GLOBAL DIGITAL FORENSICS

OT regulatory assessment planning library

Water and wastewater, power and energy, manufacturing, and transportation

Planning edition | Research cutoff October 15, 2026

This library combines four sector manuals, a 50-state and local applicability companion, an editable project workbook and the review record. It supports scoping through field examination, corrective work, verification and handover.

Read the scope before adopting the pack. All 50 states received selected-source screening. This edition does not establish every state-sector or local obligation. Controlling instruments, site facts, permits, contracts and technical approvals remain necessary. Restricted or unresolved material is identified below and in the review report.

Planning packs and working records

VolumeUse
Water and wastewater35 pages | 24 fillable fieldsAWIA coverage and certification, wastewater permits, selected state duties, treatment and telemetry examination, safe work, evidence, recovery and verification.
Power and energy35 pages | 24 fillable fieldsNERC applicability and evidence workstreams, distribution and DER, nuclear and pipeline boundaries, control centers, substations and operating authority.
Manufacturing34 pages | 24 fillable fieldsProcess safety, contract information boundaries, product and quality records, production cells, controlled changes and restart acceptance.
Transportation36 pages | 24 fillable fieldsSurface transportation, ports and vessels, aviation and pipelines. Includes mode boundaries, maritime milestones and recurring work, and restricted-instrument questions.
50-state and local applicability companion72 pages | 12 fillable fieldsOne selected-authority profile for each state, the local determination method, facility inputs and fillable local and notification worksheets.
Review findings and unresolved questions27 pagesAdversarial content, accuracy and usability desk reviews; corrections and exclusions; eight open questions with the evidence needed to resolve them.
Editable project workbook13 worksheets | 200 state-sector screening prompts | 88 proposed tasksApplicability, assets, control checks, evidence, activity permits, findings, notification decisions, local duties, recurring calendar, sources and review findings. Site decisions begin Unresolved.
Source register101 authorities and publicationsPortable register with full URLs, locators, legal/publication status, research date and retrieval limitations.

First use

  1. CISO and risk owner: select the sector pack and review the open questions. Define the decision, business consequence and intended assurance.
  2. Compliance owner: review federal scope and each relevant state profile. Retrieve controlling instruments and record signed site decisions. A missing rule or document remains unresolved.
  3. Project manager: assign the 22 proposed tasks for the selected sector, name people and alternates, and populate dates around evidence access and operating windows.
  4. Technical lead and field technician: follow the approved method and operating owner. Use existing evidence first; obtain exact activity authorization, baseline, stop and recovery arrangements before field work.
  5. Reviewer and sponsor: challenge findings against evidence and scope, separate implementation from verified closure, and sign the facility adoption decisions.

The PDF contents and source IDs are clickable. The worksheets are interactive; save a completed copy in the approved record location and check that entered values persist in the selected PDF reader. The workbook contains no completed facility assessment or inferred personal approval.

Questions requiring discussion

These questions were retained after the content, usability and accuracy reviews. They require the identified evidence; an assumed legal obligation or exemption was not substituted.

QuestionUnresolved informationNext evidence
Q01 Current CIRCIA instrumentAn effective final rule and its operative coverage/date were not established.Obtain the current final Federal Register instrument and implementing CISA instructions. Record whether and when the named entity is covered.
Q02 Current TSA rail and pipeline instrumentsPublic copies obtained expire May 2 2026. Current replacements, extensions and operator-specific approved plans were not authenticated.The operator security official supplies the currently issued instruments, applicability notice and approved plans through the authorized handling process.
Q03 Aviation cybersecurity criteriaCurrent airport/aircraft security-program amendments and applicable airworthiness/operating conditions were not supplied.Obtain the actual approved program and qualified aviation review. Do not reconstruct SSI or product certification criteria from public summaries.
Q04 CMMC implementation directionAn official indexed July 2026 announcement reports Phase II suspension. Current detailed procurement direction and effect on each awarded contract remain unresolved.Obtain current implementing direction and the contracting-officer determination for the specific award. Existing safeguarding clauses require a separate assessment.
Q05 State gaps and restricted retrievalLouisiana and Vermont sector-wide duties remain research gaps. Some New York, Minnesota and Massachusetts full text could not be retrieved; Illinois/Pennsylvania enactment/finality was not established.Retrieve controlling state text and current agency instructions before a site-specific conclusion. Do not interpret these gaps as exemptions.
Q06 Facility local and contractual inputsNo facility list, complete permits, leases, grants, insurer terms, ownership matrix or local operating agreements were supplied.Provide the site and operator inventory. Complete the local worksheets and retain each controlling instrument, trigger and verified contact.
Q07 Licensed standards and specialist regimesFull normative ISA/IEC texts and product-specific, nuclear, safety or quality approvals were not obtained.Obtain the applicable edition and the responsible specialist. Agree assessment criteria and evidence before claiming conformity.
Q08 Current NERC requirement editionsThe public register distinguishes current and future enforcement but does not complete the entity-specific matrix.Freeze current requirement versions, implementation dates, registration and BES categorization with the compliance owner.
Source register with direct links

