The New York State Senate

                    S T A T E   O F   N E W   Y O R K
________________________________________________________________________

                                 3407--A

                       2015-2016 Regular Sessions

                            I N  S E N A T E

                            February 6, 2015
                               ___________

Introduced  by  Sens.  CROCI, AVELLA, CARLUCCI, FLANAGAN, FUNKE, GOLDEN,
  MARTINS, NOZZOLIO -- read twice and ordered printed, and when  printed
  to  be  committed  to  the  Committee  on  Rules -- recommitted to the
  Committee on Veterans,  Homeland  Security  and  Military  Affairs  in
  accordance  with  Senate  Rule 6, sec. 8 -- committee discharged, bill
  amended, ordered reprinted as amended and recommitted to said  commit-
  tee

AN  ACT  to  amend  the  executive  law, in relation to a cyber security
  initiative

  THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
BLY, DO ENACT AS FOLLOWS:

  Section 1. The executive law is amended by adding a new section 719 to
read as follows:
  S 719. NEW YORK STATE CYBER SECURITY INITIATIVE.  1. LEGISLATIVE FIND-
INGS.  THE LEGISLATURE FINDS AND DECLARES THAT REPEATED CYBER INTRUSIONS
INTO CRITICAL INFRASTRUCTURE, EFFECTING GOVERNMENT, PRIVATE SECTOR BUSI-
NESS, AND CITIZENS OF THE STATE OF NEW YORK, HAVE DEMONSTRATED THE  NEED
FOR IMPROVED CYBER SECURITY.
  THE  LEGISLATURE  FURTHER  FINDS  AND  DECLARES THAT THIS CYBER THREAT
CONTINUES TO GROW AND REPRESENTS ONE OF THE MOST SERIOUS PUBLIC SECURITY
CHALLENGES THAT NEW YORK MUST CONFRONT. MOREOVER, THE  SECURITY  OF  THE
STATE  OF  NEW  YORK  DEPENDS  ON  THE  RELIABLE FUNCTIONING OF NEW YORK
STATE'S CRITICAL INFRASTRUCTURE, AND PRIVATE SECTOR BUSINESS  INTERESTS,
AS  WELL  AS  THE PROTECTION OF THE FINANCES AND INDIVIDUAL LIBERTIES OF
EVERY CITIZEN, IN THE FACE OF SUCH THREATS.
  THE LEGISLATURE ADDITIONALLY FINDS AND DECLARES THAT  TO  ENHANCE  THE
SECURITY, PROTECTION AND RESILIENCE OF NEW YORK STATE'S CRITICAL INFRAS-
TRUCTURE,  AND  PRIVATE  SECTOR  BUSINESS  INTERESTS,  AS  WELL  AS  THE
PROTECTION OF THE FINANCES AND INDIVIDUAL LIBERTIES  OF  EVERY  CITIZEN,
THE  STATE  OF NEW YORK MUST PROMOTE A CYBER ENVIRONMENT THAT ENCOURAGES
EFFICIENCY, INNOVATION, AND ECONOMIC PROSPERITY, AND  THAT  CAN  OPERATE

 EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                      [ ] is old law to be omitted.
                                                           LBD09031-02-5

