Fort Walton Beach Resolution — 2026-09 Accepting Funding FL Department of Managed Services-Cybersecurity Software — reading text

may be used by any government agency, such as FL[ DS] and Grantee, in carrying out its functions. Such personal information may not be re -disclosed by FL[ DS] or Grantee, however, except in accordance with the permissible uses set forth at 18 U. S. C. § 2721( b). With certain limited exceptions, DPPA further prohibits the disclosure of highly restricted personal information, as defined in 18 U. S. C. § 2725(4), without the express consent of the individual who is the subject of such information. In accordance with section 119. 0712( 2)( d)( 2), F. S., the emergency contact information contained in a motor vehicle record, without the express consent of the person to whom such emergency contact information applies, may be released only to: ( a) law enforcement agencies for purposes of contacting those listed in the event of an emergency; or ( b) a receiving facility, hospital, or licensed detoxification or addictions receiving facility pursuant to sections 394.463(2)( a) or 397. 6772( 1)( a), F. S., for the sole purpose of informing a patient' s emergency contacts of the patient' s whereabouts. E- mail addresses that are collected by the Florida Department of Highway Safety and Motor Vehicles also may not be disclosed pursuant to Section 119. 0712( 2)( c), F. S. 3. Training. The Parties agree to work together to provide Authorized Users with confidentiality, privacy, and security training regarding access, use, and disclosure requirements for the DPPA Covered Data under DPPA and the Florida Statutes referenced above. 4. Access Requirements. Unique authorization is required for Access and must be properly authenticated and recorded for audit purposes, including, but not limited to, compliance with these terms and conditions. Designation of DSA Coordinators A. The Coordinators for this DSA are: FUDSI DSA Coordinator: Policy Manager 2555 Shumard Oak Boulevard Tallahassee, FL 32399 Page 30 of 37  ATTACHMENT C GRANTEE DATA SHARING AGREEMENT Telephone: 850- 413- 0604 Email: Policv a diaital.fi.aov FLIDSI IT Coordinator: State Cybersecurity Information Security Officer 2555 Shumard Oak Boulevard Tallahassee, FL 32399 Telephone: 850- 413-0604 Email: Cvberna diaital. fl. aov Grantee' s DSA Coordinator: Jeremy Willis City of Fort Walton Beach 107 Miracle Strip Pkwy SW Fort Walton Beach, Florida 32548 Telephone: (850) 833- 9619 Email: jwillis@fwb. org Grantee' s IT Coordinator: Jeremy Willis City of Fort Walton Beach 107 Miracle Strip Pkwy SW Fort Walton Beach, Florida 32548 Telephone: ( 850) 833- 9619 Email: jwillis@fwb. org A. Changes to the DSA and/ or IT Coordinator designations may be accomplished by providing email change notification that is acknowledged by both Parties. Inspection of Records Each Party shall permit the other Party and any other applicable state and federal representatives with regulatory oversight over the other Parry, or their designees, to conduct inspections described in this paragraph, or to make on- site inspections of records relevant to this DSA to ensure compliance with any state and federal law, regulation, or rule. Such inspections may take place with notice during normal business hours wherever the records are maintained. Each Party shall ensure a system is maintained that is sufficient to permit an audit of such Party' s compliance with this DSA and the requirements specified above. Failure to allow such inspections constitutes a material breach of this DSA. This DSA may be terminated in accordance with Article VII. C. for a material breach. Grantee Additional Terms A. Contractors. Grantee shall ensure all contractors that have Access to Covered Data or Software Entitlements comply with all requirements of this DSA. The Software Entitlements shall not be Accessible by, or deployed on, Information Technology Resources not owned, employed, or controlled by Grantee. Page 31 of 37  RELEVANT FLORIDA STATUTES ( 2025) Section 282. 3185, Florida Statutes ( F. S.), the " Local Government Cybersecurity Act," directs the Florida Digital Service ( FL[ DS]) to provide training in cybersecurity to local governments, oversee their compliance in adopting cybersecurity standards, and to receive cybersecurity incident and ransomware event notifications through the State Cybersecurity Operations Center. Such incident reporting must also include "[ a] statement requesting or declining assistance from the Cybersecurity Operations Center, the Cybercrime Office of the Department of Law Enforcement, or the sheriff who has jurisdiction over the local government." per section 282. 3185, F. S. Under Specific Appropriation 2708 and Section 211 of the 2025- 2026 General Appropriations Act, FL[ DS] has been directed to provide nonrecurring assistance to local governments for the development and enhancement of cybersecurity risk management programs. Section 119. 