S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   3448
 
                        2017-2018 Regular Sessions
 
                           I N  A S S E M B L Y
 
                             January 27, 2017
                                ___________
 
 Introduced  by  M.  of  A.  DenDEKKER  --  read once and referred to the
   Committee on Governmental Operations
 
 AN ACT to amend the executive law,  in  relation  to  a  cyber  security
   initiative
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:

   Section 1. The executive law is amended by adding a new section 719 to
 read as follows:
   § 719. NEW YORK STATE CYBER SECURITY INITIATIVE.  1. LEGISLATIVE FIND-
 INGS. THE LEGISLATURE FINDS AND DECLARES THAT REPEATED CYBER  INTRUSIONS
 INTO CRITICAL INFRASTRUCTURE, EFFECTING GOVERNMENT, PRIVATE SECTOR BUSI-
 NESS,  AND CITIZENS OF THE STATE OF NEW YORK, HAVE DEMONSTRATED THE NEED
 FOR IMPROVED CYBER SECURITY.
   THE LEGISLATURE FURTHER FINDS AND  DECLARES  THAT  THIS  CYBER  THREAT
 CONTINUES TO GROW AND REPRESENTS ONE OF THE MOST SERIOUS PUBLIC SECURITY
 CHALLENGES  THAT  NEW  YORK MUST CONFRONT. MOREOVER, THE SECURITY OF THE
 STATE OF NEW YORK DEPENDS  ON  THE  RELIABLE  FUNCTIONING  OF  NEW  YORK
 STATE'S  CRITICAL INFRASTRUCTURE, AND PRIVATE SECTOR BUSINESS INTERESTS,
 AS WELL AS THE PROTECTION OF THE FINANCES AND  INDIVIDUAL  LIBERTIES  OF
 EVERY CITIZEN, IN THE FACE OF SUCH THREATS.
   THE  LEGISLATURE  ADDITIONALLY  FINDS AND DECLARES THAT TO ENHANCE THE
 SECURITY, PROTECTION AND RESILIENCE OF NEW YORK STATE'S CRITICAL INFRAS-
 TRUCTURE,  AND  PRIVATE  SECTOR  BUSINESS  INTERESTS,  AS  WELL  AS  THE
 PROTECTION  OF  THE  FINANCES AND INDIVIDUAL LIBERTIES OF EVERY CITIZEN,
 THE STATE OF NEW YORK MUST PROMOTE A CYBER ENVIRONMENT  THAT  ENCOURAGES
 EFFICIENCY,  INNOVATION,  AND  ECONOMIC PROSPERITY, AND THAT CAN OPERATE
 WITH SAFETY, SECURITY,  BUSINESS  CONFIDENTIALITY,  PRIVACY,  AND  CIVIL
 LIBERTY.
   THE  LEGISLATURE FURTHER FINDS AND DECLARES THAT TO CREATE SUCH A SAFE
 AND SECURE CYBER ENVIRONMENT FOR GOVERNMENT, PRIVATE SECTOR BUSINESS AND
 INDIVIDUAL CITIZENS, NEW YORK MUST ADVANCE, IN ADDITION TO  ITS  CURRENT
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
              