S. 3407--A                          2

WITH  SAFETY,  SECURITY,  BUSINESS  CONFIDENTIALITY,  PRIVACY, AND CIVIL
LIBERTY.
  THE  LEGISLATURE FURTHER FINDS AND DECLARES THAT TO CREATE SUCH A SAFE
AND SECURE CYBER ENVIRONMENT FOR GOVERNMENT, PRIVATE SECTOR BUSINESS AND
INDIVIDUAL CITIZENS, NEW YORK MUST ADVANCE, IN ADDITION TO  ITS  CURRENT
EFFORTS  IN THIS FIELD, A NEW YORK STATE CYBER SECURITY INITIATIVE, THAT
ESTABLISHES A NEW YORK STATE CYBER SECURITY ADVISORY BOARD; A  NEW  YORK
STATE  CYBER  SECURITY PARTNERSHIP PROGRAM WITH THE OWNERS AND OPERATORS
OF CRITICAL INFRASTRUCTURE, PRIVATE SECTOR BUSINESS, ACADEMIA, AND INDI-
VIDUAL CITIZENS TO IMPROVE, DEVELOP AND IMPLEMENT  RISK-BASED  STANDARDS
FOR GOVERNMENT, PRIVATE SECTOR BUSINESSES AND INDIVIDUAL CITIZENS; AND A
NEW YORK STATE CYBER SECURITY INFORMATION SHARING PROGRAM.
  2.  CRITICAL  INFRASTRUCTURE  AND INFORMATION SYSTEMS. AS USED IN THIS
SECTION, THE TERM  "CRITICAL  INFRASTRUCTURE  AND  INFORMATION  SYSTEMS"
SHALL MEAN ALL SYSTEMS AND ASSETS, WHETHER PHYSICAL OR VIRTUAL, SO VITAL
TO  THE GOVERNMENT, PRIVATE SECTOR BUSINESSES AND INDIVIDUAL CITIZENS OF
THE STATE OF NEW YORK THAT THE INCAPACITY OR DESTRUCTION OF SUCH SYSTEMS
AND ASSETS WOULD HAVE A DEBILITATING IMPACT TO THE SECURITY, ECONOMY, OR
PUBLIC HEALTH OF THE INDIVIDUAL CITIZENS, GOVERNMENT, OR PRIVATE  SECTOR
BUSINESSES OF THE STATE OF NEW YORK.
  3.  NEW  YORK  STATE CYBER SECURITY ADVISORY BOARD. (A) THERE SHALL BE
WITHIN THE DIVISION OF HOMELAND SECURITY AND EMERGENCY SERVICES,  A  NEW
YORK  STATE CYBER SECURITY ADVISORY BOARD, WHICH SHALL ADVISE THE GOVER-
NOR AND THE LEGISLATURE ON  DEVELOPMENTS  IN  CYBER  SECURITY  AND  MAKE
RECOMMENDATIONS  FOR  PROTECTING THE STATE'S CRITICAL INFRASTRUCTURE AND
INFORMATION SYSTEMS.
  (B) THE BOARD MEMBERS SHALL CONSIST OF ELEVEN MEMBERS APPOINTED BY THE
GOVERNOR, WITH THREE MEMBERS APPOINTED UPON RECOMMENDATION OF THE TEMPO-
