What's happening
This bill requires New York State to produce a comprehensive cybersecurity report every five years, assessing and detailing the state’s cyber defense needs and practices.
Why it matters
In-depth Analysis of Cyber Needs. The bill mandates a highly detailed assessment of all cybersecurity needs for New York State, its agencies, and public authorities. This goes beyond general reporting, requiring breakdowns by type, scope, cost, effectiveness, and best practices, helping to reveal specific vulnerabilities and strengths.
Comparison with Other Sectors. By requiring the report to include how similar needs are addressed by other states, the federal government, and private sector entities, the law pushes New York to benchmark its defenses and potentially adopt proven strategies from outside government.
Access to Sensitive Information with Security Safeguards. The bill creates a mechanism for legislative leaders to request and receive confidential or sensitive cybersecurity information, but restricts public disclosure and exempts such material from FOIL (Freedom of Information Law). This balances transparency for oversight with protection against exposing security weaknesses.
Public Awareness and Continued Oversight. While sensitive content is withheld, most of the report will be posted publicly. This regular disclosure (every five years) gives the public, businesses, and local governments insight into state cybersecurity posture, encouraging accountability and allowing stakeholders to align their own cyber strategies accordingly.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Headline styles
Regular Cybersecurity Reviews Required
Plain English, a few words. Used as the page title.
Sponsors
Senator · Senate District 3
History
- Reported and committed to finance
- Print number 926a
- Amend and recommit to veterans, homeland security and military affairs
- Referred to veterans, homeland security and military affairs
- Returned to senate
- Died in assembly
- Referred to governmental operations
- Delivered to assembly
- Passed senateVote 62–0
- Ordered to third reading cal.1883
- Committee discharged and committed to rules
- Reported and committed to finance
Show 1 earlier action
- Referred to veterans, homeland security and military affairs
Companion bill
The same bill in the other chamber. A bill becomes law when one version passes both houses and the governor signs it, so either number can carry it.
Review Cyber Security Every Five Years
In Assembly Committee · Governmental Operations · Sponsor Michael DenDekker
Full text
3 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
926--A
2017-2018 Regular Sessions
IN SENATE
January 5, 2017
Introduced by Sens. CROCI, AKSHAR, AVELLA, DeFRANCISCO, FUNKE, GOLDEN, HELMING, ROBACH, SERINO, SEWARD -- read twice and ordered printed, and when printed to be committed to the Committee on Veterans, Homeland Security and Military Affairs -- recommitted to the Committee on Veterans, Homeland Security and Military Affairs in accordance with Senate Rule 6, sec. 8 -- committee discharged, bill amended, ordered reprinted as amended and recommitted to said committee
AN ACT to amend the executive law, in relation to a cyber security report
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. The executive law is amended by adding a new section 719 to read as follows:
§ 719. Quinquennial cyber security report. 1. The commissioner, in consultation with the superintendent of the state police, the chief information officer, and the president of the center for internet security, shall prepare a report, to be delivered to the governor, the temporary president of the senate, the speaker of the assembly, the chair of the senate standing committee on veterans, homeland security and military affairs, and the chair of the assembly standing committee on governmental operations, on or before the first day of September, two thousand eighteen, and then every five years thereafter, which provides a comprehensive review of all cyber security services performed by, and on behalf of, the state of New York.
2. The report required pursuant to subdivision one of this section, shall include a detailed assessment of each and every cyber security need of the state of New York, including but not limited to, its state agencies and its public authorities, and for each and every such cyber security need so identified, shall further include a detailed description of:
(a) the type of cyber security service used to address such need;
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD01791-02-8
S. 926--A 2
(b) the scope of the need so addressed, as well as the scope of the service used to address such need;
(c) the cost of the service used to address such need;
(d) the effectiveness of the cyber security service used to address such need;
(e) the entity providing such cyber security service used to address such need;
(f) the government, industry and/or academically accepted best cyber security practice for addressing such need;
(g) how other states, and the federal government have addressed such need; and
(h) how private sector entities addressed such need.
