S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   5736
 
                        2023-2024 Regular Sessions
 
                           I N  A S S E M B L Y
 
                              March 23, 2023
                                ___________
 
 Introduced  by M. of A. SOLAGES -- read once and referred to the Commit-
   tee on Governmental Operations
 
 AN ACT to amend the state technology law, in  relation  to  establishing
   the "secure our data act"
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:

   Section 1. This act shall be known and may be cited as the "secure our
 data act".
   § 2. Legislative intent. The legislature  finds  that  ransomware  and
 other  malware  attacks have affected the electronically stored personal
 information relating to thousands of people statewide  and  millions  of
 people  nationwide.  The  legislature  also  finds  that  state entities
 receive such personal information from various  sources,  including  the
 data  subjects themselves, other state entities, and the federal govern-
 ment.  In addition, the legislature finds that state entities  use  such
 personal information to make determinations regarding the data subjects.
 The  legislature  further  finds  that New Yorkers deserve to have their
 personal information that is in the possession of a state entity  stored
 in  a  manner  that  will  withstand any attempt by ransomware and other
 malware to alter, change, or encrypt such information.
   Therefore, the legislature enacts the secure our data act  which  will
 guarantee  that  state  entities  will  employ  the proper technology to
 protect the personal information stored as backup information  from  any
 unauthorized alteration or change.
   §  3.  The state technology law is amended by adding a new section 210
 to read as follows:
   § 210. RANSOMWARE AND OTHER MALWARE PROTECTION.  1.  DEFINITIONS.  FOR
 PURPOSES  OF  THIS SECTION, THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING
 MEANINGS:
   (A) "DATA SUBJECT" SHALL MEAN THE PERSON WHO IS  THE  SUBJECT  OF  THE
 PERSONAL INFORMATION.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD09002-01-3
              

