S T A T E O F N E W Y O R K
________________________________________________________________________
5007--A
2023-2024 Regular Sessions
I N S E N A T E
February 21, 2023
___________
Introduced by Sens. GONZALEZ, SALAZAR -- read twice and ordered printed,
and when printed to be committed to the Committee on Internet and
Technology -- reported favorably from said committee and committed to
the Committee on Finance -- committee discharged, bill amended,
ordered reprinted as amended and recommitted to said committee
AN ACT to amend the state technology law, in relation to establishing
the "secure our data act"
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. This act shall be known and may be cited as the "secure our
data act".
§ 2. Legislative intent. The legislature finds that ransomware and
other malware attacks have affected the electronically stored personal
information relating to thousands of people statewide and millions of
people nationwide. The legislature also finds that state entities
receive such personal information from various sources, including the
data subjects themselves, other state entities, and the federal govern-
ment. In addition, the legislature finds that state entities use such
personal information to make determinations regarding the data subjects.
The legislature further finds that New Yorkers deserve to have their
personal information that is in the possession of a state entity stored
in a manner that will withstand any attempt by ransomware and other
malware to alter, change, or encrypt such information.
Therefore, the legislature enacts the secure our data act which will
guarantee that state entities will employ the proper technology to
protect the personal information stored as backup information from any
unauthorized alteration or change.
§ 3. The state technology law is amended by adding a new section 210
to read as follows:
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD09002-02-3
S. 5007--A 2
§ 210. RANSOMWARE AND OTHER MALWARE PROTECTION. 1. DEFINITIONS. FOR
PURPOSES OF THIS SECTION, THE FOLLOWING TERMS SHALL HAVE THE FOLLOWING
MEANINGS:
(A) "DATA SUBJECT" SHALL MEAN THE PERSON WHO IS THE SUBJECT OF THE
PERSONAL INFORMATION.
(B) "IMMUTABLE" MEANS DATA THAT IS STORED UNCHANGED OVER TIME OR
UNABLE TO BE CHANGED. FOR THE PURPOSES OF BACKUPS, "IMMUTABLE" SHALL
MEAN THAT, ONCE INGESTED, NO EXTERNAL OR INTERNAL OPERATION CAN MODIFY
THE DATA AND MUST NEVER BE AVAILABLE IN A READ/WRITE STATE TO THE
CLIENT. "IMMUTABLE" SHALL SPECIFICALLY APPLY TO THE CHARACTERISTICS AND
ATTRIBUTES OF A BACKUP SYSTEM'S FILE SYSTEM AND MAY NOT BE APPLIED TO
TEMPORARY SYSTEMS STATE, TIME-BOUND OR EXPIRING CONFIGURATIONS, OR
TEMPORARY CONDITIONS CREATED BY A PHYSICAL AIR GAP AS IS IMPLEMENTED IN
MOST LEGACY SYSTEMS. AN IMMUTABLE FILE SYSTEM MUST DEMONSTRATE CHARAC-
TERISTICS THAT DO NOT PERMIT THE EDITING OR CHANGING OF ANY DATA BACKED
UP TO PROVIDE AGENCIES WITH COMPLETE RECOVERY CAPABILITIES.
(C) "INFORMATION SYSTEM" SHALL MEAN ANY GOOD, SERVICE OR A COMBINATION
THEREOF, USED BY ANY COMPUTER, CLOUD SERVICE, OR INTERCONNECTED SYSTEM
THAT IS MAINTAINED FOR OR USED BY A STATE ENTITY IN THE ACQUISITION,
STORAGE, MANIPULATION, MANAGEMENT, MOVEMENT, CONTROL, DISPLAY, SWITCH-
ING, INTERCHANGE, TRANSMISSION, OR RECEPTION OF DATA OR VOICE INCLUDING,
BUT NOT LIMITED TO, HARDWARE, SOFTWARE, INFORMATION APPLIANCES, FIRM-
WARE, PROGRAMS, SYSTEMS, NETWORKS, INFRASTRUCTURE, MEDIA, AND RELATED
MATERIAL USED TO AUTOMATICALLY AND ELECTRONICALLY COLLECT, RECEIVE,
ACCESS, TRANSMIT, DISPLAY, STORE, RECORD, RETRIEVE, ANALYZE, EVALUATE,
PROCESS, CLASSIFY, MANIPULATE, MANAGE, ASSIMILATE, CONTROL, COMMUNICATE,
EXCHANGE, CONVERT, COVERAGE, INTERFACE, SWITCH, OR DISSEMINATE DATA OF
ANY KIND OR FORM.
