Bill Text: NY A03451 | 2017-2018 | General Assembly | Introduced

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: Requires a comprehensive review of all cyber security services to be performed every five years.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Introduced - Dead) 2018-01-17 - print number 3451a [A03451 Detail]

Download: New_York-2017-A03451-Introduced.html

---

                STATE OF NEW YORK
        ________________________________________________________________________
                                          3451
                               2017-2018 Regular Sessions
                   IN ASSEMBLY
                                    January 27, 2017
                                       ___________
        Introduced  by  M.  of  A.  DenDEKKER  --  read once and referred to the
          Committee on Governmental Operations
        AN ACT to amend the executive law,  in  relation  to  a  cyber  security
          report
          The  People of the State of New York, represented in Senate and Assem-
        bly, do enact as follows:
     1    Section 1. The executive law is amended by adding a new section 719 to
     2  read as follows:
     3    § 719. Quinquennial cyber security report.   1. The  commissioner,  in
     4  consultation  with  the  superintendent  of  the state police, the chief
     5  information officer, and the president of the center for internet  secu-
     6  rity,  shall  prepare  a  report,  to  be delivered to the governor, the
     7  temporary president of the senate, the  speaker  of  the  assembly,  the
     8  chair  of  the  senate standing committee on veterans, homeland security
     9  and military affairs, and the chair of the assembly  standing  committee
    10  on governmental operations, on or before the first day of September, two
    11  thousand seventeen, and then every five years thereafter, which provides
    12  a  comprehensive review of all cyber security services performed by, and
    13  on behalf of, the state of New York.
    14    2. The report required pursuant to subdivision one  of  this  section,
    15  shall  include  a  detailed  assessment of each and every cyber security
    16  need of the state of New York, including but not limited to,  its  state
    17  agencies  and  its public authorities, and for each and every such cyber
    18  security  need  so  identified,  shall  further   include   a   detailed
    19  description of:
    20    (a) the type of cyber security service used to address such need;
    21    (b)  the  scope  of the need so addressed, as well as the scope of the
    22  service used to address such need;
    23    (c) the cost of the service used to address such need;
    24    (d) the effectiveness of the cyber security service  used  to  address
    25  such need;
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD01791-01-7
        A. 3451                             2
     1    (e)  the  entity providing such cyber security service used to address
     2  such need;
     3    (f)  the  government, industry and/or academically accepted best cyber
     4  security practice for addressing such need;
     5    (g) how other states, and the federal government have  addressed  such
     6  need; and
     7    (h) how private sector entities addressed such need.
     8    3. During the preparation of the report required by subdivision one of
     9  this  section,  and  after  its  delivery  to  the persons identified to
    10  receive such report, the commissioner, the superintendent of  the  state
    11  police,  the  chief information officer, and the president of the center
    12  for internet security, as well as  the  divisions,  offices  and  corpo-
    13  rations under their direction, shall provide to such persons entitled to
    14  receive such report, any and all additional information such persons may
    15  request, with respect to any cyber security issue concerning:
    16    (a)  the  state of New York, including but not limited to, any agency,
    17  board, bureau, commission, department, division, institution, office, or
    18  public authority of the state;
    19    (b) any local government entity, including but  not  limited  to,  any
    20  county,  town, city, village, school district, special district, and any
    21  agency, board, bureau, commission,  department,  division,  institution,
    22  office, or public authority of such local government entity;
    23    (c)  any regulated entity of the state of New York or local government
    24  entity;
    25    (d) any not-for-profit corporation in the state of New York;
    26    (e) any private sector business in the state of  New  York,  including
    27  but  not  limited  to, a sole proprietor, partnership, limited liability
    28  company or business corporation; and/or
    29    (f) any citizen of the state of New York.
    30    4. Where compliance with this section shall require the disclosure  of
    31  confidential  information,  or  the  disclosure of sensitive information
    32  which in the judgment of the commissioner  would  jeopardize  the  cyber
    33  security of the state:
    34    (a)  such  confidential  or sensitive information shall be provided to
    35  the persons entitled to receive the report as  provided  by  subdivision
    36  one of this section, as follows:
    37    (i)  In  the  case  of  the report required by subdivision one of this
    38  section, in the form of a supplemental appendix to the report; and
    39    (ii) In the case of a response to a request for  information  made  in
    40  accordance with subdivision three of this section, in a secure manner as
    41  determined by the commissioner;
    42    (b)  neither  a supplemental appendix to the report, nor any confiden-
    43  tial or sensitive information provided in  accordance  with  subdivision
    44  three  of  this  section,  shall  be posted on the division's website as
    45  required by subdivision five of this section;
    46    (c) neither a supplemental appendix to the report, nor  any  confiden-
    47  tial  or  sensitive  information provided in accordance with subdivision
    48  three of this section, shall be subject to the provisions of the freedom
    49  of information law pursuant to article six of the public  officers  law;
    50  and
    51    (d) the persons entitled to receive the report as provided by subdivi-
    52  sion  one of this section, may disclose the supplemental appendix to the
    53  report, and  any  confidential  or  sensitive  information  provided  in
    54  accordance with subdivision three of this section, to their professional
    55  staff,  but  shall  not otherwise publicly disclose such confidential or
    56  secure information.
        A. 3451                             3
     1    5. Except with respect to any confidential or sensitive information as
     2  described in subdivision four of this section, the division shall post a
     3  copy of the report prepared in accordance with subdivision one  of  this
     4  section, on its website, not more than fifteen days after such report is
     5  delivered  to  the persons entitled to receive such report. The division
     6  may further post any and all further information it may  deem  appropri-
     7  ate,  on  its  website,  regarding cyber security, and the protection of
     8  public and private computer systems, networks, hardware and software.
     9    § 2. This act shall take effect immediately.