S10728: Requires the commissioner of the division of homeland security and emergency services to conduct a…

STATE OF NEW YORK ________________________________________________________________________ 10728 IN SENATE October 28, 2026 ___________ Introduced by Sen. GRIFFO -- read twice and ordered printed, and when printed to be committed to the Committee on Rules AN ACT to amend the executive law, in relation to establishing a state- wide critical infrastructure security, condition and resilience assessment program The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. Short title. This act shall be known and may be cited as 2 the "New York critical infrastructure security and resilience act". 3 § 2. The executive law is amended by adding a new section 711-d to 4 read as follows: 5 § 711-d. Statewide critical infrastructure security, condition and 6 resilience assessments. 1. Definitions. For purposes of this section: 7 (a) "Critical infrastructure" shall mean physical or virtual systems, 8 facilities, assets and networks located within the state that are essen- 9 tial to public health, safety, security, economic stability or the 10 continuity of essential governmental or community services, the incapac- 11 ity or destruction of which would have a substantial adverse impact upon 12 the state or any region thereof. Such infrastructure shall include, but 13 not be limited to: 14 (i) electric generation, transmission and distribution facilities; 15 (ii) natural gas, petroleum and other energy production, storage and 16 transmission systems; 17 (iii) public drinking water supplies, wastewater treatment facilities, 18 water distribution systems and related infrastructure; 19 (iv) highways, bridges, tunnels, railroads, airports, ports and public 20 transportation systems; 21 (v) telecommunications networks, broadband infrastructure, emergency 22 communications and public safety answering points; 23 (vi) hospitals, emergency medical facilities and other health care 24 infrastructure essential to emergency response; 25 (vii) dams, levees, flood control facilities and other infrastructure 26 necessary for the protection of life and property; EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD16493-01-6 S. 10728 2 1 (viii) government facilities and information systems essential to the 2 continuity of government operations; and 3 (ix) other infrastructure designated by the commissioner as essential 4 to public health, safety, security or the continuity of essential 5 services. 6 (b) "Commissioner" shall mean the commissioner of the division of 7 homeland security and emergency services. 8 (c) "Division" shall mean the division of homeland security and emer- 9 gency services. 10 (d) "Resilience" shall mean the ability of critical infrastructure to 11 anticipate, withstand, adapt to, respond to and recover from natural 12 disasters, physical threats, cyberattacks, equipment failures, infras- 13 tructure deterioration and other disruptive events. 14 (e) "Infrastructure interdependency" shall mean a relationship in 15 which the operation, reliability or security of one critical infrastruc- 16 ture system depends upon the continued operation of another infrastruc- 17 ture system. 18 2. Statewide assessment program. (a) The commissioner shall establish 19 and administer a statewide critical infrastructure security, condition 20 and resilience assessment program for the purpose of identifying vulner- 21 abilities, evaluating infrastructure reliability and preparedness, and 22 developing recommendations to reduce risks to public health, safety, 23 security and economic stability. Such assessment shall be conducted not 24 less than once every three years. 25 (b) In conducting such assessments, the commissioner shall consult 26 with appropriate state agencies, authorities, municipalities, public 27 utilities, infrastructure owners and operators, federal agencies, emer- 28 gency management personnel and other relevant stakeholders. 29 (c) The commissioner shall coordinate such assessments with existing 30 federal, state and local inspection, reporting, security and emergency 31 preparedness programs to the greatest extent practicable in order to 32 avoid unnecessary duplication of efforts. 