(D) "MAINTAINED" SHALL MEAN PERSONAL INFORMATION STORED BY A STATE
ENTITY THAT WAS PROVIDED TO THE STATE ENTITY BY THE DATA SUBJECT, A
STATE ENTITY, OR A FEDERAL GOVERNMENTAL ENTITY. SUCH TERM SHALL ALSO
INCLUDE PERSONAL INFORMATION PROVIDED BY AN ADVERSE PARTY IN THE COURSE
OF LITIGATION OR OTHER ADVERSARIAL PROCEEDING.
(E) "MALWARE" SHALL MEAN MALICIOUS CODE INCLUDED IN ANY APPLICATION,
DIGITAL CONTENT, DOCUMENT, EXECUTABLE, FIRMWARE, PAYLOAD, OR SOFTWARE
FOR THE PURPOSE OF PERFORMING OR EXECUTING ONE OR MORE UNAUTHORIZED
PROCESSES DESIGNED TO HAVE AN ADVERSE IMPACT ON THE AVAILABILITY, CONFI-
DENTIALITY, OR INTEGRITY OF DATA STORED IN AN INFORMATION SYSTEM.
(F) "RANSOMWARE" SHALL MEAN ANY TYPE OF MALWARE THAT USES ENCRYPTION
TECHNOLOGY TO PREVENT USERS FROM ACCESSING AN INFORMATION SYSTEM OR DATA
STORED BY SUCH INFORMATION SYSTEM UNTIL A RANSOM IS PAID.
(G) "STATE ENTITY" SHALL MEAN ANY STATE BOARD, BUREAU, DIVISION,
COMMITTEE, COMMISSION, COUNCIL, DEPARTMENT, PUBLIC AUTHORITY, PUBLIC
BENEFIT CORPORATION, OFFICE OR OTHER GOVERNMENTAL ENTITY PERFORMING A
GOVERNMENTAL OR PROPRIETARY FUNCTION FOR THE STATE OF NEW YORK, EXCEPT:
(I) THE JUDICIARY; AND
(II) ALL CITIES, COUNTIES, MUNICIPALITIES, VILLAGES, TOWNS, AND OTHER
LOCAL AGENCIES.
2. DATA PROTECTION STANDARDS. (A) NO LATER THAN ONE YEAR AFTER THE
EFFECTIVE DATE OF THIS SECTION, THE DIRECTOR, IN CONSULTATION WITH
STAKEHOLDERS AND OTHER INTERESTED PARTIES, WHICH SHALL INCLUDE AT LEAST
ONE PUBLIC HEARING, SHALL PROMULGATE REGULATIONS THAT DESIGN AND DEVELOP
STANDARDS FOR:
(I) MALWARE AND RANSOMWARE PROTECTION FOR MISSION CRITICAL INFORMATION
SYSTEMS AND FOR PERSONAL INFORMATION USED BY SUCH INFORMATION SYSTEMS;
S. 5007--A 3
(II) DATA BACKUP THAT INCLUDES THE CREATION OF IMMUTABLE BACKUPS OF
PERSONAL INFORMATION MAINTAINED BY THE STATE ENTITY AND STORAGE OF SUCH
BACKUPS IN A SEGMENTED ENVIRONMENT, INCLUDING A SEGMENTED DEVICE;
(III) INFORMATION SYSTEM RECOVERY THAT INCLUDES CREATING AN IDENTICAL
COPY OF AN IMMUTABLE PERSONAL INFORMATION BACKUP MAINTAINED BY OR FOR
THE STATE ENTITY THAT WAS STORED IN A SEGMENTED ENVIRONMENT OR ON A
SEGMENTED DEVICE FOR USE WHEN AN INFORMATION SYSTEM HAS BEEN ADVERSELY
AFFECTED BY RENT SOMEWHERE OR OTHER MALWARE AND REQUIRES RESTORATION
FROM ONE OR MORE BACKUPS; AND
(IV) ANNUAL WORKFORCE TRAINING REGARDING PROTECTION FROM RANSOMWARE
AND OTHER MALWARE, AS WELL AS PROCESSES AND PROCEDURES THAT SHOULD BE
FOLLOWED IN THE EVENT OF A DATA INCIDENT INVOLVING RANSOMWARE OR OTHER
MALWARE.
