§ 713. Protection of critical infrastructure including energy
generating and transmission facilities. 1. Notwithstanding any other
provision of law, the commissioner of the division of homeland security
and emergency services shall conduct a review and analysis of measures
being taken by the public service commission and any other agency or
authority of the state or any political subdivision thereof and, to the
extent practicable, of any federal entity, to protect the security, and
cyber security, of critical infrastructure related to energy generation
and transmission located within the state. The commissioner of the
division of homeland security and emergency services shall have the
authority to review any audits or reports related to the security of
such critical infrastructure, including audits or reports conducted at
the request of the public service commission or any other agency or
authority of the state or any political subdivision thereof or, to the
extent practicable, of any federal entity. The owners and operators of
such energy generating or transmission facilities shall, in compliance
with any federal and state requirements regarding the dissemination of
such information, provide access to the commissioner of the division of
homeland security and emergency services to such audits or reports
regarding such critical infrastructure provided, however, that exclusive
custody and control of such audits and reports shall remain solely with
the owners and operators of such energy generating or transmission
facilities. For the purposes of this article, the term "critical
infrastructure" has the meaning ascribed to that term in subdivision
five of section eighty-six of the public officers law.

2. (a) On or before December thirty-first, two thousand four, and not
later than three years after such date, and every five years thereafter,
the commissioner of the division of homeland security and emergency
services shall report to the governor, the temporary president of the
senate, the speaker of the assembly, the chairperson of the public
service commission and the chief executive of any such affected
generating or transmission company or his or her designee. Such report
shall review the security measures being taken regarding critical
infrastructure related to energy generating and transmission facilities,
assess the effectiveness thereof, and include recommendations to the
legislature or the public service commission if the commissioner of the
division of homeland security and emergency services determines that
additional measures are required to be implemented, considering, among
other factors, the unique characteristics of each energy generating or
transmission facility.

(b) Before the receipt of such report identified in paragraph (a) of
this subdivision, each recipient of such report shall develop
confidentiality protocols, which shall be binding upon the recipient who
issues the protocols and anyone to whom the recipient shows a copy of
the report, in consultation with the commissioner of the division of
homeland security and emergency services for the maintenance and use of
such report so as to ensure the confidentiality of the report and all
information contained therein, provided, however, that such protocols
shall not be binding upon a person who is provided access to such report
or any information contained therein pursuant to section eighty-nine of
the public officers law after a final determination that access to such
report or any information contained therein could not be denied pursuant
to subdivision two of section eighty-seven of the public officers law.
The commissioner of the division of homeland security and emergency
services shall also develop protocols for his or her office related to
the maintenance and use of such report so as to ensure the
confidentiality of the report and all information contained therein. On
each report, the commissioner of the division of homeland security and
emergency services shall prominently display the following statement:
"this report may contain information that if disclosed could endanger
the life or safety of the public, and therefore, pursuant to section
seven hundred eleven of the executive law, this report is to be
maintained and used in a manner consistent with protocols established to
preserve the confidentiality of the information contained herein in a
manner consistent with law".

(c) Except in the case of federally licensed electric generating
facilities, the public service commission shall have the discretion to
require that the recommendations of the commissioner of the division of
homeland security and emergency services be implemented by any owner or
operator of an energy generating or transmission facility.
Recommendations regarding federally licensed electric generating
facilities shall instead only be made available by the commissioner of
the division of homeland security and emergency services to the
appropriate federal agency in compliance with any federal and state
requirements regarding the dissemination of such information.

3. Any reports prepared pursuant to this article shall not be subject
to disclosure pursuant to section eighty-eight of the public officers
law.