New York Bill Requires Annual Cybersecurity Training for State and Local Agencies

Saying that “the security and safety of all New Yorkers” is her top priority, Gov. Kathy Hochul recently signed legislation that mandates annual cybersecurity training for employees within New York state and local government agencies.

A statement announcing Hochul’s signing of the bill described it as “a pivotal measure” aimed at enhancing the security and resilience of state and local government networks across New York, detailing how the legislation will improve the state’s ability to respond to threats, safeguard critical infrastructure and reduce statewide cybersecurity risks.

In addition to requiring annual cybersecurity training for government employees across New York, the bill sets data protection standards for state-maintained information systems. The new law also obliges all municipal corporations and public authorities to report cybersecurity incidents to the New York State Division of Homeland Security and Emergency Services (DHSES) within 72 hours, and to provide notice of payment of a ransom within 24 hours.

The cyber threats facing municipalities such as those in New York “have never been more numerous, more sophisticated or more dangerous, and coordinated whole-of-government information sharing is more important than ever to tackle these threats,” said Colin Ahern, New York State chief cyber officer, in a statement.

Adding that the legislation is designed to enable New York State “to build awareness of statewide cyberthreat activity and create a comprehensive threat picture that can protect all New Yorkers,” Ahern also noted the importance of the bill’s employee training requirements.

“Ensuring that state and local government employees complete annual cybersecurity awareness training adds another line of cyber defense,” Ahern said, “and empowers government employees statewide to recognize and respond to cyberthreats.”