Rural water cyber plan proposed with audits

Summary#

S-10724 would amend New York’s Public Authorities Law and Public Service Law; it does not create a separate agency or corporation. Its stated goal is to improve cybersecurity at rural water utilities. The bill is at the introduced stage and is not law.

  • It would require a cybersecurity action plan for rural water utilities, developed by “the corporation” in consultation with the state Division of Homeland Security and Emergency Services (DHSES). The plan is due by December 31, 2027, and must include steps such as disconnecting control devices from direct internet exposure, using firewalls and VPNs, updating passwords, and training staff in manual backup operations.
  • Rural water utilities would have to implement the plan and conduct an independent third-party cybersecurity audit every year. Audit results would be filed confidentially with DHSES.
  • After discovering a cyber breach, data extortion, or unauthorized system access, a utility would have to notify DHSES and the State Police cybercrime unit within 24 hours.
  • DHSES would have to establish a water cyber-defense task force providing free technical help, monitoring tools, and emergency remediation.
  • The SECURE grant program would have to prioritize rural water utilities. That would not guarantee any utility a grant.

What it means for you#

  • Rural water utilities: The bill defines these generally as systems serving 10,000 people or fewer at homes, schools, and/or hospitals. Covered utilities would have to follow the action plan, get annual independent audits, and report specified cyber incidents within 24 hours of discovery.
  • Utility staff: The action plan must include training on running plants using manual backup operations. Video training is allowed only if followed by an in-person inspection.
  • Utilities seeking SECURE grants: They would receive priority in grant distribution, but the bill does not guarantee funding or set grant amounts.
  • Water customers: The bill does not directly change water rates, service eligibility, or customers’ legal rights. Whether utilities’ costs would affect rates is not stated.
  • Current law: The supplied material does not include the existing Public Authorities Law or Public Service Law, so I could not verify which requirements or SECURE program rules already exist.

Money#

No publicly available information on the bill’s total public or utility costs.

  • The bill requires DHSES to establish a task force and provide free services, but gives no staffing or cost estimate.
  • Utilities would have to pay for annual audits unless another source covers them; the bill does not say who pays or provide an estimate.
  • The bill gives rural utilities priority for SECURE grants, but states no grant amount or new appropriation.

What is unclear#

  • The action-plan section uses “the corporation” without naming it in that section. The bill also does not explain how the plan will be enforced or when each utility must complete its steps.
  • The definitions of “rural water utility” differ: the action-plan provision includes a “water management facility,” while the audit and grant provisions do not. The bill does not explain the difference.
  • It does not set audit standards, auditor qualifications, or rules for how confidential audit results may be used.
  • It does not define the terms “cyber breach,” “data extortion,” or “unauthorized system access,” or state a penalty for failing to meet the duties.
  • It does not say how utilities qualify for SECURE grants, how much funding is available, or how the new priority interacts with existing grant rules.

Case for#

  • The bill appears intended to address cybersecurity risks at smaller water systems by requiring specific security steps, yearly audits, and rapid notice of incidents.
  • A shared action plan could give utilities a common starting point, while the task force’s free assistance could help them put the plan into practice.
  • Prioritizing rural utilities for grants could direct funding toward the systems the bill identifies as especially vulnerable.

Case against#

  • Annual independent audits and required security measures could impose costs and work on small utilities, but the bill provides no estimate or clear funding to cover them.
  • The bill requires utilities to implement the plan without setting deadlines for their steps or describing enforcement. This could leave important duties uncertain.
  • The bill does not explain how the task force will be staffed or how its services will reach utilities across the state.
  • Different definitions of rural water utility could leave some facilities covered by one requirement but not another.