Small water systems would follow cybersecurity safeguards and undergo yearly audits

Covered utilities would follow a state cybersecurity plan. The requirements would cover New York water utilities serving up to 10,000 people at homes, schools, or hospitals. The plan would cover internet and network safeguards, stronger passwords, and staff training for manual backup operations. Video training would require an in-person follow-up inspection. If enacted, the bill would take effect immediately. The first plan would be due December 31, 2027, followed by yearly reviews and updates as needed.

Covered utilities would get an independent outside cybersecurity audit each year. These duties would cover New York water utilities serving up to 10,000 people at homes, schools, or hospitals. Audit results would go confidentially to state emergency officials. Cyber breaches, data extortion, or unauthorized system access would require notice to those officials and the state police cybercrime unit. Incident reports would be due within 24 hours of discovery.

State emergency officials would run a water cybersecurity task force, and the state's SECURE grant program would give covered utilities priority. These provisions would cover New York water utilities serving up to 10,000 people at homes, schools, or hospitals. The task force would offer free technical help, monitoring tools, and emergency help fixing cybersecurity problems.