to stop and file a report. If your incident response plan doesn't already name who files it and how, fix that now.
Why this matters right now
The timing isn't an accident. Local governments have lost some of the outside help they used to count on.
Last September, federal funding for the Multi-State Information Sharing and Analysis Center (MS-ISAC) ended. The center, which gave thousands of cities, counties and school districts free threat intelligence and security services, moved to a paid, tiered membership. Some states bought statewide coverage for their local governments. Others didn't. Purchase records compiled by GovSpend show individual cities and counties now paying a few thousand dollars or more a year for memberships they used to get free.
Meanwhile, state security leaders are worried about the local level. In the 2026 NASCIO-Deloitte Cybersecurity Study, released in May, 63 percent of state CISOs said they were "not very confident" in the cybersecurity of local governments and public higher education. In 2022, that figure was 35 percent.
A state program that pushes tools down to counties and cities is a direct answer to that gap. Whether it's enough depends on funding, and the bill analysis lists the fiscal impact as "indeterminate."
How to get ready before December 1
The first awards are due by December 1. That leaves a few months to get organized, and the agencies that prepare now will be in a better spot when FLDS opens the process.
Know where you stand against NIST. You're already supposed to have adopted NIST-aligned standards. Pull out that document and do an honest gap assessment. A clear list of what's missing makes a far stronger grant case than a general request for "more security."
Check your training records. If an auditor or FLDS asked tomorrow for proof that every employee finished this year's training, could you produce it? If not, that's an easy win.
Test the reporting process. Run a short tabletop exercise built around a ransomware scenario. Time how long it takes to identify who calls the state, who calls the sheriff and what information they need.
Think about data sharing early. Participating in the program means sharing security data with FLDS. Bring your IT lead, attorney and records custodian into that conversation now so it doesn't stall your application later.
Watch for FLDS guidance. Eligibility and evaluation criteria will come from FLDS. Sign up for updates and keep an eye on the Florida Digital Service site through the summer.
Where vTECH io can help
We've worked with Florida municipalities, counties and sheriff's offices on compliance with the 2022 law since it passed. That includes NIST gap assessments, staff training, incident response planning and the security tools that fill the gaps.
If you'd like help sizing up where your organization stands before the first award cycle, call the vTECH io team at 888-277-5918.
Sources
- HB 1085 (2026) Bill Analysis: Local Government Cybersecurity, The Florida Senate
- HB 1085 summary, Florida Association of Counties
- SLED cybersecurity spending in 2026: adapting to the post-MS-ISAC funding era, GovSpend, January 28, 2026
- State CISOs less confident in protecting public data, Smart Cities Dive, May 5, 2026