Senate Bill S10724

                             
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   10724
 
                             I N  S E N A T E
 
                             October 23, 2026
                                ___________
 
 Introduced  by  Sen.  MAY  --  read  twice and ordered printed, and when
   printed to be committed to the Committee on Rules
 
 AN ACT to amend the public authorities law and the public  service  law,
   in relation to establishing the "rural water utility modernization and
   security act"
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Short title. This act shall be known and may  be  cited  as
 the "rural state water utility modernization and security act".
   § 2. Legislative findings and intent. The legislature finds that water
 security  is  an  important  aspect of homeland security, and that safe-
 guarding public health, securing critical infrastructure,  and  ensuring
 equitable  resource  distribution  are  paramount  duties  of the state.
 Further, and with respect to drinking water, the state  has  a  duty  of
 care  that  should  extend  not only to providing clean water but also a
 safe and secure supply of drinking water in rural communities.    Nearly
 ninety  percent of the state's total community water systems serve popu-
 lations under 10,000; the purpose of this act is to focus on such  rural
 systems  because  they  are the most vulnerable to cyber attacks and are
 the most in need of modernization.
   § 3. The public authorities law is amended by  adding  a  new  section
 1285-v to read as follows:
   §  1285-V.  RURAL  WATER UTILITY CYBERSECURITY ACTION PLAN. 1. FOR THE
 PURPOSES OF THIS SECTION, THE TERM "RURAL WATER UTILITY"  SHALL  MEAN  A
 WATER  MANAGEMENT  FACILITY,  A  WATER-WORKS  CORPORATION  AS DEFINED BY
 SECTION TWO OF THE PUBLIC SERVICE LAW, OR OTHER OWNER OR OPERATOR  OF  A
 WATER  SYSTEM  AS  DEFINED  BY  SECTION  TWO  OF THE PUBLIC SERVICE LAW,
 PROVIDING WATER TO TEN THOUSAND PERSONS OR LESS AT DOMESTIC  RESIDENCES,
 SCHOOLS, AND/OR HOSPITALS.
   2.  THE  CORPORATION,  IN  CONSULTATION  WITH THE DIVISION OF HOMELAND
 SECURITY AND EMERGENCY SERVICES, SHALL DEVELOP AN ACTION  PLAN  FOR  THE
 MODERNIZATION AND ENHANCEMENT OF CYBERSECURITY AT ALL RURAL WATER UTILI-
 TIES  IN  THE  STATE. SUCH ACTION PLAN SHALL INCLUDE, BUT NOT BE LIMITED
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD16381-02-6
              