Government, regulator and standards-publisher sources support regulatory and standards statements. Selected peer reviewed research supports qualitative assessment context. Social media and vendor marketing are excluded as authorities. Drafts, expired instruments and restricted retrieval remain labeled.

IDAuthority or publicationStatusLocator and limitation
F01Guide to Operational Technology Security Revision 3NISTFinal guidanceSeptember 2023 final publication; chapters 4 through 6 and OT control tailoring
F02Guide to Operational Technology Security Revision 4NISTDraft guidanceSeptember 21 2026 initial public draftRevision 4 is not the final baseline in this edition.
F03Technical Guide to Information Security Testing and AssessmentNISTFinal guidanceAssessment planning and rules of engagementApply OT operating constraints; this IT testing guide does not authorize production testing.
F04Incident Response Recommendations and Considerations Revision 3NISTFinal guidanceApril 2025 final publication
F05CIRCIA public rulemaking noticeCISA and Federal RegisterRulemaking record2026 notice referring to the proposed rule and further town hallsThis notice does not establish an effective final reporting rule. A current final rule was not established in this research.
F06State PlansOSHAJurisdiction directoryState and federal occupational safety jurisdictionCheck public employee coverage and industry exceptions for the actual workplace.
F07Emergency Release Notifications under EPCRAEPAAgency guidanceEPCRA 304 and CERCLA release notificationChemical thresholds, release facts and recipients require a separate EHS determination.
F08ISA IEC 62443 Series of StandardsISAStandards publisher overviewPublished series and applicable partsFull normative texts were not obtained. No clause-level conformity or security level is certified here.
R01A survey of cyber security management in industrial control systemsKnowles and colleagues in International Journal of Critical Infrastructure ProtectionPeer reviewed researchVolume 9 June 2015 pages 52 to 80Used for qualitative management context, not contemporary law or numeric effectiveness claims.
R02Threat modeling of industrial control systems A systematic literature reviewComputers and SecurityPeer reviewed researchVolume 136 January 2024 article 103543Supports structured threat modeling; it does not validate a specific plant assessment.
R03ICSSIM A framework for building industrial control systems security testbedsComputers in IndustryPeer reviewed researchVolume 148 June 2023 article 103906Laboratory results do not establish safety or coverage on installed production equipment.
W01AWIA Section 2013 and SDWA Section 1433EPAAgency implementation guidanceCovered systems; RRA and ERP content; certification cycles
W02Certification of Risk and Resilience Assessments and Emergency Response PlansEPAAgency implementation guidanceCertification and secure retention of actual plans
W03Emergency Response Plan Templates for Drinking Water and WastewaterEPAAgency guidanceSeparate drinking water and wastewater templatesEPA identifies the wastewater template as voluntary under SDWA 1433.
W04Cybersecurity for Water and Wastewater FacilitiesIndiana IDEMAgency implementation guidanceIC 13-18-16.5; covered facility types; 2026 assessments and incident reporting
W05Community Water and Sewerage System CybersecurityMaryland General AssemblyEnacted chapter lawChapter 495 of 2025; Environment Article 9-2704 through 9-2707Read final added text and strikeouts correctly; customers are not the same unit as AWIA population.
W06Guidance on Senate Bill 871Maryland MDEAgency guidanceApril 2026 guidance; system assessments, certification and ERP workAgency collection or legislative reporting dates must not be assigned to operators as unverified filing deadlines.
W07Water Quality Accountability ActNew Jersey DEPAgency implementation guidanceCybersecurity plans; annual assessment; scope over 500 service connectionsFull-page retrieval was restricted; selected official search excerpts were checked against chapter law W08.
W08Water cybersecurity amendmentsNew Jersey LegislatureEnacted chapter lawP L 2021 chapter 262 and N J S A 58:31-4.1
W09New York drinking water cybersecurity applicabilityNew York DOHCurrent rule page10 NYCRR Appendix 5-E.1; Subpart 5-1.33Full-page retrieval was restricted. The January 1 2027 transition and immediate training/reporting exceptions are supported by official indexed text; obtain the full rule before facility signoff.
W10Wastewater cybersecurity resources and adopted rulesNew York DECAgency implementation guidance6 NYCRR Parts 616 650 and 750; March 2026 adoption; reporting
