S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   3094
 
                        2023-2024 Regular Sessions
 
                           I N  A S S E M B L Y
 
                             February 2, 2023
                                ___________
 
 Introduced  by  M. of A. OTIS -- read once and referred to the Committee
   on Science and Technology
 
 AN ACT to amend the state technology law, in relation  to  enacting  the
   "critical infrastructure standards and procedures act"
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. The state technology law is amended by adding a new article
 4 to read as follows:
                                  ARTICLE 4
           CRITICAL INFRASTRUCTURE STANDARDS AND PROCEDURES ACT
 SECTION 401. SHORT TITLE.
         402. DEFINITIONS.
         403.  COMPLIANCE  WITH  CYBERSECURITY  STANDARDS  FOR   CRITICAL
                INFRASTRUCTURE.
         404.   PROCUREMENT,  CONSTRUCTION,  RECONSTRUCTION,  ALTERATION,
                DESIGN AND COMMISSIONING OF  CRITICAL  INFRASTRUCTURE  OR
                AUTOMATION  CONTROL  SYSTEMS OR AUTOMATION CONTROL SYSTEM
                COMPONENTS.
         405. OPERATIONS AND MAINTENANCE OF CRITICAL INFRASTRUCTURE.
   § 401. SHORT TITLE. THIS ARTICLE SHALL BE KNOWN AND MAY  BE  CITED  AS
 THE "CRITICAL INFRASTRUCTURE STANDARDS AND PROCEDURES (CRISP) ACT".
   § 402. DEFINITIONS. THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING MEAN-
 INGS:
   1. CRITICAL INFRASTRUCTURE SHALL INCLUDE, BUT SHALL NOT BE LIMITED TO:
   (A) PUBLIC TRANSPORTATION;
   (B) WATER AND WASTEWATER TREATMENT FACILITIES;
   (C)  PUBLIC UTILITIES AND SERVICES SUBJECT TO THE JURISDICTION, SUPER-
 VISION, POWERS AND DUTIES OF  THE  PUBLIC  SERVICE  COMMISSION  AND  THE
 DEPARTMENT OF PUBLIC SERVICE;
   (D) PUBLIC BUILDINGS, INCLUDING THOSE OPERATED BY THE STATE UNIVERSITY
 OF NEW YORK;

