What's happening
This bill requires rural water utilities to strengthen cybersecurity, conduct yearly audits, and receive priority for modernization funding.
Why it matters
Impacts rural communities statewide. This bill directly affects small water utilities serving 10,000 or fewer people—including many of New York’s rural towns, villages, schools, and hospitals—where resources for cybersecurity and modernization are often limited.
Creates new compliance and reporting obligations. Rural water utilities will be required to disconnect critical controls from the internet, upgrade cybersecurity infrastructure, provide staff training, undergo annual third-party cybersecurity audits, and report breaches within 24 hours—significantly increasing operational and oversight requirements.
Expands technical and financial support. By establishing a specialized cyber-defense task force and prioritizing rural utilities for modernization grants, the legislation aims to level the playing field for rural systems, helping them access expertise and funding they have historically struggled to obtain, which could reduce disparities in water system safety across the state.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Rural Water Utilities and Operators
These entities, serving fewer than 10,000 people, are directly impacted as they must implement new cybersecurity measures, conduct annual audits, train staff, and comply with new reporting and operational requirements.
Residents, Schools, and Hospitals in Rural Areas
As end-users of these water systems, their access to safe, reliable, and secure drinking water is at stake; they benefit from increased cybersecurity protections and infrastructure modernization.
State and Local Government Agencies
The New York State Division of Homeland Security and Emergency Services, State Police Cybercrime Unit, and Public Authorities will have new responsibilities to develop action plans, provide oversight, technical assistance, and emergency response.
Cybersecurity and Infrastructure Vendors
Firms specializing in cybersecurity solutions, training, vulnerability assessments, and remediation services may see increased demand for their products and services from rural utilities upgrading their systems.
Headline styles
Modernize Rural Water Security
Plain English, a few words. Used as the page title.
Sponsors
No co-sponsors yet.
History
- Referred to rules
Full text
3 pagesUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
10724
IN SENATE
October 23, 2026
Introduced by Sen. MAY -- read twice and ordered printed, and when printed to be committed to the Committee on Rules
AN ACT to amend the public authorities law and the public service law, in relation to establishing the "rural water utility modernization and security act"
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. Short title. This act shall be known and may be cited as the "rural state water utility modernization and security act".
§ 2. Legislative findings and intent. The legislature finds that water security is an important aspect of homeland security, and that safeguarding public health, securing critical infrastructure, and ensuring equitable resource distribution are paramount duties of the state. Further, and with respect to drinking water, the state has a duty of care that should extend not only to providing clean water but also a safe and secure supply of drinking water in rural communities. Nearly ninety percent of the state's total community water systems serve populations under 10,000; the purpose of this act is to focus on such rural systems because they are the most vulnerable to cyber attacks and are the most in need of modernization.
§ 3. The public authorities law is amended by adding a new section 1285-v to read as follows:
§ 1285-v. Rural water utility cybersecurity action plan. 1. For the purposes of this section, the term "rural water utility" shall mean a water management facility, a water-works corporation as defined by section two of the public service law, or other owner or operator of a water system as defined by section two of the public service law, providing water to ten thousand persons or less at domestic residences, schools, and/or hospitals.
2. The corporation, in consultation with the division of homeland security and emergency services, shall develop an action plan for the modernization and enhancement of cybersecurity at all rural water utilities in the state. Such action plan shall include, but not be limited
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD16381-02-6
to, the following steps to be undertaken by rural water utilities in the state:
(a) disconnection of all control devices from direct exposure to the internet;
(b) installation of secure cybersecurity firewalls and use of virtual private networks (VPNs);
(c) regularly updating system access passwords to strong, unique character combinations; and
(d) trainings for staff on how to safely run rural water utility plants using manual backup operations.
3. Trainings under paragraph (d) of subdivision two of this section may include video training components, provided, however, that such trainings include an in-person follow up inspection following such video training.
4. The action plan developed pursuant to subdivision two of this section shall initially be developed no later than December thirtyfirst, two thousand twenty-seven, and shall be reviewed and updated as deemed necessary by the corporation annually thereafter.
§ 4. The public service law is amended by adding a new section 89-q to read as follows:
§ 89-q. Rural water utility cybersecurity. 1. For the purposes of this section, the term "rural water utility" shall mean any water-works corporation or other owner or operator of a water system providing water to ten thousand persons or less at domestic residences, schools, and/or hospitals.
2. Each rural water utility in the state shall implement the action plan developed pursuant to subdivision two of section twelve hundred eighty-five-v of the public authorities law.
3. Each rural water utility shall conduct an independent, third-party cybersecurity vulnerability audit annually. The results of such audit shall be filed confidentially with the New York state division of homeland security and emergency services.
4. In the event of a cyber breach, data extortion, or unauthorized system access, the affected rural water utility shall notify the division of homeland security and emergency services and the state police cybercrime unit within twenty-four hours of discovery.
