74-2.005. Respond  

Effective on Wednesday, January 2, 2019
  • 1The respond function of the FCS is visually represented as such:




    15Respond (RS)

    17Response Planning (RP)

    20RS.RP-1: Execute 22response plan during or after an incident

    29Communications (CO)

    31RS.CO-1: Ensure that 34personnel know their roles and order of operations when a response is needed

    47RS.CO-2: 48Report incidents consistent with established criteria

    54RS.CO-3: Share 56information consistent with response plans

    61RS.CO-4: 62Coordinate with stakeholders consistent with response plans

    69RS.CO-5: Engage in 72voluntary information sharing with external stakeholders to achieve broader cybersecurity situational awareness

    84Analysis (AN)

    86RS.AN-1: Investigate 88notifications from detection systems

    92RS.AN-2: 93Understand the impact of incidents

    98RS.AN-3: 99Perform forensic analysis

    102RS.AN-4: 103Categorize incidents consistent with response plans

    109RS.AN-5: 110Establish processes to receive, analyze, and respond to vulnerabilities disclosed to the agency from internal and external sources

    128Mitigation (MI)

    130RS.MI-1: Contain 132incidents

    133RS.MI-2: 134Mitigate incidents

    136RS.MI-3: 137Mitigate newly identified vulnerabilities or document accepted risks

    145Improvements (IM)

    147RS.IM-1: 148Incorporate lessons learned in response 153plans

    154RS.IM-2: Periodically update r158esponse strategies

    160(1) Response Planning. Each agency shall establish and maintain response processes and procedures and validate execution capability to ensure agency response for detected cybersecurity incidents. Each agency shall execute a response plan during or after an incident (RS.RP-1).

    198(a) Agencies shall establish a Computer Security Incident Response Team (CSIRT) to respond to cybersecurity incidents. CSIRT members shall convene immediately, upon notice of cybersecurity incidents. Responsibilities of CSIRT members include:

    2291. Convening a simple majority of CSIRT members at least quarterly to review, at a minimum, established processes and escalation protocols.

    2502. Receiving incident response training annually. Training shall be coordinated as a part of the information security program.

    2683. CSIRT membership shall include, at a minimum, a member from the information security team, the CIO (or designee), and a member from the Inspector General’s Office who shall act in an advisory capacity. The CSIRT team shall report findings to agency management.

    3114. The CSIRT shall determine the appropriate response required for each cybersecurity incident.

    3245. The agency security incident reporting process must include notification procedures, established pursuant to section 501.171, F.S., section 342282.318, F.S., 344and as specified in executed agreements with external parties. For reporting incidents to AST and the Cybercrime Office (as established within the Florida Department of Law Enforcement via section 373943.0415, F.S.375), agencies shall report observed incident indicators via the AST Incident Reporting Portal to provide early warning and proactive response capability to other State of Florida agencies. Such indicators may include any known attacker IP addresses, malicious uniform resource locator (URL) addresses, malicious code file names and/or associated file hash values.

    426(2) Communications. Each agency shall coordinate response activities with internal and external stakeholders, as appropriate, to include external support from law enforcement agencies. Each agency shall:

    452(a) Inform workers of their roles and order of operations when a response is needed (RS.CO-1).

    468(b) Require that incidents be reported consistent with established criteria and in accordance with agency incident reporting procedures. Criteria shall require immediate reporting, including instances of lost identification and authentication resources (RS.CO-2).

    500(c) Share information, consistent with response plans (RS.CO-3).

    508(d) Coordinate with stakeholders, consistent with response plans (RS.CO-4).

    517(e) Establish communications with external stakeholders to share and receive information to achieve broader cybersecurity situational awareness (RS.CO-5). Where technology permits, enable automated security alerts. Establish processes to receive, assess, and act upon security advisories.

    552(3) Analysis. Each agency shall conduct analysis to adequately respond and support recovery activities. Related activities include:

    569(a) Each agency shall establish notification thresholds and investigate notifications from detection systems (RS.AN-1).

    583(b) Each agency shall assess and identify the impact of incidents (RS.AN-2).

    595(c) Each agency shall perform forensics, where deemed appropriate (RS.AN-3).

    605(d) Each agency shall categorize incidents, consistent with response plans (RS.AN-4). Each incident report and analysis, including findings and corrective actions, shall be documented.

    629(e) Establish processes to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (RS.AN-5).

    649(4) Mitigation. Each agency shall perform incident mitigation activities. The objective of incident mitigation activities shall be to: attempt to contain and prevent recurrence of incidents (RS.MI-1); mitigate incident effects and resolve the incident (RS.MI-2); and address vulnerabilities or document as accepted risks.

    692(5) Improvements. Each agency shall improve organizational response activities by incorporating lessons learned from current and previous detection/response activities into response plans (RS.IM-1). Agencies shall update response strategies in accordance with agency-established policy (RS.IM-2).

    726Rulemaking Authority 728282.318(5) FS. 730Law Implemented 732282.318(3) FS. 734History735‒New 3-10-16, Amended 1-2-19.


Rulemaking Events:

Historical Versions(1)

Select effective date to view different version.