Quick Answer
Tallahassee firms that contract with Florida agencies must:
- protect state data under the Florida Cybersecurity Standards, which are based on the NIST Cybersecurity Framework
- report data breaches to the agency within 10 days under Florida’s breach law
- sign a foreign-country-of-concern affidavit for contracts that involve personal data or IT
- follow any sector rules that apply, such as HIPAA, CJIS or IRS Publication 1075
Federal defense work adds NIST SP 800-171 and CMMC. CMMC Level 1 and Level 2 self-assessments are still required, but third-party certification under Phase 2 is suspended.
Why Tallahassee Contractors Face Layered Requirements
Most state agencies are headquartered in Tallahassee, which makes the capital the center of Florida’s public-sector IT and consulting market. Contractors here usually face three layers of security obligations:
- State law and rules that bind agencies, which agencies pass down to vendors through contract terms
- Florida statutes that apply directly to vendors, such as the breach notification and foreign-entity laws
- Federal frameworks tied to the data or the funding source, such as HIPAA, CJIS, IRS rules or DoD requirements
Who Sets Florida’s State Cybersecurity Rules?
| Entity | Role for Contractors |
|---|---|
| Florida Digital Service (within DMS) | Sets enterprise cybersecurity standards for state agencies |
| Department of Management Services (DMS) | Runs state purchasing and the MyFloridaMarketPlace vendor portal |
| Each contracting agency | Writes security terms into your contract |
| Florida Department of Legal Affairs | Enforces the state’s breach notification law |
| FDLE | Oversees the CJIS security policy for criminal justice data |
Key Florida Requirements for State Vendors
1. Florida Cybersecurity Standards (Rule 60GG-2, F.A.C.)
State agencies must follow the Florida Cybersecurity Standards in Rule 60GG-2 of the Florida Administrative Code. The standards are organized around the NIST Cybersecurity Framework functions: Identify, Protect, Detect, Respond and Recover. They don’t apply to vendors directly, but agencies pass them down through contracts. Expect contract terms covering:
- Access controls: multi-factor authentication and least-privilege access to state systems
- Encryption: confidential data protected in transit and at rest
- Logging and monitoring: audit trails kept and made available to the agency
- Background screening: for staff with access to sensitive systems
- Data return and destruction: at contract end, with written certification
- Security assessments: audits or questionnaires during the contract
2. Breach Notification Under the Florida Information Protection Act
The Florida Information Protection Act (Section 501.171, Florida Statutes) applies to any business or government entity, and to any third-party agent, that handles Florida residents’ personal information. Vendors that maintain, store or process personal information for a state agency count as “third-party agents.”
| Who Notifies | Deadline |
|---|---|
| Vendor (third-party agent) → agency | As soon as practicable, no later than 10 days |
| Data owner → affected individuals | No later than 30 days |
| Data owner → Department of Legal Affairs | Within 30 days if 500+ Floridians affected |
| Data owner → consumer reporting agencies | If more than 1,000 people are notified |
Penalties: Entities that fail to give required notice face fines of $1,000 per day for the first 30 days, then $50,000 for each additional 30-day period, up to $500,000. A vendor’s notice failure counts as a violation against the entity it works for, so agencies write strict notice terms into contracts.
3. Agency Incident Reporting Timelines
State agencies and local governments face their own deadlines to report cybersecurity incidents to the state Cybersecurity Operations Center. They must report ransomware within hours, and other significant incidents within a short window after that. Your contract will likely require you to notify the agency much faster than the 10-day breach-law deadline, often within 24 to 72 hours. Read the incident clause carefully.
4. Foreign-Country-of-Concern Affidavits
Section 287.138, Florida Statutes, bars government entities from contracts that give access to personal identifying information to companies that are:
- owned by the government of a foreign country of concern,
- controlled by such a government, or
- organized under the laws of, or based in, a foreign country of concern.
The listed countries are China, Russia, Iran, North Korea, Cuba, Venezuela and Syria. Since July 1, 2024, vendors have had to sign an affidavit certifying they don’t meet any of these criteria before a government entity can contract with them.
HB 905, effective July 1, 2026, broadens these restrictions. It now covers contracts for IT services as well as contracts with access to residents’ personal data. Ask the procurement office for its current affidavit form, because older templates may be out of date.
5. Local Government Contracts
City of Tallahassee and Leon County contracts carry similar requirements. Local governments must adopt cybersecurity standards consistent with Florida law, and they collect the same affidavits. Local procurement packages typically include both the foreign-entity affidavit and a human-trafficking affidavit under Section 787.06.
Sector-Specific Requirements
| Data Type | Framework | Common Florida Agencies |
|---|---|---|
| Health information | HIPAA / HITECH | AHCA, Dept. of Health, DCF |
| Criminal justice data | FBI CJIS Security Policy | FDLE, Dept. of Corrections, law enforcement |
| Federal tax information | IRS Publication 1075 | Dept. of Revenue, DCF |
| Student records | FERPA | Dept. of Education, universities |
| Payment card data | PCI DSS | Any agency taking card payments |
| Defense information (FCI/CUI) | NIST SP 800-171 / CMMC | Federal defense work |
Where Does CMMC Stand for Florida Contractors?
