STATE OF NEW YORK ________________________________________________________________________ 7414 2023-2024 Regular Sessions IN SENATE May 24, 2023 ___________ Introduced by Sen. GONZALEZ -- read twice and ordered printed, and when printed to be committed to the Committee on Internet and Technology AN ACT to amend the executive law, in relation to the security and cyber security of certain critical infrastructure The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. Subdivision 1 of section 713 of the executive law, as 2 amended by section 16 of part B of chapter 56 of the laws of 2010, is 3 amended to read as follows: 4 1. Notwithstanding any other provision of law, the commissioner of the 5 division of homeland security and emergency services shall conduct a 6 review and analysis of measures being taken by the public service 7 commission and any other agency or authority of the state or any poli- 8 tical subdivision thereof and, to the extent practicable, of any federal 9 entity, to protect the security, and cyber security, of critical infras- 10 tructure related to energy generation and transmission located within 11 the state. The commissioner of the division of homeland security and 12 emergency services shall have the authority to review any audits or 13 reports related to the security of such critical infrastructure, includ- 14 ing audits or reports conducted at the request of the public service 15 commission or any other agency or authority of the state or any poli- 16 tical subdivision thereof or, to the extent practicable, of any federal 17 entity. The owners and operators of such energy generating or trans- 18 mission facilities shall, in compliance with any federal and state 19 requirements regarding the dissemination of such information, provide 20 access to the commissioner of the division of homeland security and 21 emergency services to such audits or reports regarding such critical 22 infrastructure provided, however, that exclusive custody and control of 23 such audits and reports shall remain solely with the owners and opera- 24 tors of such energy generating or transmission facilities. For the 25 purposes of this article, the term "critical infrastructure" has the EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD11392-01-3
S. 7414 2 1 meaning ascribed to that term in subdivision five of section eighty-six 2 of the public officers law. 3 § 2. Subdivision 1 of section 714 of the executive law, as amended by 4 section 17 of part B of chapter 56 of the laws of 2010, is amended to 5 read as follows: 6 1. Notwithstanding any other provision of law and subject to the 7 availability of an appropriation, the commissioner of the division of 8 homeland security and emergency services shall conduct a review and 9 analysis of measures being taken by the owners and operators of facili- 10 ties identified pursuant to paragraph (b) of subdivision two of this 11 section to protect the security, and cyber security, of critical infras- 12 tructure related to such facilities. The commissioner of the division of 13 homeland security and emergency services shall have the authority to 14 review all audits or reports related to the security of such critical 15 infrastructure, including all such audits or reports mandated by state 16 and federal law or regulation, including spill prevention reports and 17 risk management plans, audits and reports conducted at the request of 18 the department of environmental conservation or at the request of any 19 federal entity, or any other agency or authority of the state or any 20 political subdivision thereof, and reports prepared by owners and opera- 21 tors of such facilities as required in this subdivision. The owners and 22 operators of such facilities shall, in compliance with any federal and 23 state requirements regarding the dissemination of such information, 24 provide access to the commissioner of the division of homeland security 25 and emergency services to such audits and reports regarding such crit- 26 ical infrastructure provided, however, exclusive custody and control of 27 such audits and reports shall remain solely with the owners and opera- 28 tors of such facilities to the extent not inconsistent with any other 29 law. For the purposes of this section, the term "critical infrastruc- 30 ture" has the meaning ascribed to that term in subdivision five of 31 section eighty-six of the public officers law. 32 § 3. Subdivision 1 of section 716 of the executive law, as amended by 33 section 19 of part B of chapter 56 of the laws of 2010, is amended to 34 read as follows: 35 1. Notwithstanding any other provision of law, the commissioner of the 36 division of homeland security and emergency services shall conduct a 37 review and analysis of measures being taken by any other agency or 38 authority of the state or any political subdivision thereof and, to the 39 extent practicable, of any federal entity, to protect the security, and 40 cyber security, of critical infrastructure related to commercial 41 aviation fuel, petroleum and natural gas transmission facilities and 42 pipelines in this state which are not located upon the premises of a 43 commercial airport. As deemed appropriate by such commissioner, the 44 division of homeland security and emergency services shall have the 45 authority to physically inspect the premises and review any audits or 46 reports related to the security of such critical infrastructure, includ- 47 ing audits or reports conducted at the request of any other agency or 48 authority of the state or any political subdivision thereof or, to the 49 extent practicable, of any federal entity. The operators of such commer- 50 cial aviation fuel, petroleum or natural gas transmission facilities and 51 pipelines shall, in compliance with any federal and state requirements 52 regarding the dissemination of such information, provide access to the 53 commissioner of the division of homeland security and emergency services 54 to such audits or reports regarding such critical infrastructure 55 provided, however, that exclusive custody and control of such audits and 56 reports shall remain solely with the operators of such commercial
S. 7414 3 1 aviation fuel, petroleum or natural gas transmission facilities and 2 pipelines. For the purposes of this article, the term "critical infras- 3 tructure" has the meaning ascribed to that term in subdivision five of 4 section eighty-six of the public officers law. 5 § 4. This act shall take effect immediately.