Requires the commissioner of the division of homeland security and emergency services to conduct a statewide critical infrastructure security, condition and resilience assessment program for the purpose of identifying vulnerabilities, evaluating infrastructure reliability and preparedness, and developing recommendations to reduce risks to public health, safety, security and economic stability; provides that such assessments shall be conducted at least once every three years.
STATE OF NEW YORK
________________________________________________________________________
10728
IN SENATE
October 28, 2026
___________
Introduced by Sen. GRIFFO -- read twice and ordered printed, and when
printed to be committed to the Committee on Rules
AN ACT to amend the executive law, in relation to establishing a state-
wide critical infrastructure security, condition and resilience
assessment program
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. Short title. This act shall be known and may be cited as
2 the "New York critical infrastructure security and resilience act".
3 § 2. The executive law is amended by adding a new section 711-d to
4 read as follows:
5 § 711-d. Statewide critical infrastructure security, condition and
6 resilience assessments. 1. Definitions. For purposes of this section:
7 (a) "Critical infrastructure" shall mean physical or virtual systems,
8 facilities, assets and networks located within the state that are essen-
9 tial to public health, safety, security, economic stability or the
10 continuity of essential governmental or community services, the incapac-
11 ity or destruction of which would have a substantial adverse impact upon
12 the state or any region thereof. Such infrastructure shall include, but
13 not be limited to:
14 (i) electric generation, transmission and distribution facilities;
15 (ii) natural gas, petroleum and other energy production, storage and
16 transmission systems;
17 (iii) public drinking water supplies, wastewater treatment facilities,
18 water distribution systems and related infrastructure;
19 (iv) highways, bridges, tunnels, railroads, airports, ports and public
20 transportation systems;
21 (v) telecommunications networks, broadband infrastructure, emergency
22 communications and public safety answering points;
23 (vi) hospitals, emergency medical facilities and other health care
24 infrastructure essential to emergency response;
25 (vii) dams, levees, flood control facilities and other infrastructure
26 necessary for the protection of life and property;
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD16493-01-6
S. 10728 2
1 (viii) government facilities and information systems essential to the
2 continuity of government operations; and
3 (ix) other infrastructure designated by the commissioner as essential
4 to public health, safety, security or the continuity of essential
5 services.
6 (b) "Commissioner" shall mean the commissioner of the division of
7 homeland security and emergency services.
8 (c) "Division" shall mean the division of homeland security and emer-
9 gency services.
10 (d) "Resilience" shall mean the ability of critical infrastructure to
11 anticipate, withstand, adapt to, respond to and recover from natural
12 disasters, physical threats, cyberattacks, equipment failures, infras-
13 tructure deterioration and other disruptive events.
14 (e) "Infrastructure interdependency" shall mean a relationship in
15 which the operation, reliability or security of one critical infrastruc-
16 ture system depends upon the continued operation of another infrastruc-
17 ture system.
18 2. Statewide assessment program. (a) The commissioner shall establish
19 and administer a statewide critical infrastructure security, condition
20 and resilience assessment program for the purpose of identifying vulner-
21 abilities, evaluating infrastructure reliability and preparedness, and
22 developing recommendations to reduce risks to public health, safety,
23 security and economic stability. Such assessment shall be conducted not
24 less than once every three years.
25 (b) In conducting such assessments, the commissioner shall consult
26 with appropriate state agencies, authorities, municipalities, public
27 utilities, infrastructure owners and operators, federal agencies, emer-
28 gency management personnel and other relevant stakeholders.
29 (c) The commissioner shall coordinate such assessments with existing
30 federal, state and local inspection, reporting, security and emergency
31 preparedness programs to the greatest extent practicable in order to
32 avoid unnecessary duplication of efforts.
