S T A T E O F N E W Y O R K
________________________________________________________________________
10728
I N S E N A T E
October 28, 2026
___________
Introduced by Sen. GRIFFO -- read twice and ordered printed, and when
printed to be committed to the Committee on Rules
AN ACT to amend the executive law, in relation to establishing a state-
wide critical infrastructure security, condition and resilience
assessment program
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. Short title. This act shall be known and may be cited as
the "New York critical infrastructure security and resilience act".
§ 2. The executive law is amended by adding a new section 711-d to
read as follows:
§ 711-D. STATEWIDE CRITICAL INFRASTRUCTURE SECURITY, CONDITION AND
RESILIENCE ASSESSMENTS. 1. DEFINITIONS. FOR PURPOSES OF THIS SECTION:
(A) "CRITICAL INFRASTRUCTURE" SHALL MEAN PHYSICAL OR VIRTUAL SYSTEMS,
FACILITIES, ASSETS AND NETWORKS LOCATED WITHIN THE STATE THAT ARE ESSEN-
TIAL TO PUBLIC HEALTH, SAFETY, SECURITY, ECONOMIC STABILITY OR THE
CONTINUITY OF ESSENTIAL GOVERNMENTAL OR COMMUNITY SERVICES, THE INCAPAC-
ITY OR DESTRUCTION OF WHICH WOULD HAVE A SUBSTANTIAL ADVERSE IMPACT UPON
THE STATE OR ANY REGION THEREOF. SUCH INFRASTRUCTURE SHALL INCLUDE, BUT
NOT BE LIMITED TO:
(I) ELECTRIC GENERATION, TRANSMISSION AND DISTRIBUTION FACILITIES;
(II) NATURAL GAS, PETROLEUM AND OTHER ENERGY PRODUCTION, STORAGE AND
TRANSMISSION SYSTEMS;
(III) PUBLIC DRINKING WATER SUPPLIES, WASTEWATER TREATMENT FACILITIES,
WATER DISTRIBUTION SYSTEMS AND RELATED INFRASTRUCTURE;
(IV) HIGHWAYS, BRIDGES, TUNNELS, RAILROADS, AIRPORTS, PORTS AND PUBLIC
TRANSPORTATION SYSTEMS;
(V) TELECOMMUNICATIONS NETWORKS, BROADBAND INFRASTRUCTURE, EMERGENCY
COMMUNICATIONS AND PUBLIC SAFETY ANSWERING POINTS;
(VI) HOSPITALS, EMERGENCY MEDICAL FACILITIES AND OTHER HEALTH CARE
INFRASTRUCTURE ESSENTIAL TO EMERGENCY RESPONSE;
(VII) DAMS, LEVEES, FLOOD CONTROL FACILITIES AND OTHER INFRASTRUCTURE
NECESSARY FOR THE PROTECTION OF LIFE AND PROPERTY;
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD16493-01-6
S. 10728 2
(VIII) GOVERNMENT FACILITIES AND INFORMATION SYSTEMS ESSENTIAL TO THE
CONTINUITY OF GOVERNMENT OPERATIONS; AND
(IX) OTHER INFRASTRUCTURE DESIGNATED BY THE COMMISSIONER AS ESSENTIAL
TO PUBLIC HEALTH, SAFETY, SECURITY OR THE CONTINUITY OF ESSENTIAL
SERVICES.
(B) "COMMISSIONER" SHALL MEAN THE COMMISSIONER OF THE DIVISION OF
HOMELAND SECURITY AND EMERGENCY SERVICES.
(C) "DIVISION" SHALL MEAN THE DIVISION OF HOMELAND SECURITY AND EMER-
GENCY SERVICES.
(D) "RESILIENCE" SHALL MEAN THE ABILITY OF CRITICAL INFRASTRUCTURE TO
ANTICIPATE, WITHSTAND, ADAPT TO, RESPOND TO AND RECOVER FROM NATURAL
DISASTERS, PHYSICAL THREATS, CYBERATTACKS, EQUIPMENT FAILURES, INFRAS-
TRUCTURE DETERIORATION AND OTHER DISRUPTIVE EVENTS.
(E) "INFRASTRUCTURE INTERDEPENDENCY" SHALL MEAN A RELATIONSHIP IN
WHICH THE OPERATION, RELIABILITY OR SECURITY OF ONE CRITICAL INFRASTRUC-
TURE SYSTEM DEPENDS UPON THE CONTINUED OPERATION OF ANOTHER INFRASTRUC-
TURE SYSTEM.
