Landmark Legislation to Strengthen Cybersecurity

Governor Kathy Hochul today signed into law S.7672A/A.6769A, a pivotal measure aimed at enhancing the cybersecurity and resilience of state and local government networks across New York. First announced in Governor Hochul’s 2025 State of the State, this legislation will improve the State’s ability to respond to threats, safeguard critical infrastructure and reduce statewide cybersecurity risks. Governor Hochul made the announcement today following a meeting with City, County, Town and Village officials from across the State to discuss current security efforts in response to the ongoing conflict in the Middle East.

“My top priority as Governor is the security and safety of all New Yorkers, and with this legislation we’re strengthening our ability to respond to and ultimately prevent cyber threats all across our state,” Governor Hochul said. “As global conflicts escalate and cyber threats evolve, so must our response, and we are taking a whole of government approach in doing so. Requiring timely incident reporting and providing annual cybersecurity training for government employees will build a stronger digital shield for every community across the State and ensure they get the support they need when it matters most.”

The legislation mandates that all municipal corporations and public authorities promptly report cybersecurity incidents and ransom payments to the New York State Division of Homeland Security and Emergency Services (DHSES), fortifying the statewide defense against digital threats. Under the new law, municipalities and public authorities are required to report cybersecurity incidents within 72 hours to DHSES and provide notice of payment of a ransom within 24 hours. The legislation also mandates annual cybersecurity awareness training for government employees across New York and sets data protection standards for State-maintained information systems.

New York State Chief Cyber Officer Colin Ahern said, “The cyber threats that municipalities face have never been more numerous, more sophisticated, or more dangerous, and coordinated whole-of-government information sharing is more important than ever to tackle these threats. This legislation will enable New York State to build situational awareness of statewide cyber threat activity and create a comprehensive threat picture that can protect all New Yorkers. Ensuring that state and local government employees complete annual cybersecurity awareness training adds another line of cyber defense and empowers government employees statewide to recognize and respond to cyber threats.”

State and local governments are on the front lines of a growing wave of cyberattacks that threaten essential services and public data. As attackers become more sophisticated and aggressive, municipalities face mounting risks with limited support and rapidly evolving threats. Recent ransomware incidents across the country have underscored the urgent need for coordinated, statewide action to help local agencies respond swiftly and protect the communities they serve. The 72-hour reporting requirement will give New York State critical visibility into threats, allowing for faster response, better coordination and damage limitation.

State Senator Monica R. Martinez said, “Protecting the public is government’s most important responsibility, but attacks on critical infrastructure put essential services and the people who rely on them at risk. This bill gives municipalities the structure, support, and accountability they need to protect residents and taxpayers from prolonged disruption in the event of a cyberattack. I thank Governor Hochul and my colleagues in the Legislature for recognizing the cost of inaction and for advancing this important legislation.”

State Senator Kristen Gonzalez said, “In our increasingly digital world, our data is constantly at risk. As emerging technologies make it easier for hackers to access our data, readiness isn't just an option for our government; it's our imperative. I thank the sponsor for introducing this bill and the Governor for signing it into law. It is a smart measure that will improve municipal cybersecurity posture and threat intelligence sharing within the state. I look forward to more legislation on cybersecurity being considered so we can make New York as technologically safe as possible.”

Assemblymember Billy Jones said, “This piece of legislation is vital for our ever-changing technological state. The unique threats digital attackers pose to our municipalities requires a strong and direct response, and this bill will allow our local and state leaders to do just that. Cybersecurity is an increasingly important topic across all sectors of the state, and ensuring our government offices and agencies are able to respond to threats is critical.”

Assemblymember Steve Otis said, “Since the August 2023 release of Governor Hochul’s NYS Cybersecurity Strategy, New York has steadily increased cybersecurity assistance to local governments. This important legislation continues that commitment by requiring prompt reporting of cyberattacks and ransom payments and cybersecurity training of government employees. Full knowledge of cyberattacks statewide will allow state cyber agencies to better advise local governments and school districts about the evolving threat environment. This new law is another example of Governor Hochul and the Legislature working together to expand our resilience to these threats.”

New York State Division of Homeland Security and Emergency Services Commissioner Jackie Bray said, “As Governor Hochul says, our number one job is to keep New Yorkers safe. That includes protecting local governments from cyberattacks. This bill will ensure that all local governments and public authorities report cyberattacks soon after they occur so that our cyber security team has the information we need to respond to the ever-changing threat landscape.”

New York State Chief Information Officer and Director of the Office of Information Technology Services Dru Rai said, “Training and awareness is a key component in enhancing New York’s statewide cybersecurity posture and creating an army of cyber warriors who can better shield their IT assets, safeguard sensitive data and protect all New Yorkers. Thanks to Governor Hochul’s strong leadership and historic cybersecurity investments, as well as our ongoing partnership with the Senate, Assembly and our local governments, New York State is better prepared than ever to take the fight to the enemy. Cyber threat actors will continue to change their tactics in an attempt to find even the slightest vulnerability, but as a State we will continue to adapt, evolve, educate and strengthen our overall defenses to aggressively and proactively meet this challenge.”

New York Association of Towns Executive Director Christopher A Koetzle said, “Municipalities face ever-increasing and sophisticated cyber threats. I applaud the governor and the Legislature for helping to better protect our local governments across the state and giving them more tools to prepare for and respond to these growing threats. NYAOT has long stood in partnership with NYMIR in its mission of delivering cyber security training to each of our member towns and this bill will ensure that more towns make training a priority in the coming years.”

New York State Association of Counties Executive Director Stephen J. Acquario said, “Almost everything that counties and local governments do today rely on some type of information technology system, and we know that these systems are under threat. This new law is designed to raise the baseline of understanding of cybersecurity for all local leaders and employees so we can all better defend the information systems and data we all rely on to operate government and serve residents. On behalf of the county governments of New York, we commend Governor Hochul for approving this legislation.”

New York State Conference of Mayors Executive Director Barbara Van Epps said, “NYCOM applauds Governor Hochul and the State Legislature for making cybersecurity a top priority for New York. The enactment of this legislation marks a critical step forward in strengthening our collective defense against digital threats to the State and its local governments. By requiring prompt incident reporting, ransomware disclosures and annual cybersecurity training, the Governor is sending a clear message: cybersecurity is not just an IT issue — it’s a core public safety priority that demands coordination, vigilance and shared responsibility.”

The enactment of S.7672A/A.6769A underscores New York State’s commitment to cybersecurity, setting a precedent for other states to follow in protecting both state and local critical infrastructure from cyber threats. Under Governor Hochul's leadership, New York has led the nation in developing smart and effective cybersecurity policy — from nation-leading financial sector regulations to landmark legislation to protect New York's energy grid from cyberattacks, and first-in-the-nation hospital cybersecurity regulations.

These and other initiatives build on Governor Hochul’s previous actions and investments to build a more resilient, safer and secure digital environment for all New Yorkers. Following escalation of the conflict in the Middle East, Governor Hochul immediately convened the State’s top security personnel from counterintelligence, State Police and Homeland Security. In order to protect New York’s municipalities and cyber infrastructure, Governor Hochul has invested millions of dollars to harden local assets and ensure the protection of critical data that's used to deliver services to New Yorkers.

Over the last three years, Governor Hochul has also made foundational investments in New York’s cybersecurity by establishing the NYS Joint Security Operations Center (JSOC), operationalizing the statewide shared services program for counties and municipalities and expanding the State’s law enforcement cyber capabilities by growing the Computer Crimes Unit, Cyber Analysis Unit and Internet Crimes Against Children Center at the New York State Police.