 A. 5736                             2
 
   (B)  "IMMUTABLE"  MEANS  DATA  THAT  IS  STORED UNCHANGED OVER TIME OR
 UNABLE TO BE CHANGED. FOR THE PURPOSES  OF  BACKUPS,  "IMMUTABLE"  SHALL
 MEAN  THAT,  ONCE INGESTED, NO EXTERNAL OR INTERNAL OPERATION CAN MODIFY
 THE DATA AND MUST NEVER BE  AVAILABLE  IN  A  READ/WRITE  STATE  TO  THE
 CLIENT.  "IMMUTABLE" SHALL SPECIFICALLY APPLY TO THE CHARACTERISTICS AND
 ATTRIBUTES OF A BACKUP SYSTEM'S FILE SYSTEM AND MAY NOT  BE  APPLIED  TO
 TEMPORARY  SYSTEMS  STATE,  TIME-BOUND  OR  EXPIRING  CONFIGURATIONS, OR
 TEMPORARY CONDITIONS CREATED BY A PHYSICAL AIR GAP AS IS IMPLEMENTED  IN
 MOST  LEGACY SYSTEMS.  AN IMMUTABLE FILE SYSTEM MUST DEMONSTRATE CHARAC-
 TERISTICS THAT DO NOT PERMIT THE EDITING OR CHANGING OF ANY DATA  BACKED
 UP TO PROVIDE AGENCIES WITH COMPLETE RECOVERY CAPABILITIES.
   (C) "INFORMATION SYSTEM" SHALL MEAN ANY GOOD, SERVICE OR A COMBINATION
 THEREOF,  USED  BY ANY COMPUTER, CLOUD SERVICE, OR INTERCONNECTED SYSTEM
 THAT IS MAINTAINED FOR OR USED BY A STATE  ENTITY  IN  THE  ACQUISITION,
 STORAGE,  MANIPULATION,  MANAGEMENT, MOVEMENT, CONTROL, DISPLAY, SWITCH-
 ING, INTERCHANGE, TRANSMISSION, OR RECEPTION OF DATA OR VOICE INCLUDING,
 BUT NOT LIMITED TO, HARDWARE, SOFTWARE,  INFORMATION  APPLIANCES,  FIRM-
 WARE,  PROGRAMS,  SYSTEMS,  NETWORKS, INFRASTRUCTURE, MEDIA, AND RELATED
 MATERIAL USED TO  AUTOMATICALLY  AND  ELECTRONICALLY  COLLECT,  RECEIVE,
 ACCESS,  TRANSMIT,  DISPLAY, STORE, RECORD, RETRIEVE, ANALYZE, EVALUATE,
 PROCESS, CLASSIFY, MANIPULATE, MANAGE, ASSIMILATE, CONTROL, COMMUNICATE,
 EXCHANGE, CONVERT, COVERAGE, INTERFACE, SWITCH, OR DISSEMINATE  DATA  OF
 ANY KIND OR FORM.
   (D)  "MAINTAINED"  SHALL  MEAN  PERSONAL INFORMATION STORED BY A STATE
 ENTITY THAT WAS PROVIDED TO THE STATE ENTITY  BY  THE  DATA  SUBJECT,  A
 STATE  ENTITY,  OR  A  FEDERAL GOVERNMENTAL ENTITY. SUCH TERM SHALL ALSO
 INCLUDE PERSONAL INFORMATION PROVIDED BY AN ADVERSE PARTY IN THE  COURSE
 OF LITIGATION OR OTHER ADVERSARIAL PROCEEDING.
   (E)  "MALWARE"  SHALL MEAN MALICIOUS CODE INCLUDED IN ANY APPLICATION,
 DIGITAL CONTENT, DOCUMENT, EXECUTABLE, FIRMWARE,  PAYLOAD,  OR  SOFTWARE
 FOR  THE  PURPOSE  OF  PERFORMING  OR EXECUTING ONE OR MORE UNAUTHORIZED
 PROCESSES DESIGNED TO HAVE AN ADVERSE IMPACT ON THE AVAILABILITY, CONFI-
 DENTIALITY, OR INTEGRITY OF DATA STORED IN AN INFORMATION SYSTEM.
   (F) "RANSOMWARE" SHALL MEAN ANY TYPE OF MALWARE THAT  USES  ENCRYPTION
 TECHNOLOGY TO PREVENT USERS FROM ACCESSING AN INFORMATION SYSTEM OR DATA
 STORED BY SUCH INFORMATION SYSTEM UNTIL A RANSOM IS PAID.
   (G)  "STATE  ENTITY"  SHALL  MEAN  ANY  STATE BOARD, BUREAU, DIVISION,
 COMMITTEE, COMMISSION, COUNCIL,  DEPARTMENT,  PUBLIC  AUTHORITY,  PUBLIC
 BENEFIT  CORPORATION,  OFFICE  OR OTHER GOVERNMENTAL ENTITY PERFORMING A
 GOVERNMENTAL OR PROPRIETARY FUNCTION FOR THE STATE OF NEW YORK OR ANY OF
 ITS POLITICAL SUBDIVISIONS.
   2. DATA PROTECTION STANDARDS. (A) NO LATER THAN  ONE  YEAR  AFTER  THE
 EFFECTIVE  DATE  OF  THIS  SECTION,  THE  DIRECTOR, IN CONSULTATION WITH
 STAKEHOLDERS AND OTHER INTERESTED PARTIES, WHICH SHALL INCLUDE AT  LEAST
 ONE PUBLIC HEARING, SHALL PROMULGATE REGULATIONS THAT DESIGN AND DEVELOP
 STANDARDS FOR:
   (I) MALWARE AND RANSOMWARE PROTECTION FOR MISSION CRITICAL INFORMATION
 SYSTEMS AND FOR PERSONAL INFORMATION USED BY SUCH INFORMATION SYSTEMS;
   (II)  DATA  BACKUP  THAT INCLUDES THE CREATION OF IMMUTABLE BACKUPS OF
 PERSONAL INFORMATION MAINTAINED BY THE STATE ENTITY AND STORAGE OF  SUCH
 BACKUPS IN A SEGMENTED ENVIRONMENT, INCLUDING A SEGMENTED DEVICE;
   (III)  INFORMATION SYSTEM RECOVERY THAT INCLUDES CREATING AN IDENTICAL
 COPY OF AN IMMUTABLE PERSONAL INFORMATION BACKUP MAINTAINED  BY  OR  FOR
 THE  STATE  ENTITY  THAT  WAS  STORED IN A SEGMENTED ENVIRONMENT OR ON A
 SEGMENTED DEVICE FOR USE WHEN AN INFORMATION SYSTEM HAS  BEEN  ADVERSELY
 A. 5736                             3
 
