New York Senate Bill S07672

New York 2025-2026 Regular Session

• Introduced: 4/28/25
• Refer: 4/28/25
• Engrossed: 5/12/25
• Refer: 5/12/25
• Engrossed: 5/19/25
• Enrolled: 6/26/25
• Chaptered: 6/26/25
• Passed: 6/26/25

Caption

Requires all municipal corporations to report cybersecurity incidents and demands of ransom payments to the division of homeland security and emergency services; defines terms; requires cybersecurity incident reviews; requires cybersecurity awareness training, cybersecurity protection and data protection standards for state maintained information systems.

Impact

The bill introduces significant changes to existing municipal laws by requiring public authorities to maintain detailed records of cybersecurity incidents, which are to be kept confidential and exempt from public disclosure under the state's freedom of information laws. This provision aims to protect sensitive information regarding the state's response to cyber threats. Furthermore, the legislation emphasizes the necessity of developing incident response plans within eighteen months of its enactment, thereby standardizing how municipal corporations manage and recover from cybersecurity breaches.

Summary

Bill S07672 aims to enhance cybersecurity measures across municipal corporations and public authorities in New York State. It establishes a framework that requires these entities to report any cybersecurity incidents, particularly those involving ransom demands, to the Division of Homeland Security and Emergency Services within 72 hours. The bill intends to improve incident response capabilities and protect state-maintained information systems from potential vulnerabilities. It also mandates annual cybersecurity awareness training for government employees starting in 2026, ensuring that personnel are well-equipped to handle cyber threats.

Contention

Notably, the bill has sparked discussions regarding privacy and transparency. Critics argue that exempting incident reports from public scrutiny could hinder accountability and oversight of municipal data management. There are concerns that, while aiming to fortify cybersecurity, the legislation could potentially create a lack of transparency about how effectively these municipalities handle cyber threats and ransom situations. Proponents defend the bill, asserting that the confidentiality of these reports is essential to safeguard sensitive operational details and minimize risks of further attacks.