S 7672: Requires all municipal corporations to report cybersecurity incidents and demands of ransom payments to the division of homeland security and emergency services; defines terms; requires cybersecurity incident reviews; requires cybersecurity awareness training, cybersecurity protection and data protection standards for state maintained information systems.

  
  STATE OF NEW YORK ________________________________________________________________________ 7672 2025-2026 Regular Sessions  IN SENATE April 28, 2025 ___________ Introduced by Sen. MARTINEZ -- read twice and ordered printed, and when printed to be committed to the Committee on Rules AN ACT to amend the general municipal law and the executive law, in relation to requiring municipal cybersecurity incident reporting and exempting such reports from freedom of information requirements; and to amend the state technology law, in relation to requiring cyberse- curity awareness training for government employees, data protection standards, and cybersecurity protection The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. The general municipal law is amended by adding a new arti- 2 cle 19-C to read as follows: 3 ARTICLE 19-C 4 CYBERSECURITY INCIDENT REPORTING REQUIREMENTS FOR MUNICIPAL CORPORATIONS 5 AND PUBLIC AUTHORITIES 6 Section 995-a. Definitions. 7 995-b. Reporting of cybersecurity incidents. 8 995-c. Notice and explanation of ransom payment. 9 § 995-a. Definitions. For the purposes of this article: 1. "Cyberse- 10 curity incident" means an event occurring on or conducted through a 11 computer network that actually or imminently jeopardizes the integrity, 12 confidentiality, or availability of computers, information or communi- 13 cations systems or networks, physical or virtual infrastructure 14 controlled by computers or information systems, or information resident 15 thereon. 16 2. "Cyber threat" means any circumstance or event with the potential 17 to adversely impact organizational operations, organizational assets, or 18 individuals through an information system via unauthorized access, 19 destruction, disclosure, modification of information, and/or denial of 20 service. EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD10937-03-5 
 S. 7672 2 1 3. "Cyber threat indicator" means information that is necessary to 2 describe or identify: 3 (a) malicious reconnaissance, including anomalous patterns of communi- 4 cations that appear to be transmitted for the purpose of gathering tech- 5 nical information related to a cybersecurity threat or security vulner- 6 ability; 7 (b) a method of defeating a security control or exploitation of a 8 security vulnerability; 9 (c) a security vulnerability, including anomalous activity that 10 appears to indicate the existence of a security vulnerability; 11 (d) a method of causing a user with legitimate access to an informa- 12 tion system or information that is stored on, processed by, or transit- 13 ing an information system to unwittingly enable the defeat of a security 14 control or exploitation of a security vulnerability; 15 (e) malicious cyber command and control; 16 (f) the actual or potential harm caused by an incident, including a 17 description of the information exfiltrated as a result of a particular 18 cybersecurity threat; 19 (g) any other attribute of a cybersecurity threat, if disclosure of 20 such attribute is not otherwise prohibited by law; or 21 (h) any combination thereof. 22 4. "Defensive measure" means an action, device, procedure, signature, 23 technique, or other measure applied to an information system or informa- 24 tion that is stored on, processed by, or transiting an information 25 system that detects, prevents, or mitigates a known or suspected 26 cybersecurity threat or security vulnerability. The term "defensive 27 measure" does not include a measure that destroys, renders unusable, 28 provides unauthorized access to, or substantially harms an information 29 system or information stored on, processed by, or transiting such infor- 30 mation system not owned by the municipal corporation or public authority 31 operating the measure, or federal entity that is authorized to provide 32 consent and has provided consent to that municipal corporation or public 33 authority for operation of such measure. 34 5. "Information system" means a discrete set of information resources 35 organized for the collection, processing, maintenance, use, sharing, 36 dissemination, or disposition of information. 37 6. "Municipal corporation" means: 38 (a) A municipal corporation as defined in section one hundred nine- 39 teen-n of this chapter; or 40 (b) A district as defined in section one hundred nineteen-n of this 41 chapter. 42 7. "Public authority" means any state authority or local authority, as 43 such terms are defined in section two of the public authorities law, or 44 any subsidiary thereof. 45 8. "Ransom payment" means the transmission of any money or other prop- 46 erty or asset, including virtual currency, or any portion thereof, which 47 has at any time been delivered as ransom in connection with a ransomware 48 attack. 49 9. "Ransomware attack": 50 (a) means an incident that includes the use or threat of use of unau- 51 thorized or malicious code on an information system, or the use or 52 threat of use of another digital mechanism such as a denial of service 53 attack, to interrupt or disrupt the operations of an information system 54 or compromise the confidentiality, availability, or integrity of elec- 55 tronic data stored on, processed by, or transiting an information system 56 to extort a demand for a ransom payment; and 