                                                            LBD02129-01-7

 A. 3448                             2
 
 EFFORTS  IN THIS FIELD, A NEW YORK STATE CYBER SECURITY INITIATIVE, THAT
 ESTABLISHES A NEW YORK STATE CYBER SECURITY ADVISORY BOARD; A  NEW  YORK
 STATE  CYBER  SECURITY PARTNERSHIP PROGRAM WITH THE OWNERS AND OPERATORS
 OF CRITICAL INFRASTRUCTURE, PRIVATE SECTOR BUSINESS, ACADEMIA, AND INDI-
 VIDUAL  CITIZENS  TO IMPROVE, DEVELOP AND IMPLEMENT RISK-BASED STANDARDS
 FOR GOVERNMENT, PRIVATE SECTOR BUSINESSES AND INDIVIDUAL CITIZENS; AND A
 NEW YORK STATE CYBER SECURITY INFORMATION SHARING PROGRAM.
   2. CRITICAL INFRASTRUCTURE AND INFORMATION SYSTEMS. AS  USED  IN  THIS
 SECTION,  THE  TERM  "CRITICAL  INFRASTRUCTURE  AND INFORMATION SYSTEMS"
 SHALL MEAN ALL SYSTEMS AND ASSETS, WHETHER PHYSICAL OR VIRTUAL, SO VITAL
 TO THE GOVERNMENT, PRIVATE SECTOR BUSINESSES AND INDIVIDUAL CITIZENS  OF
 THE STATE OF NEW YORK THAT THE INCAPACITY OR DESTRUCTION OF SUCH SYSTEMS
 AND ASSETS WOULD HAVE A DEBILITATING IMPACT TO THE SECURITY, ECONOMY, OR
 PUBLIC  HEALTH OF THE INDIVIDUAL CITIZENS, GOVERNMENT, OR PRIVATE SECTOR
 BUSINESSES OF THE STATE OF NEW YORK.
   3. NEW YORK STATE CYBER SECURITY ADVISORY BOARD. (A)  THERE  SHALL  BE
 WITHIN  THE  DIVISION OF HOMELAND SECURITY AND EMERGENCY SERVICES, A NEW
 YORK STATE CYBER SECURITY ADVISORY BOARD, WHICH SHALL ADVISE THE  GOVER-
 NOR  AND  THE  LEGISLATURE  ON  DEVELOPMENTS  IN CYBER SECURITY AND MAKE
 RECOMMENDATIONS FOR PROTECTING THE STATE'S CRITICAL  INFRASTRUCTURE  AND
 INFORMATION SYSTEMS.
   (B) THE BOARD MEMBERS SHALL CONSIST OF ELEVEN MEMBERS APPOINTED BY THE
 GOVERNOR, WITH THREE MEMBERS APPOINTED UPON RECOMMENDATION OF THE TEMPO-
 RARY  PRESIDENT OF THE SENATE, AND THREE MEMBERS APPOINTED AT THE RECOM-
 MENDATION OF THE SPEAKER OF THE ASSEMBLY. ALL MEMBERS SO APPOINTED SHALL
 HAVE EXPERTISE IN CYBER SECURITY, TELECOMMUNICATIONS,  INTERNET  SERVICE
 DELIVERY, PUBLIC PROTECTION, COMPUTER SYSTEMS AND/OR COMPUTER NETWORKS.