33 3. Scope of assessment. Each statewide assessment conducted pursuant 34 to this section shall include, but not be limited to, an evaluation of 35 the following: 36 (a) physical security, including existing protections against terror- 37 ism, sabotage, unauthorized access, vandalism and other deliberate phys- 38 ical threats to critical infrastructure; 39 (b) cybersecurity, including vulnerabilities affecting information 40 technology, operational technology, industrial control systems, supervi- 41 sory control and data acquisition systems, communications networks and 42 other digital systems essential to infrastructure operations; 43 (c) infrastructure condition and maintenance, including, to the extent 44 such information is available or may lawfully be obtained, the age, 45 structural condition, maintenance needs, equipment reliability, deferred 46 maintenance and anticipated service life of critical infrastructure; 47 (d) natural disasters and environmental threats, including vulnerabil- 48 ities arising from flooding, severe storms, extreme temperatures, wild- 49 fires, earthquakes, droughts and other natural hazards; 50 (e) infrastructure interdependencies, including the potential for a 51 disruption or failure in one infrastructure sector to adversely affect 52 other essential infrastructure systems, including cascading failures 53 involving electrical power, water supply, telecommunications, transpor- 54 tation, health care and emergency services; 55 (f) emergency preparedness and recovery, including the adequacy of 56 emergency response procedures, continuity of operations planning, backup S. 10728 3 1 systems, emergency power supplies, alternative service arrangements and 2 restoration capabilities; 3 (g) regional vulnerabilities, including infrastructure vulnerabilities 4 affecting particular geographic regions, such as rural communities, 5 municipalities with aging infrastructure, economically distressed areas 6 and communities dependent upon limited or single-source infrastructure 7 systems; 8 (h) workforce and operational readiness, including the availability of 9 qualified personnel, technical resources, training and operational 10 capacity necessary to maintain, secure and restore essential infrastruc- 11 ture systems; and 12 (i) emerging threats, including technological, security, environmental 13 and other emerging risks that may reasonably be expected to affect crit- 14 ical infrastructure within the state. 15 4. Interagency coordination. (a) In carrying out the provisions of 16 this section, the commissioner shall consult with, as appropriate: 17 (i) the department of public service; 18 (ii) the department of environmental conservation; 19 (iii) the department of health; 20 (iv) the department of transportation; 21 (v) the office of information technology services; 22 (vi) the New York state energy research and development authority; 23 (vii) the New York power authority; 24 (viii) the department of state; 25 (ix) the metropolitan transportation authority; 26 (x) the thruway authority; and 27 (xi) other state agencies, public authorities, local governments and 28 infrastructure owners or operators as the commissioner deems appropri- 29 ate. 30 (b) State agencies and public authorities shall, to the extent permit- 31 ted by law, cooperate with the division in conducting such assessments 32 and shall provide relevant existing reports, plans, records and other 33 information reasonably necessary to carry out the provisions of this 34 section. 35 (c) The commissioner may enter into agreements with federal agencies, 36 institutions of higher education, research institutions and other quali- 37 fied entities to obtain technical expertise or assistance. 38 (d) Nothing in this section shall be construed to supersede the lawful 39 jurisdiction of any state or federal regulatory agency or to require an 40 infrastructure owner or operator to disclose information prohibited from 41 disclosure by federal law. 42 5. Identification and prioritization of vulnerabilities. (a) The 43 commissioner shall establish a methodology for identifying and prior- 44 itizing infrastructure vulnerabilities based upon factors including, but 45 not limited to: 46 (i) the likelihood and potential consequences of infrastructure fail- 47 ure; 48 (ii) risks to human life, public health and safety; 49 (iii) the population and geographic area dependent upon the affected 50 infrastructure; 51 (iv) the potential for cascading failures affecting other infrastruc- 52 ture sectors; 53 (v) the availability of redundant systems or alternative services; 54 (vi) the age, physical condition and maintenance history of the 55 infrastructure; S. 10728 4 1 (vii) the estimated time required to restore essential services 2 following a disruption; and 3 (viii) the potential economic consequences of an interruption in 4 service. 5 (b) The commissioner shall identify categories of infrastructure 6 vulnerabilities requiring immediate, near-term or long-term attention 7 and develop recommendations for mitigating such vulnerabilities. Such 8 recommendations may include, but need not be limited to: proposed capi- 9 tal improvements, maintenance measures, security enhancements, opera- 10 tional changes, workforce investments, emergency preparedness improve- 11 ments and legislative or regulatory actions. 