0725, F. S., establishes that coverage limits and deductible or self-insurance amounts of insurance or other risk mitigation coverages acquired for the protection of information technology systems, operational technology systems, or data of entities subject to the requirements of section 119. 07( 1), F. S., and section 24(a), Article I of the State Constitution; information relating to existing or proposed information technology and operational technology systems and assets, whether physical or virtual, the incapacity or destruction of which would negatively affect security, economic security, public health, or public safety; cybersecurity incident information reported under section 282. 3185, F. S.; network schematics, hardware and software configurations, or encryption information or information that identifies detection, investigation, or response practices for suspected or confirmed cybersecurity incidents, including suspected or confirmed breaches, if the disclosure of such information would facilitate unauthorized access to or unauthorized modification, disclosure, or destruction of data or information, whether physical or virtual, or information technology resources, which include an agency' s existing or proposed information technology systems; and the recordings and transcripts of public meetings where such information may be revealed are confidential and exempt, and such public meetings are exempt from section 286.011, F. S., and section 24( b), Article I of the State Constitution. Page 32 of 37  Exhibit A Cybersecurity Incident Response Rider I. Definitions In addition to the defined terms in the DSA, capitalized terms used herein have the meanings provided below: A. Cloud Console —The global administrative accounts for Software Entitlements directly managed and licensed by FL[ DS]. B. Customer Account —The accounts for Software Entitlements directly utilized by Grantee. C. Information Technology Resources — As defined in section 282. 0041, Florida Statutes, data processing hardware and software and services, communications, supplies, personnel, facility resources, maintenance, and training. As used in this IR Rider, the term also includes the definition for " Information Technology," as defined in section 282. 0041, Florida Statutes, to add equipment, hardware, software, firmware, programs, systems, networks, infrastructure, media, and related material used to automatically, electronically, and wirelessly collect, receive, access, transmit, display, store, record, retrieve, analyze, evaluate, process, classify, manipulate, manage, assimilate, control, communicate, exchange, convert, converge, interface, switch, or disseminate information of any kind or form. D. Managing Organization — The entity managing the use of the Software Entitlements and their Cloud Consoles. As used in this IR Rider, the Managing Organization is FL[ DS]. E. Protected Grantee Data — Data, not including Telemetry Data, maintained and generated by Grantee, which shall not be Accessed or Accessible by, or sent to, Software Entitlements. F. Solution Data — Data, reports, or other information generated by Software Entitlements. This may be derived from, but does not include, Telemetry Data. G. Telemetry Data —Data generated by Grantee through automated communication processes from multiple data sources and processed by Software Entitlements. H. View - The permissions Grantee grants to FL[ DS] to see Telemetry and Solutions Data provided to the Managing Organization by Customer Accounts. A View does not permit FL[ DS] Access to Protected Grantee Data. II. Purpose FL[ DS] and Grantee enter into this IR Rider to establish the terms and conditions for FL[ DS] Access to assist Grantee with responding to incidents. 111. Incident Response A. Incident Response Support. As specified in section 282. 3185( 5), F. S., if applicable, upon discovery of an incident, Grantee may request, or FL[ DS] may offer to provide, incident response support. Access to Grantee Information Technology Resources shall be limited to the extent expressly agreed to by Grantee. Such Access and support are unilaterally terminable at any time by either Party. FL[ DS] may establish, and Grantee shall comply with, protocols or procedures for reporting and requesting support for incidents under this IR Rider, responding to incidents, and the types of support available to be provided for an incident. Grantee shall mitigate the impact of the incident and Page 33 of 37  preserve all relevant documents, records, and data. Grantee shall cooperate and coordinate with FL[ DS] in responding to incidents where incident response support is received, including, but not limited to: 1. Assisting with any incident response related investigation by FL[ DS]; 2. Providing FL[ DS] with physical access to the affected facilities and operations; 3. Facilitating interviews with Grantee personnel; and 4. Making all relevant records, logs, files, data reporting, and other materials available to FL[ DS] or Grantee -authorized third parties. FL[ DS] shall only Access Covered Data, other Grantee data, and Grantee