   (C)  THE  BOARD  SHALL  INVESTIGATE,  DISCUSS AND MAKE RECOMMENDATIONS
 CONCERNING CYBER SECURITY ISSUES INVOLVING BOTH THE PUBLIC  AND  PRIVATE
 SECTORS  AND  WHAT STEPS CAN BE TAKEN BY NEW YORK STATE TO PROTECT CRIT-
 ICAL  CYBER  INFRASTRUCTURE,   FINANCIAL   SYSTEMS,   TELECOMMUNICATIONS
 NETWORKS,  ELECTRICAL  GRIDS,  SECURITY SYSTEMS, FIRST RESPONDER SYSTEMS
 AND  INFRASTRUCTURE,  PHYSICAL  INFRASTRUCTURE  SYSTEMS,  TRANSPORTATION
 SYSTEMS,  AND SUCH OTHER AND FURTHER SECTORS OF STATE GOVERNMENT AND THE
 PRIVATE SECTOR AS THE ADVISORY BOARD SHALL DEEM PRUDENT.
   (D) THE PURPOSE OF THE ADVISORY BOARD SHALL BE TO PROMOTE THE DEVELOP-
 MENT OF INNOVATIVE, ACTIONABLE POLICIES TO ENSURE THAT NEW YORK STATE IS
 IN THE FOREFRONT OF PUBLIC CYBER SECURITY DEFENSE.
   (E) THE MEMBERS OF THE ADVISORY BOARD SHALL  RECEIVE  NO  COMPENSATION
 FOR  THEIR  SERVICES, BUT MAY RECEIVE ACTUAL AND NECESSARY EXPENSES, AND
 SHALL NOT BE DISQUALIFIED FOR HOLDING ANY OTHER PUBLIC OFFICE OR EMPLOY-
 MENT BY MEANS OF THEIR SERVICE AS A MEMBER OF THE ADVISORY BOARD.
   (F) THE ADVISORY BOARD SHALL BE ENTITLED TO REQUEST AND  RECEIVE,  AND
 SHALL BE PROVIDED WITH, SUCH FACILITIES, RESOURCES AND DATA OF ANY AGEN-
 CY, DEPARTMENT, DIVISION, BOARD, BUREAU, COMMISSION, OR PUBLIC AUTHORITY
 OF  THE  STATE,  AS  THEY  MAY REASONABLY REQUEST, TO CARRY OUT PROPERLY
 THEIR POWERS, DUTIES AND PURPOSE.
   4. NEW YORK STATE CYBER  SECURITY  INFORMATION  SHARING  AND  ANALYSIS
 PROGRAM.  (A)  THE DIVISION OF HOMELAND SECURITY AND EMERGENCY SERVICES,
 IN CONSULTATION WITH THE DIVISION OF THE STATE POLICE, THE STATE  OFFICE
 OF  INFORMATION TECHNOLOGY SERVICES, AND THE CENTER FOR INTERNET SECURI-
 TY, SHALL ESTABLISH, WITHIN SIXTY DAYS OF THE  EFFECTIVE  DATE  OF  THIS
 SECTION,  A  VOLUNTARY NEW YORK STATE CYBER SECURITY INFORMATION SHARING
 AND ANALYSIS PROGRAM.
   (B) IT SHALL BE THE PURPOSE OF  THE  NEW  YORK  STATE  CYBER  SECURITY
 INFORMATION SHARING AND ANALYSIS PROGRAM TO INCREASE THE VOLUME, TIMELI-

