General Municipal Law 995-C — Legislation

Legislation Search OpenLegislation Statutes Search Term Search icon Search previous SECTION 995-B Reporting of cybersecurity incidents up ARTICLE 19-C Cybersecurity Incident Reporting Requirements For Municipal Corporations and Public Authorities Viewing most recent revision (from 2025-08-01) View historical revision as of: -- Choose a Date -- 2025-08-01 2025-07-04 Share Facebook Email SECTION 995-C Notice and explanation of ransom payment General Municipal (GMU) CHAPTER 24, ARTICLE 19-C § 995-c. Notice and explanation of ransom payment. Notwithstanding any other provision of law to the contrary, each municipal corporation or public authority shall, in the event of a ransom payment made in connection with a cybersecurity incident involving the municipal corporation or public authority, provide the commissioner of the division of homeland security and emergency services through means prescribed by such commissioner with the following: 1. within twenty-four hours of the ransom payment, notice of the payment; and 2. within thirty days of the ransom payment, a written description of the reasons payment was necessary, the amount of the ransom payment, the means by which the ransom payment was made, a description of alternatives to payment considered, all diligence performed to find alternatives to payment and all diligence performed to ensure compliance with applicable state and federal rules and regulations including those of the United States department of the treasury's office of foreign assets control.