N.Y. GMU Law § 995-C

§ 995-c. Notice and explanation of ransom payment. Notwithstanding any\nother provision of law to the contrary, each municipal corporation or\npublic authority shall, in the event of a ransom payment made in\nconnection with a cybersecurity incident involving the municipal\ncorporation or public authority, provide the commissioner of the\ndivision of homeland security and emergency services through means\nprescribed by such commissioner with the following:\n 1. within twenty-four hours of the ransom payment, notice of the\npayment; and\n 2. within thirty days of the ransom payment, a written description of\nthe reasons payment was necessary, the amount of the ransom payment, the\nmeans by which the ransom payment was made, a description of\nalternatives to payment considered, all diligence performed to find\nalternatives to payment and all diligence performed to ensure compliance\nwith applicable state and federal rules and regulations including those\nof the United States department of the treasury's office of foreign\nassets control.\n