BILL NUMBER: S5615

SPONSOR: THOMAS
 
TITLE OF BILL:

An act to amend the state finance law, in relation to procurement
requirements for end point device security

 
PURPOSE OR GENERAL IDEA OF BILL:

To strengthen New York procurement requirements to prevent cyberattacks.

 
SUMMARY OF SPECIFIC PROVISIONS:

Section one of the bill amends section 165 of the state finance law by
adding a new subdivision 9 to require the commissioner of general
services and all state agencies to procure end point devices that meet
the National Institute of Standards and Technology (NIST) guidelines and
best practices for computer security. This subdivision also requires
that the commissioner and each state agency update their end point
device procurement requirements to reflect any amendments made to the
NIST guidelines within one year of its adoption.
              

Section two of the bill provides the effective date.

 
JUSTIFICATION:

Cyber security attacks cost business and government billions each year.
In today's environment, it's not a matter of if you'll be attacked, but
when you will be attacked.Often, governments consider security in terms
of preventing 'a PC' from being infected. The reality is that attacks
are becoming much more destructive and at a larger scale. It's not
uncommon to see attacks take down hundreds or thousands of machines in a
single incident. Trends include increasing firmware attacks, increasing-
ly destructive attacks and the rapid evolution of novel malware.

In this environment, it's critical to understand that every PC or print-
er purchase decision a governmental unit should include cyber security
as a critical procurement requirement and utilize best practices that
have been adopted by the U.S. Government.

The National Institute of Standards and Technology (NIST) guidelines and
best practices for computer security consists of standards, guidelines,
and best practices to manage cybersecurity-related risk.  The Cyberse-
curity Framework's prioritized, flexible, and cost-effective approach
helps to promote the protection and resilience of critical infrastruc-
ture and other sectors important to the economy and national security.
New York wants to protect its critical infrastructure, its citizens, and
its data. In order to do so the state should demonstrate due diligence
by adopting the cybersecurity best practices to combat the adversaries,
whose attacks cost business and government billions per annum.'

The U.S. Department of Homeland Security Supply Chain Risk Management
(SCRM) guidelines and the NIST Cybersecurity Framework as found in the
NIST Special Publication 800 series are critical guidelines and stand-
ards. For the State of New York to demonstrate capability to fight the
adversaries, who are perpetually launching cyberattacks and employing
malware such as Kwampirs Malware, they need to have the best tools and
procedures on the market and follow best business practices. Kwampirs is
employed in an ongoing Cyber Supply Chain campaign targeting the supply
chain of global industries, including the Healthcare Sector. These types
of campaigns are just examples of current persistent malicious actions
of cyber actors. This bill will make New York safer by using proven
standards to protect against these types of cyberattacks.

 
PRIOR LEGISLATIVE HISTORY:

2021-22: S.3213 (Thomas) / A.9951 (Otis) - Referred to Procurement and
Contracts.

 
FISCAL IMPLICATIONS:

None.

 
EFFECTIVE DATE:
This act shall take effect on the ninetieth day after it shall have
become a law.