Bill > A06301

This bill, known as the "critical infrastructure standards and procedures (CRISP) act," mandates that the Office of Information Technology, in conjunction with the Division of Homeland Security and Emergency Services, identify critical infrastructure—which includes public transportation, water and wastewater facilities, public utilities, public buildings, hospitals, and facilities created under the public authorities law—that is vulnerable to cyber-attacks. Asset owners, defined as the public or private entities responsible for operating critical infrastructure and its associated automation and control systems, will be required to ensure that any new or upgraded automation and control system components, services, or solutions procured or installed on or after July 1, 2029, conform to specific cybersecurity standards outlined in the ISA/IEC 62443 series. Furthermore, on or after July 1, 2027, asset owners must ensure the ongoing operation and maintenance of their operational technology, which refers to the hardware and software that directly monitors or controls physical devices and processes, also complies with these ISA/IEC 62443 standards, including conducting annual risk assessments and developing mitigation plans.

Budget and Finance, Business and Industry

https://www.nysenate.gov/legislation/bills/2025/A6301