The New York State Senate

 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   3904
 
                        2021-2022 Regular Sessions
 
                           I N  A S S E M B L Y
 
                             January 28, 2021
                                ___________
 
 Introduced by M. of A. CUSICK -- read once and referred to the Committee
   on Energy
 
 AN ACT to amend the energy law, the executive law and the public service
   law,  in  relation  to  critical  energy  infrastructure  security and
   responsibility
 
   THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND  ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section  1.  Subdivision  1  of  section  3-101  of the energy law, as
 amended by chapter 253 of the laws  of  2013,  is  amended  to  read  as
 follows:
   1.  to  obtain and maintain an adequate and continuous supply of safe,
 dependable and economical energy for the people of the state,  INCLUDING
 THROUGH  THE  PROTECTION OF CRITICAL ENERGY INFRASTRUCTURE AS DEFINED IN
 SUBDIVISION FOURTEEN OF SECTION 1-103 OF THIS CHAPTER, and to accelerate
 development and use within the state of renewable energy sources, all in
 order to promote the state's economic growth, to create employment with-
 in the state, to  protect  its  environmental  values  and  agricultural
 heritage,  to  husband  its  resources  for  future  generations, and to
 promote the health and welfare of its people;
   § 2. Section 1-103 of the energy law is  amended  by  adding  two  new
 subdivisions 14 and 15 to read as follows:
   14.  "CRITICAL  ENERGY INFRASTRUCTURE" MEANS SYSTEMS, INCLUDING INDUS-
 TRIAL CONTROL SYSTEMS, CUSTOMER  ELECTRICAL  OR  GAS  CONSUMPTION  DATA,
 ASSETS,  PLACES  OR THINGS, WHETHER PHYSICAL OR VIRTUAL, SO VITAL TO THE
 STATE  THAT  THE  DISRUPTION,  INCAPACITATION  OR  DESTRUCTION  OF  SUCH
 SYSTEMS,  INCLUDING  INDUSTRIAL  CONTROL SYSTEMS, CUSTOMER ELECTRICAL OR
 GAS CONSUMPTION DATA, ASSETS, PLACES  OR  THINGS  COULD  JEOPARDIZE  THE
 HEALTH, SAFETY, WELFARE, ENERGY DISTRIBUTION, TRANSMISSION, RELIABILITY,
 OR SECURITY OF THE STATE, ITS RESIDENTS OR ITS ECONOMY.
   15. "INDUSTRIAL CONTROL SYSTEMS" MEANS A COMBINATION OF CONTROL COMPO-
 NENTS  THAT  SUPPORT  OPERATIONAL FUNCTIONS IN GAS, DISTRIBUTION, TRANS-
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD06856-01-1

