Relates to municipal cybersecurity incidents or ransomware attacks

Where it stands

Signed into law.

Local Government · New York State Senate

Also referred to Local Governments · New York State Assembly, Rules · New York State Assembly, Rules · New York State Senate.

Purpose, from the sponsor's memo

Section 1 adds a new article to the general municipal law to require the reporting of cybersecurity incidents and demands for a ransom payment by municipal corporations and public authorities to the Commissioner of the Division of Homeland Security and Emergency Services (DHSES). Such reports must include whether the reporting municipal corporation or public authority is requesting or declining advice and/or technical assistance from DHSES with respect to the reported cybersecurity inci- dent or demand for a ransom payment. Cybersecurity incidents, including demands for ransom payment must be reported to DHSES within 72 hours after the municipal corporation or public authority reasonably believes the cybersecurity incident has occurred. In the event of a ransom payment made in connection with a cybersecurity incident, the municipal corporation or public authority must provide DHSES notice of the payment within 24 hours and a written description of the reasons payment was necessary, the amount of the ransom payment, the means by which the ransom payment was made, a description of alternatives to payment considered, and all diligence performed to find alternatives to payment and to ensure compliance with applicable state and federal r ules and regulations. Cybersecurity incident reports and any records related to ransom payments submitted to the Commissioner of DHSES are exempt from Freedom of Information Law (FOIL) disclosure. Section 2 adds a new section to the executive law to require the Commis- sioner of DHSES, or their designees, to review each cybersecurity inci- dent report and notice and explanation of ransom payment submitted by municipal corporations and public authorities to assess potential impacts on the health, safety, welfare or security of the state, or its residents. DHSES is authorized to work with appropriate state agencies, federal law enforcement, and federal homeland security agencies to provide municipal corporations and public authorities with reports of cybersecurity incidents and trends and may coordinate and share reported information with municipal corporations, public authorities, state agen- cies, and federal law enforcement and homeland security agencies to respond to and mitigate cybersecurity threats. Within 48 hours of receiving cybersecurity incident reports that contain a request for advice and/or technical assistance, DHSES must acknowledge receipt of such a request and provide advice to the requesting municipal corpo- ration or public authority and, to the extent practicable, provide tech- nical assistance. Section 3 adds a new section 103-f to the State Technology Law to require employees of the state, a county, city, town, village, or a district, who use technology as part of their official job duties to take an annual cybersecurity awareness training starting January 1, 2026. State training shall be made available to a county, city, town, village, or a district at no charge, however the requirement may be satisfied by another cybersecurity awareness training. All training must be conducted during the employee's regular working hours and employees shall receive compensation at their regular rate of pay for any time spent participating in the training. Section 4 adds a new section 210 to the State Technology Law, to require the Director of the Office of Information Services to issue policies and standards for protection against breaches for the security of the infor- mation systems and for personal information used by such information systems, data backups, information system recovery, secure sanitization and deletion of data, vulnerability management and assessment, and annu- al workforce training regarding protection against breaches of security systems. No later than two years after the effective date of this section, each state agency must create and maintain an inventory of its information systems. Not later than 18 months after the effective date of this section, each state agency sh

Filed with the bill. Read it on nysenate.gov (opens in a new tab)

Recorded votes

• Vote: Floor vote

  NY SenateMay 12, 2025Result: passed

  Voted yes (56)Voted no (1)Voted present (0)Absent (5)

  See member positions for the vote on May 12, 2025 (Floor vote)

• Vote: Committee vote · Rules

  Senate RulesApr 29, 2025Result: passed

  Voted yes (21)Voted no (0)Voted present (0)Absent (0)

  See member positions for the vote on Apr 29, 2025 (Committee vote · Rules)

Full history

1. Jun 26, 2025

   Sent to the executive

   DELIVERED TO GOVERNOR

   NY Senate

2. Jun 26, 2025

   Signed

   SIGNED CHAP.177

   NY Senate

3. May 19, 2025

   Ordered to Third Reading CAL.67

   ORDERED TO THIRD READING CAL.67

   NY Assembly

4. May 19, 2025

   Passed a chamber

   PASSED ASSEMBLY

   NY Assembly

5. May 19, 2025

   Substituted

   SUBSTITUTED BY S7672A

   NY Assembly

About this record

Summary

The summary comes from NY Open Legislation, the New York State Senate's public record. For more, see How we handle summaries.

Cosponsors

The list shows the cosponsors who are on Agora, A to Z. The official record may list more.

Party colors

Parties are shown in the same neutral colors.

Source

From NY Open Legislation, the NY Senate and Assembly, and official rosters. This record was last updated Oct 22, 2026. About our data

Read the record

• Read on NY Senate (opens in a new tab) The official record on nysenate.gov.