Strengthening New York’s Cyber Defense: What Government Agencies Need to Know About S.7672A / A.6769A
Strengthening New York’s Cyber Defense: What Government Agencies Need to Know About S.7672A / A.6769A
In June 2025, Governor Kathy Hochul signed Senate Bill S.7672A / Assembly Bill A.6769A into law, now known as Chapter 177. This legislation marks a major shift in how New York’s municipal corporations and public authorities approach cybersecurity. It introduces new reporting requirements, enhances incident response protocols, and mandates annual training for government employees. If you work in state or local government, here’s what you need to know to stay compliant and prepared.
Key Requirements at a Glance:
- Incident Reporting
Cybersecurity incidents—those that threaten the confidentiality, integrity, or availability of information systems—must be reported to the Division of Homeland Security and Emergency Services (DHSES) within 72 hours of discovery. - Ransom Payments
If a ransom is paid, your agency must notify DHSES within 24 hours. A detailed written report is then required within 30 days, including the amount paid, justification, alternatives considered, and any compliance efforts such as adherence to OFAC regulations. - Technical Support
DHSES will review all reports and respond to requests for assistance within 48 hours when feasible. This support can be especially valuable for under-resourced municipalities. - Privacy Protections
All incident reports and ransom payment details are exempt from public disclosure under the Freedom of Information Law (FOIL), helping protect sensitive security information. - Annual Cyber Training
Starting January 1, 2026, all government employees who use technology must complete annual cybersecurity awareness training. Free training will be available through the Office of Information Technology Services (ITS), or agencies may choose other approved programs. - Data Protection Standards
Agencies must establish clear policies for breach prevention, backups, recovery, vulnerability management, and system inventories.
Why This Matters
- Faster Response: Timely reporting allows DHSES to coordinate support and contain threats quickly.
- Transparency and Accountability: Ransom disclosures help the state monitor payments and prevent funding of criminal or terrorist groups.
- Support for Local Teams: DHSES provides guidance that can supplement local IT resources.
- Empowered Employees: Training helps staff recognize threats and respond effectively.
- Stronger Infrastructure: Standardized data protection policies reduce risk and improve resilience.
Cyber threats are growing more sophisticated. Suffolk County’s 2022 ransomware attack disrupted services for weeks and cost over $25 million. This law is designed to help prevent similar incidents.
What You Should Do Now
Phase 1: Immediate Actions
- Update your incident response plan to meet the 72-hour and 24-hour reporting deadlines.
- Train your response leads on how to report incidents via the DHSES portal or hotline (1‑844‑OCT‑CIRT).
Phase 2: Policy and Compliance
- Draft or revise policies for ransom reporting and FOIL exemptions.
- Schedule cybersecurity training for all relevant staff before January 2026.
Phase 3: Prep and Assess
- Take inventory of your systems and review your backup and recovery plans.
- Reach out to DHSES early for guidance or mock scenario testing.
Phase 4: Monitor and Improve
- Review incident reports regularly to identify trends or vulnerabilities.
- Share best practices and training resources across departments.
Sample Internal Checklist
| Task | Action Item | Deadline |
| Incident Response Plan | Add 72h/24h reporting workflows | Immediate |
| Employee Training | Launch campaign and schedule annual sessions | Before Jan 2026 |
| Data Policies | Draft standards for protection and breach response | Q4 2025 |
| DHSES Engagement | Register for portal access and test submissions | Q3 2025 |
| Technical Assistance | Submit mock scenarios to DHSES | Q3 2025 |
Training Makes the Difference
Cybersecurity is no longer just an IT issue—it’s a shared responsibility across every level of government. The law provides the framework, but it’s your team’s awareness and readiness that truly make the difference.
Enterprise Training Solutions offers eLearning programs that help government staff:
- Spot phishing and social engineering tactics
- Understand incident reporting requirements
- Apply best practices for data protection and recovery
In today’s threat landscape, continuous learning is one of your strongest defenses. Empower your team and help keep New York’s networks secure, resilient, and ready for the future.
