Bill Text: NY A10605 | 2023-2024 | General Assembly | Introduced

---

Bill Title: Requires state employees who use a computer to complete at least twenty-five percent of such employees' required duties to undergo annual cyber security training.

Spectrum: Partisan Bill (Democrat 1-0)

Status: (Introduced) 2024-06-20 - referred to governmental operations [A10605 Detail]

Download: New_York-2023-A10605-Introduced.html

---

                STATE OF NEW YORK
        ________________________________________________________________________

                                          10605

                   IN ASSEMBLY

                                      June 20, 2024
                                       ___________

        Introduced by COMMITTEE ON RULES -- (at request of M. of A. Rajkumar) --
          read once and referred to the Committee on Governmental Operations

        AN  ACT  to  amend  the  state  technology law, in relation to requiring
          certain state employees to undergo annual cyber security training

          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:

     1    Section 1. The state technology law is amended by adding a new section
     2  108 to read as follows:
     3    §  108.  Annual  cyber  security training for state employees. 1. Each
     4  state agency shall identify  state  employees  who  use  a  computer  to
     5  complete  at  least  twenty-five  percent  of  such  employees' required
     6  duties. At least once per year, such identified employees shall complete
     7  a cyber security training program approved by the office.
     8    2. Each state agency may select the most  appropriate  cyber  security
     9  training program approved by the office for employees of each such state
    10  agency.
    11    3. The executive head of each such state agency shall:
    12    (a)  verify completion of a cyber security training program by employ-
    13  ees of each such state agency in such form and manner  as  specified  by
    14  the office; and
    15    (b)  periodically  require  an internal review of the agency to ensure
    16  compliance with the provisions of this section.
    17    4. The office shall develop a form for each state  agency  to  use  in
    18  verifying  completion  of annual cyber security trainings as required by
    19  paragraph (a) of subdivision three of  this  section.  Such  form  shall
    20  allow a state agency to indicate the percentage of employee completion.
    21    5. This section shall not apply to state employees who have been:
    22    (a) granted military leave;
    23    (b)  granted  leave  under the federal family and medical leave act of
    24  1993 (29 U.S.C. § 2601 et seq.);
    25    (c) granted leave related to a sickness or disability covered by work-
    26  ers' compensation benefits, if such employee no longer has access  to  a
    27  state agency's database and information technology systems; or

         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD15357-01-4
        A. 10605                            2

     1    (d)  granted any other type of extended leave or authorization to work
     2  from an alternative work site, if such employee no longer has access  to
     3  a state agency's database and information technology systems.
     4    §  2.  This  act  shall take effect on the sixtieth day after it shall
     5  have become a law. Effective immediately, the addition, amendment and/or
     6  repeal of any rule or regulation necessary  for  the  implementation  of
     7  this  act  on its effective date are authorized to be made and completed
     8  on or before such effective date.