RARY PRESIDENT OF THE SENATE, AND THREE MEMBERS APPOINTED AT THE  RECOM-
MENDATION OF THE SPEAKER OF THE ASSEMBLY. ALL MEMBERS SO APPOINTED SHALL
HAVE  EXPERTISE  IN CYBER SECURITY, TELECOMMUNICATIONS, INTERNET SERVICE
DELIVERY, PUBLIC PROTECTION, COMPUTER SYSTEMS AND/OR COMPUTER NETWORKS.
  (C) THE BOARD SHALL  INVESTIGATE,  DISCUSS  AND  MAKE  RECOMMENDATIONS
CONCERNING  CYBER  SECURITY ISSUES INVOLVING BOTH THE PUBLIC AND PRIVATE
SECTORS AND WHAT STEPS CAN BE TAKEN BY NEW YORK STATE TO  PROTECT  CRIT-
ICAL   CYBER   INFRASTRUCTURE,   FINANCIAL  SYSTEMS,  TELECOMMUNICATIONS
NETWORKS, ELECTRICAL GRIDS, SECURITY SYSTEMS,  FIRST  RESPONDER  SYSTEMS
AND  INFRASTRUCTURE,  PHYSICAL  INFRASTRUCTURE  SYSTEMS,  TRANSPORTATION
SYSTEMS, AND SUCH OTHER AND FURTHER SECTORS OF STATE GOVERNMENT AND  THE
PRIVATE SECTOR AS THE ADVISORY BOARD SHALL DEEM PRUDENT.
  (D) THE PURPOSE OF THE ADVISORY BOARD SHALL BE TO PROMOTE THE DEVELOP-
MENT OF INNOVATIVE, ACTIONABLE POLICIES TO ENSURE THAT NEW YORK STATE IS
IN THE FOREFRONT OF PUBLIC CYBER SECURITY DEFENSE.
  (E)  THE  MEMBERS  OF THE ADVISORY BOARD SHALL RECEIVE NO COMPENSATION
FOR THEIR SERVICES, BUT MAY RECEIVE ACTUAL AND NECESSARY  EXPENSES,  AND
SHALL NOT BE DISQUALIFIED FOR HOLDING ANY OTHER PUBLIC OFFICE OR EMPLOY-
MENT BY MEANS OF THEIR SERVICE AS A MEMBER OF THE ADVISORY BOARD.
  (F)  THE  ADVISORY BOARD SHALL BE ENTITLED TO REQUEST AND RECEIVE, AND
SHALL BE PROVIDED WITH, SUCH FACILITIES, RESOURCES AND DATA OF ANY AGEN-
CY, DEPARTMENT, DIVISION, BOARD, BUREAU, COMMISSION, OR PUBLIC AUTHORITY
OF THE STATE, AS THEY MAY REASONABLY  REQUEST,  TO  CARRY  OUT  PROPERLY
THEIR POWERS, DUTIES AND PURPOSE.
  4.  NEW  YORK  STATE  CYBER  SECURITY INFORMATION SHARING AND ANALYSIS
PROGRAM. (A) THE DIVISION OF HOMELAND SECURITY AND  EMERGENCY  SERVICES,
IN  CONSULTATION WITH THE DIVISION OF THE STATE POLICE, THE STATE OFFICE
OF INFORMATION TECHNOLOGY SERVICES, AND THE CENTER FOR INTERNET  SECURI-