 A. 3904                             2
 
 MISSION, AND ADVANCED METERING INFRASTRUCTURE CONTROL CENTERS,  AND  ACT
 TOGETHER TO ACHIEVE AN INDUSTRIAL OBJECTIVE, INCLUDING CONTROLS THAT ARE
 FULLY AUTOMATED OR THAT INCLUDE A HUMAN-MACHINE INTERFACE.
   §  3.  Paragraph  (j) of subdivision 2 of section 709 of the executive
 law, as amended by section 14 of part B of chapter 56  of  the  laws  of
 2010, is amended to read as follows:
   (j)  work  with local, state and federal agencies and private entities
 to conduct assessments of the vulnerability of  critical  infrastructure
 to terrorist attack, CYBER ATTACK, and other natural and man-made disas-
 ters,  including,  but not limited to, nuclear facilities, power plants,
 telecommunications systems, mass transportation  systems,  public  road-
 ways,  railways,  bridges  and tunnels, AND ATTENDANT INDUSTRIAL CONTROL
 SYSTEMS AS DEFINED BY SUBDIVISION FIFTEEN OF SECTION 1-103 OF THE ENERGY
 LAW and develop strategies that may be used to protect such  infrastruc-
 ture from terrorist attack, CYBER ATTACK, and other natural and man-made
 disasters;
   §  4.    Paragraph  (a)  of subdivision 19 of section 66 of the public
 service law, as amended by section 4 of part X of chapter 57 of the laws
 of 2013, is amended to read as follows:
   (a) The commission shall have power  to  provide  for  management  and
 operations  audits  of  gas corporations and electric corporations. Such
 audits shall be performed at least once every five years for combination
 gas and electric corporations, as well as for straight gas  corporations
 having  annual  gross revenues in excess of two hundred million dollars.
 The audit shall include, but not be limited to, an investigation of  the
 company's  construction program planning in relation to the needs of its
 customers for reliable service, an evaluation of the efficiency  of  the
 company's operations AND PROTECTION OF CRITICAL ENERGY INFRASTRUCTURE AS
 DEFINED  IN  SUBDIVISION  FOURTEEN  OF  SECTION 1-103 OF THE ENERGY LAW,
 recommendations with respect to same, and the timing with respect to the
 implementation  of  such  recommendations.  The  commission  shall  have
 discretion to have such audits performed by its staff, or by independent
 auditors.
   In  every  case  in  which  the  commission  chooses to have the audit
 provided for in this subdivision or pursuant to subdivision fourteen  of
 section sixty-five of this article performed by independent auditors, it
 shall  have authority to select the auditors, and to require the company
 being audited to enter into a contract with the auditors  providing  for
 their  payment  by the company. Such contract shall provide further that
 the auditors shall work for and under the direction  of  the  commission
 according  to  such  terms as the commission may determine are necessary
 and reasonable.
   § 5. Paragraph (a) of subdivision 21  of  section  66  of  the  public
 service  law,  as added by section 4 of part X of chapter 57 of the laws
 of 2013, is amended to read as follows:
   (a) Each electric corporation subject to section twenty-five-a of this
 chapter shall annually, on or before December fifteenth, submit  to  the
 commission an emergency response plan for review and approval. The emer-
 gency response plan shall be designed for the reasonably prompt restora-
 tion  of service in the case of an emergency event, defined for purposes
 of this subdivision as an event where widespread outages  have  occurred
 in  the service territory of the company due to storms, CYBER ATTACK, or
 other causes beyond the control of the company. The  emergency  response
 plan  shall  include, but need not be limited to, the following: (i) the
 identification of management staff responsible  for  company  operations
 during  an emergency; (ii) a communications system with customers during

