Florida Digital Bill of Rights (FDBR) 2-3.002(2): Rule 2-3.002(2): general data security practices based on the NIST risk management framework

A controller must protect the confidentiality, integrity and accessibility of personal data it creates, receives, processes, archives, maintains or transmits; maintain security practices complying with the NIST risk management framework and standards (SP 800-37 revision 2, incorporated by reference) or their equivalent, considering the volume and nature of the data; protect mixed-sensitivity data sets at the level of their most sensitive data; keep protecting non-exempt data after its initial purpose until its retention schedule is met; and keep procedures for secure disposal.