S. 3407--A                          3

TY,  SHALL  ESTABLISH,  WITHIN  SIXTY DAYS OF THE EFFECTIVE DATE OF THIS
SECTION, A VOLUNTARY NEW YORK STATE CYBER SECURITY  INFORMATION  SHARING
AND ANALYSIS PROGRAM.
  (B)  IT  SHALL  BE  THE  PURPOSE  OF THE NEW YORK STATE CYBER SECURITY
INFORMATION SHARING AND ANALYSIS PROGRAM TO INCREASE THE VOLUME, TIMELI-
NESS, AND QUALITY OF CYBER THREAT INFORMATION SHARED WITH NEW YORK STATE
PUBLIC AND PRIVATE SECTOR ENTITIES SO THAT  THESE  ENTITIES  MAY  BETTER
PROTECT  AND  DEFEND THEMSELVES AGAINST CYBER THREATS AND TO PROMOTE THE
DEVELOPMENT OF EFFECTIVE DEFENSES AND STRATEGIES TO COMBAT, AND  PROTECT
AGAINST, CYBER THREATS AND ATTACKS.
  (C)  TO  FACILITATE  THE PURPOSES OF THE NEW YORK STATE CYBER SECURITY
INFORMATION SHARING AND ANALYSIS PROGRAM, THE DIVISION OF HOMELAND SECU-
RITY AND EMERGENCY SERVICES, SHALL PROMULGATE REGULATIONS, IN ACCORDANCE
WITH THE PROVISIONS OF THIS SUBDIVISION.
  (D) THE REGULATIONS SHALL PROVIDE FOR THE TIMELY PRODUCTION OF UNCLAS-
SIFIED REPORTS OF CYBER THREATS TO NEW YORK STATE  AND  ITS  PUBLIC  AND
PRIVATE  SECTOR  ENTITIES,  INCLUDING  THREATS  THAT IDENTIFY A SPECIFIC
TARGETED ENTITY.
  (E) THE REGULATIONS SHALL ADDRESS THE NEED TO PROTECT INTELLIGENCE AND
LAW ENFORCEMENT SOURCES, METHODS, OPERATIONS,  AND  INVESTIGATIONS,  AND
SHALL  FURTHER ESTABLISH A PROCESS THAT RAPIDLY DISSEMINATES THE REPORTS
PRODUCED PURSUANT TO PARAGRAPH (D) OF  THIS  SUBDIVISION,  TO  BOTH  ANY
TARGETED  ENTITY  AS  WELL  AS SUCH OTHER AND FURTHER PUBLIC AND PRIVATE
ENTITIES AS THE DIVISION SHALL DEEM NECESSARY TO ADVANCE THE PURPOSES OF
THIS SUBDIVISION.
  (F) THE REGULATIONS SHALL PROVIDE FOR PROTECTIONS FROM  LIABILITY  FOR
ENTITIES SHARING AND RECEIVING INFORMATION WITH THE NEW YORK STATE CYBER
SECURITY  INFORMATION  AND ANALYSIS PROGRAM, SO LONG AS THE ENTITY ACTED
IN GOOD FAITH.
  (G) THE REGULATIONS SHALL FURTHER ESTABLISH A SYSTEM FOR TRACKING  THE
PRODUCTION,  DISSEMINATION,  AND  DISPOSITION OF THE REPORTS PRODUCED IN
ACCORDANCE WITH THE PROVISIONS OF THIS SUBDIVISION.
  (H) THE REGULATIONS SHALL ALSO ESTABLISH AN  ENHANCED  CYBER  SECURITY
SERVICES  PROGRAM,  WITHIN  NEW  YORK  STATE, TO PROVIDE FOR PROCEDURES,
METHODS AND DIRECTIVES, FOR A  VOLUNTARY  INFORMATION  SHARING  PROGRAM,
THAT  WILL PROVIDE CYBER THREAT AND TECHNICAL INFORMATION COLLECTED FROM
BOTH PUBLIC AND PRIVATE SECTOR ENTITIES,  TO  SUCH  PRIVATE  AND  PUBLIC
SECTOR  ENTITIES AS THE DIVISION DEEMS PRUDENT, TO ADVISE ELIGIBLE CRIT-
ICAL INFRASTRUCTURE COMPANIES OR COMMERCIAL SERVICE PROVIDERS THAT OFFER
SECURITY SERVICES TO CRITICAL INFRASTRUCTURE ON CYBER  SECURITY  THREATS
AND DEFENSE MEASURES.
  (I)  THE REGULATIONS SHALL ALSO SEEK TO DEVELOP STRATEGIES TO MAXIMIZE
THE UTILITY OF CYBER THREAT INFORMATION SHARING BETWEEN AND  ACROSS  THE
PRIVATE AND PUBLIC SECTORS, AND SHALL FURTHER SEEK TO PROMOTE THE USE OF
PRIVATE  AND PUBLIC SECTOR SUBJECT MATTER EXPERTS TO ADDRESS CYBER SECU-
RITY NEEDS IN NEW YORK STATE, WITH THESE SUBJECT MATTER EXPERTS  PROVID-
ING  ADVICE  REGARDING  THE CONTENT, STRUCTURE, AND TYPES OF INFORMATION
MOST USEFUL TO CRITICAL INFRASTRUCTURE OWNERS AND OPERATORS IN  REDUCING
AND MITIGATING CYBER RISKS.
  (J)  THE  REGULATIONS  SHALL  FURTHER SEEK TO ESTABLISH A CONSULTATIVE
PROCESS TO COORDINATE IMPROVEMENTS TO THE  CYBER  SECURITY  OF  CRITICAL
INFRASTRUCTURE,  WHERE  AS  PART OF THE CONSULTATIVE PROCESS, THE PUBLIC
AND PRIVATE ENTITIES OF THE STATE OF NEW YORK SHALL ENGAGE AND  CONSIDER
THE  ADVICE OF THE DIVISION OF HOMELAND SECURITY AND EMERGENCY SERVICES,
THE DIVISION OF THE STATE POLICE, THE STATE OFFICE OF INFORMATION  TECH-
NOLOGY  SERVICES,  THE  CENTER FOR INTERNET SECURITY, THE NEW YORK STATE