 A. 3904                             3

 an emergency that extends beyond  normal  business  hours  and  business
 conditions;  (iii) identification of and outreach plans to customers who
 had documented their need for essential electricity for  medical  needs;
 (iv)  identification  of  and  outreach plans to customers who had docu-
 mented their need for essential electricity to provide critical telecom-
 munications,  critical  transportation,   critical   fuel   distribution
 services or other large-load customers identified by the commission; (v)
 designation  of  company  staff  to communicate with local officials and
 appropriate regulatory  agencies;  (vi)  provisions  regarding  how  the
 company  will  assure the safety of its employees and contractors; (vii)
 procedures for deploying company and mutual aid crews to work assignment
 areas; (viii) identification of additional supplies and equipment needed
 during an emergency; (ix) the means of obtaining additional supplies and
 equipment; (x) procedures to practice the emergency response plan;  (xi)
 appropriate  safety  precautions regarding electrical hazards, including
 plans to promptly secure downed wires within thirty-six hours of notifi-
 cation of the location of such downed wires from a  municipal  emergency
 official;  and (xii) such other additional information as the commission
 may require. Each such corporation shall, on an annual basis,  undertake
 drills  implementing  procedures  to  practice  its emergency management
 plan. The commission may adopt additional requirements  consistent  with
 ensuring  the reasonably prompt restoration of service in the case of an
 emergency event.
   § 6. Section 66 of the public service law is amended by adding two new
 subdivisions 29 and 30 to read as follows:
   29. PROMULGATE RULES AND REGULATIONS TO DIRECT ELECTRIC OR GAS  CORPO-
 RATIONS  TO  DEVELOP  AND IMPLEMENT TOOLS TO CONTINUOUSLY MONITOR OPERA-
 TIONAL CONTROL NETWORKS GIVING THE ELECTRIC OR GAS CORPORATION THE ABIL-
 ITY  TO  UNDERTAKE  THE  IMMEDIATE  DETECTION  OF  UNAUTHORIZED  NETWORK
 BEHAVIOR  RELATED  TO  SUCH CORPORATION'S INDUSTRIAL CONTROL SYSTEMS, AS
 DEFINED IN SUBDIVISION FIFTEEN OF SECTION 1-103 OF THE ENERGY LAW. ON OR
 BEFORE DECEMBER THIRTY-FIRST, TWO THOUSAND TWENTY-THREE  AND  NOT  LATER
 THAN  FIVE  YEARS  AFTER SUCH DATE, AND EVERY FIVE YEARS THEREAFTER, THE
 COMMISSION SHALL PROVIDE A REPORT TO THE GOVERNOR, THE TEMPORARY  PRESI-
 DENT  OF THE SENATE, THE SPEAKER OF THE ASSEMBLY, THE CHAIRPERSON OF THE
 ASSEMBLY STANDING COMMITTEE ON ENERGY, AND THE CHAIRPERSON OF THE SENATE
 STANDING COMMITTEE ON ENERGY AND TELECOMMUNICATIONS  REVIEWING  ELECTRIC
 OR  GAS  CORPORATION  COMPLIANCE WITH THIS SECTION, INCLUDING, AS NECES-
 SARY, RECOMMENDATIONS TO THE LEGISLATURE IF  THE  COMMISSION  DETERMINES
 THAT ADDITIONAL MEASURES ARE REQUIRED TO ENSURE THE EFFECTIVE PROTECTION
 OF ELECTRIC OR GAS CORPORATION CRITICAL INFRASTRUCTURE.
   30.  PROMULGATE RULES AND REGULATIONS TO DIRECT ELECTRIC OR GAS CORPO-
 RATIONS TO REQUIRE THE INSTALLATION OF ADVANCED METERING  INFRASTRUCTURE
 THAT  CONNECTS  TO  THE ELECTRIC OR GAS DISTRIBUTION NETWORK OPERATED BY
 SUCH ELECTRIC OR GAS CORPORATION BE PERMITTED ONLY SO LONG AS ACCESS  TO
 THE  ADVANCED METER INFRASTRUCTURE IS GRANTED VIA A WIRELESS MESH INTER-
 OPERABILITY STANDARD THAT IS SHARED BY AT LEAST  TWO  ADVANCED  METERING
 INFRASTRUCTURE PROVIDERS OPERATING WITHIN THE UNITED STATES OF AMERICA.
   § 7. This act shall take effect on the one hundred eightieth day after
 it  shall  have  become a law. Effective immediately, the public service
 commission is authorized and  directed  to  take  actions  necessary  to
 promulgate rules and regulations related to the implementation of subdi-
 visions  29  and 30 of section 66 of the public service law on or before
 such effective date.

 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  3904--A
 
                        2021-2022 Regular Sessions
 
                           I N  A S S E M B L Y
 
                             January 28, 2021
                                ___________
 
 Introduced by M. of A. CUSICK, ENGLEBRIGHT, ZEBROWSKI, FAHY, MAGNARELLI,
   THIELE,  McDONALD,  ABINANTI,  ABBATE, HEVESI, JACKSON, SIMON, BARRON,
   GOTTFRIED -- read once and referred to  the  Committee  on  Energy  --
   reported  and referred to the Committee on Ways and Means -- committee
   discharged, bill amended, ordered reprinted as amended and recommitted
   to said committee
 
