New York State Charges Ahead On Critical Infrastructure Cybersecurity Legislation

On Feb. 26, 2015, in an effort to make "New York State's computer infrastructure the most secure in the nation," the New York State Senate passed a suite of four cybersecurity-related bills focused on protecting critical infrastructure entities, such as providers of financial services, telecommunications, energy and health care. The bills mark an aggressive effort to toughen penalties on cybercriminals who attack critical infrastructure (S3404 and S3406),^1. to implement cybersecurity review processes and reporting by key state agencies (S3405),^2. and to establish a "baseline framework" and information-sharing protocols around cybersecurity risks (S3407).

Although the Senate bills put New York at the forefront of state critical infrastructure cybersecurity legislation, certain provisions should cause significant concern in corporate boardrooms and C suites because they effectively transform "voluntary" government guidelines into mandates without at least offering