Cybersecurity Policy Report, N.Y. Senate Votes to Pass Secure Our Data Act, (May 29, 2025)
The New York state Senate this week voted to approve the proposed Secure Our Data Act, which would require state entities to enhance cybersecurity measures, including creating “immutable backups and conducting regular vulnerability assessments.”
The primary objective of SB 1961 is to protect personal information maintained by state entities from unauthorized access, breaches, and alterations. The bill would require the development of cybersecurity protection standards, including the creation of immutable backups, data validation, and segmented storage to safeguard personal information.
“Our state’s information systems are under attack every day. The emergence of generative Al tools has enabled these attacks to grow in sophistication. While we cannot eradicate all cyberattacks or halt the behavior of all bad actors, we must fortify defense of New York’s information systems and the personal information stored therein,” said bill sponsor Sen. Kristen Gonzalez (D.).
The bill would also require annual workforce training on breach protection and procedures for system recovery. The legislation includes a timeline for implementing these standards, with regulations to be implemented within one year of the act’s effective date. The bill would also require state entities to conduct monthly vulnerability assessments of mission-critical systems starting January 2026 and complete a full system assessment by December 2026.
The bill does not create a private right of action.
The bill (S.B. 1961, Reg Sess.) has been referred to the Senate Governmental Operations Committee.
News: StateLegislation DataSecurity DataBreach