N.Y. State Technology Law § 103-f: Cybersecurity awareness training

§ 103-f. Cybersecurity awareness training. 1. (a) Employees of the

state who use technology as a part of their official job duties shall

take annual cybersecurity awareness training beginning January first,

two thousand twenty-six. Employees of the state shall be required to

complete the training provided by the office.

(b) For purposes of this section, "employees of the state" shall

include employees of all state agencies and all public benefit

corporations, the heads of which are appointed by the governor.

2. Employees of a county, a city, a town, a village, or a district as

defined in section one hundred nineteen-n of the general municipal law,

who use technology as a part of their official job duties shall take

annual cybersecurity awareness training beginning January first, two

thousand twenty-six. The office shall make a cybersecurity training

available for use by a county, a city, a town, a village, or a district

as defined in section one hundred nineteen-n of the general municipal

law, at no charge, provided however, no employee of a county, a city, a

town, a village, or a district as defined in section one hundred

nineteen-n of the general municipal law shall be required to complete

such training provided by the office and the cybersecurity awareness

training requirements of this section may be satisfied by the completion

of other cybersecurity awareness training.

3. All training mandated by this section shall be conducted during the

employee's regular working hours and employees shall receive

compensation at their regular rate of pay for any time spent

participating in such training.