33 3. Scope of assessment. Each statewide assessment conducted pursuant
34 to this section shall include, but not be limited to, an evaluation of
35 the following:
36 (a) physical security, including existing protections against terror-
37 ism, sabotage, unauthorized access, vandalism and other deliberate phys-
38 ical threats to critical infrastructure;
39 (b) cybersecurity, including vulnerabilities affecting information
40 technology, operational technology, industrial control systems, supervi-
41 sory control and data acquisition systems, communications networks and
42 other digital systems essential to infrastructure operations;
43 (c) infrastructure condition and maintenance, including, to the extent
44 such information is available or may lawfully be obtained, the age,
45 structural condition, maintenance needs, equipment reliability, deferred
46 maintenance and anticipated service life of critical infrastructure;
47 (d) natural disasters and environmental threats, including vulnerabil-
48 ities arising from flooding, severe storms, extreme temperatures, wild-
49 fires, earthquakes, droughts and other natural hazards;
50 (e) infrastructure interdependencies, including the potential for a
51 disruption or failure in one infrastructure sector to adversely affect
52 other essential infrastructure systems, including cascading failures
53 involving electrical power, water supply, telecommunications, transpor-
54 tation, health care and emergency services;
55 (f) emergency preparedness and recovery, including the adequacy of
56 emergency response procedures, continuity of operations planning, backup
S. 10728 3
1 systems, emergency power supplies, alternative service arrangements and
2 restoration capabilities;
3 (g) regional vulnerabilities, including infrastructure vulnerabilities
4 affecting particular geographic regions, such as rural communities,
5 municipalities with aging infrastructure, economically distressed areas
6 and communities dependent upon limited or single-source infrastructure
7 systems;
8 (h) workforce and operational readiness, including the availability of
9 qualified personnel, technical resources, training and operational
10 capacity necessary to maintain, secure and restore essential infrastruc-
11 ture systems; and
12 (i) emerging threats, including technological, security, environmental
13 and other emerging risks that may reasonably be expected to affect crit-
14 ical infrastructure within the state.
15 4. Interagency coordination. (a) In carrying out the provisions of
16 this section, the commissioner shall consult with, as appropriate:
17 (i) the department of public service;
18 (ii) the department of environmental conservation;
19 (iii) the department of health;
20 (iv) the department of transportation;
21 (v) the office of information technology services;
22 (vi) the New York state energy research and development authority;
23 (vii) the New York power authority;
24 (viii) the department of state;
25 (ix) the metropolitan transportation authority;
26 (x) the thruway authority; and
27 (xi) other state agencies, public authorities, local governments and
28 infrastructure owners or operators as the commissioner deems appropri-
29 ate.
30 (b) State agencies and public authorities shall, to the extent permit-
31 ted by law, cooperate with the division in conducting such assessments
32 and shall provide relevant existing reports, plans, records and other
33 information reasonably necessary to carry out the provisions of this
34 section.
35 (c) The commissioner may enter into agreements with federal agencies,
36 institutions of higher education, research institutions and other quali-
37 fied entities to obtain technical expertise or assistance.
38 (d) Nothing in this section shall be construed to supersede the lawful
39 jurisdiction of any state or federal regulatory agency or to require an
40 infrastructure owner or operator to disclose information prohibited from
41 disclosure by federal law.
42 5. Identification and prioritization of vulnerabilities. (a) The
43 commissioner shall establish a methodology for identifying and prior-
44 itizing infrastructure vulnerabilities based upon factors including, but
45 not limited to:
46 (i) the likelihood and potential consequences of infrastructure fail-
47 ure;
48 (ii) risks to human life, public health and safety;
49 (iii) the population and geographic area dependent upon the affected
50 infrastructure;
51 (iv) the potential for cascading failures affecting other infrastruc-
52 ture sectors;
53 (v) the availability of redundant systems or alternative services;
54 (vi) the age, physical condition and maintenance history of the
55 infrastructure;
S. 10728 4
1 (vii) the estimated time required to restore essential services
2 following a disruption; and
3 (viii) the potential economic consequences of an interruption in
4 service.
5 (b) The commissioner shall identify categories of infrastructure
6 vulnerabilities requiring immediate, near-term or long-term attention
7 and develop recommendations for mitigating such vulnerabilities. Such
8 recommendations may include, but need not be limited to: proposed capi-
9 tal improvements, maintenance measures, security enhancements, opera-
10 tional changes, workforce investments, emergency preparedness improve-
11 ments and legislative or regulatory actions.