 A. 3448                             3
 
 NESS, AND QUALITY OF CYBER THREAT INFORMATION SHARED WITH NEW YORK STATE
 PUBLIC  AND  PRIVATE  SECTOR  ENTITIES SO THAT THESE ENTITIES MAY BETTER
 PROTECT AND DEFEND THEMSELVES AGAINST CYBER THREATS AND TO  PROMOTE  THE
 DEVELOPMENT  OF EFFECTIVE DEFENSES AND STRATEGIES TO COMBAT, AND PROTECT
 AGAINST, CYBER THREATS AND ATTACKS.
   (C) TO FACILITATE THE PURPOSES OF THE NEW YORK  STATE  CYBER  SECURITY
 INFORMATION SHARING AND ANALYSIS PROGRAM, THE DIVISION OF HOMELAND SECU-
 RITY AND EMERGENCY SERVICES, SHALL PROMULGATE REGULATIONS, IN ACCORDANCE
 WITH THE PROVISIONS OF THIS SUBDIVISION.
   (D) THE REGULATIONS SHALL PROVIDE FOR THE TIMELY PRODUCTION OF UNCLAS-
 SIFIED  REPORTS  OF  CYBER  THREATS TO NEW YORK STATE AND ITS PUBLIC AND
 PRIVATE SECTOR ENTITIES, INCLUDING  THREATS  THAT  IDENTIFY  A  SPECIFIC
 TARGETED ENTITY.
   (E) THE REGULATIONS SHALL ADDRESS THE NEED TO PROTECT INTELLIGENCE AND
 LAW  ENFORCEMENT  SOURCES,  METHODS, OPERATIONS, AND INVESTIGATIONS, AND
 SHALL FURTHER ESTABLISH A PROCESS THAT RAPIDLY DISSEMINATES THE  REPORTS
 PRODUCED  PURSUANT  TO  PARAGRAPH  (D)  OF THIS SUBDIVISION, TO BOTH ANY
 TARGETED ENTITY AS WELL AS SUCH OTHER AND  FURTHER  PUBLIC  AND  PRIVATE
 ENTITIES AS THE DIVISION SHALL DEEM NECESSARY TO ADVANCE THE PURPOSES OF
 THIS SUBDIVISION.
   (F)  THE  REGULATIONS SHALL PROVIDE FOR PROTECTIONS FROM LIABILITY FOR
 ENTITIES SHARING AND RECEIVING INFORMATION WITH THE NEW YORK STATE CYBER
 SECURITY INFORMATION AND ANALYSIS PROGRAM, SO LONG AS THE  ENTITY  ACTED
 IN GOOD FAITH.
   (G)  THE REGULATIONS SHALL FURTHER ESTABLISH A SYSTEM FOR TRACKING THE
 PRODUCTION, DISSEMINATION, AND DISPOSITION OF THE  REPORTS  PRODUCED  IN
 ACCORDANCE WITH THE PROVISIONS OF THIS SUBDIVISION.
   (H)  THE  REGULATIONS  SHALL ALSO ESTABLISH AN ENHANCED CYBER SECURITY