2. STATEWIDE ASSESSMENT PROGRAM. (A) THE COMMISSIONER SHALL ESTABLISH
AND ADMINISTER A STATEWIDE CRITICAL INFRASTRUCTURE SECURITY, CONDITION
AND RESILIENCE ASSESSMENT PROGRAM FOR THE PURPOSE OF IDENTIFYING VULNER-
ABILITIES, EVALUATING INFRASTRUCTURE RELIABILITY AND PREPAREDNESS, AND
DEVELOPING RECOMMENDATIONS TO REDUCE RISKS TO PUBLIC HEALTH, SAFETY,
SECURITY AND ECONOMIC STABILITY. SUCH ASSESSMENT SHALL BE CONDUCTED NOT
LESS THAN ONCE EVERY THREE YEARS.
(B) IN CONDUCTING SUCH ASSESSMENTS, THE COMMISSIONER SHALL CONSULT
WITH APPROPRIATE STATE AGENCIES, AUTHORITIES, MUNICIPALITIES, PUBLIC
UTILITIES, INFRASTRUCTURE OWNERS AND OPERATORS, FEDERAL AGENCIES, EMER-
GENCY MANAGEMENT PERSONNEL AND OTHER RELEVANT STAKEHOLDERS.
(C) THE COMMISSIONER SHALL COORDINATE SUCH ASSESSMENTS WITH EXISTING
FEDERAL, STATE AND LOCAL INSPECTION, REPORTING, SECURITY AND EMERGENCY
PREPAREDNESS PROGRAMS TO THE GREATEST EXTENT PRACTICABLE IN ORDER TO
AVOID UNNECESSARY DUPLICATION OF EFFORTS.
3. SCOPE OF ASSESSMENT. EACH STATEWIDE ASSESSMENT CONDUCTED PURSUANT
TO THIS SECTION SHALL INCLUDE, BUT NOT BE LIMITED TO, AN EVALUATION OF
THE FOLLOWING:
(A) PHYSICAL SECURITY, INCLUDING EXISTING PROTECTIONS AGAINST TERROR-
ISM, SABOTAGE, UNAUTHORIZED ACCESS, VANDALISM AND OTHER DELIBERATE PHYS-
ICAL THREATS TO CRITICAL INFRASTRUCTURE;
(B) CYBERSECURITY, INCLUDING VULNERABILITIES AFFECTING INFORMATION
TECHNOLOGY, OPERATIONAL TECHNOLOGY, INDUSTRIAL CONTROL SYSTEMS, SUPERVI-
SORY CONTROL AND DATA ACQUISITION SYSTEMS, COMMUNICATIONS NETWORKS AND
OTHER DIGITAL SYSTEMS ESSENTIAL TO INFRASTRUCTURE OPERATIONS;
(C) INFRASTRUCTURE CONDITION AND MAINTENANCE, INCLUDING, TO THE EXTENT
SUCH INFORMATION IS AVAILABLE OR MAY LAWFULLY BE OBTAINED, THE AGE,
STRUCTURAL CONDITION, MAINTENANCE NEEDS, EQUIPMENT RELIABILITY, DEFERRED
MAINTENANCE AND ANTICIPATED SERVICE LIFE OF CRITICAL INFRASTRUCTURE;
(D) NATURAL DISASTERS AND ENVIRONMENTAL THREATS, INCLUDING VULNERABIL-
ITIES ARISING FROM FLOODING, SEVERE STORMS, EXTREME TEMPERATURES, WILD-
FIRES, EARTHQUAKES, DROUGHTS AND OTHER NATURAL HAZARDS;
(E) INFRASTRUCTURE INTERDEPENDENCIES, INCLUDING THE POTENTIAL FOR A
DISRUPTION OR FAILURE IN ONE INFRASTRUCTURE SECTOR TO ADVERSELY AFFECT
OTHER ESSENTIAL INFRASTRUCTURE SYSTEMS, INCLUDING CASCADING FAILURES
INVOLVING ELECTRICAL POWER, WATER SUPPLY, TELECOMMUNICATIONS, TRANSPOR-
TATION, HEALTH CARE AND EMERGENCY SERVICES;
(F) EMERGENCY PREPAREDNESS AND RECOVERY, INCLUDING THE ADEQUACY OF
EMERGENCY RESPONSE PROCEDURES, CONTINUITY OF OPERATIONS PLANNING, BACKUP
S. 10728 3
SYSTEMS, EMERGENCY POWER SUPPLIES, ALTERNATIVE SERVICE ARRANGEMENTS AND
RESTORATION CAPABILITIES;
(G) REGIONAL VULNERABILITIES, INCLUDING INFRASTRUCTURE VULNERABILITIES
AFFECTING PARTICULAR GEOGRAPHIC REGIONS, SUCH AS RURAL COMMUNITIES,
MUNICIPALITIES WITH AGING INFRASTRUCTURE, ECONOMICALLY DISTRESSED AREAS
AND COMMUNITIES DEPENDENT UPON LIMITED OR SINGLE-SOURCE INFRASTRUCTURE
SYSTEMS;
(H) WORKFORCE AND OPERATIONAL READINESS, INCLUDING THE AVAILABILITY OF
QUALIFIED PERSONNEL, TECHNICAL RESOURCES, TRAINING AND OPERATIONAL
CAPACITY NECESSARY TO MAINTAIN, SECURE AND RESTORE ESSENTIAL INFRASTRUC-
TURE SYSTEMS; AND
(I) EMERGING THREATS, INCLUDING TECHNOLOGICAL, SECURITY, ENVIRONMENTAL
AND OTHER EMERGING RISKS THAT MAY REASONABLY BE EXPECTED TO AFFECT CRIT-
ICAL INFRASTRUCTURE WITHIN THE STATE.