S. 3407--A                          4

CYBER SECURITY ADVISORY BOARD, THE PROGRAMS ESTABLISHED BY THIS SUBDIVI-
SION, AND SUCH OTHER AND FURTHER PRIVATE  AND  PUBLIC  SECTOR  ENTITIES,
UNIVERSITIES,  AND  CYBER  SECURITY  EXPERTS AS THE DIVISION OF HOMELAND
SECURITY AND EMERGENCY SERVICES MAY DEEM PRUDENT.
  (K)  THE REGULATIONS SHALL FURTHER SEEK TO ESTABLISH A BASELINE FRAME-
WORK TO REDUCE CYBER RISK TO CRITICAL INFRASTRUCTURE, AND SHALL SEEK  TO
HAVE  THE  DIVISION  OF  HOMELAND  SECURITY  AND  EMERGENCY SERVICES, IN
CONSULTATION WITH THE DIVISION OF STATE  POLICE,  THE  STATE  OFFICE  OF
INFORMATION  TECHNOLOGY  SERVICES, AND THE CENTER FOR INTERNET SECURITY,
LEAD THE DEVELOPMENT OF A VOLUNTARY FRAMEWORK TO REDUCE CYBER  RISKS  TO
CRITICAL  INFRASTRUCTURE,  TO  BE KNOWN AS THE CYBER SECURITY FRAMEWORK,
WHICH SHALL:
  (I) INCLUDE A SET OF STANDARDS, METHODOLOGIES, PROCEDURES,  AND  PROC-
ESSES  THAT  ALIGN  POLICY,  BUSINESS,  AND  TECHNOLOGICAL APPROACHES TO
ADDRESS CYBER RISKS;
  (II) INCORPORATE VOLUNTARY CONSENSUS STANDARDS AND INDUSTRY BEST PRAC-
TICES TO THE FULLEST EXTENT POSSIBLE;
  (III) PROVIDE A PRIORITIZED, FLEXIBLE, REPEATABLE,  PERFORMANCE-BASED,
AND COST-EFFECTIVE APPROACH, INCLUDING INFORMATION SECURITY MEASURES AND
CONTROLS,  TO HELP OWNERS AND OPERATORS OF CRITICAL INFRASTRUCTURE IDEN-
TIFY, ASSESS, AND MANAGE CYBER RISK;
  (IV) FOCUS ON IDENTIFYING CROSS-SECTOR SECURITY STANDARDS  AND  GUIDE-
LINES APPLICABLE TO CRITICAL INFRASTRUCTURE;
  (V)  IDENTIFY  AREAS  FOR IMPROVEMENT THAT SHOULD BE ADDRESSED THROUGH
FUTURE COLLABORATION WITH PARTICULAR  SECTORS  AND  STANDARDS-DEVELOPING
ORGANIZATIONS;
  (VI)  ENABLE  TECHNICAL  INNOVATION  AND  ACCOUNT  FOR  ORGANIZATIONAL
DIFFERENCES, TO PROVIDE GUIDANCE THAT IS  TECHNOLOGY  NEUTRAL  AND  THAT
ENABLES  CRITICAL  INFRASTRUCTURE  SECTORS TO BENEFIT FROM A COMPETITIVE
