S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  9952--A
 
                           I N  A S S E M B L Y
 
                              April 19, 2022
                                ___________
 
 Introduced  by  M. of A. OTIS -- read once and referred to the Committee
   on Science and  Technology  --  committee  discharged,  bill  amended,
   ordered reprinted as amended and recommitted to said committee
 
 AN  ACT  to  amend the state technology law, in relation to enacting the
   "critical infrastructure standards and procedures act"

   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The state technology law is amended by adding a new article
 4 to read as follows:
                                  ARTICLE 4
           CRITICAL INFRASTRUCTURE STANDARDS AND PROCEDURES ACT
 SECTION 401. SHORT TITLE.
         402. DEFINITIONS.
         403.   COMPLIANCE  WITH  CYBERSECURITY  STANDARDS  FOR  CRITICAL
                INFRASTRUCTURE.
         404.  PROCUREMENT,  CONSTRUCTION,  RECONSTRUCTION,   ALTERATION,
                DESIGN  AND  COMMISSIONING  OF CRITICAL INFRASTRUCTURE OR
                AUTOMATION CONTROL SYSTEMS OR AUTOMATION  CONTROL  SYSTEM
                COMPONENTS.
         405. OPERATIONS AND MAINTENANCE OF CRITICAL INFRASTRUCTURE.
   §  401.  SHORT  TITLE. THIS ARTICLE SHALL BE KNOWN AND MAY BE CITED AS
 THE "CRITICAL INFRASTRUCTURE STANDARDS AND PROCEDURES (CRISP) ACT".
   § 402. DEFINITIONS. THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEAN-
 INGS:
   1. CRITICAL INFRASTRUCTURE SHALL INCLUDE, BUT SHALL NOT BE LIMITED TO:
   (A) PUBLIC TRANSPORTATION;
   (B) WATER AND WASTEWATER TREATMENT FACILITIES;
   (C) PUBLIC UTILITIES AND SERVICES SUBJECT TO THE JURISDICTION,  SUPER-
 VISION,  POWERS  AND  DUTIES  OF  THE  PUBLIC SERVICE COMMISSION AND THE
 DEPARTMENT OF PUBLIC SERVICE;
   (D) PUBLIC BUILDINGS, INCLUDING THOSE OPERATED BY THE STATE UNIVERSITY
 OF NEW YORK;
   (E) HOSPITALS AND PUBLIC HEALTH FACILITIES REGULATED PURSUANT TO ARTI-
 CLE TWENTY-EIGHT OF THE PUBLIC HEALTH LAW; AND
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD11950-02-2
 A. 9952--A                          2
 
