Law / United States / 
New York
Public Service Commission Information Technology Cybersecurity Requirements, notices to the Department
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This binds the same covered entities as 16 NYCRR Part 1200 generally: a public utility company as defined in subdivision 23 of section 2 of the Public Service Law, other than the small water-works, electric and gas operators, telephone and telegraph corporations and municipal corporations section 1200.1(c) excludes. Declare operates_essential_service if your organization is such a utility.
- Notify the Director of the Department of Public Service's Office of Resilience, Utility Security, Nuclear Affairs and Emergency Preparedness as promptly as possible but in no event later than 72 hours after you reasonably believe a cybersecurity incident has occurred or is occurring that affects your information technology or information, or that of an affiliate or a third-party provider; no transitional period applies to this duty.
- Keep a log of all cybersecurity events and cybersecurity incidents, whether or not they are subject to the 72-hour notice, for at least three calendar years, and make the log and its supporting documentation available to the Director within 10 calendar days of a request.
- By June 30 each year, file a written statement for the prior calendar year in the form of Appendix 18 certifying compliance with Part 1200, beginning , and keep the records that support it for five years.
These lines are LexLint's reading of the law's text, as of .
What this law does
Each covered entity must notify the Director of the Department of Public Service’s Office of Resilience, Utility Security, Nuclear Affairs and Emergency Preparedness as promptly as possible but in no event later than 72 hours after it reasonably believes that a cybersecurity incident affecting its information technology, or that of an affiliate or a third party provider, has occurred or is occurring.
A cybersecurity incident is a cybersecurity event that falls within one of six listed categories, which include a reasonable likelihood of harming any part of normal operations, a demand for payment of a ransom, and any event that triggers a notice requirement to a government body by law, order or regulation.
Each covered entity must keep a log of all cybersecurity events and cybersecurity incidents, whether or not they are subject to the notice requirement, for no fewer than three calendar years. Each covered entity must submit a yearly written statement covering the prior calendar year, by June 30, certifying that it complies with Part 1200. The first Certification of Compliance is due . There is no transitional period to comply with the requirements of section 1200.21.
When LexLint raises it
When your app profile says your app runs an essential service.