Establishes the "rural state water utility modernization and security act" which requires the development and implementation of an action plan for the modernization and enhancement of cybersecurity at all rural water utilities in the state; requires SECURE program funding to prioritize rural water utilities.
STATE OF NEW YORK
________________________________________________________________________
10724
IN SENATE
October 23, 2026
___________
Introduced by Sen. MAY -- read twice and ordered printed, and when
printed to be committed to the Committee on Rules
AN ACT to amend the public authorities law and the public service law,
in relation to establishing the "rural water utility modernization and
security act"
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. Short title. This act shall be known and may be cited as
2 the "rural state water utility modernization and security act".
3 § 2. Legislative findings and intent. The legislature finds that water
4 security is an important aspect of homeland security, and that safe-
5 guarding public health, securing critical infrastructure, and ensuring
6 equitable resource distribution are paramount duties of the state.
7 Further, and with respect to drinking water, the state has a duty of
8 care that should extend not only to providing clean water but also a
9 safe and secure supply of drinking water in rural communities. Nearly
10 ninety percent of the state's total community water systems serve popu-
11 lations under 10,000; the purpose of this act is to focus on such rural
12 systems because they are the most vulnerable to cyber attacks and are
13 the most in need of modernization.
14 § 3. The public authorities law is amended by adding a new section
15 1285-v to read as follows:
16 § 1285-v. Rural water utility cybersecurity action plan. 1. For the
17 purposes of this section, the term "rural water utility" shall mean a
18 water management facility, a water-works corporation as defined by
19 section two of the public service law, or other owner or operator of a
20 water system as defined by section two of the public service law,
21 providing water to ten thousand persons or less at domestic residences,
22 schools, and/or hospitals.
23 2. The corporation, in consultation with the division of homeland
24 security and emergency services, shall develop an action plan for the
25 modernization and enhancement of cybersecurity at all rural water utili-
26 ties in the state. Such action plan shall include, but not be limited
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD16381-02-6
S. 10724 2
1 to, the following steps to be undertaken by rural water utilities in the
2 state:
3 (a) disconnection of all control devices from direct exposure to the
4 internet;
5 (b) installation of secure cybersecurity firewalls and use of virtual
6 private networks (VPNs);
7 (c) regularly updating system access passwords to strong, unique char-
8 acter combinations; and
9 (d) trainings for staff on how to safely run rural water utility
10 plants using manual backup operations.
11 3. Trainings under paragraph (d) of subdivision two of this section
12 may include video training components, provided, however, that such
13 trainings include an in-person follow up inspection following such video
14 training.
15 4. The action plan developed pursuant to subdivision two of this
16 section shall initially be developed no later than December thirty-
17 first, two thousand twenty-seven, and shall be reviewed and updated as
18 deemed necessary by the corporation annually thereafter.
19 § 4. The public service law is amended by adding a new section 89-q to
20 read as follows:
21 § 89-q. Rural water utility cybersecurity. 1. For the purposes of
22 this section, the term "rural water utility" shall mean any water-works
23 corporation or other owner or operator of a water system providing water
24 to ten thousand persons or less at domestic residences, schools, and/or
25 hospitals.
26 2. Each rural water utility in the state shall implement the action
27 plan developed pursuant to subdivision two of section twelve hundred
28 eighty-five-v of the public authorities law.
29 3. Each rural water utility shall conduct an independent, third-party
30 cybersecurity vulnerability audit annually. The results of such audit
31 shall be filed confidentially with the New York state division of home-
32 land security and emergency services.
33 4. In the event of a cyber breach, data extortion, or unauthorized
34 system access, the affected rural water utility shall notify the divi-
35 sion of homeland security and emergency services and the state police
36 cybercrime unit within twenty-four hours of discovery.
37 5. The New York state division of homeland security and emergency
38 services shall establish a specialized water cyber-defense task force to
39 provide free technical assistance, monitoring tools, and emergency reme-
40 diation services to rural water utilities.
41 § 5. The public authorities law is amended by adding a new section
42 1285-w to read as follows:
43 § 1285-w. Rural water utility funding and accessibility expansion. 1.
44 For the purposes of this section, the term "rural water utility" shall
45 mean any water-works corporation or other owner or operator of a water
46 system providing water to ten thousand persons or less at domestic resi-
47 dences, schools, and/or hospitals.
48 2. The strengthening essential cybersecurity for utilities and resili-
49 ency enhancements (SECURE) program established and operated by the
50 authority of the New York environmental facilities corporation shall
51 prioritize rural water utilities in the distribution of grants under
52 such program.
53 § 6. Severability. If any clause, sentence, paragraph, subdivision,
54 section or part of this act shall be adjudged by any court of competent
55 jurisdiction to be invalid, such judgment shall not affect, impair, or
56 invalidate the remainder thereof, but shall be confined in its operation
S. 10724 3
1 to the clause, sentence, paragraph, subdivision, section or part thereof
2 directly involved in the controversy in which such judgment shall have
3 been rendered. It is hereby declared to be the intent of the legislature
4 that this act would have been enacted even if such invalid provisions
5 had not been included herein.
6 § 7. This act shall take effect immediately.
