N.Y. General Municipal Law § 995-b: Reporting of cybersecurity incidents

§ 995-b. Reporting of cybersecurity incidents. 1. Notwithstanding any

other provision of law to the contrary, all municipal corporations and

public authorities shall report cybersecurity incidents and when

applicable, the demand of a ransom payment, to the commissioner of the

division of homeland security and emergency services in the form and

method prescribed by such commissioner. Such report shall include

whether the reporting municipal corporation or public authority is

requesting or declining advice and/or technical assistance from the

division of homeland security and emergency services with respect to the

reported cybersecurity incident or demand for a ransom payment.

2. All municipal corporations and public authorities shall report

cybersecurity incidents, including demands for ransom payment, no later

than seventy-two hours after the municipal corporation or public

authority reasonably believes the cybersecurity incident has occurred.

3. Any cybersecurity incident report and any records related to a

ransom payment submitted to the commissioner of the division of homeland

security and emergency services pursuant to the requirements of this

article shall be exempt from disclosure under article six of the public

officers law.