S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   1345
 
                        2023-2024 Regular Sessions
 
                             I N  S E N A T E
 
                             January 11, 2023
                                ___________
 
 Introduced  by  Sen.  PARKER -- read twice and ordered printed, and when
   printed to be committed to the Committee on Rules
 
 AN ACT to amend the energy law, the executive law and the public service
   law, in  relation  to  critical  energy  infrastructure  security  and
   responsibility;  and  to  amend a chapter of the laws of 2022 amending
   the energy law, the executive law and the public service law  relating
   to  critical  energy  infrastructure  security  and responsibility, as
   proposed in legislative bills numbers S.  5579-A  and  A.  3904-B,  in
   relation to the effectiveness thereof
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Subdivisions 14 and 15 of section 1-103 of the energy  law,
 as  added  by a chapter of the laws of 2022 amending the energy law, the
 executive law and the public service law  relating  to  critical  energy
 infrastructure  security  and responsibility, as proposed in legislative
 bills numbers S. 5579-A and A. 3904-B, are amended to read as follows:
   14. "Critical energy infrastructure" means systems,  including  indus-
 trial  control  systems,  [customer electrical or gas consumption data,]
 assets, places or things, whether physical or virtual, so vital  to  the
 state  that  the  disruption,  incapacitation  or  destruction  of  such
 systems, including industrial control systems, [customer  electrical  or
 gas  consumption  data,]  assets,  places or things could jeopardize the
 health, safety, welfare, energy distribution, transmission, reliability,
 or security of the state, its residents or its economy.
   15. "Industrial control  systems"  means  [a  combination  of  control
 components  that  support  operational  functions  in gas, distribution,
 transmission, and advanced metering infrastructure control centers,  and
 act together to achieve an industrial objective, including controls that
 are fully automated or that include a human-machine interface] AN INFOR-
 MATION  SYSTEM  USED  TO  MONITOR  AND/OR  CONTROL INDUSTRIAL PROCESSES,
 INCLUDING SUPERVISORY CONTROL AND DATA ACQUISITION SYSTEMS USED TO MONI-
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD04193-01-3
              

 S. 1345                             2
 
 TOR AND/OR CONTROL GEOGRAPHICALLY DISPERSED ASSETS, DISTRIBUTED  CONTROL
 SYSTEMS,  HUMAN-MACHINE  INTERFACES,  AND PROGRAMMABLE LOGIC CONTROLLERS
 THAT CONTROL LOCALIZED PROCESSES.
   §  2.  Paragraph  (j) of subdivision 2 of section 709 of the executive
 law, as amended by a chapter of the laws of  2022  amending  the  energy
 law,  the  executive law and the public service law relating to critical
 energy infrastructure security and responsibility, as proposed in legis-
 lative bills numbers S. 5579-A and A. 3904-B,  is  amended  to  read  as
 follows:
   (j)  work  with local, state and federal agencies and private entities
 to conduct assessments of the vulnerability of  critical  infrastructure
 to terrorist attack, cyber attack, and other natural and man-made disas-
 ters,  including,  but not limited to, nuclear facilities, power plants,
 telecommunications systems, mass transportation  systems,  public  road-
 ways,  railways,  bridges and tunnels, [and attendant industrial control
 systems as defined by subdivision fifteen of section 1-103 of the energy
 law] and develop strategies that may be used to protect such infrastruc-
 ture from terrorist attack, cyber attack, and other natural and man-made
 disasters;
   § 3. Paragraph (a) of subdivision 19  of  section  66  of  the  public
 service  law,  as  amended by a chapter of the laws of 2022 amending the
 energy law, the executive law and the public  service  law  relating  to
 critical  energy infrastructure security and responsibility, as proposed
 in legislative bills numbers S. 5579-A and A. 3904-B, is amended to read
 as follows:
   (a) The commission shall have power  to  provide  for  management  and
 operations  audits  of  gas corporations and electric corporations. Such
 audits shall be performed at least once every five years for combination
 gas and electric corporations, as well as for straight gas  corporations
 having  annual  gross revenues in excess of two hundred million dollars.
 The audit shall include, but not be limited to, an investigation of  the
 company's  construction program planning in relation to the needs of its
 customers for reliable service, an evaluation of the efficiency  of  the
 company's  operations,  AN  EVALUATION  OF CUSTOMER PRIVACY PROTECTIONS,
 INCLUDING BUT NOT LIMITED TO CUSTOMER  ELECTRICAL  AND  GAS  CONSUMPTION
 DATA,  and  protection  of  critical energy infrastructure as defined in
 subdivision fourteen of section 1-103 of the energy law, recommendations
 with respect to same, and the timing with respect to the  implementation
 of  such  recommendations.  The commission shall have discretion to have
 such audits performed by its staff, or by independent auditors.
   In every case in which  the  commission  chooses  to  have  the  audit
 provided  for in this subdivision or pursuant to subdivision fourteen of
 section sixty-five of this article performed by independent auditors, it
 shall have authority to select the auditors, and to require the  company
 being  audited  to enter into a contract with the auditors providing for
 their payment by the company. Such contract shall provide  further  that
 the  auditors  shall  work for and under the direction of the commission
 according to such terms as the commission may  determine  are  necessary
 and reasonable.
   §  4.  Paragraph  (d)  of  subdivision  19 of section 66 of the public
 service law, as added by a chapter of the  laws  of  2022  amending  the
 energy  law,  the  executive  law and the public service law relating to
 critical energy infrastructure security and responsibility, as  proposed
 in legislative bills numbers S. 5579-A and A. 3904-B, is amended to read
 as follows:
 S. 1345                             3
 
