Requires state employees who use a computer to complete at least twenty-five percent of such employees' required duties to undergo annual cyber security training.
STATE OF NEW YORK
________________________________________________________________________
10605
IN ASSEMBLY
June 20, 2024
___________
Introduced by COMMITTEE ON RULES -- (at request of M. of A. Rajkumar) --
read once and referred to the Committee on Governmental Operations
AN ACT to amend the state technology law, in relation to requiring
certain state employees to undergo annual cyber security training
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The state technology law is amended by adding a new section
2 108 to read as follows:
3 § 108. Annual cyber security training for state employees. 1. Each
4 state agency shall identify state employees who use a computer to
5 complete at least twenty-five percent of such employees' required
6 duties. At least once per year, such identified employees shall complete
7 a cyber security training program approved by the office.
8 2. Each state agency may select the most appropriate cyber security
9 training program approved by the office for employees of each such state
10 agency.
11 3. The executive head of each such state agency shall:
12 (a) verify completion of a cyber security training program by employ-
13 ees of each such state agency in such form and manner as specified by
14 the office; and
15 (b) periodically require an internal review of the agency to ensure
16 compliance with the provisions of this section.
17 4. The office shall develop a form for each state agency to use in
18 verifying completion of annual cyber security trainings as required by
19 paragraph (a) of subdivision three of this section. Such form shall
20 allow a state agency to indicate the percentage of employee completion.
21 5. This section shall not apply to state employees who have been:
22 (a) granted military leave;
23 (b) granted leave under the federal family and medical leave act of
24 1993 (29 U.S.C. § 2601 et seq.);
25 (c) granted leave related to a sickness or disability covered by work-
26 ers' compensation benefits, if such employee no longer has access to a
27 state agency's database and information technology systems; or
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD15357-01-4
A. 10605 2
1 (d) granted any other type of extended leave or authorization to work
2 from an alternative work site, if such employee no longer has access to
3 a state agency's database and information technology systems.
4 § 2. This act shall take effect on the sixtieth day after it shall
5 have become a law. Effective immediately, the addition, amendment and/or
6 repeal of any rule or regulation necessary for the implementation of
7 this act on its effective date are authorized to be made and completed
8 on or before such effective date.