Law / United States / 
New York
Cybersecurity incident reporting by municipal corporations and public authorities
N.Y. Gen. Mun. Law art. 19-C, secs. 995-a to 995-c (L. 2025, ch. 177)
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds municipal corporations, meaning a municipal corporation or a district as defined in section 119-n of the General Municipal Law, and public authorities, meaning a state authority or local authority as defined in section 2 of the Public Authorities Law or a subsidiary of one; it does not bind a private business.
- Report each cybersecurity incident, and any demand for a ransom payment, to the Commissioner of the Division of Homeland Security and Emergency Services in the form and method the Commissioner prescribes, no later than 72 hours after you reasonably believe the incident has occurred, stating whether you request or decline the Division's advice or technical assistance.
- If a ransom payment is made in connection with a cybersecurity incident, give the Commissioner notice of the payment within 24 hours and, within 30 days, a written description of why payment was necessary, the amount, the means of payment, the alternatives to payment you considered, the diligence you performed to find alternatives and the diligence you performed to ensure compliance with state and federal rules, including those of the Treasury Department's Office of Foreign Assets Control.
These lines are LexLint's reading of the law's text, as of .
What this law does
Article 19-C of the General Municipal Law requires all municipal corporations and public authorities to report cybersecurity incidents, and when applicable the demand of a ransom payment, to the commissioner of the division of homeland security and emergency services in the form and method the commissioner prescribes. The report is due no later than seventy-two hours after the municipal corporation or public authority reasonably believes the cybersecurity incident has occurred.
Within twenty-four hours of a ransom payment the municipal corporation or public authority must give the commissioner notice of the payment, and within thirty days it must give a written description of the reasons payment was necessary, the amount, the means of payment and the alternatives considered. A municipal corporation, for the purposes of the article, is a municipal corporation or a district as defined in section 119-n of the General Municipal Law.
A public authority, for the purposes of the article, is any state authority or local authority as defined in section two of the Public Authorities Law, or any subsidiary of one. Sections one and two of the act that added article 19-C take effect on the thirtieth day after the act's effective date. The bill was signed as chapter 177 of the Laws of 2025 on .