 SERVICES PROGRAM, WITHIN NEW YORK  STATE,  TO  PROVIDE  FOR  PROCEDURES,
 METHODS  AND  DIRECTIVES,  FOR  A VOLUNTARY INFORMATION SHARING PROGRAM,
 THAT WILL PROVIDE CYBER THREAT AND TECHNICAL INFORMATION COLLECTED  FROM
 BOTH  PUBLIC  AND  PRIVATE  SECTOR  ENTITIES, TO SUCH PRIVATE AND PUBLIC
 SECTOR ENTITIES AS THE DIVISION DEEMS PRUDENT, TO ADVISE ELIGIBLE  CRIT-
 ICAL INFRASTRUCTURE COMPANIES OR COMMERCIAL SERVICE PROVIDERS THAT OFFER
 SECURITY  SERVICES  TO CRITICAL INFRASTRUCTURE ON CYBER SECURITY THREATS
 AND DEFENSE MEASURES.
   (I) THE REGULATIONS SHALL ALSO SEEK TO DEVELOP STRATEGIES TO  MAXIMIZE
 THE  UTILITY  OF CYBER THREAT INFORMATION SHARING BETWEEN AND ACROSS THE
 PRIVATE AND PUBLIC SECTORS, AND SHALL FURTHER SEEK TO PROMOTE THE USE OF
 PRIVATE AND PUBLIC SECTOR SUBJECT MATTER EXPERTS TO ADDRESS CYBER  SECU-
 RITY  NEEDS IN NEW YORK STATE, WITH THESE SUBJECT MATTER EXPERTS PROVID-
 ING ADVICE REGARDING THE CONTENT, STRUCTURE, AND  TYPES  OF  INFORMATION
 MOST  USEFUL TO CRITICAL INFRASTRUCTURE OWNERS AND OPERATORS IN REDUCING
 AND MITIGATING CYBER RISKS.
   (J) THE REGULATIONS SHALL FURTHER SEEK  TO  ESTABLISH  A  CONSULTATIVE
 PROCESS  TO  COORDINATE  IMPROVEMENTS  TO THE CYBER SECURITY OF CRITICAL
 INFRASTRUCTURE, WHERE AS PART OF THE CONSULTATIVE  PROCESS,  THE  PUBLIC
 AND  PRIVATE ENTITIES OF THE STATE OF NEW YORK SHALL ENGAGE AND CONSIDER
 THE ADVICE OF THE DIVISION OF HOMELAND SECURITY AND EMERGENCY  SERVICES,
 THE  DIVISION OF THE STATE POLICE, THE STATE OFFICE OF INFORMATION TECH-
 NOLOGY SERVICES, THE CENTER FOR INTERNET SECURITY, THE  NEW  YORK  STATE
 CYBER SECURITY ADVISORY BOARD, THE PROGRAMS ESTABLISHED BY THIS SUBDIVI-
 SION,  AND  SUCH  OTHER  AND FURTHER PRIVATE AND PUBLIC SECTOR ENTITIES,
 UNIVERSITIES, AND CYBER SECURITY EXPERTS AS  THE  DIVISION  OF  HOMELAND
 SECURITY AND EMERGENCY SERVICES MAY DEEM PRUDENT.