  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD01897-02-3
              

 A. 3094                             2
 
   (E) HOSPITALS AND PUBLIC HEALTH FACILITIES REGULATED PURSUANT TO ARTI-
 CLE TWENTY-EIGHT OF THE PUBLIC HEALTH LAW; AND
   (F) FACILITIES CREATED OR EXISTING UNDER THE PUBLIC AUTHORITIES LAW.
   2.  AUTOMATION  AND  CONTROL SYSTEM SHALL INCLUDE PERSONNEL, HARDWARE,
 SOFTWARE AND POLICIES INVOLVED IN THE OPERATION OF THE CRITICAL  INFRAS-
 TRUCTURE  THAT  MAY  AFFECT  OR  INFLUENCE ITS SAFE, SECURE AND RELIABLE
 OPERATION.
   3. AUTOMATION AND CONTROL SYSTEM COMPONENTS SHALL MEAN CONTROL SYSTEMS
 AND ANY COMPLEMENTARY HARDWARE AND SOFTWARE COMPONENTS  THAT  HAVE  BEEN
 INSTALLED AND CONFIGURED TO OPERATE IN AN AUTOMATION AND CONTROL SYSTEM.
 SUCH SYSTEMS SHALL INCLUDE, BUT SHALL NOT BE LIMITED TO:
   (A)  CONTROL  SYSTEMS,  WHETHER  PHYSICALLY  SEPARATE  OR  INTEGRATED,
 INCLUDING DISTRIBUTED CONTROL SYSTEMS, PROGRAMMABLE  LOGIC  CONTROLLERS,
 REMOTE  TERMINAL  UNITS,  INTELLIGENT  ELECTRONIC  DEVICES,  SUPERVISORY
 CONTROL AND DATA ACQUISITION, NETWORKED ELECTRONIC SENSING AND  CONTROL,
 AND MONITORING AND DIAGNOSTIC SYSTEMS;
   (B)  ASSOCIATED INFORMATION SYSTEMS, SUCH AS ADVANCED OR MULTIVARIABLE
 CONTROL, ONLINE  OPTIMIZERS,  DEDICATED  EQUIPMENT  MONITORS,  GRAPHICAL
 INTERFACES,  PROCESS  HISTORIANS,  MANUFACTURING  EXECUTION  SYSTEMS AND
 PLANT INFORMATION MANAGEMENT SYSTEMS;
   (C) ASSOCIATED INTERNAL, HUMAN, NETWORK, OR MACHINE INTERFACES USED TO
 PROVIDE CONTROL, SAFETY, AND MANUFACTURING OPERATIONS  FUNCTIONALITY  TO
 CONTINUOUS, BATCH, DISCRETE; AND
   (D)  OTHER  PROCESSES AS DEFINED BY THE INTERNATIONAL SOCIETY OF AUTO-
 MATION INCLUDING THE ISA/IEC 62443 SERIES OF STANDARDS, AS REFERENCED BY
 THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST).
   4. ASSET OWNER SHALL MEAN  THE  PUBLIC  OR  PRIVATE  OWNER  OR  ENTITY
 ACCOUNTABLE AND RESPONSIBLE FOR OPERATION OF THE CRITICAL INFRASTRUCTURE
 AND  FOR THE AUTOMATION AND CONTROL SYSTEM. THE ASSET OWNER SHALL BE THE
 OPERATOR OF THE AUTOMATION AND CONTROL  SYSTEM  AND  OF  SUCH  EQUIPMENT
 UNDER CONTROL.
   5.  OPERATIONAL  TECHNOLOGY  SHALL MEAN THE HARDWARE AND SOFTWARE THAT
 DETECTS OR CAUSES A CHANGE IN THE CRITICAL  INFRASTRUCTURE  THROUGH  THE
 DIRECT MONITORING OR CONTROL OF PHYSICAL DEVICES, SYSTEMS, PROCESSES AND
 EVENTS.
   §  403.  COMPLIANCE  WITH CYBERSECURITY STANDARDS FOR CRITICAL INFRAS-
 TRUCTURE. THE OFFICE, IN CONSULTATION WITH THE  DEPARTMENT  OF  HOMELAND
 SECURITY  AND  EMERGENCY SERVICES SHALL MAKE A DETERMINATION OF CRITICAL
 INFRASTRUCTURE, INCLUDING WHOSE ASSETS, SYSTEMS, AND  NETWORKS,  WHETHER
 PHYSICAL OR VIRTUAL, ARE CONSIDERED VITAL AND VULNERABLE TO CYBERSECURI-
 TY ATTACKS.
   §  404.  PROCUREMENT, CONSTRUCTION, RECONSTRUCTION, ALTERATION, DESIGN
 AND COMMISSIONING  OF  CRITICAL  INFRASTRUCTURE  OR  AUTOMATION  CONTROL
 SYSTEMS OR AUTOMATION CONTROL SYSTEM COMPONENTS. ON OR AFTER JULY FIRST,
 TWO  THOUSAND  TWENTY-SEVEN,  THE ASSET OWNER, WHEN PROCURING AUTOMATION
 AND CONTROL SYSTEM  COMPONENTS,  AS  DEFINED  IN  SUBDIVISION  THREE  OF
 SECTION FOUR HUNDRED TWO OF THIS ARTICLE, SERVICES OR SOLUTIONS, OR WHEN
 CONTRACTING  FOR  FACILITY  UPGRADES  OR  THE  CONSTRUCTION  OF CRITICAL
 INFRASTRUCTURE FACILITIES, SHALL REQUIRE SUCH COMPONENTS, SERVICES,  AND
 SOLUTIONS  TO  CONFORM  TO  THE  ISA/IEC  62443 SERIES OF STANDARDS. ALL
 CONTRACTS AWARDED FOR CONSTRUCTION, RECONSTRUCTION,  ALTERATION,  DESIGN
 AND  COMMISSIONING  OF  FACILITIES IDENTIFIED AS CRITICAL INFRASTRUCTURE
 UNDER THIS ARTICLE SHALL PROVIDE  THAT  SUCH  INSTALLED  AUTOMATION  AND
 CONTROL COMPONENTS MEET THE FOLLOWING MINIMUM STANDARDS FOR CYBERSECURI-
 TY AS DEFINED BY THE ISA/IEC 62443 SERIES OF STANDARDS:
   1. 2-4 REQUIREMENTS FOR IACS SOLUTIONS PROVIDERS;
 A. 3094                             3
 
   2. 3-2 SECURITY RISK ASSESSMENT AND SYSTEMS DESIGN;
   3. 3-3 SYSTEM SECURITY REQUIREMENTS AND SECURITY LEVELS;
   4. 4-1 PRODUCT DEVELOPMENT REQUIREMENTS; AND
   5. 4-2 TECHNICAL SECURITY REQUIREMENTS FOR IACS COMPONENTS.
   §  405.  OPERATIONS  AND MAINTENANCE OF CRITICAL INFRASTRUCTURE. ON OR
 AFTER JULY FIRST, TWO THOUSAND TWENTY-FIVE, THE  ASSET  OWNER  SHALL  BE
 RESPONSIBLE  FOR  ENSURING  THAT THE OPERATION AND MAINTENANCE OF OPERA-
 TIONAL TECHNOLOGY, INCLUDING CRITICAL INFRASTRUCTURE, AUTOMATION CONTROL
 SYSTEMS AND  AUTOMATION  CONTROL  SYSTEM  COMPONENTS  CONFORM  WITH  THE
 FOLLOWING  ISA/IEC  62443  SERIES  OF  STANDARDS,  INCLUDING ANNUAL RISK
 ASSESSMENTS AND SHALL CREATE A MITIGATION PLAN:
   1. 2-1 REQUIREMENTS FOR AN IACS SECURITY MANAGEMENT SYSTEM;
   2. 2-3 PATCH MANAGEMENT IN THE IACS ENVIRONMENT;
   3. 2-4 SECURITY PROGRAM REQUIREMENTS FOR SERVICE PROVIDERS;
   4. 3-2 SECURITY RISK ASSESSMENT AND SYSTEM DESIGN; AND
   5. 3-3 SYSTEM SECURITY REQUIREMENTS AND SECURITY LEVELS.
   § 2. This act shall take effect on the one hundred eightieth day after
 it shall have become a  law.  Effective  immediately,  the  office,  the
 commissioner  of homeland security and emergency services and the super-
 intendent of financial services may promulgate rules and regulations and
 take other actions reasonably necessary to implement this  act  on  that
 date.