In a recent article published in Talk of the Towns, a publication of the New York Association of Towns, F. Paul Green and Laura A. Higgins dive into the state’s new cybersecurity mandate, effective July 26, 2025. Municipalities must now report any cyber incident or ransomware demand to the NYS Commissioner of Homeland Security and Emergency Services within 72 hours, disclose any ransomware payment within 24 hours, and provide a detailed justification with 30 days of payment.
This groundbreaking law reflects a growing trend: states are tightening restrictions on ransomware payments and imposing aggressive reporting obligations to strengthen public sector resilience. In this article, Paul and Laura explain what these requirements mean for towns, villages, and public authorities–and why proactive compliance planning is essential.