4. INTERAGENCY COORDINATION. (A) IN CARRYING OUT THE PROVISIONS OF
THIS SECTION, THE COMMISSIONER SHALL CONSULT WITH, AS APPROPRIATE:
(I) THE DEPARTMENT OF PUBLIC SERVICE;
(II) THE DEPARTMENT OF ENVIRONMENTAL CONSERVATION;
(III) THE DEPARTMENT OF HEALTH;
(IV) THE DEPARTMENT OF TRANSPORTATION;
(V) THE OFFICE OF INFORMATION TECHNOLOGY SERVICES;
(VI) THE NEW YORK STATE ENERGY RESEARCH AND DEVELOPMENT AUTHORITY;
(VII) THE NEW YORK POWER AUTHORITY;
(VIII) THE DEPARTMENT OF STATE;
(IX) THE METROPOLITAN TRANSPORTATION AUTHORITY;
(X) THE THRUWAY AUTHORITY; AND
(XI) OTHER STATE AGENCIES, PUBLIC AUTHORITIES, LOCAL GOVERNMENTS AND
INFRASTRUCTURE OWNERS OR OPERATORS AS THE COMMISSIONER DEEMS APPROPRI-
ATE.
(B) STATE AGENCIES AND PUBLIC AUTHORITIES SHALL, TO THE EXTENT PERMIT-
TED BY LAW, COOPERATE WITH THE DIVISION IN CONDUCTING SUCH ASSESSMENTS
AND SHALL PROVIDE RELEVANT EXISTING REPORTS, PLANS, RECORDS AND OTHER
INFORMATION REASONABLY NECESSARY TO CARRY OUT THE PROVISIONS OF THIS
SECTION.
(C) THE COMMISSIONER MAY ENTER INTO AGREEMENTS WITH FEDERAL AGENCIES,
INSTITUTIONS OF HIGHER EDUCATION, RESEARCH INSTITUTIONS AND OTHER QUALI-
FIED ENTITIES TO OBTAIN TECHNICAL EXPERTISE OR ASSISTANCE.
(D) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO SUPERSEDE THE LAWFUL
JURISDICTION OF ANY STATE OR FEDERAL REGULATORY AGENCY OR TO REQUIRE AN
INFRASTRUCTURE OWNER OR OPERATOR TO DISCLOSE INFORMATION PROHIBITED FROM
DISCLOSURE BY FEDERAL LAW.
5. IDENTIFICATION AND PRIORITIZATION OF VULNERABILITIES. (A) THE
COMMISSIONER SHALL ESTABLISH A METHODOLOGY FOR IDENTIFYING AND PRIOR-
ITIZING INFRASTRUCTURE VULNERABILITIES BASED UPON FACTORS INCLUDING, BUT
NOT LIMITED TO:
(I) THE LIKELIHOOD AND POTENTIAL CONSEQUENCES OF INFRASTRUCTURE FAIL-
URE;
(II) RISKS TO HUMAN LIFE, PUBLIC HEALTH AND SAFETY;
(III) THE POPULATION AND GEOGRAPHIC AREA DEPENDENT UPON THE AFFECTED
INFRASTRUCTURE;
(IV) THE POTENTIAL FOR CASCADING FAILURES AFFECTING OTHER INFRASTRUC-
TURE SECTORS;
(V) THE AVAILABILITY OF REDUNDANT SYSTEMS OR ALTERNATIVE SERVICES;
(VI) THE AGE, PHYSICAL CONDITION AND MAINTENANCE HISTORY OF THE
INFRASTRUCTURE;
S. 10728 4
(VII) THE ESTIMATED TIME REQUIRED TO RESTORE ESSENTIAL SERVICES
FOLLOWING A DISRUPTION; AND
(VIII) THE POTENTIAL ECONOMIC CONSEQUENCES OF AN INTERRUPTION IN
SERVICE.
