New York Adopts Strict Cybersecurity Rules for Utilities

The New York Public Service Commission on April 16 adopted comprehensive cybersecurity regulations for electric, gas, steam, and water utilities, establishing one of the most stringent frameworks in the U.S. to safeguard critical infrastructure and customer data. The action advances statutory requirements under state law directing utilities to strengthen privacy protections while addressing growing cyber threats to essential service networks.

The rules require utilities to evaluate their individual risk profiles and implement tailored cybersecurity programs designed to mitigate identified vulnerabilities. Covered entities must adopt widely accepted access controls and authentication protocols, while also deploying systems capable of detecting and responding to network intrusions. The framework mandates that utilities not only prevent cyber incidents but also develop clear response and recovery plans to ensure operational continuity in the event of disruptions.

The regulations apply broadly to information technology systems, including billing platforms, human resource systems, and customer-facing digital infrastructure, reflecting the increasing digitization of utility operations. By formalizing cybersecurity expectations across these systems, the commission aims to create a consistent baseline of protections across all regulated utilities.

The decision fulfills provisions in state law requiring the development of tools to monitor and protect customer information. At the same time, the commission continues to evaluate whether similar requirements should extend to the telecommunications sector, signaling potential future expansion of oversight.

Following issuance of the order, a Notice of Adoption will be filed with the Department of State, with the regulations scheduled to take effect on June 1, 2026. Commission staff are also preparing to develop separate cybersecurity standards for operational technology systems, indicating a phased approach to strengthening defenses across both digital and physical utility infrastructure.