N.Y. General Municipal Law § 995-a: Definitions

§ 995-a. Definitions. For the purposes of this article: 1.

"Cybersecurity incident" means an event occurring on or conducted

through a computer network that actually or imminently jeopardizes the

integrity, confidentiality, or availability of computers, information or

communications systems or networks, physical or virtual infrastructure

controlled by computers or information systems, or information resident

thereon.

2. "Cyber threat" means any circumstance or event with the potential

to adversely impact organizational operations, organizational assets, or

individuals through an information system via unauthorized access,

destruction, disclosure, modification of information, and/or denial of

service.

3. "Cyber threat indicator" means information that is necessary to

describe or identify:

(a) malicious reconnaissance, including anomalous patterns of

communications that appear to be transmitted for the purpose of

gathering technical information related to a cybersecurity threat or

security vulnerability;

(b) a method of defeating a security control or exploitation of a

security vulnerability;

(c) a security vulnerability, including anomalous activity that

appears to indicate the existence of a security vulnerability;

(d) a method of causing a user with legitimate access to an

information system or information that is stored on, processed by, or

transiting an information system to unwittingly enable the defeat of a

security control or exploitation of a security vulnerability;

(e) malicious cyber command and control;

(f) the actual or potential harm caused by an incident, including a

description of the information exfiltrated as a result of a particular

cybersecurity threat;

(g) any other attribute of a cybersecurity threat, if disclosure of

such attribute is not otherwise prohibited by law; or

(h) any combination thereof.

4. "Defensive measure" means an action, device, procedure, signature,

technique, or other measure applied to an information system or

information that is stored on, processed by, or transiting an

information system that detects, prevents, or mitigates a known or

suspected cybersecurity threat or security vulnerability. The term

"defensive measure" does not include a measure that destroys, renders

unusable, provides unauthorized access to, or substantially harms an

information system or information stored on, processed by, or transiting

such information system not owned by the municipal corporation or public

authority operating the measure, or federal entity that is authorized to

provide consent and has provided consent to that municipal corporation

or public authority for operation of such measure.

5. "Information system" means a discrete set of information resources

organized for the collection, processing, maintenance, use, sharing,

dissemination, or disposition of information.

6. "Municipal corporation" means:

(a) A municipal corporation as defined in section one hundred

nineteen-n of this chapter; or

(b) A district as defined in section one hundred nineteen-n of this

chapter.

7. "Public authority" means any state authority or local authority, as

such terms are defined in section two of the public authorities law, or

any subsidiary thereof.

8. "Ransom payment" means the transmission of any money or other

property or asset, including virtual currency, or any portion thereof,

which has at any time been delivered as ransom in connection with a

ransomware attack.

9. "Ransomware attack":

(a) means an incident that includes the use or threat of use of

unauthorized or malicious code on an information system, or the use or

threat of use of another digital mechanism such as a denial of service

attack, to interrupt or disrupt the operations of an information system

or compromise the confidentiality, availability, or integrity of

electronic data stored on, processed by, or transiting an information

system to extort a demand for a ransom payment; and

(b) does not include any such event in which the demand for payment

is:

(i) not genuine; or

(ii) made in good faith by an entity in response to a specific request

by the owner or operator of the information system.