 AN ACT to amend the energy law, the executive law and the public service
   law, in  relation  to  critical  energy  infrastructure  security  and
   responsibility
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Subdivision 1 of  section  3-101  of  the  energy  law,  as
 amended  by  chapter  253  of  the  laws  of 2013, is amended to read as
 follows:
   1. to obtain and maintain an adequate and continuous supply  of  safe,
 dependable  and economical energy for the people of the state, INCLUDING
 THROUGH THE PROTECTION OF CRITICAL ENERGY INFRASTRUCTURE AS  DEFINED  IN
 SUBDIVISION FOURTEEN OF SECTION 1-103 OF THIS CHAPTER, and to accelerate
 development and use within the state of renewable energy sources, all in
 order to promote the state's economic growth, to create employment with-
 in  the  state,  to  protect  its  environmental values and agricultural
 heritage, to husband  its  resources  for  future  generations,  and  to
 promote the health and welfare of its people;
   §  2.  Section  1-103  of  the energy law is amended by adding two new
 subdivisions 14 and 15 to read as follows:
   14. "CRITICAL ENERGY INFRASTRUCTURE" MEANS SYSTEMS,  INCLUDING  INDUS-
 TRIAL  CONTROL  SYSTEMS,  CUSTOMER  ELECTRICAL  OR GAS CONSUMPTION DATA,
 ASSETS, PLACES OR THINGS, WHETHER PHYSICAL OR VIRTUAL, SO VITAL  TO  THE
 STATE  THAT  THE  DISRUPTION,  INCAPACITATION  OR  DESTRUCTION  OF  SUCH
 SYSTEMS, INCLUDING INDUSTRIAL CONTROL SYSTEMS,  CUSTOMER  ELECTRICAL  OR
 GAS  CONSUMPTION  DATA,  ASSETS,  PLACES  OR THINGS COULD JEOPARDIZE THE
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.

                                                            LBD06856-03-1

 A. 3904--A                          2
 
 HEALTH, SAFETY, WELFARE, ENERGY DISTRIBUTION, TRANSMISSION, RELIABILITY,
 OR SECURITY OF THE STATE, ITS RESIDENTS OR ITS ECONOMY.
   15. "INDUSTRIAL CONTROL SYSTEMS" MEANS A COMBINATION OF CONTROL COMPO-
 NENTS  THAT  SUPPORT  OPERATIONAL FUNCTIONS IN GAS, DISTRIBUTION, TRANS-
 MISSION, AND ADVANCED METERING INFRASTRUCTURE CONTROL CENTERS,  AND  ACT
 TOGETHER TO ACHIEVE AN INDUSTRIAL OBJECTIVE, INCLUDING CONTROLS THAT ARE
 FULLY AUTOMATED OR THAT INCLUDE A HUMAN-MACHINE INTERFACE.
   §  3.  Paragraph  (j) of subdivision 2 of section 709 of the executive
 law, as amended by section 14 of part B of chapter 56  of  the  laws  of
 2010, is amended to read as follows:
   (j)  work  with local, state and federal agencies and private entities
 to conduct assessments of the vulnerability of  critical  infrastructure
 to terrorist attack, CYBER ATTACK, and other natural and man-made disas-
 ters,  including,  but not limited to, nuclear facilities, power plants,
 telecommunications systems, mass transportation  systems,  public  road-