The Cybersecurity Maturity Model Certification (CMMC) applies to Defense Department contracts, not Florida state contracts. Many Tallahassee technology firms do both, so the timeline still matters:
- November 10, 2025: The DFARS rule took effect. Contracting officers began adding CMMC requirements to new solicitations, starting with Phase 1 self-assessments.
- July 13, 2026: The Pentagon suspended Phase 2 and all later CMMC milestones, pending a 60-day review by a new CMMC Reform Task Force.
- September 3, 2026: The Pentagon issued a class deviation telling contracting officers to remove third-party assessment requirements from contracts.
- November 10, 2026: The original Phase 2 start date. It won’t take effect under the current suspension. As of early October 2026, the task force’s report hadn’t been published.
What’s still required: Phase 1 self-assessments, the DFARS 252.204-7012 cybersecurity clause and annual SPRS affirmations remain fully in effect. Third-party certification is paused, not cancelled, and prime contractors may still require it of subcontractors.
Compliance Checklist for Tallahassee Government Contractors
- Register in MyFloridaMarketPlace, the DMS vendor portal, and keep your W-9 and certifications current.
- Map your data. Know where you store, process or send state data and personal information.
- Align with the NIST Cybersecurity Framework. It’s the basis for both Rule 60GG-2 and most agency contract terms.
- Write an incident response plan that meets the shortest notice deadline in any of your contracts.
- Flow requirements down to subcontractors. The 10-day notice duty and data-handling terms should appear in every subcontract.
- Prepare foreign-entity affidavits and know your ownership chain, including investors and parent companies.
- Keep cyber insurance that covers breach notification, forensics and regulatory defense.
- Document everything. Keep policies, training records, access reviews and audit logs ready for agency review.
- Track Florida legislation. State IT governance has been the subject of reorganization bills in two straight sessions.
Frequently Asked Questions
What cybersecurity standards do Florida state contractors need to meet?
Contractors generally have to meet the security terms in their agency contracts, which follow the Florida Cybersecurity Standards in Rule 60GG-2 and the NIST Cybersecurity Framework. They also have to follow Florida’s breach notification law and any sector rules for the data they handle.
How fast must a vendor report a data breach to a Florida agency?
Under Section 501.171, Florida Statutes, a vendor holding personal information for an agency must report a breach as soon as practicable and no later than 10 days. Many contracts set shorter deadlines.
How do state vendor compliance rules apply to Tallahassee tech firms?
Tallahassee tech firms that serve state agencies must:
- register with DMS
- sign foreign-entity affidavits
- meet contract security terms based on Florida’s cybersecurity standards
- follow breach-notice rules
- meet sector frameworks like HIPAA or CJIS when they apply
Is CMMC required for Florida state contracts?
No. CMMC applies to Defense Department contracts. Its Phase 2 third-party certification requirement has been suspended since July 2026, while Phase 1 self-assessments remain in effect.
Who oversees cybersecurity for Florida state agencies?
The Florida Digital Service, part of the Department of Management Services, leads enterprise cybersecurity for state agencies. Proposals to move it to a new agency failed in the 2025 and 2026 legislative sessions.
What is the Florida foreign country of concern affidavit?
It’s a sworn statement required under Section 287.138, Florida Statutes. It certifies that a vendor isn’t owned, controlled or based in a listed country such as China or Russia. HB 905 expanded the requirement to more IT-related contracts as of July 1, 2026.
Sources and Further Reading
- WilmerHale, “Pentagon Suspends CMMC Phase 2 Requirements and Launches Review of Cybersecurity Certification Program,” July 20, 2026
- U.S. Department of War, Office of Industrial Base Growth, “Department of War Suspends CMMC Phase II Requirements,” July 13, 2026
- Crowell & Moring, “Department of War Immediately Suspends CMMC Phase II Requirements, Launches 60-Day Reform Review,” 2026
- Nextgov/FCW, “CMMC’s Phase 2 suspension locked in with binding regulation,” September 2026
- Pegasus Technologies, “Is CMMC Paused? What You Still Owe in 2026”
- Galaxy Consulting, “CMMC Phase 2 Is Suspended,” updated October 2, 2026
- Cooley, “DoD Releases Long-Awaited Final Rule Implementing CMMC Contract Clause,” September 2025
- Florida Senate, CS/CS/SB 480 (2026), Information Technology: bill history
- Government Technology, “Lawmakers Propose Another Restructuring of Florida IT,” 2026
- Government Technology, “Florida Senate Committee Advances Bill to Overhaul State IT,” 2025
- Florida Senate, CS/CS/CS/HB 905 (2026), Foreign Influence: bill history
- Office of Governor Ron DeSantis, “Governor Ron DeSantis Signs Legislation to Protect Florida Against Foreign Influence and Hostile Foreign Actors,” 2026
- Florida Association of Counties, HB 905 legislative summary, March 2026
- Laws of Florida, Chapter 2023-33 (SB 264), creating Section 287.138
- Shumaker, Loop & Kendrick, summary of Florida vendor affidavit requirements
- Perkins Coie, Security Breach Notification Chart: Florida
- Morgan Lewis, “Florida’s Strict New Data Breach Notification Law Takes Effect,” July 2014
About the Author