3. During the preparation of the report required by subdivision one of this section, and after its delivery to the persons identified to receive such report, the commissioner, the superintendent of the state police, the chief information officer, and the president of the center for internet security, as well as the divisions, offices and corporations under their direction, shall provide to such persons entitled to receive such report, any and all additional information such persons may request, with respect to any cyber security issue concerning:
(a) the state of New York, including but not limited to, any agency, board, bureau, commission, department, division, institution, office, or public authority of the state;
(b) any local government entity, including but not limited to, any county, town, city, village, school district, special district, and any agency, board, bureau, commission, department, division, institution, office, or public authority of such local government entity;
(c) any regulated entity of the state of New York or local government entity;
(d) any not-for-profit corporation in the state of New York;
(e) any private sector business in the state of New York, including but not limited to, a sole proprietor, partnership, limited liability company or business corporation; and/or
(f) any citizen of the state of New York.
4. Where compliance with this section shall require the disclosure of confidential information, or the disclosure of sensitive information which in the judgment of the commissioner would jeopardize the cyber security of the state:
(a) such confidential or sensitive information shall be provided to the persons entitled to receive the report as provided by subdivision one of this section, as follows:
(i) In the case of the report required by subdivision one of this section, in the form of a supplemental appendix to the report; and
(ii) In the case of a response to a request for information made in accordance with subdivision three of this section, in a secure manner as determined by the commissioner;
(b) neither a supplemental appendix to the report, nor any confidential or sensitive information provided in accordance with subdivision three of this section, shall be posted on the division's website as required by subdivision five of this section;
(c) neither a supplemental appendix to the report, nor any confidential or sensitive information provided in accordance with subdivision three of this section, shall be subject to the provisions of the freedom of information law pursuant to article six of the public officers law; and
S. 926--A 3
(d) the persons entitled to receive the report as provided by subdivision one of this section, may disclose the supplemental appendix to the report, and any confidential or sensitive information provided in accordance with subdivision three of this section, to their professional staff, but shall not otherwise publicly disclose such confidential or secure information.
5. Except with respect to any confidential or sensitive information as described in subdivision four of this section, the division shall post a copy of the report prepared in accordance with subdivision one of this section, on its website, not more than fifteen days after such report is delivered to the persons entitled to receive such report. The division may further post any and all further information it may deem appropriate, on its website, regarding cyber security, and the protection of public and private computer systems, networks, hardware and software.
§ 2. This act shall take effect immediately.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the executive law, in relation to a cyber security report
Purpose or general idea of bill
This bill would amend the executive law to require a comprehensive review of all cyber security services to be performed every five years.
Summary of specific provisions
This bill would add a new section to the executive law to establish a Quinquennial Cyber Security Report.
Specifically, this new section would:
*Require the Commissioner of the Division of Homeland Security and Emer- gency Services, in consultation with the Superintendent of the State Police, the Chief Information Officer, and the President of the Center for Internet Security, to prepare and issue a quinquennial cyber securi- ty report;
*Require that such report must include an assessment of each and every cyber security need of the state or New York and a detailed description of how that need is being met; and
*Further require, that persons statutorily entitled to receive the report, would also be entitled to request additional information to supplement the report.
Justification
According to the such entities as the United States Department of Home- land Security, Interpol and the New York State White Collar Crime Task Force, cybercrime is a pervasive and rapidly expanding threat. New York state is particularly at risk to cybercrime due to its status as a global hub of international business and commerce. As most major national and international banks, insurance companies and brokerage houses also have headquarters or a significant presence within the state, such present a particularly attractive target to those who wish to engage in cyber crime or cyber terrorism.
In addition to regulating the various business entities noted above, New York State government, also stores and maintains vast quantities of sensitive personal data pertaining to the citizens of our state. The state thereby has an incumbent duty to ensure that the cyber security needs of all entities with state government are being met in order to protect such information.
By requiring the Division of Homeland Security and Emergency Services to identify the various cyber security needs of our state, and detail how the needs are being met, we can ensure that adequate cyber security measures are being taken, and that best practices are being employed to foster the public protection and security the people of our state deserve.
Prior legislative history
S3405 of 2015/16: Passed in the Senate
Fiscal implications
None noted.
Effective date
This act would take effect immediately.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.