NY A10605

State agencies must identify employees who use computers for at least 25 percent of their job duties and require these employees to complete annual cyber security training approved by the office of information technology services.

Each state agency may select the most appropriate cyber security training program from office-approved options and verify employee completion through a standardized form that tracks completion percentages.

Executive heads of state agencies must verify training completion and conduct periodic internal reviews to ensure compliance with the annual training requirement.

Exemptions apply to employees on military leave, federal family and medical leave, workers' compensation leave, or extended leave if they lack access to state database and IT systems.

The bill takes effect 60 days after enactment, with authorization for implementing rules and regulations to be completed by the effective date.