(a) "Water supply emergency plan" shall mean a plan reviewed and approved by the commissioner and filed with the department. The plan shall follow a form which shall be specified by the department and which shall include, but not be limited to, those items enumerated in this section, and shall address those actions to be taken by a water supplier to anticipate emergencies and respond responsibly to emergency situations. The department shall maintain a list of all water suppliers required to submit a water supply emergency plan pursuant to this section.

(b) "Water supplier" shall mean any person who owns or operates a community water system that supplies drinking water to more than three thousand three hundred people. 2. All water suppliers shall prepare a water supply emergency plan; provided, however, if more than one water supplier is responsible for the same system, such plan shall be submitted jointly by such two or more water suppliers. The plan shall identify and outline the steps necessary to ensure that potable water is available during a water supply emergency. The water supply emergency plan shall include, but not be limited to, the following:

(a) establishment of criteria and procedures to determine critical water levels or safe yield of system,

(b) identification of existing and future sources of water under normal conditions and emergency conditions,

(c) system capacity and ability to meet peak demand and fire flows concurrently,

(d) storage capacities,

(e) current condition of present interconnections and identification of additional interconnections to meet a water supply emergency,

(f) specific action plan to be followed during a water supply emergency including a phased implementation of the plan,

(g) general water conservation programs and water use reduction strategies for water supply emergencies,

(h) prioritization of water users,

(i) identification and availability of emergency equipment needed during a water supply emergency,

(j) public notification program coordinated with the phased implementation schedule, and

(k) a vulnerability analysis assessment, including an analysis of vulnerability to terrorist attack and cyber attack, which shall be made after consultation with local and state law enforcement agencies. 3. All water suppliers shall, prior to the final submission of the water supply emergency plan, publish a notice in a newspaper of general circulation in the area served by the community water system stating that the proposed water emergency plan is available for review and comment; provided, however, a water supplier shall exempt from public disclosure for public review and comment any information it determines to pose a security risk to operation of the water supply system. Such notice shall be printed at least once in each of two successive weeks and the water supplier shall accept public comment for at least fourteen days following the date of the first publication. The water supplier shall submit all public comments with the water emergency plan to the department. 4. Water supply emergency plans shall be submitted to the commissioner on or before December thirty-first, nineteen hundred ninety. All water suppliers who have previously submitted emergency water supply plans which were approved by the commissioner prior to the effective date of this title are exempt from the provisions of this subdivision. The commissioner shall retain a copy of each water supply emergency plan. 5. Every water supplier shall review, and if necessary, revise its water supply emergency plan and report its findings to the commissioner by December thirty-first, nineteen hundred ninety-five. Any water supplier whose water supply emergency plan does not include an analysis of vulnerability to terrorist attack and cyber attack, shall initiate such an analysis by June first, two thousand seventeen, and shall revise its emergency plan and report its findings to the commissioner by January first, two thousand eighteen. Every water supplier shall keep its water supply emergency plan up to date, shall provide updated communication and notification information to the commissioner by December thirty-first of every year, and shall submit its water supply emergency plan to the commissioner for review at least once every five years and within thirty days after major water facility infrastructure changes have been made. The commissioner shall make available for review, following established security protocols, a copy of each vulnerability analysis assessment from a water supplier to the superintendent of state police, commissioner of the division of homeland security and emergency services, and chief technology officer. 6. (a) The commissioner or a county health department may provide guidance and assistance to community water systems on conducting vulnerability assessments, preparing water supply emergency plans and addressing threats from terrorist attacks, including cyber attacks, designed to disrupt the provision of safe drinking water or significantly affect the public health, or significantly affect the safety or supply of drinking water provided to communities or individuals.

(b) A community water system, that is not a water supplier, may elect to complete a water supply emergency plan. Such community water system may elect to submit the plan to the commissioner for approval. In such a case, the commissioner shall subject the plan to such approval process as described in paragraph (a) of subdivision one of this section. 7. The commissioner, in his discretion, may provide an opportunity for public hearing for persons served by a community water system. 8. The commissioner shall make such rules and regulations which may be necessary to effectuate the purposes of this title. 9. The commissioner, superintendent of state police, commissioner of the division of homeland security and emergency services, and chief technology officer shall keep confidential: (a) all vulnerability analysis assessments and all information derived therefrom; and (b) all information determined by a water supplier to pose a security risk to the operation of a water supply system. Such assessments and information shall be exempt from disclosure under article six of the public officers law. A person who, without authorization, discloses any such assessment or information to another person who has not been authorized to receive such assessment or information is guilty of a class A misdemeanor.