On June 26, 2025 Governor Hochul signed Senate Bill 7672A/Assembly Bill A6769 into law which is aimed at addressing cybersecurity concerns for local governments. Effective immediately, all municipal corporations (defined as “a city, a town, a village, a board of cooperative educational services (“BOCES”), fire district or a school district”) and public authorities, (collectively referred to as “municipalities”), must report any cybersecurity incidents to the Commissioner of the New York State Division of Homeland Security and Emergency Services (“DHSES”). If any ransom payments are made, municipalities must also provide notice of the ransom payments to the Commissioner of the DHSES. Beginning January 1, 2026, municipal employees, excluding school districts and BOCES, will be required to complete annual cybersecurity awareness training.
The law adds Article 19-c to the General Municipal Law, § 711-C to the Executive Law, and §§ 103-F and 210 to the State Technology Law (which only apply to State Agencies and is not discussed herein). The new Executive Law § 711-C outlines the responsibilities of DHSES, including the assessment and review of all incident reports, information sharing among municipalities to mitigate cybersecurity threats and providing advice and assistance at a municipality’s request. The new State laws do not create a private right of action (that would otherwise allow municipalities to be sued for failing to report cybersecurity incidents or if employees did not complete the required training).
Reporting of Cybersecurity Incidents & Ransom Payments
Reports of cybersecurity incidents, including demands for ransom payments, must be filed with the DHSES within 72 hours of the incident. The report must include whether the municipality is requesting or declining advice and/or technical assistance from DHSES. For the purposes of this reporting obligation, a “cybersecurity incident” is an event occurring on, or conducted through, a computer network, which actually or imminently jeopardizes the integrity, confidentiality or availability of computers, information or communications systems or networks, physical or virtual infrastructure controlled by computers or information systems or information residing on those systems or networks. Once a report is filed, the incident will receive a unique numerical identifier as proof of reporting and for subsequent reporting. Reports can be made electronically on the DHSES website at this link.
A municipality must also provide DHSES notice of a ransom payment within 24 hours. Within 30 days of a ransom payment, municipalities must also submit a written description of the reason for payment, amount of payment, means of tendering payment, alternatives to payment considered and steps taken to find alternatives to payment. Cybersecurity incident reports and any records related to a ransom payment submitted to DHSES are exempt from disclosure pursuant to the New York State Freedom of Information Law (“FOIL”).
Cybersecurity Training Requirements
As of January 1, 2026, all municipal employees, excluding school districts and BOCES, who use technology as part of their official job duties are required to take an annual cybersecurity awareness training course. See State Technology Law § 103-F. The first annual training must be completed on or before December 31, 2026 and by December 31st every year thereafter. The New York State Department of Office of Information Services will provide the training at no charge. The requirement can also be satisfied by another cybersecurity training course. All training must be conducted during the employee’s regular working hours and employees must receive compensation for the training at their regular rate of pay. Failure to take the training may impact insurance costs and increase the risks of cybersecurity incidents. However, there is no reporting requirement for training.
Please do not hesitate to contact any of our Municipal Law attorneys with questions or for assistance.