5. The New York state division of homeland security and emergency services shall establish a specialized water cyber-defense task force to provide free technical assistance, monitoring tools, and emergency remediation services to rural water utilities.
§ 5. The public authorities law is amended by adding a new section 1285-w to read as follows:
§ 1285-w. Rural water utility funding and accessibility expansion. 1. For the purposes of this section, the term "rural water utility" shall mean any water-works corporation or other owner or operator of a water system providing water to ten thousand persons or less at domestic residences, schools, and/or hospitals.
2. The strengthening essential cybersecurity for utilities and resiliency enhancements (SECURE) program established and operated by the authority of the New York environmental facilities corporation shall prioritize rural water utilities in the distribution of grants under such program.
§ 6. Severability. If any clause, sentence, paragraph, subdivision, section or part of this act shall be adjudged by any court of competent jurisdiction to be invalid, such judgment shall not affect, impair, or invalidate the remainder thereof, but shall be confined in its operation to the clause, sentence, paragraph, subdivision, section or part thereof directly involved in the controversy in which such judgment shall have been rendered. It is hereby declared to be the intent of the legislature that this act would have been enacted even if such invalid provisions had not been included herein.
§ 7. This act shall take effect immediately.
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Sponsor's memo
Title of bill
An act to amend the public authorities law and the public service law, in relation to establishing the "rural water utility modernization and security act"
Purpose
To focus the state's cybersecurity efforts on rural water utilities as they are the most vulnerable to cyber attacks and in response to recent threats to drinking water utilities across the country. This act seeks to build upon the SECURE Program launched by the state in 2026.
Summary of provisions
The bill adds a new section 1285-v to the public authorities law to outline the development of an action plan focused on the modernization and enhancement of cybersecurity at all rural water utilities, defined as those serving water to ten thousand persons or less at domestic resi- dences, schools, and/or hospitals.
Read the full memo (734 words)
The action plan would be developed by the environmental facilities corporation (EFC) no later than December 31, 2027 and would be done in consultation with the division of homeland security and emergency services.
Action plans must include, at a minimum, the following steps to be undertaken by rural water utilities:
a) Disconnection, either remotely or in person, of all control devices from direct exposure to the internet;
b) Installation of secure cybersecurity firewalls and use of virtual private networks (VPNs);
c) Periodic updates of system access passwords which could include the use of two-step authentication; and
d) Training for water utility operators and staff on how to safely switch to manual operation. Such training would be followed up with in person inspection.
The bill adds a new section 89-q to the public service law to reinforce the required implementation of the action plan set forth in the previous section by each rural water utility. This section also creates a required annual cybersecurity vulnerability audit of each rural water utility to be conducted by an independent third party. In the event of a cyber breach of a rural water utility, a 24 hour rule for notification to homeland security and state police is established along with the establishment of a specialized water cyber security task force for providing free technical assistance to rural water utilities.
The bill adds a new section 1285-w to the public authorities law to make rural water utilities the priority entities for distribution of grant funds made available through the "strengthening essential cybersecurity for utilities and resiliency enhancements (SECURE) program.
Justification
This bill affirms the idea of water security as homeland security. In July and August 2026, a wave of cyber incidents hit public water and utilities across the country. Malicious hackers targeted internet-con- nected water systems in at least 12 U.S. states by breaking into equip- ment that controls water flow and pressure. The vast majority were rural water utilities. According to the FBI Alert, "After remotely accessing internet-facing devices, the actors changed the IP addresses and pass- words, resulting in a loss of monitoring and control functionality." The Cybersecurity and Infrastructure Security Agency (CISA) reported that more than 100 water systems faced automated breach attempts. States like Minnesota, Michigan, New Jersey, South Dakota, Georgia, and Alabama experienced direct operational interference. New York must prioritize its rural water utilities, schools, and hospitals to ensure future threats are not successful in our state.
Most small utilities can't afford to hire dedicated cybersecurity teams and existing federally funded training and improvements are all volun- tary; many don't even know these exist or don't have the resources to access them. According to a National Conference of State legislatures 2022 report, nearly 90% of all public water utilities serve fewer than 10,000 people.
Both the American Water Works Association and the National Association of Water Companies have issued statements urging passage of bills related to cybersecurity funding for water utilities and warning that the existing uniform cybersecurity standards leaves too many systems vulnerable. Meanwhile, CISA has been downsized and gutted by the federal administration and has not had a permanent director in years. States have been left to address their vulnerabilities on their own. By devel- oping an action plan and setting a timeframe within which updates will occur, New York will send the signal that protecting its communities' water supplies is its priority. Without prompt action, New York could face serious breaches within its most vulnerable communities.
Fiscal impact
Funding for this act may be made through the 2026 SECURE Program.
Legislative history
New bill
Effective date
Immediately.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.