# N.Y. EXC Law § 711-C: Cybersecurity incident reviews

> New York · Statutes · In force

URL: https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S711-C

## Section

- **Citation:** N.Y. EXC Law § 711-C
- **Heading:** Cybersecurity incident reviews
- **Jurisdiction:** New York
- **Kind:** Statutes
- **Status:** In force
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** New York Code / Act EXC / Article 26 / Section 711-C

## Text

§ 711-c. Cybersecurity incident reviews. 1. Definitions. As used in\nthis section, the terms cybersecurity incident, cyber threat, cyber\nthreat indicator, defensive measure, information system, municipal\ncorporation, public authority, ransom payment and ransomware attack\nshall have the same meaning as such terms are defined in article\nnineteen-C of the general municipal law.\n 2. The commissioner, or their designees, shall review each\ncybersecurity incident report and notice and explanation of ransom\npayment submitted pursuant to sections nine hundred ninety-five-b and\nnine hundred ninety-five-c of the general municipal law to assess\npotential impacts of cybersecurity incidents and ransom payments on the\nhealth, safety, welfare or security of the state, or its residents.\n 3. The commissioner, or their designees, may work with appropriate\nstate agencies, federal law enforcement, and federal homeland security\nagencies to provide municipal corporations and public authorities with\nreports of cybersecurity incidents and trends, including but not limited\nto, to the maximum extent practicable, related contextual information,\ncyber threat indicators, and defensive measures. The commissioner may\ncoordinate and share such reported information with municipal\ncorporations, public authorities, state agencies, and federal law\nenforcement and homeland security agencies to respond to and mitigate\ncybersecurity threats.\n 4. Such reports, assessments, records, reviews, documents,\nrecommendations, guidance and any information contained or used in its\npreparation shall be exempt from disclosure under article six of the\npublic officers law.\n 5. No later than forty-eight hours after receiving a cybersecurity\nincident report containing a request for advice and/or technical\nassistance from the division pursuant to subdivision one of section nine\nhundred ninety-five-b of the general municipal law, the commissioner or\nthe commissioner's designees shall acknowledge receipt of such request.\nAs soon as possible after receiving such a request, the commissioner or\nthe commissioner's designees, subject to the commissioner's discretion\nin prioritizing the division's response to the municipal corporation's\nor public authority's cybersecurity incident report, shall provide\nadvice to the requesting municipal corporation or public authority and,\nto the extent practicable, provide technical assistance.\n

## Nearby sections

- [N.Y. EXC Law § 709 Division of homeland security and emergency services; creation; powers and duties](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S709.md)
- [N.Y. EXC Law § 709-A Office of counterterrorism](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S709-A.md)
- [N.Y. EXC Law § 710 Commissioner of the division of homeland security and emergency services; appointment of the commissioner; powers and duties](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S710.md)
- [N.Y. EXC Law § 711 Reports](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S711.md)
- [N.Y. EXC Law § 711-A Analyze and report on the feasibility of implementing tornado warning systems](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S711-A.md)
- [N.Y. EXC Law § 711-B Review of water supplier vulnerability analysis assessments](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S711-B.md)
- [N.Y. EXC Law § 711-C Cybersecurity incident reviews](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S711-C.md)
- [N.Y. EXC Law § 712 Miscellaneous](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S712.md)
- [N.Y. EXC Law § 713 Protection of critical infrastructure including energy generating and transmission facilities](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S713.md)
- [N.Y. EXC Law § 714 Protection of critical infrastructure; storage facilities for hazardous substances](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S714.md)
- [N.Y. EXC Law § 716 Protection of critical infrastructure; commercial aviation, petroleum and natural gas fuel transmission facilities and pipelines](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S716.md)
- [N.Y. EXC Law § 717 Office of interoperable and emergency communications](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S717.md)
- [N.Y. EXC Law § 717-A Direct dialing to public service answering points](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S717-A.md)
- [N.Y. EXC Law § 718 Voluntary surveillance access database](https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S718.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/STATE_NY_AEXC_A26_S711-C. Check the current official text before relying on it. Not legal advice.