Daytona Beach commission tables cybersecurity policy for elected officials after legal, insurance debate

The Daytona Beach City Commission on Feb. 19 tabled a second‑reading ordinance that would establish a cybersecurity policy for elected officials, voting 7-0 to send the proposal back to staff for revision and additional information.

City Attorney review and IT staff recommendations were central to the discussion. The draft ordinance would attach an IT policy to the city code, set an initial stipend for elected officials to cover devices and data service at $30 (changed from $25 in the draft), and give a designated administrator authority to temporarily suspend access “if the violation makes it reasonably necessary for the manager to take action to protect network resources from cybersecurity threats, an imminent threat, or to comply with cybersecurity best practices,” language that prompted objections from at least one commissioner.

The debate focused on two legal and operational questions: whether the commission may lawfully delegate temporary suspension authority to the city manager (or another designee) and whether doing so could imperil the city’s cyber insurance coverage if the insurer deemed the city had not followed industry best practices. Commissioner Cantu argued the ordinance would violate the Daytona Beach charter and said she had solicited outside legal advice to that effect. She told colleagues she had “no problem of putting a policy in place for the elected officials” but opposed language that would let a manager suspend access absent an imminent threat. She said the state statute that requires local governments to adopt cybersecurity standards applies to employees and not elected officials.

City Attorney (mister Gross) told the commission he did not believe the charter barred delegation and said the charter already vests the commission with authority to delegate administrative powers to the manager. He also said the ordinance could be adopted as either a resolution or an ordinance and that staff recommended codification so future commissions and managers would find the rule in the code.

Outside speakers backed the proposed policy. Pierre Lewis, who identified himself as a retired cybersecurity officer, told commissioners the draft “is a very sound … program” and emphasized the technical point that cybersecurity protections are aimed at protecting data and devices rather than “a person.” Anne Ruby, a resident, said the city is a “target rich environment” and urged commissioners to approve preventive measures: “I think this is a great ordinance in terms of being an ounce of prevention to prevent a costly pound of cure. And I hope you all vote yes.”

Several commissioners said they supported the overall goal of stronger protections but wanted more work on specific language and assurances from the city’s cyber insurance carrier. Commissioner Strickland summarized concerns about insurance exposure and industry standards: “Our deductible gets higher the longer the delay,” and a failure to meet best management practices could be used by an insurer to decline coverage, he said.

A narrow operational compromise was proposed on the dais: staff should return with revised language that limits the manager’s automatic suspension authority to imminent threats and that documents whether the mayor’s emergency‑order authority under state law could be used as an alternate mechanism. Commissioners also requested a written opinion or documentation from the city’s cyber insurance carrier about coverage risks tied to timing and to noncompliance with best practices. The commission voted 7-0 to table the ordinance so staff and counsel can return with revisions and the requested insurance/legal information.

What’s next: staff will rework the ordinance’s suspension language, return with the insurance policy language and related statutory research, and re‑present the item at a future meeting for further consideration. The draft had already been edited to set the initial elected‑official stipend at $30; the ordinance as drafted would permit future stipend adjustments by resolution.