The Critical Infrastructure Protection (CIP) Program builds on the success of the 2023 Critical Infrastructure Risk Assessment (CIRA) program funded by the Florida Legislature by continuing to provide Florida’s public and private critical infrastructure entities with access to a free, comprehensive online risk assessment. The CIP Program is intended to gather anonymous, aggregated data on critical infrastructure cybersecurity to help inform state-level policy, legislative, and funding decisions to enhance the cyber posture of Florida’s critical infrastructure. Participating organizations receive numerous, no-cost benefits for participating, and data gathered is anonymized and aggregated prior to review to protect participant’s privacy.
WHO CAN PARTICIPATE?
The CIP program is available to any public- or private-sector critical infrastructure entities at no cost. Organizations providing goods and services related to the following sectors and operating within the state of Florida are eligible and encouraged to participate:
Communications
Energy
Water and Wastewater Systems
Food and Agriculture
Critical Manufacturing
Commercial Facilities
Dams
Defense Industrial Base
Financial Services
Chemical
Healthcare and Public Health
Transportation
Emergency Services
Government Facilities
Information Technology
Nuclear Reactors, Materials, and Waste
THE ONLINE RISK ASSESSMENT
Cyber Florida is pleased to provide the Cyber Security Evaluation Tool (CSET®) developed by the Idaho National Laboratory (INL) on behalf of the Department of Homeland Security (DHS) at no cost to local government and critical infrastructure organizations, both public and private. The assessment covers the most common cybersecurity threats and vulnerabilities and provides several reports detailing an organization’s strength and weaknesses to help you determine how to allocate resources in the future.
The Entry-Level Assessment is the first step in the CIP Program. Leveraging the CSET®, this confidential online assessment consists of only 20 questions covering commonly reported challenges faced by smaller organizations. Find out how your organization stacks up in these common areas of concern and take the first step toward better cyber resiliency!
- No cost, confidential, secure
- 20 questions, about 30 minutes
- Start, save, return
- Help available
- Snapshot of common issues
This customized instance of the CSET® consists of 156 questions addressing a range of cybersecurity concerns outlined by the NIST Cybersecurity Framework. The survey should be completed by your IT/cybersecurity lead and their team members. Responses are confidential and securely stored (see FAQs for details) an users receive a set of seven customizes reports providing valuable insights on various aspects of your organizational cyber posture. If your organization doesn’t have on-staff expertise, Cyber Florida will connect you with an expert who can help you complete the assessment.
- No cost, confidential, secure
- 156 questions, about 2 hours
- Start, save, return later
- Help available
- Seven customized reports
- Prerequisite to apply for the State of Florida Local Cybersecurity Grant Program (SB2500.3013A)
PLANNING RESOURCES
Incident Response Plan Template*
This document is intended to help small organizations be better prepared to respond to and recover from cybersecurity incidents. Aligned to the standards of the National Institute of Standards and Technology (NIST), this guide can be used to help your organization establish an incident response policy. Download the fillable MS Word form and complete it with your senior leadership team to help your organization be more prepared to mitigate and recover from a cyber incident.
RISK ASSESSMENT BENEFITS
For no-cost and a reasonable time commitment, the CSET® assessment allows you to evaluate your organization’s critical information technology, operational technology, and ransomware readiness using a systematic, disciplined, and repeatable approach. The tailored outputs – seven customized reports – provide prioritized, actionable information to mitigate the risks revealed by your assessment. Your assessment data will support Cyber Florida’s development of an interactive visualization capability to compare cyber risks across infrastructure sectors as well as an anonymized state-wide summary report, two resources that will provide valuable intelligence to the critical infrastructure community and state decision-makers.
Additionally, selected participants can opt in to access to a full suite of cyber workforce development toolsets that identify skills gaps, display training pathways for upskilling employees, and assist with finding the most qualified new cyber talent. To be considered for the no-cost analysis, interested participants must fully complete their CSET® assessment and express interest in receiving the workforce development analysis service through email to Cyber Florida or selecting the follow-on cyber workforce service question in CSET®.
Having trouble with the CSET®? Watch the tutorial video below. If you need additional assistance, submit the Help is Here form.
FREQUENTLY ASKED QUESTIONS
In addition to receiving a free risk assessment for your organization, the data gathered will establish a baseline to guide future planning, policies, and expenditures to strengthen the state’s critical infrastructure assets. This could yield additional state-provided resources and tools for your organization. Additionally, up to 150 participating organizations will get free access to the CyberKnights and Cyber-CHAMP programs, which use the assessment data to help your organization identify and improve cyber skills gaps in your workforce.
Yes! Cyber Florida has a network of staff and volunteers available to assist organizations in completing the assessment. They can connect virtually or in-person to help you submit your assessment. Complete the contact form to request assistance.
You may have completed a risk assessment with a third-party vendor, but that information will not be included in the overall Florida critical infrastructure risk score, which may impact the policies and potential funding for Florida critical infrastructure. The survey is short and easy to use. You will not be asked to reveal protected company details, your information will be strictly protected as critical infrastructure information.
Within the CSET tool, there are a variety of options based on the type of standard being measured. For this reason, we ask all critical infrastructure owners/operators to participate in the survey to be counted and heard so the leaders of Florida can get as accurate a picture as possible to guide Florida’s future investments to make Florida a safe and secure state to live, work, and play.
The data is gathered anonymously and stored on physical servers at the University of South Florida. The University of South Florida uses the NIST Cybersecurity framework to manage its technical and administrative controls. The university has a complete set of security policies, procedures, and standards based on the NIST 800-171 security guidelines. In addition to these administrative controls, the university employs a great number of technical controls including but not limited to: A number of physical and cloud-based Pal Alto Firewalls, the complete Microsoft Defender Stack of products including EDR, Beyond Trust Privileged access management, Microsoft MFA, Splunk for Enterprise Security SIEM, and regular penetration tests and risk assessment performed by both internal staff, state auditors, and 3rd party companies.
The University of South Florida is a Carnegie Research-1 University with numerous federal grants dealing with Medical, Personal, and DoD restricted non-classified data that is secured and monitored 24/7 by USF staff as well as two external SOCs.
Yes, it’s really free! Florida is serious about cybersecurity, and the Florida Legislature provided funding for this initiative so they could gain a better understanding of Florida’s critical infrastructure cyber strengths and weaknesses. The information gathered will help inform future legislation and funding opportunities to help organizations throughout the state, while helping your organization immediately identify potential risks.
HELP IS HERE
We recognize that not every organization has a cybersecurity person on staff. If you have a question or would like assistance in completing the CSET, please submit the form and we will connect you with someone that can help.