 ways,  railways,  bridges  and tunnels, AND ATTENDANT INDUSTRIAL CONTROL
 SYSTEMS AS DEFINED BY SUBDIVISION FIFTEEN OF SECTION 1-103 OF THE ENERGY
 LAW and develop strategies that may be used to protect such  infrastruc-
 ture from terrorist attack, CYBER ATTACK, and other natural and man-made
 disasters;
   §  4.    Paragraph  (a)  of subdivision 19 of section 66 of the public
 service law, as amended by section 4 of part X of chapter 57 of the laws
 of 2013, is amended to read as follows:
   (a) The commission shall have power  to  provide  for  management  and
 operations  audits  of  gas corporations and electric corporations. Such
 audits shall be performed at least once every five years for combination
 gas and electric corporations, as well as for straight gas  corporations
 having  annual  gross revenues in excess of two hundred million dollars.
 The audit shall include, but not be limited to, an investigation of  the
 company's  construction program planning in relation to the needs of its
 customers for reliable service, an evaluation of the efficiency  of  the
 company's operations AND PROTECTION OF CRITICAL ENERGY INFRASTRUCTURE AS
 DEFINED  IN  SUBDIVISION  FOURTEEN  OF  SECTION 1-103 OF THE ENERGY LAW,
 recommendations with respect to same, and the timing with respect to the
 implementation  of  such  recommendations.  The  commission  shall  have
 discretion to have such audits performed by its staff, or by independent
 auditors.
   In  every  case  in  which  the  commission  chooses to have the audit
 provided for in this subdivision or pursuant to subdivision fourteen  of
 section sixty-five of this article performed by independent auditors, it
 shall  have authority to select the auditors, and to require the company
 being audited to enter into a contract with the auditors  providing  for
 their  payment  by the company. Such contract shall provide further that
 the auditors shall work for and under the direction  of  the  commission
 according  to  such  terms as the commission may determine are necessary
 and reasonable.
   § 5. Subdivision 19 of section 66 of the public service law is amended
 by adding a new paragraph (d) to read as follows:
   (D) THE COMMISSION SHALL HAVE THE POWER TO PROVIDE FOR AN ANNUAL AUDIT
 OF GAS CORPORATIONS AND ELECTRIC CORPORATIONS RELATING TO  THE  ADEQUACY
 OF   CYBER-SECURITY  POLICIES,  PROTOCOLS,  PROCEDURES  AND  PROTECTIONS
 INCLUDING, BUT NOT LIMITED TO, AS SUCH POLICIES,  PROTOCOLS,  PROCEDURES
 AND  PROTECTIONS  RELATE TO CRITICAL ENERGY INFRASTRUCTURE AS DEFINED IN
 SUBDIVISION FOURTEEN OF SECTION 1-103 OF THE  ENERGY  LAW  AND  ALSO  TO
 CUSTOMER  PRIVACY. THE COMMISSION SHALL HAVE THE DISCRETION TO HAVE SUCH
 AUDITS PERFORMED BY ITS STAFF OR BY AN INDEPENDENT THIRD-PARTY.

