Runs an essential service, in New York

16 NYCRR 1200.21 · Read the law's page

• This binds the same covered entities as 16 NYCRR Part 1200 generally: a public utility company as defined in subdivision 23 of section 2 of the Public Service Law, other than the small water-works, electric and gas operators, telephone and telegraph corporations and municipal corporations section 1200.1(c) excludes. Declare operates_essential_service if your organization is such a utility.
• Notify the Director of the Department of Public Service's Office of Resilience, Utility Security, Nuclear Affairs and Emergency Preparedness as promptly as possible but in no event later than 72 hours after you reasonably believe a cybersecurity incident has occurred or is occurring that affects your information technology or information, or that of an affiliate or a third-party provider; no transitional period applies to this duty.
• Keep a log of all cybersecurity events and cybersecurity incidents, whether or not they are subject to the 72-hour notice, for at least three calendar years, and make the log and its supporting documentation available to the Director within 10 calendar days of a request.
• By June 30 each year, file a written statement for the prior calendar year in the form of Appendix 18 certifying compliance with Part 1200, beginning June 30, 2027, and keep the records that support it for five years.

16 NYCRR Part 1200, secs. 1200.2 to 1200.20 · Read the law's page

• This binds a covered entity: a public utility company as defined in subdivision 23 of section 2 of the Public Service Law (electric, gas, steam and water-works companies), except a water-works corporation serving fewer than 50,001 service connections, an electric corporation maintaining fewer than 50,000 service lines, a gas corporation that is a small business under the State Administrative Procedure Act, a telephone or telegraph corporation, and a municipal corporation. Declare operates_essential_service if your organization is such a utility; the Part covers information technology and not operational technology.
• Maintain a written cybersecurity program based on your risk assessment that identifies and assesses risks, protects your information technology, detects, responds to and recovers from cybersecurity events, and fulfills regulatory reporting obligations, and give the Director of the Department of Public Service's Office of Resilience, Utility Security, Nuclear Affairs and Emergency Preparedness your program documentation within 10 calendar days of a request (section 1200.2).
• Implement a written cybersecurity policy approved by a senior officer or your board covering the areas section 1200.3 lists, designate a qualified Chief Information Security Officer, and have that officer report in writing to your board at least yearly (sections 1200.3 and 1200.4).
• Run continuous monitoring or, absent it, penetration testing at least every 12 months and vulnerability assessments at least every six months, and carry out a documented risk assessment at least once every two years (sections 1200.5 and 1200.9).
• Limit and yearly review user access privileges, require multi-factor authentication for access to your internal networks from an external network unless your Chief Information Security Officer approves equivalent controls in writing, encrypt nonpublic information in transit and at rest or use compensating controls your Chief Information Security Officer approves, and give all personnel annual cybersecurity awareness training (sections 1200.7, 1200.12, 1200.14 and 1200.15).
• Keep a written incident response plan, test it at least yearly with a tabletop or similar exercise, hold a contract with a qualified third-party forensic vendor, and have a forensic report prepared after a suspected cybersecurity incident (sections 1200.16 and 1200.19).
• Have a qualified auditor perform a third-party cybersecurity audit every year and make it available to the Director by September 15, and submit to cybersecurity audits by Department staff on request, not more than yearly (sections 1200.17 and 1200.18).
• Contract in advance with a credit monitoring service and offer it, paid for by you or another responsible party for at least one year, to each person you must notify of a breach under General Business Law 899-aa (section 1200.20).
• Comply from June 1, 2026, with 180 days to comply with most requirements and one year or eighteen months for the sections section 1200.25 names (sections 1200.24 and 1200.25).