 A. 3448                             4
 
   (K)  THE REGULATIONS SHALL FURTHER SEEK TO ESTABLISH A BASELINE FRAME-
 WORK TO REDUCE CYBER RISK TO CRITICAL INFRASTRUCTURE, AND SHALL SEEK  TO
 HAVE  THE  DIVISION  OF  HOMELAND  SECURITY  AND  EMERGENCY SERVICES, IN
 CONSULTATION WITH THE DIVISION OF STATE  POLICE,  THE  STATE  OFFICE  OF
 INFORMATION  TECHNOLOGY  SERVICES, AND THE CENTER FOR INTERNET SECURITY,
 LEAD THE DEVELOPMENT OF A VOLUNTARY FRAMEWORK TO REDUCE CYBER  RISKS  TO
 CRITICAL  INFRASTRUCTURE,  TO  BE KNOWN AS THE CYBER SECURITY FRAMEWORK,
 WHICH SHALL:
   (I) INCLUDE A SET OF STANDARDS, METHODOLOGIES, PROCEDURES,  AND  PROC-
 ESSES  THAT  ALIGN  POLICY,  BUSINESS,  AND  TECHNOLOGICAL APPROACHES TO
 ADDRESS CYBER RISKS;
   (II) INCORPORATE VOLUNTARY CONSENSUS STANDARDS AND INDUSTRY BEST PRAC-
 TICES TO THE FULLEST EXTENT POSSIBLE;
   (III) PROVIDE A PRIORITIZED, FLEXIBLE, REPEATABLE,  PERFORMANCE-BASED,
 AND COST-EFFECTIVE APPROACH, INCLUDING INFORMATION SECURITY MEASURES AND
 CONTROLS,  TO HELP OWNERS AND OPERATORS OF CRITICAL INFRASTRUCTURE IDEN-
 TIFY, ASSESS, AND MANAGE CYBER RISK;
   (IV) FOCUS ON IDENTIFYING CROSS-SECTOR SECURITY STANDARDS  AND  GUIDE-
 LINES APPLICABLE TO CRITICAL INFRASTRUCTURE;
   (V)  IDENTIFY  AREAS  FOR IMPROVEMENT THAT SHOULD BE ADDRESSED THROUGH
 FUTURE COLLABORATION WITH PARTICULAR  SECTORS  AND  STANDARDS-DEVELOPING
 ORGANIZATIONS;
   (VI)  ENABLE  TECHNICAL  INNOVATION  AND  ACCOUNT  FOR  ORGANIZATIONAL
 DIFFERENCES, TO PROVIDE GUIDANCE THAT IS  TECHNOLOGY  NEUTRAL  AND  THAT
 ENABLES  CRITICAL  INFRASTRUCTURE  SECTORS TO BENEFIT FROM A COMPETITIVE
 MARKET FOR PRODUCTS AND SERVICES THAT MEET THE STANDARDS, METHODOLOGIES,
 PROCEDURES, AND PROCESSES DEVELOPED TO ADDRESS CYBER RISKS;
   (VII) INCLUDE GUIDANCE FOR MEASURING THE PERFORMANCE OF AN  ENTITY  IN
 IMPLEMENTING THE CYBER SECURITY FRAMEWORK;
   (VIII)  INCLUDE  METHODOLOGIES TO IDENTIFY AND MITIGATE IMPACTS OF THE
 CYBER SECURITY FRAMEWORK AND ASSOCIATED INFORMATION SECURITY MEASURES OR
 CONTROLS ON BUSINESS CONFIDENTIALITY, AND TO PROTECT INDIVIDUAL  PRIVACY
 AND CIVIL LIBERTIES; AND
   (IX)  ENGAGE IN THE REVIEW OF THREAT AND VULNERABILITY INFORMATION AND
 TECHNICAL EXPERTISE.
   (L) THE REGULATIONS SHALL ADDITIONALLY ESTABLISH A VOLUNTARY  CRITICAL
 INFRASTRUCTURE  CYBER  SECURITY  PROGRAM  TO SUPPORT THE ADOPTION OF THE
 CYBER SECURITY FRAMEWORK BY OWNERS AND OPERATORS OF CRITICAL INFRASTRUC-
 TURE AND ANY OTHER INTERESTED ENTITIES, WHERE UNDER THIS PROGRAM  IMPLE-
 MENTATION  GUIDANCE  OR  SUPPLEMENTAL  MATERIALS  WOULD  BE DEVELOPED TO
 ADDRESS SECTOR-SPECIFIC RISKS AND OPERATING ENVIRONMENTS, AND  RECOMMEND
 LEGISLATION FOR ENACTMENT TO ADDRESS CYBER SECURITY ISSUES.
   (M)  IN DEVELOPING THE NEW YORK STATE CYBER SECURITY INFORMATION SHAR-
 ING AND ANALYSIS PROGRAM IN  ACCORDANCE  WITH  THE  PROVISIONS  OF  THIS
 SUBDIVISION,  THE  DIVISION OF HOMELAND SECURITY AND EMERGENCY SERVICES,
 IN CONSULTATION WITH THE DIVISION OF STATE POLICE, THE STATE  OFFICE  OF
 INFORMATION  TECHNOLOGY  SERVICES, AND THE CENTER FOR INTERNET SECURITY,
 SHALL PRODUCE AND SUBMIT A REPORT, TO THE GOVERNOR, THE TEMPORARY PRESI-
 DENT OF THE SENATE, AND THE SPEAKER OF THE ASSEMBLY, MAKING  RECOMMENDA-
 TIONS  ON  THE  FEASIBILITY,  SECURITY  BENEFITS, AND RELATIVE MERITS OF
 INCORPORATING SECURITY STANDARDS INTO ACQUISITION PLANNING AND  CONTRACT
 ADMINISTRATION.  SUCH  REPORT  SHALL  FURTHER  ADDRESS WHAT STEPS CAN BE
 TAKEN TO HARMONIZE AND MAKE CONSISTENT EXISTING PROCUREMENT REQUIREMENTS
 RELATED TO CYBER SECURITY AND THE FEASIBILITY  OF  INCLUDING  RISK-BASED
 SECURITY STANDARDS INTO PROCUREMENT AND CONTRACT ADMINISTRATION.