 A. 3904--A                          3
 
   § 6. Paragraph (a) of subdivision 21  of  section  66  of  the  public
 service  law,  as added by section 4 of part X of chapter 57 of the laws
 of 2013, is amended to read as follows:
   (a) Each electric corporation subject to section twenty-five-a of this
 chapter  shall  annually, on or before December fifteenth, submit to the
 commission an emergency response plan for review and approval. The emer-
 gency response plan shall be designed for the reasonably prompt restora-
 tion of service in the case of an emergency event, defined for  purposes
 of  this  subdivision as an event where widespread outages have occurred
 in the service territory of the company due to storms, CYBER ATTACK,  or
 other  causes  beyond the control of the company. The emergency response
 plan shall include, but need not be limited to, the following:  (i)  the
 identification  of  management  staff responsible for company operations
 during an emergency; (ii) a communications system with customers  during
 an  emergency  that  extends  beyond  normal business hours and business
 conditions; (iii) identification of and outreach plans to customers  who
 had  documented  their need for essential electricity for medical needs;
 (iv) identification of and outreach plans to  customers  who  had  docu-
 mented their need for essential electricity to provide critical telecom-
 munications,   critical   transportation,   critical  fuel  distribution
 services or other large-load customers identified by the commission; (v)
 designation of company staff to communicate  with  local  officials  and
 appropriate  regulatory  agencies;  (vi)  provisions  regarding  how the
 company will assure the safety of its employees and  contractors;  (vii)
 procedures for deploying company and mutual aid crews to work assignment
 areas; (viii) identification of additional supplies and equipment needed
 during an emergency; (ix) the means of obtaining additional supplies and
 equipment;  (x) procedures to practice the emergency response plan; (xi)
 appropriate safety precautions regarding electrical  hazards,  including
 plans to promptly secure downed wires within thirty-six hours of notifi-
 cation  of  the location of such downed wires from a municipal emergency
 official; and (xii) such other additional information as the  commission
 may  require. Each such corporation shall, on an annual basis, undertake
 drills implementing procedures  to  practice  its  emergency  management
 plan.  The  commission may adopt additional requirements consistent with
 ensuring the reasonably prompt restoration of service in the case of  an
 emergency event.
   § 7. Section 66 of the public service law is amended by adding two new
 subdivisions 29 and 30 to read as follows:
   29.  PROMULGATE RULES AND REGULATIONS TO DIRECT ELECTRIC OR GAS CORPO-
 RATIONS TO DEVELOP AND IMPLEMENT TOOLS TO  MONITOR  OPERATIONAL  CONTROL
 NETWORKS GIVING THE ELECTRIC OR GAS CORPORATION THE ABILITY TO UNDERTAKE
 THE  DETECTION  OF  UNAUTHORIZED NETWORK BEHAVIOR RELATED TO SUCH CORPO-
 RATION'S INDUSTRIAL CONTROL SYSTEMS, AS DEFINED IN  SUBDIVISION  FIFTEEN
 OF  SECTION 1-103 OF THE ENERGY LAW. ON OR BEFORE DECEMBER THIRTY-FIRST,
 TWO THOUSAND TWENTY-THREE AND NOT LATER THAN FIVE YEARS AFTER SUCH DATE,
 AND EVERY FIVE YEARS THEREAFTER, THE COMMISSION SHALL PROVIDE  A  REPORT
 TO  THE  GOVERNOR, THE TEMPORARY PRESIDENT OF THE SENATE, THE SPEAKER OF
 THE ASSEMBLY, THE CHAIRPERSON OF  THE  ASSEMBLY  STANDING  COMMITTEE  ON
 ENERGY,  AND  THE CHAIRPERSON OF THE SENATE STANDING COMMITTEE ON ENERGY
 AND TELECOMMUNICATIONS REVIEWING ELECTRIC OR GAS CORPORATION  COMPLIANCE
 WITH  THIS  SECTION,  INCLUDING,  AS  NECESSARY,  RECOMMENDATIONS TO THE
 LEGISLATURE IF THE COMMISSION DETERMINES THAT  ADDITIONAL  MEASURES  ARE
 REQUIRED  TO  ENSURE  THE EFFECTIVE PROTECTION OF ELECTRIC OR GAS CORPO-
 RATION CRITICAL INFRASTRUCTURE.

 A. 3904--A                          4
 
   30. PROMULGATE RULES AND REGULATIONS TO DIRECT ELECTRIC OR GAS  CORPO-
 RATIONS  TO REQUIRE THE INSTALLATION OF ADVANCED METERING INFRASTRUCTURE
 THAT CONNECTS TO THE ELECTRIC OR GAS DISTRIBUTION  NETWORK  OPERATED  BY
 SUCH  ELECTRIC OR GAS CORPORATION BE PERMITTED ONLY SO LONG AS ACCESS TO
 THE  ADVANCED METER INFRASTRUCTURE ENABLES TWO-WAY COMMUNICATION BETWEEN
 UTILITIES AND METERS THROUGH THE OPTIMAL COMMUNICATIONS NETWORK  OPTION,
 SUCH AS A WIRELESS NETWORK, THAT IS SHARED BY AT LEAST TWO METER PROVID-
 ERS  OPERATING  WITHIN  THE  UNITED STATES OF AMERICA, IF THE COMMISSION
 DETERMINES THAT IT IS COST EFFECTIVE TO DO SO.
   § 8. This act shall take effect on the one hundred eightieth day after
 it shall have become a law. Effective immediately,  the  public  service
 commission  is  authorized  and  directed  to  take actions necessary to
 promulgate rules and regulations related to the implementation of subdi-
 visions 29 and 30 of section 66 of the public service law on  or  before
 such effective date.