Critical Infrastructure Program
A State-Funded Effort to Enhance Cyber Resiliency across Florida
The Critical Infrastructure Program helps both public- and private-sector critical infrastructure organizations assess and improve their cyber posture
Eligibility | Risk Assessment | Guides | Help | FAQ
Cyber News for Critical Infrastructure
Cyber Florida is pleased to partner with the USF School of Information to provide bimonthly updates on the latest international cybersecurity news, broken down by critical infrastructure sector.
Announcing a Valuable New Tool in the CIP Portfolio
Cyber Bulls-i is a first-of-its-kind tool built for Florida’s critical infrastructure organizations! A user-friendly, no-cost way to strengthen your cybersecurity, Cyber Bulls-i can help your organization meet compliance requirements and reduce risk. Whether you’re a public agency, small business, utility, school, or hospital, this tool is here to help!
How It Works: Three Easy Steps
-
Complete the Florida Cyber Risk Assessment (FCRA): Answer straightforward questions to get a custom report.
-
Secure a personalized cybersecurity plan: Receive a tailored map of free resources and expert help.
-
Continue to improve: Track progress, get updates, and strengthen your defenses over time.
Why This Matters
Recent assessments show that half of organizations lack a recovery plan and nearly half lack formal cybersecurity training. Many also face limited time, staff, and budgets. Cyber Bulls-i helps fix this, making it easier to protect your mission and stay compliant without added costs.
What makes Cyber Bulls-i different?
-
Completely free to use, thanks to state funding
- Specific plan tailored to your needs
- Assessment to Action: Turns cybersecurity insights into a clear, actionable roadmap for improvement.
Key Benefits
- Build stronger defenses against cyber threats
- Meet compliance and insurance requirements
- Save time and money with ready-to-use tools
- Get ongoing support to stay protected
-
Start or update your journey today. There are no costs or strings attached. Your participation is a crucial step toward building a safer, more resilient Florida.
Communications
Energy
Water and Wastewater Systems
Food and Agriculture
Critical Manufacturing
Commercial Facilities
Dams
Defense Industrial Base
Financial Services
Chemical
Healthcare and Public Health
Transportation
Emergency Services
Government Facilities
Information Technology
Nuclear Reactors, Materials, and Waste
The Florida Cyber Risk Assessment
This customized instance of the CSET® comprises 106 questions that address a range of cybersecurity concerns outlined in the NIST Cybersecurity Framework. The survey should be completed by your IT/cybersecurity lead and their team members. Responses are confidential and securely stored (see FAQs for details). If your organization doesn’t have on-staff expertise, Cyber Florida will connect you with an expert who can help you complete the assessment.
This assessment uses the DHS’s CSET® NIST Cybersecurity Framework (CSF) 2.0 Standard Question Set and Ransomware Readiness Assessment (RRA) modules, developed by the Idaho National Laboratory for the DHS. The NIST CSF 2.0 adds governance to its core guidance, helping organizations meet their cybersecurity goals and comply with Florida statutes, and is Step 1 along the Cyber Bulls-i path to better resiliency. The assessment covers the most common cybersecurity threats and vulnerabilities, and responses are secure and confidential.
- No cost, confidential, secure
- 106 questions, about 2 hours
- Start, save, return later
- Help available
- Prerequisite to apply for the State of Florida Local Cybersecurity Grant Program (SB2500.3013A)
Cyber Decision-Making Matrix
Developed with the Florida Department of Emergency Management, this planning sheet can help local governments and other critical infrastructure organizations assign responsibility for specific response areas before a cyber incident occurs. Review the list of likely actions and assign roles in advance to ensure a more coordinated response when the need arises.
Situation Manual Development Tabletop Exercises
Developed with the Florida Department of Emergency Management, this guide helps you host a tabletop exercise in which leaders can plan and design a situation manual for responding to a cyber incident. Assign roles and play through the exercise to explore some of the considerations and decisions an organization faces in the wake of a cyber incident.
Cybersecurity Emergency Support Function (ESF) Directory
Developed with the Florida Department of Emergency Management, the Cybersecurity Emergency Support Function Directory is a repository for the state-provided support services available to you before, during, and after a cyber incident. Use this guide to identify critical emergency actions and coordinate with appropriate state agencies during a cyber emergency.
Incident Response Planning Guide
Be better prepared to respond to and recover from cybersecurity incidents. Aligned to NIST standards. Download the fillable MS Word form and complete it with your senior leadership team to help your organization be more prepared to mitigate and recover from a cyber incident.
-
If I complete the assessment, where does my data go?
The assessment data is stored on a secure server at the University of South Florida in Tampa.
-
How is my data protected?
The USF IT Department uses the NIST Cybersecurity framework to manage its technical and administrative controls. The university has a complete set of security policies, procedures, and standards based on NIST SP 800-171.
In addition to these administrative controls, USF employs many technical controls, including but not limited to several physical and cloud-based Palo Alto firewalls, the complete Microsoft Defender stack of products (including EDR), Beyond Trust Privileged Access Management, Microsoft MFA, Splunk for Enterprise Security SIEM, and regular penetration tests and risk assessments performed by both internal staff, state auditors, and 3rd-party companies.
The University of South Florida is a Carnegie Research-1 University with numerous federal grants involving medical, personal, and DoD-restricted non-classified data, which is secured and monitored 24/7 by USF staff and two external SOCs. -
Does the state see my data?
Cyber Florida aggregates the data collected to identify trends and findings, which are reported anonymously and in aggregate and shared only with designated state officials, such as the Governor, the Speaker of the House, and the President of the Senate. Individual organization information is not reported or shared anywhere.
-
Will my vulnerabilities be documented?
The Florida Cyber Risk Assessment does not ask detailed questions about your systems, policies, or procedures. We ask yes-or-no questions at a high level, such as “Do you have a cybersecurity training program?” “Do you use multifactor authentication?” etc. These questions are designed to help guide future state investments and educational efforts and do not require sharing any information about specific technical vulnerabilities.
-
We've completed a risk assessment. Why should we do this one?
Previously completed risk assessment information will not be included in the overall Florida critical infrastructure risk score, which may influence future policies and potential funding for Florida's critical infrastructure. Additionally, completing this assessment is required for any public-sector organization seeking funds through the State of Florida Local Cybersecurity Grant Program.
-
Is it really free? What's the catch?
Yes, it’s really free! Florida is serious about cybersecurity, and the Florida Legislature provided funding for this initiative to better understand the cyber strengths and weaknesses of Florida’s critical infrastructure. The information gathered will inform future legislation and funding opportunities for organizations throughout the state, while helping your organization immediately identify potential risks.