 AFFECTED  BY  RENT  SOMEWHERE  OR OTHER MALWARE AND REQUIRES RESTORATION
 FROM ONE OR MORE BACKUPS; AND
   (IV)  ANNUAL  WORKFORCE  TRAINING REGARDING PROTECTION FROM RANSOMWARE
 AND OTHER MALWARE, AS WELL AS PROCESSES AND PROCEDURES  THAT  SHOULD  BE
 FOLLOWED  IN  THE EVENT OF A DATA INCIDENT INVOLVING RANSOMWARE OR OTHER
 MALWARE.
   (B) SUCH REGULATIONS MAY BE ADOPTED ON AN  EMERGENCY  BASIS.  IF  SUCH
 REGULATIONS  ARE  ADOPTED ON AN EMERGENCY BASIS, THE OFFICE SHALL ENGAGE
 IN THE FORMAL RULEMAKING PROCEDURE NO LATER  THAN  THE  DAY  IMMEDIATELY
 FOLLOWING  THE  DATE  THAT THE OFFICE PROMULGATED SUCH REGULATIONS ON AN
 EMERGENCY BASIS. PROVIDED THAT THE OFFICE HAS COMMENCED THE FORMAL RULE-
 MAKING PROCESS, THE REGULATIONS ADOPTED ON AN  EMERGENCY  BASIS  MAY  BE
 RENEWED NO MORE THAN TWO TIMES.
   3.  VULNERABILITY ASSESSMENTS. NOTWITHSTANDING ANY PROVISION OF LAW TO
 THE CONTRARY, EACH STATE ENTITY SHALL ENGAGE IN VULNERABILITY TESTING OF
 ITS INFORMATION SYSTEMS AS FOLLOWS:
   (A) BEGINNING JANUARY FIRST, TWO THOUSAND TWENTY-FOUR AND ON A MONTHLY
 BASIS THEREAFTER, EACH STATE  ENTITY  SHALL  PERFORM,  OR  CAUSE  TO  BE
 PERFORMED,  A  VULNERABILITY ASSESSMENT OF AT LEAST ONE MISSION CRITICAL
 INFORMATION SYSTEM ENSURING THAT EACH MISSION CRITICAL SYSTEM HAS UNDER-
 GONE A VULNERABILITY ASSESSMENT DURING THE PAST YEAR. A REPORT DETAILING
 THE VULNERABILITY ASSESSMENT METHODOLOGY  AND  FINDINGS  SHALL  BE  MADE
 AVAILABLE  TO  THE OFFICE FOR REVIEW NO LATER THAN FORTY-FIVE DAYS AFTER
 THE TESTING HAS BEEN COMPLETED.
   (B) BEGINNING DECEMBER FIRST, TWO  THOUSAND  TWENTY-FOUR,  EACH  STATE
 ENTITY'S  ENTIRE  INFORMATION SYSTEM SHALL UNDERGO VULNERABILITY TESTING
 CONDUCTED BY AN INDEPENDENT THIRD PARTY. A REPORT DETAILING THE  VULNER-
 ABILITY  ASSESSMENT  METHODOLOGY AND FINDINGS SHALL BE MADE AVAILABLE TO
 THE OFFICE FOR REVIEW NO LATER THAN FORTY-FIVE DAYS AFTER  SUCH  TESTING
 HAS BEEN COMPLETED.
   (C)  THE  OFFICE  SHALL  ASSIST  STATE  ENTITIES IN COMPLYING WITH THE
 PROVISIONS OF THIS SECTION.
   4. DATA AND INFORMATION SYSTEM INVENTORY. (A) NO LATER THAN  ONE  YEAR
 AFTER THE EFFECTIVE DATE OF THIS SECTION, EACH STATE ENTITY SHALL CREATE
 AN  INVENTORY OF THE DATA MAINTAINED BY THE STATE ENTITY AND THE PURPOSE
 OR PURPOSES FOR WHICH SUCH DATA IS MAINTAINED AND  USED.  THE  INVENTORY
 SHALL  INCLUDE  A  LISTING OF ALL PERSONAL INFORMATION MAINTAINED BY THE
 STATE ENTITY, ALONG WITH THE SOURCE AND AGE OF SUCH INFORMATION.
   (B) NO LATER THAN ONE YEAR AFTER THE EFFECTIVE DATE OF  THIS  SECTION,
 EACH  STATE  ENTITY SHALL CREATE AN INVENTORY OF THE INFORMATION SYSTEMS
 MAINTAINED BY OR ON BEHALF OF  THE  STATE  ENTITY  AND  THE  PURPOSE  OR
 PURPOSES  FOR WHICH EACH SUCH INFORMATION SYSTEM IS MAINTAINED AND USED.
 THE INVENTORY SHALL DENOTE THOSE INFORMATION SYSTEMS  THAT  ARE  MISSION
 CRITICAL AND THOSE THAT USE PERSONAL INFORMATION, AND WHETHER THE INFOR-
 MATION SYSTEM IS PROTECTED BY IMMUTABLE BACKUPS.
   (C)  NOTWITHSTANDING  PARAGRAPHS (A) AND (B) OF THIS SUBDIVISION, IF A
 STATE ENTITY HAS ALREADY  COMPLETED  A  DATA  INVENTORY  OR  INFORMATION
 SYSTEMS  INVENTORY,  SUCH  STATE  ENTITY  SHALL  UPDATE  THE  PREVIOUSLY
 COMPLETED DATA INVENTORY OR INFORMATION SYSTEM INVENTORY NO  LATER  THAN
 ONE YEAR AFTER THE EFFECTIVE DATE OF THIS SECTION.
   (D) UPON WRITTEN REQUEST FROM THE OFFICE, A STATE ENTITY SHALL PROVIDE
 THE OFFICE WITH EITHER OR BOTH OF THE INVENTORIES REQUIRED TO BE CREATED
 OR UPDATED PURSUANT TO THIS SUBDIVISION.
   5. INCIDENT MANAGEMENT AND RECOVERY. (A) NO LATER THAN EIGHTEEN MONTHS
 AFTER  THE  EFFECTIVE DATE OF THIS SECTION, EACH STATE ENTITY SHALL HAVE
 CREATED AN INCIDENT RESPONSE PLAN FOR INCIDENTS INVOLVING RANSOMWARE  OR
 A. 5736                             4
 
