(a) within six months of the effective date of this section, in consultation with the commissioner of environmental conservation, the commissioner of health, and such representatives of the chemical industry and higher education as may be appropriate, prepare a list that identifies toxic or hazardous substances, including but not limited to those substances listed as hazardous to public health, safety or the environment in regulations promulgated pursuant to article thirty-seven of the environmental conservation law, as well as those substances for which the state possesses insufficient or limited toxicological information but for which there exists preliminary evidence that the substance or the class of chemicals with similar physical and chemical properties to which it belongs has the potential to cause death, injury, or serious adverse effects to human health or the environment, based on the severity of the threat posed to the public by the unauthorized release of such substances. Such list will be promulgated in accord with the provisions of the state administrative procedure act;

(b) upon completion of the list required pursuant to paragraph (a) of this subdivision, but no later than one hundred twenty days after such date, in consultation with the commissioner of environmental conservation, the commissioner of health and such representatives of the chemical industry and any state, local and municipal officials as may be appropriate, identify facilities, including facilities regulated pursuant to title nine and title eleven of article twenty-seven and article forty of the environmental conservation law, but excluding facilities that hold liquified petroleum gas for fuel at retail sale as described in section 112(1)(4)(B) of the Clean Air Act (42 U.S.C. section 7412(r)(4)(b)) and those facilities that are defined as "water suppliers" in subdivision one of section eleven hundred twenty-five of the public health law, which because of their storage of or relationship to such substances identified pursuant to paragraph (a) of this subdivision pose risks to the public should an unauthorized release of such hazardous substances occur; and

(c) require such facilities identified pursuant to paragraph (b) of this subdivision, as the commissioner so determines, to prepare a vulnerability assessment of the security measures taken by such facilities to prevent and respond to the unauthorized release of hazardous substances as may be stored therein, which assessments the commissioner of the division of homeland security and emergency services shall review and consider in light of the seriousness of the risk posed and vulnerability of such facility and, where appropriate, make recommendations with respect thereto. 3. (a) On or before June first, two thousand five, the commissioner of the division of homeland security and emergency services shall make a preliminary report to the governor, the temporary president of the senate, the speaker of the assembly, the commissioner of environmental conservation, the commissioner of health and the chief executive officer of any such affected facility or his or her designee, and on or before December thirty-first, two thousand five, and not later than three years after such date, and every five years thereafter, the commissioner of the division of homeland security and emergency services shall report to the governor, the temporary president of the senate, the speaker of the assembly, the commissioner of environmental conservation, the commissioner of health and the chief executive officer of any such affected facility or his or her designee. Such report shall review the security measures being taken regarding critical infrastructure related to such facilities, assess the effectiveness thereof, and include recommendations to the legislature, the department of environmental conservation or the department of health if the commissioner of the division of homeland security and emergency services determines that additional measures are required to be implemented.

(b) Before the receipt of such report identified in paragraph (a) of this subdivision, each recipient of such report shall develop confidentiality protocols which shall be binding upon the recipient who issues the protocols and anyone to whom the recipient shows a copy of the report in consultation with the commissioner of the division of homeland security and emergency services, for the maintenance and use of such report so as to ensure the confidentiality of the report and all information contained therein, provided, however, that such protocols shall not be binding upon a person who is provided access to such report or any information contained therein pursuant to section eighty-nine of the public officers law after a final determination that access to such report or any information contained therein could not be denied pursuant to subdivision two of section eighty-seven of the public officers law. The commissioner of the division of homeland security and emergency services shall also develop protocols for such division related to the maintenance and use of such report so as to ensure the confidentiality of all sensitive information contained in such report. On each report, the commissioner of the division of homeland security and emergency services shall prominently display the following statement: "This report may contain information that if disclosed could endanger the life or safety of the public, and therefore, pursuant to section seven hundred eleven of the executive law, this report is to be maintained and used in a manner consistent with protocols established to preserve the confidentiality of the information contained herein in a manner consistent with law."

(c) The department of environmental conservation shall have the discretion to require that recommendations of the commissioner of the division of homeland security and emergency services be implemented by any owner or operator of a hazardous substances storage facility as defined in this section.