Assess Infrastructure Security Statewide

Section 1. Short title. This act shall be known and may be cited as the "New York critical infrastructure security and resilience act".

§ 2. The executive law is amended by adding a new section 711-d to read as follows:

§ 711-d. Statewide critical infrastructure security, condition and resilience assessments. 1. Definitions. For purposes of this section:

(a) "Critical infrastructure" shall mean physical or virtual systems, facilities, assets and networks located within the state that are essential to public health, safety, security, economic stability or the continuity of essential governmental or community services, the incapacity or destruction of which would have a substantial adverse impact upon the state or any region thereof. Such infrastructure shall include, but not be limited to:

(i) electric generation, transmission and distribution facilities;

(ii) natural gas, petroleum and other energy production, storage and transmission systems;

(iii) public drinking water supplies, wastewater treatment facilities, water distribution systems and related infrastructure;

(iv) highways, bridges, tunnels, railroads, airports, ports and public transportation systems;

(v) telecommunications networks, broadband infrastructure, emergency communications and public safety answering points;

(vi) hospitals, emergency medical facilities and other health care infrastructure essential to emergency response;

(vii) dams, levees, flood control facilities and other infrastructure necessary for the protection of life and property;

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD16493-01-6

(viii) government facilities and information systems essential to the continuity of government operations; and

(ix) other infrastructure designated by the commissioner as essential to public health, safety, security or the continuity of essential services.

(b) "Commissioner" shall mean the commissioner of the division of homeland security and emergency services.

(c) "Division" shall mean the division of homeland security and emergency services.

(d) "Resilience" shall mean the ability of critical infrastructure to anticipate, withstand, adapt to, respond to and recover from natural disasters, physical threats, cyberattacks, equipment failures, infrastructure deterioration and other disruptive events.

(e) "Infrastructure interdependency" shall mean a relationship in which the operation, reliability or security of one critical infrastructure system depends upon the continued operation of another infrastructure system.

2. Statewide assessment program. (a) The commissioner shall establish and administer a statewide critical infrastructure security, condition and resilience assessment program for the purpose of identifying vulnerabilities, evaluating infrastructure reliability and preparedness, and developing recommendations to reduce risks to public health, safety, security and economic stability. Such assessment shall be conducted not less than once every three years.

(b) In conducting such assessments, the commissioner shall consult with appropriate state agencies, authorities, municipalities, public utilities, infrastructure owners and operators, federal agencies, emergency management personnel and other relevant stakeholders.

(c) The commissioner shall coordinate such assessments with existing federal, state and local inspection, reporting, security and emergency preparedness programs to the greatest extent practicable in order to avoid unnecessary duplication of efforts.

3. Scope of assessment. Each statewide assessment conducted pursuant to this section shall include, but not be limited to, an evaluation of the following:

(a) physical security, including existing protections against terrorism, sabotage, unauthorized access, vandalism and other deliberate physical threats to critical infrastructure;

(b) cybersecurity, including vulnerabilities affecting information technology, operational technology, industrial control systems, supervisory control and data acquisition systems, communications networks and other digital systems essential to infrastructure operations;

(c) infrastructure condition and maintenance, including, to the extent such information is available or may lawfully be obtained, the age, structural condition, maintenance needs, equipment reliability, deferred maintenance and anticipated service life of critical infrastructure;

(d) natural disasters and environmental threats, including vulnerabilities arising from flooding, severe storms, extreme temperatures, wildfires, earthquakes, droughts and other natural hazards;

(e) infrastructure interdependencies, including the potential for a disruption or failure in one infrastructure sector to adversely affect other essential infrastructure systems, including cascading failures involving electrical power, water supply, telecommunications, transportation, health care and emergency services;

(f) emergency preparedness and recovery, including the adequacy of emergency response procedures, continuity of operations planning, backup systems, emergency power supplies, alternative service arrangements and restoration capabilities;

(g) regional vulnerabilities, including infrastructure vulnerabilities affecting particular geographic regions, such as rural communities, municipalities with aging infrastructure, economically distressed areas and communities dependent upon limited or single-source infrastructure systems;

(h) workforce and operational readiness, including the availability of qualified personnel, technical resources, training and operational capacity necessary to maintain, secure and restore essential infrastructure systems; and

(i) emerging threats, including technological, security, environmental and other emerging risks that may reasonably be expected to affect critical infrastructure within the state.

4. Interagency coordination. (a) In carrying out the provisions of this section, the commissioner shall consult with, as appropriate:

(i) the department of public service;

(ii) the department of environmental conservation;

(iii) the department of health;

(iv) the department of transportation;

(v) the office of information technology services;

(vi) the New York state energy research and development authority;

(vii) the New York power authority;

(viii) the department of state;

(ix) the metropolitan transportation authority;

(x) the thruway authority; and

(xi) other state agencies, public authorities, local governments and infrastructure owners or operators as the commissioner deems appropriate.