 OTHER  MALWARE  THAT  RENDERS AN INFORMATION SYSTEM OR ITS DATA UNAVAIL-
 ABLE, AND INCIDENTS INVOLVING RANSOMWARE OR OTHER MALWARE THAT RESULT IN
 THE ALTERATION OR DELETION OF OR UNAUTHORIZED ACCESS TO, PERSONAL INFOR-
 MATION.
   (B)  SUCH  INCIDENT  RESPONSE PLAN SHALL INCLUDE A PROCEDURE FOR SITU-
 ATIONS WHERE PRODUCTION AND NON-SEGMENTED INFORMATION SYSTEMS HAVE  BEEN
 ADVERSELY  AFFECTED  BY  A DATA INCIDENT, AS WELL AS A PROCEDURE FOR THE
 STORAGE OF PERSONAL  INFORMATION  AND  MISSION  CRITICAL  BACKUPS  ON  A
 SEGMENTED  DEVICE OR SEGMENTED PORTION OF THE STATE ENTITY'S INFORMATION
 SYSTEM TO ENSURE THAT SUCH PERSONAL  INFORMATION  AND  MISSION  CRITICAL
 SYSTEMS ARE PROTECTED BY IMMUTABLE BACKUPS.
   (C)  BEGINNING JANUARY FIRST, TWO THOUSAND TWENTY-SIX AND ON AN ANNUAL
 BASIS THEREAFTER, EACH STATE ENTITY SHALL COMPLETE AT LEAST ONE EXERCISE
 OF ITS INCIDENT  RESPONSE  PLAN  THAT  INCLUDES  COPYING  THE  IMMUTABLE
 PERSONAL   INFORMATION   AND  MISSION  CRITICAL  APPLICATIONS  FROM  THE
 SEGMENTED PORTION OF THE STATE ENTITY'S  INFORMATION  SYSTEM  AND  USING
 SUCH COPIES IN THE STATE ENTITY'S RESTORATION AND RECOVERY PROCESS. UPON
 COMPLETION  OF  SUCH EXERCISE, THE STATE ENTITY SHALL DOCUMENT THE INCI-
 DENT RESPONSE PLAN'S SUCCESSES AND SHORTCOMINGS.
   6. NO PRIVATE RIGHT OF ACTION. NOTHING SET FORTH IN THIS SECTION SHALL
 BE CONSTRUED AS CREATING OR ESTABLISHING A PRIVATE CAUSE OF ACTION.
   § 4. Severability. The provisions of this act shall be  severable  and
 if  any  portion  thereof  or the applicability thereof to any person or
 circumstances shall be held to be invalid, the remainder of this act and
 the application thereof shall not be affected thereby.
   § 5. This act shall take effect immediately.

