Bill > A06347

This bill requires governmental entities in New York to implement multifactor authentication (MFA) for network access, with a focus on enhancing cybersecurity and data protection. The bill defines "governmental entity" broadly to include state and local departments, public authorities, universities, and local governments, while excluding the judiciary and legislatures. It mandates that whenever possible, these entities should use MFA for accessing email, cloud storage, web applications, networks, databases, and servers. The bill defines multifactor authentication as using two or more different identification credentials, which can include knowledge-based methods (like passwords), possession-based methods (like security tokens), and biometric information (such as fingerprints or facial recognition). The legislation also establishes privacy protections, prohibiting governmental entities from requiring biometric authentication, selling biometric data, or sharing such data with law enforcement without a warrant. Additionally, the bill requires public websites maintained by governmental entities to encrypt all exchanges and transfers, ensuring data confidentiality. The state technology office will be responsible for establishing technical standards, with the option to grant waivers to entities that cannot fully comply. The bill will take effect one year after becoming law, giving governmental entities time to implement the required changes.

Budget and Finance, Business and Industry

https://www.nysenate.gov/legislation/bills/2025/A6347