(B) THE COMMISSIONER SHALL IDENTIFY CATEGORIES OF INFRASTRUCTURE
VULNERABILITIES REQUIRING IMMEDIATE, NEAR-TERM OR LONG-TERM ATTENTION
AND DEVELOP RECOMMENDATIONS FOR MITIGATING SUCH VULNERABILITIES. SUCH
RECOMMENDATIONS MAY INCLUDE, BUT NEED NOT BE LIMITED TO: PROPOSED CAPI-
TAL IMPROVEMENTS, MAINTENANCE MEASURES, SECURITY ENHANCEMENTS, OPERA-
TIONAL CHANGES, WORKFORCE INVESTMENTS, EMERGENCY PREPAREDNESS IMPROVE-
MENTS AND LEGISLATIVE OR REGULATORY ACTIONS.
6. STATEWIDE REPORT. (A) WITHIN EIGHTEEN MONTHS AFTER THE EFFECTIVE
DATE OF THIS SECTION, AND EVERY THREE YEARS THEREAFTER, THE COMMISSIONER
SHALL PREPARE A STATEWIDE CRITICAL INFRASTRUCTURE SECURITY, CONDITION
AND RESILIENCE REPORT AND SHALL SUBMIT SUCH REPORT TO THE GOVERNOR, THE
TEMPORARY PRESIDENT OF THE SENATE, THE SPEAKER OF THE ASSEMBLY, THE
MINORITY LEADER OF THE SENATE AND THE MINORITY LEADER OF THE ASSEMBLY.
(B) SUCH REPORT SHALL INCLUDE, AT A MINIMUM:
(I) A SUMMARY OF THE OVERALL CONDITION, SECURITY AND RESILIENCE OF THE
STATE'S CRITICAL INFRASTRUCTURE;
(II) AN ASSESSMENT OF SIGNIFICANT STATEWIDE AND REGIONAL INFRASTRUC-
TURE VULNERABILITIES;
(III) AN EVALUATION OF RISKS ASSOCIATED WITH AGING INFRASTRUCTURE,
DEFERRED MAINTENANCE AND INFRASTRUCTURE INTERDEPENDENCIES;
(IV) AN ASSESSMENT OF EXISTING INFRASTRUCTURE PROTECTION, EMERGENCY
PREPAREDNESS AND DISASTER RECOVERY PROGRAMS;
(V) RECOMMENDATIONS FOR IMPROVING PHYSICAL SECURITY, CYBERSECURITY,
MAINTENANCE, INFRASTRUCTURE RELIABILITY AND EMERGENCY RESPONSE CAPABILI-
TIES;
(VI) IDENTIFICATION OF INFRASTRUCTURE INVESTMENT PRIORITIES, INCLUDING
ESTIMATED COSTS WHERE REASONABLY ASCERTAINABLE;
(VII) RECOMMENDATIONS FOR LEGISLATIVE, REGULATORY OR ADMINISTRATIVE
CHANGES; AND
(VIII) AN EVALUATION OF PROGRESS MADE IN ADDRESSING VULNERABILITIES
IDENTIFIED IN PRIOR REPORTS.
(C) THE COMMISSIONER SHALL PREPARE A PUBLIC VERSION OF THE REPORT
CONTAINING STATEWIDE FINDINGS, GENERAL INFRASTRUCTURE CONDITIONS, NON-
SENSITIVE RECOMMENDATIONS AND OTHER INFORMATION SUITABLE FOR PUBLIC
DISCLOSURE.