                             
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                  5736--B
 
                        2023-2024 Regular Sessions
 
                           I N  A S S E M B L Y
 
                              March 23, 2023
                                ___________
 
 Introduced  by  M. of A. SOLAGES, SEAWRIGHT -- read once and referred to
   the Committee on Governmental Operations -- committee discharged, bill
   amended, ordered reprinted as amended and recommitted to said  commit-
   tee  --  recommitted  to  the  Committee on Governmental Operations in
   accordance with Assembly Rule 3, sec. 2 -- committee discharged,  bill
   amended,  ordered reprinted as amended and recommitted to said commit-
   tee
 
 AN ACT to amend the state technology law, in  relation  to  establishing
   the "secure our data act"
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. This act shall be known and may be cited as the "secure our
 data act".
   § 2. Legislative intent. The legislature  finds  that  ransomware  and
 other  malware  attacks have affected the electronically stored personal
 information relating to thousands of people statewide  and  millions  of
 people  nationwide.  The  legislature  also  finds  that  state entities
 receive such personal information from various  sources,  including  the
 data  subjects themselves, other state entities, and the federal govern-
 ment.  In addition, the legislature finds that state entities  use  such
 personal information to make determinations regarding the data subjects.
 The  legislature  further  finds  that New Yorkers deserve to have their
 personal information that is in the possession of a state entity  stored
 in  a  manner  that  will  withstand any attempt by ransomware and other
 malware to alter, change, or encrypt such information.
   Therefore, the legislature enacts the secure our data act  which  will
 guarantee  that  state  entities  will  employ  the proper technology to
 protect the personal information stored as backup information  from  any
 unauthorized alteration or change.
   §  3.  The state technology law is amended by adding a new section 210
 to read as follows:
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD09002-05-4
              

