NY S06195

Amends Energy Law to require protection of critical infrastructure, including industrial control systems in gas distribution, transmission, and advanced metering infrastructure control centers.

Requires the Commissioner of Homeland Security and Emergency Services, in coordination with the State Office of Information Technology Services, to conduct vulnerability assessments of critical energy infrastructure and report findings every five years to the Governor, Legislature, and Public Service Commission.

Prohibits electric or gas corporations and municipalities from sharing, selling, or disclosing customer consumption data to third parties without customer consent, with exceptions for anonymized data, legally-required disclosures, and contracted service providers.

Mandates that electric and gas corporations establish minimum cybersecurity standards and cyber-insurance requirements for third parties seeking to connect to their systems to access consumption data.

Directs the Public Service Commission to promulgate rules and regulations by January 1, 2021 to implement and enforce the consumption data protection requirements, effective 30 days after the bill becomes law.