All Roll Calls
Yes: 219 • No: 1
New YorkS 76722025-2026 Regular SessionSenateWALLET
Relates to municipal cybersecurity incidents or ransomware attacks
Sponsored By: Monica Martinez (Democratic)
Signed by Governor
RULESLOCAL GOVERNMENTS
Personalized for You
How does this bill affect your finances?
Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Bill Overview
Analyzed Economic Effects
5 provisions identified: 1 benefits, 0 costs, 4 mixed.
Public employees get paid annual cybersecurity training
Beginning January 1, 2026, New York state and covered local employees who use technology for official duties must take annual cybersecurity training. Local coverage includes county, city, town, village, and district employees. Training must occur during regular working hours, with employees paid their regular rate. State employees must use state-provided training; local governments can use the state's free option or other training that meets the requirement.
Local governments must explain ransom payments
New York municipalities and public authorities that pay a cyber ransom must notify the state within 24 hours of payment. Within 30 days of payment, they must explain why payment was needed, its amount and method, including virtual currency. They must describe alternatives considered, efforts to find alternatives, and steps to follow state and federal rules, including Treasury sanctions. These reports support state oversight but add compliance work; the law does not ban or cap ransom payments.
Local governments report cyber incidents, get help
New York municipalities and public authorities must report cyber incidents to the Division of Homeland Security and Emergency Services. Reports are due within 72 hours after reasonably believing an incident occurred, adding reporting work for affected governments. Reports must include relevant ransom demands and say whether the entity requests or declines state advice or technical help. The Division reviews risks to residents and must acknowledge requests for help within 48 hours. It must provide advice as soon as possible; technical help depends on practicality and priorities, and threat information can be shared confidentially.
Residents lose access to cyber incident records
Municipal and public authority cyber reports and submitted ransom-payment records are exempt from New York's Freedom of Information Law. The exemption also covers state reviews, assessments, guidance, recommendations, and materials used to prepare them. These rules keep sensitive response information confidential but limit residents' access to records about local cyber incidents.
State agencies strengthen cyber protection and recovery
The state technology director must set standards for system and personal-data protection, backups, recovery, safe deletion, finding weaknesses, and annual breach-response training. Each New York state agency must maintain a system inventory within two years after the section takes effect and provide it upon written request. Agencies must adopt response plans within 18 months after the section takes effect, covering outages, unauthorized access, data changes or deletion, and recovery. Beginning January 1, 2028, agencies must test their plans at least annually and record successes and shortcomings. Inventories, plans, and test reports are confidential and exempt from public-records disclosure; these requirements create no new private right to sue.
Sponsors & Cosponsors
Sponsor
Monica Martinez
Democratic • Senate
Cosponsors
There are no cosponsors for this bill.
Roll Call Votes
House vote • 5/19/2025
Assembly floor vote
Yes: 142 • No: 0
Senate vote • 5/12/2025
FLOOR Vote
Yes: 56 • No: 1
committee vote • 4/29/2025
Rules Committee Vote
Yes: 21 • No: 0
Actions Timeline
SIGNED CHAP.177
6/26/2025SenateDELIVERED TO GOVERNOR
6/26/2025SenateRETURNED TO SENATE
5/19/2025HousePASSED ASSEMBLY
5/19/2025HouseORDERED TO THIRD READING CAL.67
5/19/2025HouseSUBSTITUTED FOR A6769A
5/19/2025HouseREFERRED TO LOCAL GOVERNMENTS
5/12/2025HouseDELIVERED TO ASSEMBLY
5/12/2025SenatePASSED SENATE
5/12/2025SenateAMENDED ON THIRD READING 7672A
5/5/2025SenateORDERED TO THIRD READING CAL.712
4/29/2025SenateREFERRED TO RULES
4/28/2025Senate
Bill Text
Amendment A
5/5/2025
Original
4/28/2025
Related Bills
S 9051, Prohibits artificial intelligence companions from using features which are considered unsafe for minors
S 10643, Relates to labor peace agreements and the cannabis industry wage board; repealer
A 5175, Requires certain security features and warning labels on baby monitors
S 8953, Establishes the Clarence Center Volunteer Exempt Firefighter's Benevolent Association
S 9968, Establishes the Harris Hill Volunteer Fire Company Benevolent Association
A 10052, Extends the effectiveness of the authority of the town of Red Hook to impose real estate transfer taxes and to deposit revenue from such taxes into a community preservation fund