 A. 5736--B                          2
 
   § 210. RANSOMWARE AND OTHER MALWARE PROTECTION.  1.  DEFINITIONS.  FOR
 PURPOSES  OF  THIS SECTION, THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING
 MEANINGS:
   (A)  "DATA  SUBJECT"  SHALL  MEAN THE PERSON WHO IS THE SUBJECT OF THE
 PERSONAL INFORMATION.
   (B) "IMMUTABLE" MEANS DATA THAT  IS  STORED  UNCHANGED  OVER  TIME  OR
 UNABLE  TO  BE  CHANGED.  FOR THE PURPOSES OF BACKUPS, "IMMUTABLE" SHALL
 MEAN THAT, ONCE INGESTED, NO EXTERNAL OR INTERNAL OPERATION  CAN  MODIFY
 THE  DATA  AND  MUST  NEVER  BE  AVAILABLE  IN A READ/WRITE STATE TO THE
 CLIENT. "IMMUTABLE" SHALL SPECIFICALLY APPLY TO THE CHARACTERISTICS  AND
 ATTRIBUTES  OF  A  BACKUP SYSTEM'S FILE SYSTEM AND MAY NOT BE APPLIED TO
 TEMPORARY SYSTEMS  STATE,  TIME-BOUND  OR  EXPIRING  CONFIGURATIONS,  OR
 TEMPORARY  CONDITIONS CREATED BY A PHYSICAL AIR GAP AS IS IMPLEMENTED IN
 MOST LEGACY SYSTEMS.  AN IMMUTABLE FILE SYSTEM MUST DEMONSTRATE  CHARAC-
 TERISTICS  THAT DO NOT PERMIT THE EDITING OR CHANGING OF ANY DATA BACKED
 UP TO PROVIDE AGENCIES WITH COMPLETE RECOVERY CAPABILITIES.
   (C) "INFORMATION SYSTEM" SHALL MEAN ANY GOOD, SERVICE OR A COMBINATION
 THEREOF, USED BY ANY COMPUTER, CLOUD SERVICE, OR  INTERCONNECTED  SYSTEM
 THAT  IS  MAINTAINED  FOR  OR USED BY A STATE ENTITY IN THE ACQUISITION,
 STORAGE, MANIPULATION, MANAGEMENT, MOVEMENT, CONTROL,  DISPLAY,  SWITCH-
 ING, INTERCHANGE, TRANSMISSION, OR RECEPTION OF DATA OR VOICE INCLUDING,
 BUT  NOT  LIMITED  TO, HARDWARE, SOFTWARE, INFORMATION APPLIANCES, FIRM-
 WARE, PROGRAMS, SYSTEMS, NETWORKS, INFRASTRUCTURE,  MEDIA,  AND  RELATED
 MATERIAL  USED  TO  AUTOMATICALLY  AND  ELECTRONICALLY COLLECT, RECEIVE,
 ACCESS, TRANSMIT, DISPLAY, STORE, RECORD, RETRIEVE,  ANALYZE,  EVALUATE,
 PROCESS, CLASSIFY, MANIPULATE, MANAGE, ASSIMILATE, CONTROL, COMMUNICATE,
 EXCHANGE,  CONVERT,  COVERAGE, INTERFACE, SWITCH, OR DISSEMINATE DATA OF
 ANY KIND OR FORM.
   (D) "MAINTAINED" SHALL MEAN PERSONAL INFORMATION  STORED  BY  A  STATE
 ENTITY  THAT  WAS  PROVIDED  TO  THE STATE ENTITY BY THE DATA SUBJECT, A
 STATE ENTITY, OR A FEDERAL GOVERNMENTAL ENTITY.  SUCH  TERM  SHALL  ALSO
 INCLUDE  PERSONAL INFORMATION PROVIDED BY AN ADVERSE PARTY IN THE COURSE
 OF LITIGATION OR OTHER ADVERSARIAL PROCEEDING.
   (E) "MALWARE" SHALL MEAN MALICIOUS CODE INCLUDED IN  ANY  APPLICATION,
 DIGITAL  CONTENT,  DOCUMENT,  EXECUTABLE, FIRMWARE, PAYLOAD, OR SOFTWARE
 FOR THE PURPOSE OF PERFORMING OR  EXECUTING  ONE  OR  MORE  UNAUTHORIZED
 PROCESSES DESIGNED TO HAVE AN ADVERSE IMPACT ON THE AVAILABILITY, CONFI-
 DENTIALITY, OR INTEGRITY OF DATA STORED IN AN INFORMATION SYSTEM.
   (F)  "RANSOMWARE"  SHALL MEAN ANY TYPE OF MALWARE THAT USES ENCRYPTION
 TECHNOLOGY TO PREVENT USERS FROM ACCESSING AN INFORMATION SYSTEM OR DATA
 STORED BY SUCH INFORMATION SYSTEM UNTIL A RANSOM IS PAID.
   (G) "STATE ENTITY" SHALL  MEAN  ANY  STATE  BOARD,  BUREAU,  DIVISION,
 COMMITTEE,  COMMISSION,  COUNCIL,  DEPARTMENT,  PUBLIC AUTHORITY, PUBLIC
 BENEFIT CORPORATION, OFFICE OR OTHER GOVERNMENTAL  ENTITY  PERFORMING  A
 GOVERNMENTAL OR PROPRIETARY FUNCTION FOR THE STATE OF NEW YORK, EXCEPT:
   (I) THE JUDICIARY; AND
   (II)  ALL CITIES, COUNTIES, MUNICIPALITIES, VILLAGES, TOWNS, AND OTHER
 LOCAL AGENCIES.
   2. DATA PROTECTION STANDARDS. (A) NO LATER THAN  ONE  YEAR  AFTER  THE
 EFFECTIVE  DATE  OF  THIS  SECTION,  THE  DIRECTOR, IN CONSULTATION WITH
 STAKEHOLDERS AND OTHER INTERESTED PARTIES, WHICH SHALL INCLUDE AT  LEAST
 ONE PUBLIC HEARING, SHALL PROMULGATE REGULATIONS THAT DESIGN AND DEVELOP
 STANDARDS FOR:
   (I) MALWARE AND RANSOMWARE PROTECTION FOR MISSION CRITICAL INFORMATION
 SYSTEMS AND FOR PERSONAL INFORMATION USED BY SUCH INFORMATION SYSTEMS;
 A. 5736--B                          3
 