MARKET FOR PRODUCTS AND SERVICES THAT MEET THE STANDARDS, METHODOLOGIES,
PROCEDURES, AND PROCESSES DEVELOPED TO ADDRESS CYBER RISKS;
  (VII) INCLUDE GUIDANCE FOR MEASURING THE PERFORMANCE OF AN  ENTITY  IN
IMPLEMENTING THE CYBER SECURITY FRAMEWORK;
  (VIII)  INCLUDE  METHODOLOGIES TO IDENTIFY AND MITIGATE IMPACTS OF THE
CYBER SECURITY FRAMEWORK AND ASSOCIATED INFORMATION SECURITY MEASURES OR
CONTROLS ON BUSINESS CONFIDENTIALITY, AND TO PROTECT INDIVIDUAL  PRIVACY
AND CIVIL LIBERTIES; AND
  (IX)  ENGAGE IN THE REVIEW OF THREAT AND VULNERABILITY INFORMATION AND
TECHNICAL EXPERTISE.
  (L) THE REGULATIONS SHALL ADDITIONALLY ESTABLISH A VOLUNTARY  CRITICAL
INFRASTRUCTURE  CYBER  SECURITY  PROGRAM  TO SUPPORT THE ADOPTION OF THE
CYBER SECURITY FRAMEWORK BY OWNERS AND OPERATORS OF CRITICAL INFRASTRUC-
TURE AND ANY OTHER INTERESTED ENTITIES, WHERE UNDER THIS PROGRAM  IMPLE-
MENTATION  GUIDANCE  OR  SUPPLEMENTAL  MATERIALS  WOULD  BE DEVELOPED TO
ADDRESS SECTOR-SPECIFIC RISKS AND OPERATING ENVIRONMENTS, AND  RECOMMEND
LEGISLATION FOR ENACTMENT TO ADDRESS CYBER SECURITY ISSUES.
  (M)  IN DEVELOPING THE NEW YORK STATE CYBER SECURITY INFORMATION SHAR-
ING AND ANALYSIS PROGRAM IN  ACCORDANCE  WITH  THE  PROVISIONS  OF  THIS
SUBDIVISION,  THE  DIVISION OF HOMELAND SECURITY AND EMERGENCY SERVICES,
IN CONSULTATION WITH THE DIVISION OF STATE POLICE, THE STATE  OFFICE  OF
INFORMATION  TECHNOLOGY  SERVICES, AND THE CENTER FOR INTERNET SECURITY,
SHALL PRODUCE AND SUBMIT A REPORT, TO THE GOVERNOR, THE TEMPORARY PRESI-
DENT OF THE SENATE, AND THE SPEAKER OF THE ASSEMBLY, MAKING  RECOMMENDA-
TIONS  ON  THE  FEASIBILITY,  SECURITY  BENEFITS, AND RELATIVE MERITS OF
INCORPORATING SECURITY STANDARDS INTO ACQUISITION PLANNING AND  CONTRACT
ADMINISTRATION.  SUCH  REPORT  SHALL  FURTHER  ADDRESS WHAT STEPS CAN BE

