New York State Office of Cybersecurity

New York State Office of Cybersecurity
Name	New York State Office of Cybersecurity
Type	State agency
Formed	2019
Headquarters	Albany, New York
Jurisdiction	State of New York
Parent agency	New York State Division of Homeland Security and Emergency Services

New York State Office of Cybersecurity is a state-level agency responsible for coordinating cybersecurity policy, incident response, and risk management across New York. It operates within the New York State Division of Homeland Security and Emergency Services framework and interacts with federal entities such as the Department of Homeland Security, the Federal Bureau of Investigation, and the Cybersecurity and Infrastructure Security Agency. The office supports state executive leadership offices including the Governor of New York and the New York State Legislature on matters related to critical infrastructure protection, information sharing, and compliance with state statutes like the New York State Information Security Breach and Notification Act.

History

The office emerged amid heightened attention following major incidents such as the Office of Personnel Management data breach, the Equifax data breach, and other high-profile compromises affecting entities like Target Corporation and Sony Pictures Entertainment. Its formation paralleled federal initiatives led by leaders like Christopher Krebs and agencies including the National Institute of Standards and Technology and the National Security Agency, and reflected policy debates shaped by events like the 2016 United States presidential election cyber attacks and legislation such as the Cybersecurity Information Sharing Act of 2015. State-level precedents included cybersecurity units in California Governor's Office of Emergency Services and Texas Department of Information Resources. Over time the office expanded amid collaboration with academic centers such as Columbia University, Cornell University, New York University, and research programs at Rensselaer Polytechnic Institute.

Organization and Leadership

Leadership structures align with executive offices led by the Governor of New York and administrative oversight by the Commissioner of Homeland Security and Emergency Services. Senior staff often coordinate with federal counterparts including the Attorney General of the United States's cyber task forces, the United States Secret Service, and the Federal Communications Commission. Organizational units mirror models used by entities such as the United Kingdom National Cyber Security Centre, the Australian Cyber Security Centre, and regional bodies like the Northeast Cybersecurity Hub. Advisory relationships draw on experts from institutions including the Brookings Institution, the Council on Foreign Relations, The RAND Corporation, and private sector leaders from companies like Microsoft, Google, Amazon Web Services, IBM, and Cisco Systems.

Jurisdiction and Responsibilities

Statutory responsibilities cover oversight of information security for state agencies and coordination with municipal partners such as the City of New York, County of Westchester, and Erie County. The office enforces compliance with standards influenced by frameworks from NIST Special Publication 800-53 and works alongside regulators such as the New York State Department of Financial Services regarding financial sector cybersecurity and the Public Service Commission (New York) on utility resilience. It has incident response roles akin to the United States Computer Emergency Readiness Team and engages with international entities such as INTERPOL and the European Union Agency for Cybersecurity on transnational threats. Legal interfaces include coordination with the New York State Office of the Attorney General and application of statutes like the Health Insurance Portability and Accountability Act for covered entities.

Programs and Initiatives

The office runs initiatives comparable to federal programs such as the Continuous Diagnostics and Mitigation program and state efforts reminiscent of the Multi-State Information Sharing and Analysis Center. Training and workforce development efforts partner with academic programs at Syracuse University, University at Albany, and Binghamton University and with certification bodies like ISC2 and ISACA. Grant programs and technical assistance align with funding mechanisms similar to the Homeland Security Grant Program and philanthropic collaborations seen with the Smithsonian Institution and Open Society Foundations. It sponsors tabletop exercises similar to exercises conducted by North Atlantic Treaty Organization partners and coordinates supply chain security measures referenced in guidance from National Institute of Standards and Technology and multinational firms such as Intel Corporation and Qualcomm.

Partnerships and Outreach

External engagement includes formal partnerships with federal agencies like the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, and the Department of Justice as well as private-sector alliances with Verizon, AT&T, Accenture, and Deloitte. Outreach programs involve collaboration with professional associations such as the Information Systems Security Association, the International Information System Security Certification Consortium, and the Internet Society, and civic engagement with nonprofits including The Internet Archive and Electronic Frontier Foundation. The office participates in intergovernmental forums alongside jurisdictions like California, Texas, Massachusetts, and Florida and contributes to standards dialogues with organizations including the International Organization for Standardization and the Institute of Electrical and Electronics Engineers.

Budget and Funding

Funding sources include state appropriations approved by the New York State Senate and the New York State Assembly, federal grants administered through agencies such as the Department of Homeland Security and the National Science Foundation, and cooperative agreements with private partners like Google.org and Microsoft Philanthropies. Budgetary oversight involves auditors from the New York State Comptroller and reporting requirements to the Governor of New York and legislative committees such as the New York State Senate Finance Committee. The office leverages public-private funding models similar to initiatives supported by the Economic Development Administration and grant programs administered by the Department of Energy for resilience investments.

Category:State cybersecurity agencies of the United States