(B) SUCH REGULATIONS MAY BE ADOPTED ON AN EMERGENCY BASIS. IF SUCH
REGULATIONS ARE ADOPTED ON AN EMERGENCY BASIS, THE OFFICE SHALL ENGAGE
IN THE FORMAL RULEMAKING PROCEDURE NO LATER THAN THE DAY IMMEDIATELY
FOLLOWING THE DATE THAT THE OFFICE PROMULGATED SUCH REGULATIONS ON AN
EMERGENCY BASIS. PROVIDED THAT THE OFFICE HAS COMMENCED THE FORMAL RULE-
MAKING PROCESS, THE REGULATIONS ADOPTED ON AN EMERGENCY BASIS MAY BE
RENEWED NO MORE THAN TWO TIMES.
3. VULNERABILITY ASSESSMENTS. NOTWITHSTANDING ANY PROVISION OF LAW TO
THE CONTRARY, EACH STATE ENTITY SHALL ENGAGE IN VULNERABILITY TESTING OF
ITS INFORMATION SYSTEMS AS FOLLOWS:
(A) BEGINNING JANUARY FIRST, TWO THOUSAND TWENTY-FOUR AND ON A MONTHLY
BASIS THEREAFTER, EACH STATE ENTITY SHALL PERFORM, OR CAUSE TO BE
PERFORMED, A VULNERABILITY ASSESSMENT OF AT LEAST ONE MISSION CRITICAL
INFORMATION SYSTEM ENSURING THAT EACH MISSION CRITICAL SYSTEM HAS UNDER-
GONE A VULNERABILITY ASSESSMENT DURING THE PAST YEAR. A REPORT DETAILING
THE VULNERABILITY ASSESSMENT METHODOLOGY AND FINDINGS SHALL BE MADE
AVAILABLE TO THE OFFICE FOR REVIEW NO LATER THAN FORTY-FIVE DAYS AFTER
THE TESTING HAS BEEN COMPLETED.
(B) BEGINNING DECEMBER FIRST, TWO THOUSAND TWENTY-FOUR, EACH STATE
ENTITY'S ENTIRE INFORMATION SYSTEM SHALL UNDERGO VULNERABILITY TESTING.
A REPORT DETAILING THE VULNERABILITY ASSESSMENT METHODOLOGY AND FINDINGS
SHALL BE MADE AVAILABLE TO THE OFFICE FOR REVIEW NO LATER THAN FORTY-
FIVE DAYS AFTER SUCH TESTING HAS BEEN COMPLETED.
(C) THE OFFICE SHALL ASSIST STATE ENTITIES IN COMPLYING WITH THE
PROVISIONS OF THIS SECTION.
4. DATA AND INFORMATION SYSTEM INVENTORY. (A) NO LATER THAN ONE YEAR
AFTER THE EFFECTIVE DATE OF THIS SECTION, EACH STATE ENTITY SHALL CREATE
AN INVENTORY OF THE DATA MAINTAINED BY THE STATE ENTITY AND THE PURPOSE
OR PURPOSES FOR WHICH SUCH DATA IS MAINTAINED AND USED. THE INVENTORY
SHALL INCLUDE A LISTING OF ALL PERSONAL INFORMATION MAINTAINED BY THE
STATE ENTITY, ALONG WITH THE SOURCE AND AGE OF SUCH INFORMATION.
(B) NO LATER THAN ONE YEAR AFTER THE EFFECTIVE DATE OF THIS SECTION,
EACH STATE ENTITY SHALL CREATE AN INVENTORY OF THE INFORMATION SYSTEMS
MAINTAINED BY OR ON BEHALF OF THE STATE ENTITY AND THE PURPOSE OR
PURPOSES FOR WHICH EACH SUCH INFORMATION SYSTEM IS MAINTAINED AND USED.