 A. 3448                             5
 
   5.  NEW YORK STATE CYBER SECURITY CRITICAL INFRASTRUCTURE RISK ASSESS-
 MENT REPORT.  (A)  THE  DIVISION  OF  HOMELAND  SECURITY  AND  EMERGENCY
 SERVICES,  IN  CONSULTATION WITH THE DIVISION OF STATE POLICE, THE STATE
 OFFICE OF INFORMATION TECHNOLOGY SERVICES, AND THE CENTER  FOR  INTERNET
 SECURITY,  WITHIN  ONE HUNDRED TWENTY DAYS OF THE EFFECTIVE DATE OF THIS
 SECTION, SHALL PRODUCE A NEW YORK STATE CYBER SECURITY CRITICAL  INFRAS-
 TRUCTURE RISK ASSESSMENT REPORT.
   (B)  THE  PRODUCTION  OF  THE  NEW  YORK STATE CYBER SECURITY CRITICAL
 INFRASTRUCTURE RISK ASSESSMENT REPORT SHALL USE A RISK-BASED APPROACH TO
 IDENTIFY CRITICAL INFRASTRUCTURE WHERE A CYBER SECURITY  INCIDENT  COULD
 REASONABLY  RESULT  IN  CATASTROPHIC  REGIONAL  OR STATE-WIDE EFFECTS ON
 PUBLIC HEALTH OR  SAFETY,  ECONOMIC  DISTRESS,  AND/OR  THREATEN  PUBLIC
 PROTECTION OF THE PEOPLE AND/OR PROPERTY OF NEW YORK STATE.
   (C)  THE  PRODUCTION  OF THE REPORT SHALL FURTHER USE THE CONSULTATIVE
 PROCESS AND DRAW UPON THE EXPERTISE OF AND ADVICE  OF  THE  DIVISION  OF
 HOMELAND  SECURITY AND EMERGENCY SERVICES, THE DIVISION OF STATE POLICE,
 THE STATE OFFICE OF INFORMATION  TECHNOLOGY  SERVICES,  THE  CENTER  FOR
 INTERNET SECURITY, THE NEW YORK STATE CYBER SECURITY ADVISORY BOARD, THE
 PROGRAMS ESTABLISHED BY THIS SECTION, AND SUCH OTHER AND FURTHER PRIVATE
 AND  PUBLIC SECTOR ENTITIES, UNIVERSITIES, AND CYBER SECURITY EXPERTS AS
 THE DIVISION OF  HOMELAND  SECURITY  AND  EMERGENCY  SERVICES  MAY  DEEM
 PRUDENT.
   (D)  THE  NEW  YORK  STATE CYBER SECURITY CRITICAL INFRASTRUCTURE RISK
 ASSESSMENT REPORT SHALL BE DELIVERED  TO  THE  GOVERNOR,  THE  TEMPORARY
 PRESIDENT  OF  THE SENATE, THE SPEAKER OF THE ASSEMBLY, THE CHAIR OF THE
 SENATE STANDING COMMITTEE ON VETERANS, HOMELAND  SECURITY  AND  MILITARY
 AFFAIRS,  AND  THE  CHAIR  OF THE ASSEMBLY STANDING COMMITTEE ON GOVERN-
 MENTAL OPERATIONS.
   (E) WHERE COMPLIANCE WITH THIS SECTION SHALL REQUIRE THE DISCLOSURE OF
 CONFIDENTIAL INFORMATION, OR THE  DISCLOSURE  OF  SENSITIVE  INFORMATION
 WHICH  IN  THE  JUDGMENT OF THE COMMISSIONER OF THE DIVISION OF HOMELAND
 SECURITY AND EMERGENCY SERVICES WOULD JEOPARDIZE THE CYBER  SECURITY  OF
 THE STATE:
   (I)  SUCH  CONFIDENTIAL  OR SENSITIVE INFORMATION SHALL BE PROVIDED TO
 THE PERSONS ENTITLED TO RECEIVE THE REPORT, IN THE  FORM  OF  A  SUPPLE-
 MENTAL APPENDIX TO THE REPORT; AND
   (II)  SUCH SUPPLEMENTAL APPENDIX TO THE REPORT SHALL NOT BE SUBJECT TO
 THE PROVISIONS OF THE FREEDOM OF INFORMATION LAW PURSUANT TO ARTICLE SIX
 OF THE PUBLIC OFFICERS LAW; AND
   (III) THE PERSONS ENTITLED TO RECEIVE  THE  REPORT  MAY  DISCLOSE  THE
 SUPPLEMENTAL  APPENDIX  TO  THE  REPORT TO THEIR PROFESSIONAL STAFF, BUT
 SHALL NOT OTHERWISE PUBLICLY DISCLOSE SUCH CONFIDENTIAL OR SECURE INFOR-
 MATION.
   § 2. This act shall take effect immediately.