Bill > A05739

This bill establishes the "Secure Our Data Act" to enhance cybersecurity protection for state entities in New York by requiring comprehensive data protection standards and practices. The legislation mandates that the Office of Information Technology Services develop and implement rigorous cybersecurity measures, including creating detailed regulations for protecting mission-critical information systems within one year of the act's effective date. Key provisions include requiring state entities to perform monthly vulnerability assessments of their critical systems, develop immutable and segmented data backup strategies, create comprehensive inventories of personal information and information systems, and establish incident response plans. The bill defines several technical terms like "breach of the security of the system" and "immutable" and requires annual workforce training on cybersecurity protection. State entities must conduct vulnerability testing, with a complete assessment of entire information systems mandated by December 2026, and must create incident response plans detailing how to manage and recover from security breaches. Importantly, the bill explicitly states that it does not create a private right of action, meaning individuals cannot sue state entities directly under this law. The overall goal is to protect personal information stored by state entities from unauthorized access, modification, or potential cyber threats.

Government Affairs

https://www.nysenate.gov/legislation/bills/2025/A5739