THE INVENTORY SHALL DENOTE THOSE INFORMATION SYSTEMS THAT ARE MISSION
CRITICAL AND THOSE THAT USE PERSONAL INFORMATION, AND WHETHER THE INFOR-
MATION SYSTEM IS PROTECTED BY IMMUTABLE BACKUPS.
(C) NOTWITHSTANDING PARAGRAPHS (A) AND (B) OF THIS SUBDIVISION, IF A
STATE ENTITY HAS ALREADY COMPLETED A DATA INVENTORY OR INFORMATION
SYSTEMS INVENTORY, SUCH STATE ENTITY SHALL UPDATE THE PREVIOUSLY
COMPLETED DATA INVENTORY OR INFORMATION SYSTEM INVENTORY NO LATER THAN
ONE YEAR AFTER THE EFFECTIVE DATE OF THIS SECTION.
S. 5007--A 4
(D) UPON WRITTEN REQUEST FROM THE OFFICE, A STATE ENTITY SHALL PROVIDE
THE OFFICE WITH EITHER OR BOTH OF THE INVENTORIES REQUIRED TO BE CREATED
OR UPDATED PURSUANT TO THIS SUBDIVISION.
5. INCIDENT MANAGEMENT AND RECOVERY. (A) NO LATER THAN EIGHTEEN MONTHS
AFTER THE EFFECTIVE DATE OF THIS SECTION, EACH STATE ENTITY SHALL HAVE
CREATED AN INCIDENT RESPONSE PLAN FOR INCIDENTS INVOLVING RANSOMWARE OR
OTHER MALWARE THAT RENDERS AN INFORMATION SYSTEM OR ITS DATA UNAVAIL-
ABLE, AND INCIDENTS INVOLVING RANSOMWARE OR OTHER MALWARE THAT RESULT IN
THE ALTERATION OR DELETION OF OR UNAUTHORIZED ACCESS TO, PERSONAL INFOR-
MATION.
(B) SUCH INCIDENT RESPONSE PLAN SHALL INCLUDE A PROCEDURE FOR SITU-
ATIONS WHERE PRODUCTION AND NON-SEGMENTED INFORMATION SYSTEMS HAVE BEEN
ADVERSELY AFFECTED BY A DATA INCIDENT, AS WELL AS A PROCEDURE FOR THE
STORAGE OF PERSONAL INFORMATION AND MISSION CRITICAL BACKUPS ON A
SEGMENTED DEVICE OR SEGMENTED PORTION OF THE STATE ENTITY'S INFORMATION
SYSTEM TO ENSURE THAT SUCH PERSONAL INFORMATION AND MISSION CRITICAL
SYSTEMS ARE PROTECTED BY IMMUTABLE BACKUPS.
(C) BEGINNING JANUARY FIRST, TWO THOUSAND TWENTY-SIX AND ON AN ANNUAL
BASIS THEREAFTER, EACH STATE ENTITY SHALL COMPLETE AT LEAST ONE EXERCISE
OF ITS INCIDENT RESPONSE PLAN THAT INCLUDES COPYING THE IMMUTABLE
PERSONAL INFORMATION AND MISSION CRITICAL APPLICATIONS FROM THE
SEGMENTED PORTION OF THE STATE ENTITY'S INFORMATION SYSTEM AND USING
SUCH COPIES IN THE STATE ENTITY'S RESTORATION AND RECOVERY PROCESS. UPON
COMPLETION OF SUCH EXERCISE, THE STATE ENTITY SHALL DOCUMENT THE INCI-
DENT RESPONSE PLAN'S SUCCESSES AND SHORTCOMINGS.
6. NO PRIVATE RIGHT OF ACTION. NOTHING SET FORTH IN THIS SECTION SHALL
BE CONSTRUED AS CREATING OR ESTABLISHING A PRIVATE CAUSE OF ACTION.
§ 4. Severability. The provisions of this act shall be severable and
if any portion thereof or the applicability thereof to any person or
circumstances shall be held to be invalid, the remainder of this act and
the application thereof shall not be affected thereby.
§ 5. This act shall take effect immediately.