   (II)  DATA  BACKUP  THAT INCLUDES THE CREATION OF IMMUTABLE BACKUPS OF
 PERSONAL INFORMATION MAINTAINED BY THE STATE ENTITY AND STORAGE OF  SUCH
 BACKUPS IN A SEGMENTED ENVIRONMENT, INCLUDING A SEGMENTED DEVICE;
   (III)  INFORMATION SYSTEM RECOVERY THAT INCLUDES CREATING AN IDENTICAL
 COPY OF AN IMMUTABLE PERSONAL INFORMATION BACKUP MAINTAINED  BY  OR  FOR
 THE  STATE  ENTITY  THAT  WAS  STORED IN A SEGMENTED ENVIRONMENT OR ON A
 SEGMENTED DEVICE FOR USE WHEN AN INFORMATION SYSTEM HAS  BEEN  ADVERSELY
 AFFECTED  BY  RENT  SOMEWHERE  OR OTHER MALWARE AND REQUIRES RESTORATION
 FROM ONE OR MORE BACKUPS; AND
   (IV) ANNUAL WORKFORCE TRAINING REGARDING  PROTECTION  FROM  RANSOMWARE
 AND  OTHER  MALWARE,  AS WELL AS PROCESSES AND PROCEDURES THAT SHOULD BE
 FOLLOWED IN THE EVENT OF A DATA INCIDENT INVOLVING RANSOMWARE  OR  OTHER
 MALWARE.
   (B)  SUCH  REGULATIONS  MAY  BE ADOPTED ON AN EMERGENCY BASIS. IF SUCH
 REGULATIONS ARE ADOPTED ON AN EMERGENCY BASIS, THE OFFICE  SHALL  ENGAGE
 IN  THE  FORMAL  RULEMAKING  PROCEDURE NO LATER THAN THE DAY IMMEDIATELY
 FOLLOWING THE DATE THAT THE OFFICE PROMULGATED SUCH  REGULATIONS  ON  AN
 EMERGENCY BASIS. PROVIDED THAT THE OFFICE HAS COMMENCED THE FORMAL RULE-
 MAKING  PROCESS,  THE  REGULATIONS  ADOPTED ON AN EMERGENCY BASIS MAY BE
 RENEWED NO MORE THAN TWO TIMES.
   3. VULNERABILITY ASSESSMENTS. NOTWITHSTANDING ANY PROVISION OF LAW  TO
 THE CONTRARY, EACH STATE ENTITY SHALL ENGAGE IN VULNERABILITY TESTING OF
 ITS INFORMATION SYSTEMS AS FOLLOWS:
   (A) BEGINNING JANUARY FIRST, TWO THOUSAND TWENTY-FIVE AND ON A MONTHLY
 BASIS  THEREAFTER,  EACH  STATE  ENTITY  SHALL  PERFORM,  OR CAUSE TO BE
 PERFORMED, A VULNERABILITY ASSESSMENT OF AT LEAST ONE  MISSION  CRITICAL
 INFORMATION SYSTEM ENSURING THAT EACH MISSION CRITICAL SYSTEM HAS UNDER-
 GONE A VULNERABILITY ASSESSMENT DURING THE PAST YEAR. A REPORT DETAILING
 THE  VULNERABILITY  ASSESSMENT  METHODOLOGY  AND  FINDINGS SHALL BE MADE
 AVAILABLE TO THE OFFICE FOR REVIEW NO LATER THAN FORTY-FIVE  DAYS  AFTER
 THE TESTING HAS BEEN COMPLETED.
   (B)  BEGINNING  DECEMBER  FIRST,  TWO THOUSAND TWENTY-FIVE, EACH STATE
 ENTITY'S ENTIRE INFORMATION SYSTEM SHALL UNDERGO VULNERABILITY  TESTING.
 A REPORT DETAILING THE VULNERABILITY ASSESSMENT METHODOLOGY AND FINDINGS
 SHALL  BE  MADE  AVAILABLE TO THE OFFICE FOR REVIEW NO LATER THAN FORTY-
 FIVE DAYS AFTER SUCH TESTING HAS BEEN COMPLETED.
   (C) THE OFFICE SHALL ASSIST  STATE  ENTITIES  IN  COMPLYING  WITH  THE
 PROVISIONS OF THIS SECTION.
   4.  DATA  AND INFORMATION SYSTEM INVENTORY. (A) NO LATER THAN ONE YEAR
 AFTER THE EFFECTIVE DATE OF THIS SECTION, EACH STATE ENTITY SHALL CREATE
 AN INVENTORY OF THE DATA MAINTAINED BY THE STATE ENTITY AND THE  PURPOSE
 OR  PURPOSES  FOR  WHICH SUCH DATA IS MAINTAINED AND USED. THE INVENTORY
 SHALL INCLUDE A LISTING OF ALL PERSONAL INFORMATION  MAINTAINED  BY  THE
 STATE ENTITY, ALONG WITH THE SOURCE AND AGE OF SUCH INFORMATION.
   (B)  NO  LATER THAN ONE YEAR AFTER THE EFFECTIVE DATE OF THIS SECTION,
 EACH STATE ENTITY SHALL CREATE AN INVENTORY OF THE  INFORMATION  SYSTEMS
 MAINTAINED  BY  OR  ON  BEHALF  OF  THE  STATE ENTITY AND THE PURPOSE OR
 PURPOSES FOR WHICH EACH SUCH INFORMATION SYSTEM IS MAINTAINED AND  USED.
 THE  INVENTORY  SHALL  DENOTE THOSE INFORMATION SYSTEMS THAT ARE MISSION
 CRITICAL AND THOSE THAT USE PERSONAL INFORMATION, AND WHETHER THE INFOR-
 MATION SYSTEM IS PROTECTED BY IMMUTABLE BACKUPS.
   (C) NOTWITHSTANDING PARAGRAPHS (A) AND (B) OF THIS SUBDIVISION,  IF  A
 STATE  ENTITY  HAS  ALREADY  COMPLETED  A  DATA INVENTORY OR INFORMATION
 SYSTEMS  INVENTORY,  SUCH  STATE  ENTITY  SHALL  UPDATE  THE  PREVIOUSLY
 COMPLETED  DATA  INVENTORY OR INFORMATION SYSTEM INVENTORY NO LATER THAN
 ONE YEAR AFTER THE EFFECTIVE DATE OF THIS SECTION.
 A. 5736--B                          4
 