   (d) The commission shall have the power to provide for an annual audit
 of  gas  corporations and electric corporations relating to the adequacy
 of  cyber-security  policies,  protocols,  procedures  and   protections
 including,  but  not limited to, as such policies, protocols, procedures
 and  protections  relate to critical energy infrastructure as defined in
 subdivision fourteen of section 1-103 of the energy law  and  [also  to]
 customer  privacy INCLUDING BUT NOT LIMITED TO CUSTOMER ELECTRIC AND GAS
 CONSUMPTION DATA. The commission shall have the discretion to have  such
 audits performed by its staff or by an independent third party.
   §  5.  Subdivisions 30 and 31 of section 66 of the public service law,
 as added by a chapter of the laws of 2022 amending the energy  law,  the
 executive  law  and  the  public service law relating to critical energy
 infrastructure security and responsibility, as proposed  in  legislative
 bills numbers S. 5579-A and A. 3904-B, are amended and a new subdivision
 32 is added to read as follows:
   30.  Promulgate rules and regulations to direct electric or gas corpo-
 rations to develop and  implement  tools  to  monitor:  (A)  operational
 control  networks  giving the electric or gas corporation the ability to
 undertake the detection of unauthorized network behavior related to such
 corporation's industrial control  systems,  as  defined  in  subdivision
 fifteen  of section 1-103 of the energy law; AND (B) MONITOR AND PROTECT
 CUSTOMER PRIVACY, INCLUDING BUT NOT LIMITED TO CUSTOMER ELECTRIC AND GAS
 CONSUMPTION DATA FROM UNAUTHORIZED DISCLOSURE.  On  or  before  December
 thirty-first,  two  thousand  twenty-three and not later than five years
 after such date, and every five years thereafter, the  commission  shall
 provide a report to the governor, the temporary president of the senate,
 the  speaker  of  the assembly, the chairperson of the assembly standing
 committee on energy, and the chairperson of the senate standing  commit-
 tee  on  energy  and telecommunications reviewing electric or gas corpo-
 ration compliance with this section, including, as necessary,  recommen-
 dations  to the legislature if the commission determines that additional
 measures are required to ensure the effective protection of electric  or
 gas corporation critical infrastructure.
   31.  Promulgate rules and regulations to direct electric or gas corpo-
 rations to require the installation of advanced metering  infrastructure
 that  connects  to  the electric or gas distribution network operated by
 such electric or gas corporation be permitted only so long as access  to
 the  advanced meter infrastructure enables two-way communication between
 utilities and meters through the optimal communications network  option,
 such as a wireless network, that is shared by at least two meter provid-
 ers  operating  within  the  United States of America, if the commission
 determines that it is cost effective AND TECHNICALLY FEASIBLE to do so.
   32. CUSTOMER ELECTRIC AND GAS CONSUMPTION  DATA  SHALL  BE  CONSIDERED
 CONFIDENTIAL.  THE  COMMISSION  SHALL  HAVE  THE AUTHORITY TO PROMULGATE
 RULES AND REGULATIONS TO REQUIRE GAS OR ELECTRIC  CORPORATIONS  TO  TAKE
 NECESSARY MEASURES TO PROTECT SUCH DATA FROM UNAUTHORIZED OR UNCONSENTED
 DISCLOSURE.
   §  6.  Section  8 of a chapter of the laws of 2022 amending the energy
 law, the executive law and the public service law relating  to  critical
 energy infrastructure security and responsibility, as proposed in legis-
 lative  bills  numbers  S.  5579-A  and A. 3904-B, is amended to read as
 follows:
   § 8. This act shall take effect on the one hundred eightieth day after
 it shall have become a law. Effective immediately,  the  public  service
 commission  is  authorized  and  directed  to  take actions necessary to
 promulgate rules and regulations related to the implementation of subdi-
 S. 1345                             4

 visions 30 [and], 31 AND 32 of section 66 of the public service  law  on
 or before such effective date.
   §  7.  This  act shall take effect immediately; provided however, that
 sections one, two, three, four and five of this act shall take effect on
 the same date and in the same manner as a chapter of the  laws  of  2022
 amending  the  energy  law, the executive law and the public service law
 relating to critical energy infrastructure security and  responsibility,
 as  proposed in legislative bills numbers S. 5579-A and A. 3904-B, takes
 effect.