S. 3407--A                          5

TAKEN TO HARMONIZE AND MAKE CONSISTENT EXISTING PROCUREMENT REQUIREMENTS
RELATED TO CYBER SECURITY AND THE FEASIBILITY  OF  INCLUDING  RISK-BASED
SECURITY STANDARDS INTO PROCUREMENT AND CONTRACT ADMINISTRATION.
  5.  NEW YORK STATE CYBER SECURITY CRITICAL INFRASTRUCTURE RISK ASSESS-
MENT REPORT.  (A)  THE  DIVISION  OF  HOMELAND  SECURITY  AND  EMERGENCY
SERVICES,  IN  CONSULTATION WITH THE DIVISION OF STATE POLICE, THE STATE
OFFICE OF INFORMATION TECHNOLOGY SERVICES, AND THE CENTER  FOR  INTERNET
SECURITY,  WITHIN  ONE HUNDRED TWENTY DAYS OF THE EFFECTIVE DATE OF THIS
SECTION, SHALL PRODUCE A NEW YORK STATE CYBER SECURITY CRITICAL  INFRAS-
TRUCTURE RISK ASSESSMENT REPORT.
  (B)  THE  PRODUCTION  OF  THE  NEW  YORK STATE CYBER SECURITY CRITICAL
INFRASTRUCTURE RISK ASSESSMENT REPORT SHALL USE A RISK-BASED APPROACH TO
IDENTIFY CRITICAL INFRASTRUCTURE WHERE A CYBER SECURITY  INCIDENT  COULD
REASONABLY  RESULT  IN  CATASTROPHIC  REGIONAL  OR STATE-WIDE EFFECTS ON
PUBLIC HEALTH OR  SAFETY,  ECONOMIC  DISTRESS,  AND/OR  THREATEN  PUBLIC
PROTECTION OF THE PEOPLE AND/OR PROPERTY OF NEW YORK STATE.
  (C)  THE  PRODUCTION  OF THE REPORT SHALL FURTHER USE THE CONSULTATIVE
PROCESS AND DRAW UPON THE EXPERTISE OF AND ADVICE  OF  THE  DIVISION  OF
HOMELAND  SECURITY AND EMERGENCY SERVICES, THE DIVISION OF STATE POLICE,
THE STATE OFFICE OF INFORMATION  TECHNOLOGY  SERVICES,  THE  CENTER  FOR
INTERNET SECURITY, THE NEW YORK STATE CYBER SECURITY ADVISORY BOARD, THE
PROGRAMS ESTABLISHED BY THIS SECTION, AND SUCH OTHER AND FURTHER PRIVATE
AND  PUBLIC SECTOR ENTITIES, UNIVERSITIES, AND CYBER SECURITY EXPERTS AS
THE DIVISION OF  HOMELAND  SECURITY  AND  EMERGENCY  SERVICES  MAY  DEEM
PRUDENT.
  (D)  THE  NEW  YORK  STATE CYBER SECURITY CRITICAL INFRASTRUCTURE RISK
ASSESSMENT REPORT SHALL BE DELIVERED  TO  THE  GOVERNOR,  THE  TEMPORARY
PRESIDENT  OF  THE SENATE, THE SPEAKER OF THE ASSEMBLY, THE CHAIR OF THE
SENATE STANDING COMMITTEE ON VETERANS, HOMELAND  SECURITY  AND  MILITARY
AFFAIRS,  AND  THE  CHAIR  OF THE ASSEMBLY STANDING COMMITTEE ON GOVERN-
MENTAL OPERATIONS.
  (E) WHERE COMPLIANCE WITH THIS SECTION SHALL REQUIRE THE DISCLOSURE OF
CONFIDENTIAL INFORMATION, OR THE  DISCLOSURE  OF  SENSITIVE  INFORMATION
WHICH  IN  THE  JUDGMENT OF THE COMMISSIONER OF THE DIVISION OF HOMELAND
SECURITY AND EMERGENCY SERVICES WOULD JEOPARDIZE THE CYBER  SECURITY  OF
THE STATE:
  (I)  SUCH  CONFIDENTIAL  OR SENSITIVE INFORMATION SHALL BE PROVIDED TO
THE PERSONS ENTITLED TO RECEIVE THE REPORT, IN THE  FORM  OF  A  SUPPLE-
MENTAL APPENDIX TO THE REPORT; AND
  (II)  SUCH SUPPLEMENTAL APPENDIX TO THE REPORT SHALL NOT BE SUBJECT TO
THE PROVISIONS OF THE FREEDOM OF INFORMATION LAW PURSUANT TO ARTICLE SIX
OF THE PUBLIC OFFICERS LAW; AND
  (III) THE PERSONS ENTITLED TO RECEIVE  THE  REPORT  MAY  DISCLOSE  THE
SUPPLEMENTAL  APPENDIX  TO  THE  REPORT TO THEIR PROFESSIONAL STAFF, BUT
SHALL NOT OTHERWISE PUBLICLY DISCLOSE SUCH CONFIDENTIAL OR SECURE INFOR-
MATION.
  S 2. This act shall take effect immediately.