 S. 7672 3 1 (b) does not include any such event in which the demand for payment 2 is: 3 (i) not genuine; or 4 (ii) made in good faith by an entity in response to a specific request 5 by the owner or operator of the information system. 6 § 995-b. Reporting of cybersecurity incidents. 1. Notwithstanding any 7 other provision of law to the contrary, all municipal corporations and 8 public authorities shall report cybersecurity incidents and when appli- 9 cable, the demand of a ransom payment, to the commissioner of the divi- 10 sion of homeland security and emergency services in the form and method 11 prescribed by such commissioner. Such report shall include whether the 12 reporting municipal corporation or public authority is requesting or 13 declining advice and/or technical assistance from the division of home- 14 land security and emergency services with respect to the reported 15 cybersecurity incident or demand for a ransom payment. 16 2. All municipal corporations and public authorities shall report 17 cybersecurity incidents, including demands for ransom payment, no later 18 than seventy-two hours after the municipal corporation or public author- 19 ity reasonably believes the cybersecurity incident has occurred. 20 3. Any cybersecurity incident report and any records related to a 21 ransom payment submitted to the commissioner of the division of homeland 22 security and emergency services pursuant to the requirements of this 23 article shall be exempt from disclosure under article six of the public 24 officers law. 25 § 995-c. Notice and explanation of ransom payment. Notwithstanding any 26 other provision of law to the contrary, each municipal corporation or 27 public authority shall, in the event of a ransom payment made in 28 connection with a cybersecurity incident involving the municipal corpo- 29 ration or public authority, provide the commissioner of the division of 30 homeland security and emergency services through means prescribed by 31 such commissioner with the following: 32 (a) within twenty-four hours of the ransom payment, notice of the 33 payment; and 34 (b) within thirty days of the ransom payment, a written description of 35 the reasons payment was necessary, the amount of the ransom payment, the 36 means by which the ransom payment was made, a description of alterna- 37 tives to payment considered, all diligence performed to find alterna- 38 tives to payment and all diligence performed to ensure compliance with 39 applicable state and federal rules and regulations including those of 40 the United States department of treasury's office of foreign assets 41 control. 42 § 2. The executive law is amended by adding a new section 711-c to 43 read as follows: 44 § 711-c. Cybersecurity incident reviews. 1. Definitions. As used in 45 this section, the terms cybersecurity incident, cyber threat, cyber 46 threat indicator, defensive measure, information system, municipal 47 corporation, public authority, ransom payment and ransomware attack 48 shall have the same meaning as such terms are defined in article nine- 49 teen-C of the general municipal law. 50 2. The commissioner, or their designees, shall review each cybersecur- 51 ity incident report and notice and explanation of ransom payment submit- 52 ted pursuant to sections nine hundred ninety-five-b and nine hundred 53 ninety-five-c of the general municipal law to assess potential impacts 54 of cybersecurity incidents and ransom payments on the health, safety, 55 welfare or security of the state, or its residents. 
 S. 7672 4 1 3. The commissioner, or their designees, may work with appropriate 2 state agencies, federal law enforcement, and federal homeland security 3 agencies to provide municipal corporations and public authorities with 4 reports of cybersecurity incidents and trends, including but not limited 5 to, to the maximum extent practicable, related contextual information, 6 cyber threat indicators, and defensive measures. The commissioner may 7 coordinate and share such reported information with municipal corpo- 8 rations, public authorities, state agencies, and federal law enforcement 9 and homeland security agencies to respond to and mitigate cybersecurity 10 threats. 11 4. Such reports, assessments, records, reviews, documents, recommenda- 12 tions, guidance and any information contained or used in its preparation 13 shall be exempt from disclosure under article six of the public officers 14 law. 15 5. No later than forty-eight hours after receiving a cybersecurity 16 incident report containing a request for advice and/or technical assist- 17 ance from the division pursuant to subdivision one of section nine 18 hundred ninety-five-b of the general municipal law, the commissioner or 19 the commissioner's designees shall acknowledge receipt of such request. 20 As soon as possible after receiving such a request, the commissioner or 21 the commissioner's designees, subject to the commissioner's discretion 22 in prioritizing the division's response to the municipal corporation's 23 or public authority's cybersecurity incident report, shall provide 24 advice to the requesting municipal corporation or public authority and, 25 to the extent practicable, provide technical assistance. 26 § 3. The state technology law is amended by adding a new section 103-f 27 to read as follows: 28 § 103-f. Cybersecurity awareness training. 1. (a) Employees of the 29 state who use technology as a part of their official job duties shall 30 take annual cybersecurity awareness training beginning January first, 31 two thousand twenty-six. Employees of the state shall be required to 32 complete the training provided by the office. 33 (b) For purposes of this section, "employees of the state" shall 34 include employees of all state agencies and all public benefit corpo- 35 rations, the heads of which are appointed by the governor. 