(1) The records of a governmental entity or political subdivision regarding security measures designed for the protection of persons or property, public or private, are not subject to this chapter.
(2) The records described in Subsection (1) include:
(a) security plans, including a plan:
(i) to prepare for or mitigate terrorist activity; or
(ii) for emergency and disaster response and recovery;
(b) security codes and combinations, and passwords;
(c) passes and keys;
(d) security procedures;
(e) except as provided in Subsection (3), results of, or data collected from, a public entity's risk assessment or security audit; and
(f) building and public works designs, to the extent that the records or information relate to the ongoing security measures of a public entity.
(3) The records described in Subsection (1) do not include a certification that a community water system has conducted a risk and resilience assessment under 42 U.S.C. Sec. 300i-2.