   (D) UPON WRITTEN REQUEST FROM THE OFFICE, A STATE ENTITY SHALL PROVIDE
 THE OFFICE WITH EITHER OR BOTH OF THE INVENTORIES REQUIRED TO BE CREATED
 OR UPDATED PURSUANT TO THIS SUBDIVISION.
   5. INCIDENT MANAGEMENT AND RECOVERY. (A) NO LATER THAN EIGHTEEN MONTHS
 AFTER  THE  EFFECTIVE DATE OF THIS SECTION, EACH STATE ENTITY SHALL HAVE
 CREATED AN INCIDENT RESPONSE PLAN FOR INCIDENTS INVOLVING RANSOMWARE  OR
 OTHER  MALWARE  THAT  RENDERS AN INFORMATION SYSTEM OR ITS DATA UNAVAIL-
 ABLE, AND INCIDENTS INVOLVING RANSOMWARE OR OTHER MALWARE THAT RESULT IN
 THE ALTERATION OR DELETION OF OR UNAUTHORIZED ACCESS TO, PERSONAL INFOR-
 MATION.
   (B) SUCH INCIDENT RESPONSE PLAN SHALL INCLUDE A  PROCEDURE  FOR  SITU-
 ATIONS  WHERE PRODUCTION AND NON-SEGMENTED INFORMATION SYSTEMS HAVE BEEN
 ADVERSELY AFFECTED BY A DATA INCIDENT, AS WELL AS A  PROCEDURE  FOR  THE
 STORAGE  OF  PERSONAL  INFORMATION  AND  MISSION  CRITICAL  BACKUPS ON A
 SEGMENTED DEVICE OR SEGMENTED PORTION OF THE STATE ENTITY'S  INFORMATION
 SYSTEM  TO  ENSURE  THAT  SUCH PERSONAL INFORMATION AND MISSION CRITICAL
 SYSTEMS ARE PROTECTED BY IMMUTABLE BACKUPS.
   (C) BEGINNING JANUARY FIRST, TWO THOUSAND TWENTY-SEVEN AND ON AN ANNU-
 AL BASIS THEREAFTER, EACH STATE ENTITY SHALL COMPLETE AT LEAST ONE EXER-
 CISE OF ITS INCIDENT RESPONSE PLAN THAT INCLUDES COPYING  THE  IMMUTABLE
 PERSONAL   INFORMATION   AND  MISSION  CRITICAL  APPLICATIONS  FROM  THE
 SEGMENTED PORTION OF THE STATE ENTITY'S  INFORMATION  SYSTEM  AND  USING
 SUCH COPIES IN THE STATE ENTITY'S RESTORATION AND RECOVERY PROCESS. UPON
 COMPLETION  OF  SUCH EXERCISE, THE STATE ENTITY SHALL DOCUMENT THE INCI-
 DENT RESPONSE PLAN'S SUCCESSES AND SHORTCOMINGS.
   6. NO PRIVATE RIGHT OF ACTION. NOTHING SET FORTH IN THIS SECTION SHALL
 BE CONSTRUED AS CREATING OR ESTABLISHING A PRIVATE CAUSE OF ACTION.
   § 4. Severability. The provisions of this act shall be  severable  and
 if  any  portion  thereof  or the applicability thereof to any person or
 circumstances shall be held to be invalid, the remainder of this act and
 the application thereof shall not be affected thereby.
   § 5. This act shall take effect immediately.