Protect Utility Infrastructure Data

Section 1. Subdivision 1 of section 3-101 of the energy law, as amended by chapter 253 of the laws of 2013, is amended to read as follows:

1. to obtain and maintain an adequate and continuous supply of safe, dependable and economical energy for the people of the state, including through the protection of critical infrastructure as defined in subdivision five of section eighty-six of the public officers law, and to accelerate development and use within the state of renewable energy sources, all in order to promote the state's economic growth, to create employment within the state, to protect its environmental values and agricultural heritage, to husband its resources for future generations, and to promote the health and welfare of its people;

§ 2. Subdivision 5 of section 86 of the public officers law, as added by chapter 403 of the laws of 2003, is amended to read as follows:

5. "Critical infrastructure" means systems, including industrial control systems, assets, places or things, whether physical or virtual, so vital to the state that the disruption, incapacitation or destruction of such systems, including industrial control systems, assets, places or things could jeopardize the health, safety, welfare or security of the state, its residents or its economy.

§ 3. Section 86 of the public officers law is amended by adding a new subdivision 6 to read as follows:

6. "Industrial control systems" means a combination of control components that support operational functions in gas, distribution, trans-

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD08666-04-9

A. 7682 2

mission, and advanced metering infrastructure control centers, and act together to achieve an industrial objective, including controls that are fully automated or that include a human-machine interface.

§ 4. Paragraph (j) of subdivision 2 of section 709 of the executive law, as amended by section 14 of part B of chapter 56 of the laws of 2010, is amended to read as follows:

(j) work with local, state and federal agencies and private entities to conduct assessments of the vulnerability of critical infrastructure to terrorist attack, cyber attack, criminal behavior, and other natural and man-made disasters, including, but not limited to, nuclear facilities, power plants, telecommunications systems, mass transportation systems, public roadways, railways, bridges and tunnels, and attendant industrial control systems as defined by subdivision six of section eighty-six of the public officers law and develop strategies that may be used to protect such infrastructure from terrorist attack, cyber attack, criminal behavior, and other natural and man-made disasters;

§ 5. Subdivision 1 and paragraph (a) of subdivision 2 of section 713 of the executive law, as amended by section 16 of part B of chapter 56 of the laws of 2010, are amended to read as follows:

1. Notwithstanding any other provision of law, the commissioner of the division of homeland security and emergency services, in coordination with the state office of information technology services, shall conduct a review and analysis of measures being taken by the public service commission and any other agency or authority of the state or any political subdivision thereof and, to the extent practicable, of any federal entity, to protect the security of critical infrastructure related to energy generation and transmission located within the state. The commissioner of the division of homeland security and emergency services and the director of the state office of information technology services shall have the authority to review any audits or reports related to the security of such critical infrastructure, including audits or reports conducted at the request of the public service commission or any other agency or authority of the state or any political subdivision thereof or, to the extent practicable, of any federal entity. The owners and operators of such energy generating or transmission facilities shall, in compliance with any federal and state requirements regarding the dissemination of such information, provide access to the commissioner of the division of homeland security and emergency services and the director of the state office of information technology services to such audits or reports regarding such critical infrastructure provided, however, that exclusive custody and control of such audits and reports shall remain solely with the owners and operators of such energy generating or transmission facilities. For the purposes of this article, the term "critical infrastructure" has the meaning ascribed to that term in subdivision five of section eighty-six of the public officers law.

(a) On or before December thirty-first, two thousand four, and not later than three years after such date, and every five years thereafter, the commissioner of the division of homeland security and emergency services, in coordination with the state office of information technology services, shall report to the governor, the temporary president of the senate, the speaker of the assembly, the chairperson of the assembly standing committee on energy, the chairperson of the senate standing committee on energy and telecommunications, the chairperson of the public service commission and the chief executive of any such affected generating or transmission company or his or her designee. Such report shall review the security measures being taken regarding critical

A. 7682 3

infrastructure related to energy generating and transmission facilities in consultation with the most recent version of the National Institute of Standards and Technology "Framework for Improving Critical Infrastructure Cybersecurity" and the North American Electrical Reliability Corporation's Critical Infrastructure Protection Standards, assess the effectiveness thereof, and include recommendations to the legislature or the public service commission if the commissioner of the division of homeland security and emergency services and the director of the state office of information technology services determines that additional measures are required to be implemented, considering, among other factors, the unique characteristics of each energy generating or transmission facility.

§ 6. The public service law is amended by adding a new section 54 to read as follows:

§ 54. Electric or gas consumption data protection. 1. An electric or gas corporation or municipality shall not share, sell, disclose, or otherwise make accessible to any third party a customer's electric or gas consumption data, except where the customer has consented and as provided in subdivision two of this section.

2.(a) Nothing in this section shall preclude an electric or gas corporation or municipality from disclosing a customer's electric or gas consumption data for analysis, reporting, or program management as long as all information has been anonymized regarding the individual identity of a customer.

(b) Nothing in this section shall preclude an electric or gas corporation or municipality from disclosing electric or gas consumption data as required or permitted under state or federal law or by an order of the commission.

(c) Nothing in this section shall preclude an electric or gas corporation or municipality from disclosing a customer's electric or gas consumption data to a third party that contracts with such corporation or municipality to provide services on behalf of the corporation.

3. An electric or gas corporation shall establish: (a) minimum cybersecurity and safety standards and (b) minimum cyber-security insurance requirements, which shall be applicable to third parties seeking to connect to any such corporation's systems to receive consumption or other data. Any third party not contracted by such a corporation that seeks to connect to such corporation's systems to receive consumption or other data shall meet any such established cyber-security and safety standards and insurance requirements.

4. The commission shall promulgate rules and regulations by January first, two thousand twenty-one to ensure the implementation and enforcement of this section.

§ 7. Paragraph (a) of subdivision 19 of section 66 of the public service law, as amended by section 4 of part X of chapter 57 of the laws of 2013, is amended to read as follows:

(a) The commission shall have power to provide for management and operations audits of gas corporations and electric corporations. Such audits shall be performed at least once every five years for combination gas and electric corporations, as well as for straight gas corporations having annual gross revenues in excess of two hundred million dollars. The audit shall include, but not be limited to, an investigation of the company's construction program planning in relation to the needs of its customers for reliable service, an evaluation of the efficiency of the company's operations and use of customer electric or gas consumption data as provided for in section fifty-four of the public service law,

A. 7682 4

recommendations with respect to same, and the timing with respect to the implementation of such recommendations. The commission shall have discretion to have such audits performed by its staff, or by independent auditors.

In every case in which the commission chooses to have the audit provided for in this subdivision or pursuant to subdivision fourteen of section sixty-five of this article performed by independent auditors, it shall have authority to select the auditors, and to require the company being audited to enter into a contract with the auditors providing for their payment by the company. Such contract shall provide further that the auditors shall work for and under the direction of the commission according to such terms as the commission may determine are necessary and reasonable.

§ 8. This act shall take effect on the one hundred eightieth day after it shall have become a law; provided, however, that section six of this act shall take effect thirty days after it shall have become a law. Effective immediately, the public service commission is authorized and directed to take actions necessary to promulgate rules and regulations related to the implementation of subdivision 3 of section 54 of the public service law on or before such effective date.