(D) THE COMMISSIONER SHALL PREPARE A SEPARATE CONFIDENTIAL ANNEX
CONTAINING SENSITIVE SECURITY INFORMATION, FACILITY-SPECIFIC VULNERABIL-
ITIES AND OTHER INFORMATION THE DISCLOSURE OF WHICH COULD JEOPARDIZE
PUBLIC SAFETY OR THE SECURITY OF CRITICAL INFRASTRUCTURE. SUCH CONFI-
DENTIAL ANNEX SHALL BE MAINTAINED, TRANSMITTED AND DISCLOSED ONLY IN
ACCORDANCE WITH APPLICABLE FEDERAL AND STATE LAW, INCLUDING THE PUBLIC
OFFICERS LAW AND ALL APPLICABLE PROTECTIONS GOVERNING SENSITIVE SECURITY
AND CRITICAL INFRASTRUCTURE INFORMATION.
(E) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO REQUIRE PUBLIC
DISCLOSURE OF INFORMATION OTHERWISE EXEMPT FROM DISCLOSURE UNDER STATE
OR FEDERAL LAW.
7. ANNUAL PROGRESS UPDATES. IN EACH YEAR IN WHICH A COMPREHENSIVE
STATEWIDE ASSESSMENT IS NOT REQUIRED, THE COMMISSIONER SHALL PROVIDE A
PROGRESS UPDATE TO THE GOVERNOR AND LEGISLATURE IDENTIFYING: (A) SIGNIF-
ICANT DEVELOPMENTS AFFECTING STATEWIDE CRITICAL INFRASTRUCTURE SECURITY
AND RESILIENCE; (B) PROGRESS IN ADDRESSING PREVIOUSLY IDENTIFIED VULNER-
ABILITIES; (C) NEWLY IDENTIFIED RISKS REQUIRING LEGISLATIVE OR ADMINIS-
S. 10728 5
TRATIVE ATTENTION; AND (D) CHANGES IN STATEWIDE INFRASTRUCTURE PREPARED-
NESS AND RECOVERY CAPABILITIES. SUCH PROGRESS UPDATES MAY BE
INCORPORATED INTO AN EXISTING ANNUAL REPORT SUBMITTED BY THE DIVISION,
PROVIDED THAT THE REQUIREMENTS OF THIS SUBDIVISION ARE SATISFIED.
8. LIMITATION OF AUTHORITY; CONFIDENTIALITY. (A) NOTHING IN THIS
SECTION SHALL BE CONSTRUED TO AUTHORIZE THE DIVISION TO COMPEL ACCESS TO
PRIVATELY OWNED INFRASTRUCTURE, CONDUCT INTRUSIVE PHYSICAL INSPECTIONS,
OR OBTAIN PROTECTED SECURITY, PROPRIETARY OR OPERATIONAL INFORMATION
BEYOND THE AUTHORITY OTHERWISE PROVIDED BY LAW.
(B) THE COMMISSIONER SHALL UTILIZE EXISTING ASSESSMENTS, INSPECTION
REPORTS, REGULATORY FILINGS AND OTHER AVAILABLE INFORMATION WHENEVER
PRACTICABLE, CONSISTENT WITH THE CONFIDENTIALITY REQUIREMENTS APPLICABLE
TO SUCH INFORMATION.
(C) INFORMATION OBTAINED PURSUANT TO THIS SECTION SHALL BE MAINTAINED
IN ACCORDANCE WITH APPLICABLE STATE AND FEDERAL CONFIDENTIALITY REQUIRE-
MENTS AND SHALL BE USED SOLELY FOR LAWFUL GOVERNMENTAL PURPOSES RELATING
TO INFRASTRUCTURE SECURITY, CONDITION, RESILIENCE, EMERGENCY MANAGEMENT
AND PUBLIC SAFETY.
(D) NOTHING IN THIS SECTION SHALL BE CONSTRUED TO DIMINISH OR OTHER-
WISE ALTER THE DUTIES, RESPONSIBILITIES OR AUTHORITIES OF THE DIVISION
UNDER SECTIONS SEVEN HUNDRED NINE, SEVEN HUNDRED ELEVEN-B, SEVEN HUNDRED
THIRTEEN, SEVEN HUNDRED FOURTEEN AND SEVEN HUNDRED SIXTEEN OF THIS ARTI-
CLE, OR ANY OTHER PROVISION OF LAW.
9. RULES AND REGULATIONS. THE COMMISSIONER MAY PROMULGATE SUCH RULES
AND REGULATIONS AS MAY BE NECESSARY TO IMPLEMENT THE PROVISIONS OF THIS
SECTION.
§ 3. This act shall take effect on the one hundred eightieth day after
it shall have become a law. Effective immediately, the addition, amend-
ment and/or repeal of any rule or regulation necessary for the implemen-
tation of this act on its effective date are authorized to be made and
completed on or before such effective date.