   (F) FACILITIES CREATED OR EXISTING UNDER THE PUBLIC AUTHORITIES LAW.
   2.  AUTOMATION  AND  CONTROL SYSTEM SHALL INCLUDE PERSONNEL, HARDWARE,
 SOFTWARE AND POLICIES INVOLVED IN THE OPERATION OF THE CRITICAL  INFRAS-
 TRUCTURE  THAT  MAY  AFFECT  OR  INFLUENCE ITS SAFE, SECURE AND RELIABLE
 OPERATION.
   3. AUTOMATION AND CONTROL SYSTEM COMPONENTS SHALL MEAN CONTROL SYSTEMS
 AND ANY COMPLEMENTARY HARDWARE AND SOFTWARE COMPONENTS  THAT  HAVE  BEEN
 INSTALLED AND CONFIGURED TO OPERATE IN AN AUTOMATION AND CONTROL SYSTEM.
 SUCH SYSTEMS SHALL INCLUDE, BUT SHALL NOT BE LIMITED TO:
   (A)  CONTROL  SYSTEMS,  WHETHER  PHYSICALLY  SEPARATE  OR  INTEGRATED,
 INCLUDING DISTRIBUTED CONTROL SYSTEMS, PROGRAMMABLE  LOGIC  CONTROLLERS,
 REMOTE  TERMINAL  UNITS,  INTELLIGENT  ELECTRONIC  DEVICES,  SUPERVISORY
 CONTROL AND DATA ACQUISITION, NETWORKED ELECTRONIC SENSING AND  CONTROL,
 AND MONITORING AND DIAGNOSTIC SYSTEMS;
   (B)  ASSOCIATED INFORMATION SYSTEMS, SUCH AS ADVANCED OR MULTIVARIABLE
 CONTROL, ONLINE  OPTIMIZERS,  DEDICATED  EQUIPMENT  MONITORS,  GRAPHICAL
 INTERFACES,  PROCESS  HISTORIANS,  MANUFACTURING  EXECUTION  SYSTEMS AND
 PLANT INFORMATION MANAGEMENT SYSTEMS;
   (C) ASSOCIATED INTERNAL, HUMAN, NETWORK, OR MACHINE INTERFACES USED TO
 PROVIDE CONTROL, SAFETY, AND MANUFACTURING OPERATIONS  FUNCTIONALITY  TO
 CONTINUOUS, BATCH, DISCRETE; AND
   (D)  OTHER  PROCESSES AS DEFINED BY THE INTERNATIONAL SOCIETY OF AUTO-
 MATION INCLUDING THE ISA/IEC 62443 SERIES OF STANDARDS, AS REFERENCED BY
 THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST).
   4. ASSET OWNER SHALL MEAN  THE  PUBLIC  OR  PRIVATE  OWNER  OR  ENTITY
 ACCOUNTABLE AND RESPONSIBLE FOR OPERATION OF THE CRITICAL INFRASTRUCTURE
 AND  FOR THE AUTOMATION AND CONTROL SYSTEM. THE ASSET OWNER SHALL BE THE
 OPERATOR OF THE AUTOMATION AND CONTROL  SYSTEM  AND  OF  SUCH  EQUIPMENT
 UNDER CONTROL.
   5.  OPERATIONAL  TECHNOLOGY  SHALL MEAN THE HARDWARE AND SOFTWARE THAT
 DETECTS OR CAUSES A CHANGE IN THE CRITICAL  INFRASTRUCTURE  THROUGH  THE
 DIRECT MONITORING OR CONTROL OF PHYSICAL DEVICES, SYSTEMS, PROCESSES AND
 EVENTS.
   §  403.  COMPLIANCE  WITH CYBERSECURITY STANDARDS FOR CRITICAL INFRAS-
 TRUCTURE. THE OFFICE, IN CONSULTATION WITH THE  DEPARTMENT  OF  HOMELAND
 SECURITY  AND  EMERGENCY SERVICES SHALL MAKE A DETERMINATION OF CRITICAL
 INFRASTRUCTURE, INCLUDING WHOSE ASSETS, SYSTEMS, AND  NETWORKS,  WHETHER
 PHYSICAL OR VIRTUAL, ARE CONSIDERED VITAL AND VULNERABLE TO CYBERSECURI-
 TY ATTACKS.
   §  404.  PROCUREMENT, CONSTRUCTION, RECONSTRUCTION, ALTERATION, DESIGN
 AND COMMISSIONING  OF  CRITICAL  INFRASTRUCTURE  OR  AUTOMATION  CONTROL
 SYSTEMS OR AUTOMATION CONTROL SYSTEM COMPONENTS. ON OR AFTER JULY FIRST,
 TWO  THOUSAND TWENTY-SIX, THE ASSET OWNER, WHEN PROCURING AUTOMATION AND
 CONTROL SYSTEM COMPONENTS, AS DEFINED IN SUBDIVISION  THREE  OF  SECTION
 FOUR  HUNDRED  TWO  OF  THIS  ARTICLE,  SERVICES  OR  SOLUTIONS, OR WHEN
 CONTRACTING FOR  FACILITY  UPGRADES  OR  THE  CONSTRUCTION  OF  CRITICAL
 INFRASTRUCTURE  FACILITIES, SHALL REQUIRE SUCH COMPONENTS, SERVICES, AND
 SOLUTIONS TO CONFORM TO THE  ISA/IEC  62443  SERIES  OF  STANDARDS.  ALL
 CONTRACTS  AWARDED  FOR CONSTRUCTION, RECONSTRUCTION, ALTERATION, DESIGN
 AND COMMISSIONING OF FACILITIES IDENTIFIED  AS  CRITICAL  INFRASTRUCTURE
 UNDER  THIS  ARTICLE  SHALL  PROVIDE  THAT SUCH INSTALLED AUTOMATION AND
 CONTROL COMPONENTS MEET THE FOLLOWING MINIMUM STANDARDS FOR CYBERSECURI-
 TY AS DEFINED BY THE ISA/IEC 62443 SERIES OF STANDARDS:
   1. 2-4 REQUIREMENTS FOR IACS SOLUTIONS PROVIDERS;
   2. 3-2 SECURITY RISK ASSESSMENT AND SYSTEMS DESIGN;
   3. 3-3 SYSTEM SECURITY REQUIREMENTS AND SECURITY LEVELS;
 A. 9952--A                          3
 
   4. 4-1 PRODUCT DEVELOPMENT REQUIREMENTS; AND
   5. 4-2 TECHNICAL SECURITY REQUIREMENTS FOR IACS COMPONENTS.
   §  405.  OPERATIONS  AND MAINTENANCE OF CRITICAL INFRASTRUCTURE. ON OR
 AFTER JULY FIRST, TWO THOUSAND TWENTY-FOUR, THE  ASSET  OWNER  SHALL  BE
 RESPONSIBLE  FOR  ENSURING  THAT THE OPERATION AND MAINTENANCE OF OPERA-
 TIONAL TECHNOLOGY, INCLUDING CRITICAL INFRASTRUCTURE, AUTOMATION CONTROL
 SYSTEMS AND  AUTOMATION  CONTROL  SYSTEM  COMPONENTS  CONFORM  WITH  THE
 FOLLOWING  ISA/IEC  62443  SERIES  OF  STANDARDS,  INCLUDING ANNUAL RISK
 ASSESSMENTS AND SHALL CREATE A MITIGATION PLAN:
   1. 2-1 REQUIREMENTS FOR AN IACS SECURITY MANAGEMENT SYSTEM;
   2. 2-3 PATCH MANAGEMENT IN THE IACS ENVIRONMENT;
   3. 2-4 SECURITY PROGRAM REQUIREMENTS FOR SERVICE PROVIDERS;
   4. 3-2 SECURITY RISK ASSESSMENT AND SYSTEM DESIGN; AND
   5. 3-3 SYSTEM SECURITY REQUIREMENTS AND SECURITY LEVELS.
   § 2. This act shall take effect on the one hundred eightieth day after
 it shall have become a  law.  Effective  immediately,  the  office,  the
 commissioner  of homeland security and emergency services and the super-
 intendent of financial services may promulgate rules and regulations and
 take other actions reasonably necessary to implement this  act  on  that
 date.