S10724: Establishes the "rural state water utility modernization and security act" which requires the…

STATE OF NEW YORK ________________________________________________________________________ 10724 IN SENATE October 23, 2026 ___________ Introduced by Sen. MAY -- read twice and ordered printed, and when printed to be committed to the Committee on Rules AN ACT to amend the public authorities law and the public service law, in relation to establishing the "rural water utility modernization and security act" The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. Short title. This act shall be known and may be cited as 2 the "rural state water utility modernization and security act". 3 § 2. Legislative findings and intent. The legislature finds that water 4 security is an important aspect of homeland security, and that safe- 5 guarding public health, securing critical infrastructure, and ensuring 6 equitable resource distribution are paramount duties of the state. 7 Further, and with respect to drinking water, the state has a duty of 8 care that should extend not only to providing clean water but also a 9 safe and secure supply of drinking water in rural communities. Nearly 10 ninety percent of the state's total community water systems serve popu- 11 lations under 10,000; the purpose of this act is to focus on such rural 12 systems because they are the most vulnerable to cyber attacks and are 13 the most in need of modernization. 14 § 3. The public authorities law is amended by adding a new section 15 1285-v to read as follows: 16 § 1285-v. Rural water utility cybersecurity action plan. 1. For the 17 purposes of this section, the term "rural water utility" shall mean a 18 water management facility, a water-works corporation as defined by 19 section two of the public service law, or other owner or operator of a 20 water system as defined by section two of the public service law, 21 providing water to ten thousand persons or less at domestic residences, 22 schools, and/or hospitals. 23 2. The corporation, in consultation with the division of homeland 24 security and emergency services, shall develop an action plan for the 25 modernization and enhancement of cybersecurity at all rural water utili- 26 ties in the state. Such action plan shall include, but not be limited EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD16381-02-6 S. 10724 2 1 to, the following steps to be undertaken by rural water utilities in the 2 state: 3 (a) disconnection of all control devices from direct exposure to the 4 internet; 5 (b) installation of secure cybersecurity firewalls and use of virtual 6 private networks (VPNs); 7 (c) regularly updating system access passwords to strong, unique char- 8 acter combinations; and 9 (d) trainings for staff on how to safely run rural water utility 10 plants using manual backup operations. 11 3. Trainings under paragraph (d) of subdivision two of this section 12 may include video training components, provided, however, that such 13 trainings include an in-person follow up inspection following such video 14 training. 15 4. The action plan developed pursuant to subdivision two of this 16 section shall initially be developed no later than December thirty- 17 first, two thousand twenty-seven, and shall be reviewed and updated as 18 deemed necessary by the corporation annually thereafter. 19 § 4. The public service law is amended by adding a new section 89-q to 20 read as follows: 21 § 89-q. Rural water utility cybersecurity. 1. For the purposes of 22 this section, the term "rural water utility" shall mean any water-works 23 corporation or other owner or operator of a water system providing water 24 to ten thousand persons or less at domestic residences, schools, and/or 25 hospitals. 26 2. Each rural water utility in the state shall implement the action 27 plan developed pursuant to subdivision two of section twelve hundred 28 eighty-five-v of the public authorities law. 29 3. Each rural water utility shall conduct an independent, third-party 30 cybersecurity vulnerability audit annually. The results of such audit 31 shall be filed confidentially with the New York state division of home- 32 land security and emergency services. 33 4. In the event of a cyber breach, data extortion, or unauthorized 34 system access, the affected rural water utility shall notify the divi- 35 sion of homeland security and emergency services and the state police 36 cybercrime unit within twenty-four hours of discovery. 37 5. The New York state division of homeland security and emergency 38 services shall establish a specialized water cyber-defense task force to 39 provide free technical assistance, monitoring tools, and emergency reme- 40 diation services to rural water utilities. 41 § 5. The public authorities law is amended by adding a new section 42 1285-w to read as follows: 43 § 1285-w. Rural water utility funding and accessibility expansion. 1. 44 For the purposes of this section, the term "rural water utility" shall 45 mean any water-works corporation or other owner or operator of a water 46 system providing water to ten thousand persons or less at domestic resi- 47 dences, schools, and/or hospitals. 48 2. The strengthening essential cybersecurity for utilities and resili- 49 ency enhancements (SECURE) program established and operated by the 50 authority of the New York environmental facilities corporation shall 51 prioritize rural water utilities in the distribution of grants under 52 such program. 53 § 6. Severability. If any clause, sentence, paragraph, subdivision, 54 section or part of this act shall be adjudged by any court of competent 55 jurisdiction to be invalid, such judgment shall not affect, impair, or 56 invalidate the remainder thereof, but shall be confined in its operation S. 10724 3 1 to the clause, sentence, paragraph, subdivision, section or part thereof 2 directly involved in the controversy in which such judgment shall have 3 been rendered. It is hereby declared to be the intent of the legislature 4 that this act would have been enacted even if such invalid provisions 5 had not been included herein. 6 § 7. This act shall take effect immediately.