The CDC just issues guidance. States and localities determine the actual rules, perhaps based on that guidance.
Now, there’s an interesting issue here in that Orange County has a mask mandate and three phases for removing that mandate, and the Florida Governor has said by executive order those mandates are forbidden in the state. Regardless of the legality of the Orange County mandate, Disney seems to be aligning with it. Currently Orange County is at Phase II. Phase III occurs when 70% vaccinated and/or rolling 14 day positivity below 5%. That second item, the positivity rate, I believe will occur with the next week or two, and which time theoretically Orange County will remove all mask mandates. Business can require masks along whatever policies they want, at least for now.