Infrastructure resilience bill would assess critical systems

Summary#

S-10728, the New York Critical Infrastructure Security and Resilience Act, would amend New York’s Executive Law by adding a statewide assessment program run by the commissioner of the Division of Homeland Security and Emergency Services. Its stated goal is to identify infrastructure risks and recommend ways to reduce them. The bill was introduced and referred to the Senate Rules Committee; it is not law.

  • The commissioner must assess critical infrastructure at least once every three years, covering matters such as physical and cyber security, condition, natural hazards, links between systems, emergency readiness, regional risks and workforce readiness.
  • The commissioner must set a method to rank vulnerabilities and recommend responses. Recommendations may include repairs, security changes, workforce investments or legal changes.
  • The commissioner must consult with named state agencies and other relevant groups. State agencies and public authorities must cooperate and provide relevant existing information, to the extent the law allows.
  • The commissioner must send a statewide report to state leaders within 18 months after the law takes effect and every three years after that. A public version must leave out sensitive details; a separate confidential annex may include them.
  • In years without a full assessment, the commissioner must give the governor and legislature a progress update.

What it means for you#

  • State agencies and public authorities: They would have to cooperate with the Division and provide relevant existing records, plans and reports, within the limits of other laws.
  • Infrastructure owners and operators: The commissioner must consult with them as appropriate. The bill does not require them to let the Division onto privately owned infrastructure or provide protected information beyond what existing law allows.
  • Residents and service users: The bill does not directly change utility rates, services, property rights or access to infrastructure. A public report would provide general findings and recommendations, but sensitive facility details could be kept confidential.
  • The Division: It would gain a required assessment and reporting role, but not a new power to conduct intrusive inspections or compel access to private infrastructure.

Money#

No cost estimate or appropriation is provided in the available material.

  • The bill creates duties to assess, report and provide progress updates. It does not say how much staff time or other resources those duties would require.
  • The commissioner may make agreements with research or other qualified entities for technical help, but the bill gives no cost estimate or funding source.

What is unclear#

  • The bill defines critical infrastructure broadly and lets the commissioner designate other infrastructure as essential. It does not set out how that designation would be made.
  • The bill does not specify the assessment methods, how owners would take part, or how the commissioner would assess infrastructure without compulsory access or information.
  • It does not describe oversight of the commissioner’s choices, or a process for challenging a vulnerability ranking or recommendation.
  • The current Executive Law text and details of existing assessment programs were not supplied, so I could not verify what assessments or related duties already exist. No publicly available information.

Case for#

  • A statewide assessment could help the state identify risks that cross agency or regional boundaries, including failures that could spread from one infrastructure system to another.
  • Requiring regular assessments and reports could give state leaders a recurring basis for setting priorities and tracking whether earlier problems are being addressed.
  • The bill directs the assessment to consider existing inspections and reports where practicable, and to coordinate with existing programs to avoid unnecessary duplication.

Case against#

  • The bill requires assessments but does not give the Division new powers to inspect private infrastructure or compel information. That could limit how complete the findings are.
  • The assessment covers many kinds of infrastructure and risk, but the bill does not specify the methods, staffing or funding needed to do the work.
  • Confidential annexes can protect sensitive security details, but the bill does not explain how much useful information the public version will contain.