(b) State agencies and public authorities shall, to the extent permitted by law, cooperate with the division in conducting such assessments and shall provide relevant existing reports, plans, records and other information reasonably necessary to carry out the provisions of this section.

(c) The commissioner may enter into agreements with federal agencies, institutions of higher education, research institutions and other qualified entities to obtain technical expertise or assistance.

(d) Nothing in this section shall be construed to supersede the lawful jurisdiction of any state or federal regulatory agency or to require an infrastructure owner or operator to disclose information prohibited from disclosure by federal law.

5. Identification and prioritization of vulnerabilities. (a) The commissioner shall establish a methodology for identifying and prioritizing infrastructure vulnerabilities based upon factors including, but not limited to:

(i) the likelihood and potential consequences of infrastructure failure;

(ii) risks to human life, public health and safety;

(iii) the population and geographic area dependent upon the affected infrastructure;

(iv) the potential for cascading failures affecting other infrastructure sectors;

(v) the availability of redundant systems or alternative services;

(vi) the age, physical condition and maintenance history of the infrastructure;

(vii) the estimated time required to restore essential services following a disruption; and

(viii) the potential economic consequences of an interruption in service.

(b) The commissioner shall identify categories of infrastructure vulnerabilities requiring immediate, near-term or long-term attention and develop recommendations for mitigating such vulnerabilities. Such recommendations may include, but need not be limited to: proposed capital improvements, maintenance measures, security enhancements, operational changes, workforce investments, emergency preparedness improvements and legislative or regulatory actions.

6. Statewide report. (a) Within eighteen months after the effective date of this section, and every three years thereafter, the commissioner shall prepare a statewide critical infrastructure security, condition and resilience report and shall submit such report to the governor, the temporary president of the senate, the speaker of the assembly, the minority leader of the senate and the minority leader of the assembly.

(b) Such report shall include, at a minimum:

(i) a summary of the overall condition, security and resilience of the state's critical infrastructure;

(ii) an assessment of significant statewide and regional infrastructure vulnerabilities;

(iii) an evaluation of risks associated with aging infrastructure, deferred maintenance and infrastructure interdependencies;

(iv) an assessment of existing infrastructure protection, emergency preparedness and disaster recovery programs;

(v) recommendations for improving physical security, cybersecurity, maintenance, infrastructure reliability and emergency response capabilities;

(vi) identification of infrastructure investment priorities, including estimated costs where reasonably ascertainable;

(vii) recommendations for legislative, regulatory or administrative changes; and

(viii) an evaluation of progress made in addressing vulnerabilities identified in prior reports.

(c) The commissioner shall prepare a public version of the report containing statewide findings, general infrastructure conditions, nonsensitive recommendations and other information suitable for public disclosure.

(d) The commissioner shall prepare a separate confidential annex containing sensitive security information, facility-specific vulnerabilities and other information the disclosure of which could jeopardize public safety or the security of critical infrastructure. Such confidential annex shall be maintained, transmitted and disclosed only in accordance with applicable federal and state law, including the public officers law and all applicable protections governing sensitive security and critical infrastructure information.

(e) Nothing in this section shall be construed to require public disclosure of information otherwise exempt from disclosure under state or federal law.

7. Annual progress updates. In each year in which a comprehensive statewide assessment is not required, the commissioner shall provide a progress update to the governor and legislature identifying: (a) significant developments affecting statewide critical infrastructure security and resilience; (b) progress in addressing previously identified vulnerabilities; (c) newly identified risks requiring legislative or administrative attention; and (d) changes in statewide infrastructure preparedness and recovery capabilities. Such progress updates may be incorporated into an existing annual report submitted by the division, provided that the requirements of this subdivision are satisfied.

8. Limitation of authority; confidentiality. (a) Nothing in this section shall be construed to authorize the division to compel access to privately owned infrastructure, conduct intrusive physical inspections, or obtain protected security, proprietary or operational information beyond the authority otherwise provided by law.

(b) The commissioner shall utilize existing assessments, inspection reports, regulatory filings and other available information whenever practicable, consistent with the confidentiality requirements applicable to such information.

(c) Information obtained pursuant to this section shall be maintained in accordance with applicable state and federal confidentiality requirements and shall be used solely for lawful governmental purposes relating to infrastructure security, condition, resilience, emergency management and public safety.

(d) Nothing in this section shall be construed to diminish or otherwise alter the duties, responsibilities or authorities of the division under sections seven hundred nine, seven hundred eleven-b, seven hundred thirteen, seven hundred fourteen and seven hundred sixteen of this article, or any other provision of law.

9. Rules and regulations. The commissioner may promulgate such rules and regulations as may be necessary to implement the provisions of this section.