36 2. Employees of a county, a city, a town, a village, or a district as 37 defined in section one hundred nineteen-n of the general municipal law, 38 who use technology as a part of their official job duties shall take 39 annual cybersecurity awareness training beginning January first, two 40 thousand twenty-six. The office shall make a cybersecurity training 41 available for use by a county, a city, a town, a village, or a district 42 as defined in section one hundred nineteen-n of the general municipal 43 law, at no charge, provided however, no employee of a county, a city, a 44 town, a village, or a district as defined in section one hundred nine- 45 teen-n of the general municipal law shall be required to complete such 46 training provided by the office and the cybersecurity awareness training 47 requirements of this section may be satisfied by the completion of other 48 cybersecurity awareness training. 49 3. All training mandated by this section shall be conducted during the 50 employee's regular working hours and employees shall receive compen- 51 sation at their regular rate of pay for any time spent participating in 52 such training. 53 § 4. The state technology law is amended by adding a new section 210 54 to read as follows: 55 § 210. Cybersecurity protection. 1. Definitions. For purposes of this 56 section, the following terms shall have the following meanings: 
 S. 7672 5 1 (a) "Breach of the security of the system" shall have the same meaning 2 as such term is defined in section two hundred eight of this article. 3 (b) "Data subject" means any natural person about whom personal infor- 4 mation has been collected by a state agency. 5 (c) "Information system" means a discrete set of information resources 6 organized for the collection, processing, maintenance, use, sharing, 7 dissemination, or disposition of information. 8 (d) "State agency-maintained personal information" means personal 9 information stored by a state agency that was generated by a state agen- 10 cy or provided to the state agency by the data subject, a state agency, 11 a federal governmental entity, or any other third-party source. Such 12 term shall also include personal information provided by an adverse 13 party in the course of litigation or other adversarial proceeding. 14 (e) "State agency" shall have the same meaning as such term is defined 15 in section one hundred one of this chapter. 16 2. Data protection standards. The director shall issue policies and 17 standards for: 18 (a) protection against breaches of the security of the system informa- 19 tion systems and for personal information used by such information 20 systems; 21 (b) data backup; 22 (c) information system recovery; 23 (d) secure sanitization and deletion of data; 24 (e) vulnerability management and assessment; and 25 (f) annual workforce training regarding protection against breaches of 26 the security of the system, as well as processes and procedures that 27 should be followed in the event of a breach of the security of the 28 system. 29 3. Information system inventory. (a) No later than two years after the 30 effective date of this section, each state agency shall create, then 31 maintain, an inventory of its information systems. 32 (b) Upon written request from the office, a state agency shall provide 33 the office with the state agency-maintained information systems invento- 34 ries required to be created or updated pursuant to this subdivision. 35 (c) Notwithstanding paragraph (a) of this subdivision, the state agen- 36 cy-maintained information systems inventories required to be created or 37 updated pursuant to this subdivision shall be kept confidential, as 38 disclosure of such information would jeopardize the security of a state 39 agency's information systems and information technology assets and, 40 further, shall not be made available for disclosure or inspection under 41 the state freedom of information law. 42 4. Incident management and recovery. (a) No later than eighteen months 43 after the effective date of this section, each state agency shall have 44 created an incident response plan for incidents involving a breach of 45 the security of the system that render an information system or its data 46 unavailable, and incidents involving a breach of the security of the 47 system that result in the alteration or deletion of or unauthorized 48 access to, personal information. 49 (b) Such incident response plan shall include, but not be limited to, 50 a procedure for situations where information systems have been adversely 51 affected by a breach of the security of the system, as well as a proce- 52 dure for the recovery of personal information and information systems. 53 (c) Beginning January first, two thousand twenty-eight and on an annu- 54 al basis thereafter, each state agency shall complete at least one exer- 55 cise of its incident response plan. Upon completion of such exercise, 56 the state agency shall document the incident response plan's successes 
 S. 7672 6 1 and shortcomings in an incident response plan exercise report. The inci- 2 dent response plan and any incident response plan exercise reports shall 3 be kept confidential, as disclosure of such information would jeopardize 4 the security of a state agency's information systems and information 5 technology assets, and, further, shall not be made available for disclo- 6 sure or inspection under the state freedom of information law. 7 5. No private right of action. Nothing set forth in this section shall 8 be construed as creating or establishing a private cause of action. 9 § 5. Severability. The provisions of this act shall be severable and 10 if any portion thereof or the applicability thereof to any person or 11 circumstances shall be held to be invalid, the remainder of this act and 12 the application thereof shall not be affected thereby. 13 § 6. This act shall take effect immediately; provided, however, that 14 sections one and two of this act shall take effect on the thirtieth day 15 after such effective date.