 S. 10724                            2
 
 TO, THE FOLLOWING STEPS TO BE UNDERTAKEN BY RURAL WATER UTILITIES IN THE
 STATE:
   (A)  DISCONNECTION  OF ALL CONTROL DEVICES FROM DIRECT EXPOSURE TO THE
 INTERNET;
   (B) INSTALLATION OF SECURE CYBERSECURITY FIREWALLS AND USE OF  VIRTUAL
 PRIVATE NETWORKS (VPNS);
   (C) REGULARLY UPDATING SYSTEM ACCESS PASSWORDS TO STRONG, UNIQUE CHAR-
 ACTER COMBINATIONS; AND
   (D)  TRAININGS  FOR  STAFF  ON  HOW  TO SAFELY RUN RURAL WATER UTILITY
 PLANTS USING MANUAL BACKUP OPERATIONS.
   3. TRAININGS UNDER PARAGRAPH (D) OF SUBDIVISION TWO  OF  THIS  SECTION
 MAY  INCLUDE  VIDEO  TRAINING  COMPONENTS,  PROVIDED, HOWEVER, THAT SUCH
 TRAININGS INCLUDE AN IN-PERSON FOLLOW UP INSPECTION FOLLOWING SUCH VIDEO
 TRAINING.
   4. THE ACTION PLAN DEVELOPED  PURSUANT  TO  SUBDIVISION  TWO  OF  THIS
 SECTION  SHALL  INITIALLY  BE  DEVELOPED  NO LATER THAN DECEMBER THIRTY-
 FIRST, TWO THOUSAND TWENTY-SEVEN, AND SHALL BE REVIEWED AND  UPDATED  AS
 DEEMED NECESSARY BY THE CORPORATION ANNUALLY THEREAFTER.
   § 4. The public service law is amended by adding a new section 89-q to
 read as follows:
   §  89-Q.  RURAL  WATER UTILITY CYBERSECURITY. 1.   FOR THE PURPOSES OF
 THIS SECTION, THE TERM "RURAL WATER UTILITY" SHALL MEAN ANY  WATER-WORKS
 CORPORATION OR OTHER OWNER OR OPERATOR OF A WATER SYSTEM PROVIDING WATER
 TO  TEN THOUSAND PERSONS OR LESS AT DOMESTIC RESIDENCES, SCHOOLS, AND/OR
 HOSPITALS.
   2. EACH RURAL WATER UTILITY IN THE STATE SHALL  IMPLEMENT  THE  ACTION
 PLAN  DEVELOPED  PURSUANT  TO  SUBDIVISION TWO OF SECTION TWELVE HUNDRED
 EIGHTY-FIVE-V OF THE PUBLIC AUTHORITIES LAW.
   3. EACH RURAL WATER UTILITY SHALL CONDUCT AN INDEPENDENT,  THIRD-PARTY
 CYBERSECURITY  VULNERABILITY  AUDIT  ANNUALLY. THE RESULTS OF SUCH AUDIT
 SHALL BE FILED CONFIDENTIALLY WITH THE NEW YORK STATE DIVISION OF  HOME-
 LAND SECURITY AND EMERGENCY SERVICES.
   4.  IN  THE  EVENT  OF A CYBER BREACH, DATA EXTORTION, OR UNAUTHORIZED
 SYSTEM ACCESS, THE AFFECTED RURAL WATER UTILITY SHALL NOTIFY  THE  DIVI-
 SION  OF  HOMELAND  SECURITY AND EMERGENCY SERVICES AND THE STATE POLICE
 CYBERCRIME UNIT WITHIN TWENTY-FOUR HOURS OF DISCOVERY.
   5. THE NEW YORK STATE DIVISION  OF  HOMELAND  SECURITY  AND  EMERGENCY
 SERVICES SHALL ESTABLISH A SPECIALIZED WATER CYBER-DEFENSE TASK FORCE TO
 PROVIDE FREE TECHNICAL ASSISTANCE, MONITORING TOOLS, AND EMERGENCY REME-
 DIATION SERVICES TO RURAL WATER UTILITIES.
   §  5.  The  public  authorities law is amended by adding a new section
 1285-w to read as follows:
   § 1285-W. RURAL WATER UTILITY FUNDING AND ACCESSIBILITY EXPANSION.  1.
 FOR  THE  PURPOSES OF THIS SECTION, THE TERM "RURAL WATER UTILITY" SHALL
 MEAN ANY WATER-WORKS CORPORATION OR OTHER OWNER OR OPERATOR OF  A  WATER
 SYSTEM PROVIDING WATER TO TEN THOUSAND PERSONS OR LESS AT DOMESTIC RESI-
 DENCES, SCHOOLS, AND/OR HOSPITALS.
   2. THE STRENGTHENING ESSENTIAL CYBERSECURITY FOR UTILITIES AND RESILI-
 ENCY  ENHANCEMENTS  (SECURE)  PROGRAM  ESTABLISHED  AND  OPERATED BY THE
 AUTHORITY OF THE NEW YORK  ENVIRONMENTAL  FACILITIES  CORPORATION  SHALL
 PRIORITIZE  RURAL  WATER  UTILITIES  IN THE DISTRIBUTION OF GRANTS UNDER
 SUCH PROGRAM.
   § 6. Severability. If any clause,  sentence,  paragraph,  subdivision,
 section  or part of this act shall be adjudged by any court of competent
 jurisdiction to be invalid, such judgment shall not affect,  impair,  or
 invalidate the remainder thereof, but shall be confined in its operation
 S. 10724                            3
 
 to the clause, sentence, paragraph, subdivision, section or part thereof
 directly  involved  in the controversy in which such judgment shall have
 been rendered. It is hereby declared to be the intent of the legislature
 that  this  act  would have been enacted even if such invalid provisions
 had not been included herein.
   § 7. This act shall take effect immediately.