12 6. Statewide report. (a) Within eighteen months after the effective 13 date of this section, and every three years thereafter, the commissioner 14 shall prepare a statewide critical infrastructure security, condition 15 and resilience report and shall submit such report to the governor, the 16 temporary president of the senate, the speaker of the assembly, the 17 minority leader of the senate and the minority leader of the assembly. 18 (b) Such report shall include, at a minimum: 19 (i) a summary of the overall condition, security and resilience of the 20 state's critical infrastructure; 21 (ii) an assessment of significant statewide and regional infrastruc- 22 ture vulnerabilities; 23 (iii) an evaluation of risks associated with aging infrastructure, 24 deferred maintenance and infrastructure interdependencies; 25 (iv) an assessment of existing infrastructure protection, emergency 26 preparedness and disaster recovery programs; 27 (v) recommendations for improving physical security, cybersecurity, 28 maintenance, infrastructure reliability and emergency response capabili- 29 ties; 30 (vi) identification of infrastructure investment priorities, including 31 estimated costs where reasonably ascertainable; 32 (vii) recommendations for legislative, regulatory or administrative 33 changes; and 34 (viii) an evaluation of progress made in addressing vulnerabilities 35 identified in prior reports. 36 (c) The commissioner shall prepare a public version of the report 37 containing statewide findings, general infrastructure conditions, non- 38 sensitive recommendations and other information suitable for public 39 disclosure. 40 (d) The commissioner shall prepare a separate confidential annex 41 containing sensitive security information, facility-specific vulnerabil- 42 ities and other information the disclosure of which could jeopardize 43 public safety or the security of critical infrastructure. Such confi- 44 dential annex shall be maintained, transmitted and disclosed only in 45 accordance with applicable federal and state law, including the public 46 officers law and all applicable protections governing sensitive security 47 and critical infrastructure information. 48 (e) Nothing in this section shall be construed to require public 49 disclosure of information otherwise exempt from disclosure under state 50 or federal law. 51 7. Annual progress updates. In each year in which a comprehensive 52 statewide assessment is not required, the commissioner shall provide a 53 progress update to the governor and legislature identifying: (a) signif- 54 icant developments affecting statewide critical infrastructure security 55 and resilience; (b) progress in addressing previously identified vulner- 56 abilities; (c) newly identified risks requiring legislative or adminis- S. 10728 5 1 trative attention; and (d) changes in statewide infrastructure prepared- 2 ness and recovery capabilities. Such progress updates may be 3 incorporated into an existing annual report submitted by the division, 4 provided that the requirements of this subdivision are satisfied. 5 8. Limitation of authority; confidentiality. (a) Nothing in this 6 section shall be construed to authorize the division to compel access to 7 privately owned infrastructure, conduct intrusive physical inspections, 8 or obtain protected security, proprietary or operational information 9 beyond the authority otherwise provided by law. 10 (b) The commissioner shall utilize existing assessments, inspection 11 reports, regulatory filings and other available information whenever 12 practicable, consistent with the confidentiality requirements applicable 13 to such information. 14 (c) Information obtained pursuant to this section shall be maintained 15 in accordance with applicable state and federal confidentiality require- 16 ments and shall be used solely for lawful governmental purposes relating 17 to infrastructure security, condition, resilience, emergency management 18 and public safety. 19 (d) Nothing in this section shall be construed to diminish or other- 20 wise alter the duties, responsibilities or authorities of the division 21 under sections seven hundred nine, seven hundred eleven-b, seven hundred 22 thirteen, seven hundred fourteen and seven hundred sixteen of this arti- 23 cle, or any other provision of law. 24 9. Rules and regulations. The commissioner may promulgate such rules 25 and regulations as may be necessary to implement the provisions of this 26 section. 27 § 3. This act shall take effect on the one hundred eightieth day after 28 it shall have become a law. Effective immediately, the addition, amend- 29 ment and/or repeal of any rule or regulation necessary for the implemen- 30 tation of this act on its effective date are authorized to be made and 31 completed on or before such effective date.