Cybersecurity incident reviews

§ 711-c. Cybersecurity incident reviews. 1. Definitions. As used in this section, the terms cybersecurity incident, cyber threat, cyber threat indicator, defensive measure, information system, municipal corporation, public authority, ransom payment and ransomware attack shall have the same meaning as such terms are defined in article nineteen-C of the general municipal law. 2. The commissioner, or their designees, shall review each cybersecurity incident report and notice and explanation of ransom payment submitted pursuant to sections nine hundred ninety-five-b and nine hundred ninety-five-c of the general municipal law to assess potential impacts of cybersecurity incidents and ransom payments on the health, safety, welfare or security of the state, or its residents. 3. The commissioner, or their designees, may work with appropriate state agencies, federal law enforcement, and federal homeland security agencies to provide municipal corporations and public authorities with reports of cybersecurity incidents and trends, including but not limited to, to the maximum extent practicable, related contextual information, cyber threat indicators, and defensive measures. The commissioner may coordinate and share such reported information with municipal corporations, public authorities, state agencies, and federal law enforcement and homeland security agencies to respond to and mitigate cybersecurity threats. 4. Such reports, assessments, records, reviews, documents, recommendations, guidance and any information contained or used in its preparation shall be exempt from disclosure under article six of the public officers law. 5. No later than forty-eight hours after receiving a cybersecurity incident report containing a request for advice and/or technical assistance from the division pursuant to subdivision one of section nine hundred ninety-five-b of the general municipal law, the commissioner or the commissioner's designees shall acknowledge receipt of such request. As soon as possible after receiving such a request, the commissioner or the commissioner's designees, subject to the commissioner's discretion in prioritizing the division's response to the municipal corporation's or public authority's cybersecurity incident report, shall provide advice to the requesting municipal corporation or public authority and, to the extent practicable, provide technical assistance.