 |
Florida Administrative Code (Last Updated: April 18, 2024) |
 |
60. Department of Management Services |
|
60GG. Florida Digital Service |
|
60GG-2. STATE OF FLORIDA CYBERSECURITY STANDARDS |
1(1) Definitions. Capitalized terms used herein will have the meanings ascribed in section 112.22, F.S. “Form” will mean the Form FL[DS]-02, Prohibited Application Waiver Request Form, eff. 12/23, and available at 32http://www.flrules.org/Gateway/reference.asp?No=Ref-16158, 34which is hereby incorporated by reference herein.
41(2) Prohibited Applications List. Pursuant to section 112.22, F.S., the Department is required to compile and maintain a list of Prohibited Applications, publish the list on its website, and update the list quarterly. In order to provide notice of the initial list and any list updates to Public Employers, the Department will publish a notice in the “Miscellaneous” section of the Florida Administrative Register that specifies the link at which the initial and updated list can be found on the Department’s website. Pursuant to section 112.22, F.S., unless a waiver is granted or the exception in section 112.22(2)(b)1., F.S., is met, a Public Employer is required to remove, delete, or uninstall any Prohibited Applications from Government-Issued Devices within fifteen (15) calendar days of issuance or updates to the published list.
171(3) Waiver Process.
174(a) Submission of Waiver Request. A Public Employer that desires a waiver to permit downloading or accessing a Prohibited Application on a Government-Issued Device must submit the waiver request to the Department on the Form. If the Public Employer requires a decision on the waiver within fifteen (15) calendar days of issuance or updates to the published list, then the Public Employer shall submit the Form to the Department no later than five (5) calendar days following publication of the notice in the Florida Administrative Register.
260(b) Waiver Determination.
2631. Forms Submitted within 5 Calendar Days. If the Department receives the Form from the Public Employer within five (5) calendar days of publication of the notice in the Florida Administrative Register, then the Department will provide notice to the Public Employer of its decision to either grant or deny the waiver request by e-mail to the e-mail address provided on the Form within ten (10) calendar days of receipt of the waiver request. The Department may contact the Public Employer Employee listed on the Form to request any clarification on the information submitted in the Form that is necessary for the Department to make its determination. The Public Employer must provide such clarification within one (1) business day, which is deemed to be Monday through Friday, inclusive, excluding state holidays observed in accordance with section 399110.117, F.S. 401Failure to provide such requested clarification may result in denial of the waiver request.
4152. Forms submitted at Other Times. If the Department receives the Form from the Public Employer at any other time, the Department will provide notice to the Public Employer of its decision to either grant or deny the waiver request by e-mail to the e-mail address provided on the Form within thirty (30) calendar days of receipt of the waiver request. The Department may contact the Public Employer Employee listed on the Form to request any clarification on the information submitted in the Form that is necessary for the Department to make its determination. The Public Employer must provide such clarification within five (5) business days, which are deemed to be Monday through Friday, inclusive, excluding state holidays observed in accordance with section 538110.117, F.S. 540Failure to provide such requested clarification may result in denial of the waiver request.
554(c) Waiver Criteria. The Department will make its waiver decision in accordance with the following criteria:
5701. Evaluation of the completed Form.
5762. As represented on the Form, the waiver is necessary for:
587a. Public safety, law enforcement, or other investigatory purposes, including investigations relating to licensure or disciplinary actions, where the purpose does not meet the exception for law enforcement officers in section 112.22(2)(b)1., F.S.;
620b. Research on hardware, operating systems, software, communications systems and protocols, components, and data practices for the purpose of understanding the existence and extent of potential threats, vulnerabilities, and mitigations thereto; or
652c. A recognized state interest, including the Public Employer’s performance of its essential functions.
6663. Risk mitigation is appropriate for the Prohibited Application and purpose of the waiver.
6804. The employee submitting the request on behalf of the Public Employer has indicated that he/she has authority to do so.
701(d) Waiver Extensions. Pursuant to section 112.22(3)(b)3., F.S., any waivers granted must be limited to a timeframe of no more than 1 year unless the Department approves an extension. Unless a rule waiver is submitted to the Department in accordance with section 743120.542, F.S., 745a Public Employer that desires an extension of a previously approved waiver must submit the extension request to the Department no later than sixty (60) days prior to expiration of the waiver. The Public Employer must submit the request on the Form.
787Rulemaking Authority 112.22 FS. Law Implemented 112.22 FS. History–New 12-18-23.