12 6. Statewide report. (a) Within eighteen months after the effective
13 date of this section, and every three years thereafter, the commissioner
14 shall prepare a statewide critical infrastructure security, condition
15 and resilience report and shall submit such report to the governor, the
16 temporary president of the senate, the speaker of the assembly, the
17 minority leader of the senate and the minority leader of the assembly.
18 (b) Such report shall include, at a minimum:
19 (i) a summary of the overall condition, security and resilience of the
20 state's critical infrastructure;
21 (ii) an assessment of significant statewide and regional infrastruc-
22 ture vulnerabilities;
23 (iii) an evaluation of risks associated with aging infrastructure,
24 deferred maintenance and infrastructure interdependencies;
25 (iv) an assessment of existing infrastructure protection, emergency
26 preparedness and disaster recovery programs;
27 (v) recommendations for improving physical security, cybersecurity,
28 maintenance, infrastructure reliability and emergency response capabili-
29 ties;
30 (vi) identification of infrastructure investment priorities, including
31 estimated costs where reasonably ascertainable;
32 (vii) recommendations for legislative, regulatory or administrative
33 changes; and
34 (viii) an evaluation of progress made in addressing vulnerabilities
35 identified in prior reports.
36 (c) The commissioner shall prepare a public version of the report
37 containing statewide findings, general infrastructure conditions, non-
38 sensitive recommendations and other information suitable for public
39 disclosure.
40 (d) The commissioner shall prepare a separate confidential annex
41 containing sensitive security information, facility-specific vulnerabil-
42 ities and other information the disclosure of which could jeopardize
43 public safety or the security of critical infrastructure. Such confi-
44 dential annex shall be maintained, transmitted and disclosed only in
45 accordance with applicable federal and state law, including the public
46 officers law and all applicable protections governing sensitive security
47 and critical infrastructure information.
48 (e) Nothing in this section shall be construed to require public
49 disclosure of information otherwise exempt from disclosure under state
50 or federal law.
51 7. Annual progress updates. In each year in which a comprehensive
52 statewide assessment is not required, the commissioner shall provide a
53 progress update to the governor and legislature identifying: (a) signif-
54 icant developments affecting statewide critical infrastructure security
55 and resilience; (b) progress in addressing previously identified vulner-
56 abilities; (c) newly identified risks requiring legislative or adminis-
S. 10728 5
1 trative attention; and (d) changes in statewide infrastructure prepared-
2 ness and recovery capabilities. Such progress updates may be
3 incorporated into an existing annual report submitted by the division,
4 provided that the requirements of this subdivision are satisfied.
5 8. Limitation of authority; confidentiality. (a) Nothing in this
6 section shall be construed to authorize the division to compel access to
7 privately owned infrastructure, conduct intrusive physical inspections,
8 or obtain protected security, proprietary or operational information
9 beyond the authority otherwise provided by law.
10 (b) The commissioner shall utilize existing assessments, inspection
11 reports, regulatory filings and other available information whenever
12 practicable, consistent with the confidentiality requirements applicable
13 to such information.
14 (c) Information obtained pursuant to this section shall be maintained
15 in accordance with applicable state and federal confidentiality require-
16 ments and shall be used solely for lawful governmental purposes relating
17 to infrastructure security, condition, resilience, emergency management
18 and public safety.
19 (d) Nothing in this section shall be construed to diminish or other-
20 wise alter the duties, responsibilities or authorities of the division
21 under sections seven hundred nine, seven hundred eleven-b, seven hundred
22 thirteen, seven hundred fourteen and seven hundred sixteen of this arti-
23 cle, or any other provision of law.
24 9. Rules and regulations. The commissioner may promulgate such rules
25 and regulations as may be necessary to implement the provisions of this
26 section.
27 § 3. This act shall take effect on the one hundred eightieth day after
28 it shall have become a law. Effective immediately, the addition, amend-
29 ment and/or repeal of any rule or regulation necessary for the implemen-
30 tation of this act on its effective date are authorized to be made and
31 completed on or before such effective date.