W11Wastewater cybersecurity regulations compendiumNew York DECAgency guidanceMarch 2026 compendium; POTW compliance dates and referenced documents
P01Critical Infrastructure Protection reliability standards registerNERCStandards registerFamily status and mandatory versus future enforcementFreeze the exact applicable standard, requirement and US implementation plan for the engagement. Approval and enforcement dates differ.
P02New bulk power reliability safeguardsFERCAgency order announcementMarch 19 2026 approvals including virtualization and low impact controlsUse the underlying orders and implementation plans; the announcement is not a universal immediate enforcement date.
P03Reliability standards and US effective date resourcesNERCStandards registerUS effective date status and functional applicability
P04Electric Emergency Incident and Disturbance ReportDOEAgency reporting sourceCurrent DOE-417 form and event instructionsDetermine the applicable incident category and clock from current instructions; no single clock covers all events.
P05Nuclear cybersecurityNRCAgency implementation source10 CFR 73.54 and approved licensee cybersecurity plansNuclear licensing scope is separate from NERC CIP scope.
P06Electric distribution cybersecurity baselinesNARUC and DOEGovernment supported guidanceDistribution and distributed energy resource baselinesNot a nationwide binding rule; identify state adoption or contract incorporation.
P07Utility IT cybersecurity regulations announcementNew York DPSAgency announcementApril 16 2026 announcement; June 1 2026 effectivenessThe announcement explicitly distinguishes IT regulations from prospective industry OT rulemaking.
M01Process safety management of highly hazardous chemicalsOSHAFederal regulationParagraphs e j l m and o; PHA, mechanical integrity, management of change and compliance auditsCoverage is process and substance dependent. The three-year PSM audit is not a universal OT cybersecurity audit rule.
M02Safeguarding Covered Defense Information and Cyber Incident ReportingAcquisition govFederal contract clauseDFARS 252.204-7012; covered information and rapid reportingThe contract, incorporated revision and system boundary control applicability.
M03CMMC Phase II suspension announcementOffice of Industrial Base GrowthOfficial agency announcementJuly 13 2026 announcementOfficial indexed content reports suspension of the planned Phase II rollout. Full-page retrieval was restricted. Obtain current procurement direction and contracting-officer interpretation; do not infer amendment of an existing contract.
M04CMMC program documentationDefense CIOProgram sourceProgram instruments and contract implementationReconcile current instructions with M03 and the awarded contract before using historical phase dates.
M05Risk Management Program guidanceEPAAgency guidance40 CFR Part 68 applicability and program levelsCovered chemical process duties do not create a generic cybersecurity certification.
M06CFATS program statusCISAArchived agency noticeStatutory authorization expired July 28 2023No current reauthorization was established here. Do not treat an archived CFATS checklist as proof of an active 2026 duty.
M07Manufacturing Profile Revision 1NISTFinal guidanceOctober 2020 final profile aligned to CSF 1.1
M08Manufacturing Profile Revision 2NISTDraft guidanceSeptember 2025 initial public draft aligned to CSF 2.0A final Revision 2 was not established; do not call this draft a final requirement.
T01Cybersecurity in the Marine Transportation SystemUS Coast Guard and Federal RegisterFinal rule90 FR 6298; 33 CFR 101 Subpart F; 101.605 and 101.630 through 101.665Check subsequent amendments and operator-specific approval, waivers and equivalents.
T02Maritime cybersecurity implementation timelineUS Coast GuardAgency implementation noticeJanuary 12 2026 training and July 16 2027 principal compliance milestoneOfficial indexed notice checked against T01; full-page retrieval restricted.
T03Pipeline Cybersecurity Mitigation Actions Contingency Planning and TestingTSAExpired directive copySecurity Directive Pipeline-2021-02F; effective May 3 2025; expires May 2 2026Historical public reference only. Obtain the currently issued instrument and applicability notice from the operator.
T04Rail Cybersecurity Mitigation Actions and TestingTSAExpired directive copySecurity Directive 1580/82-2022-01D; expires May 2 2026No replacement or extension was authenticated here. Do not issue a current compliance opinion from this expired copy.
T05Pipeline control room managementPHMSAAgency implementation guidance49 CFR 192.631 and 195.446; controller and SCADA scopeThese are safety requirements alongside any applicable TSA cybersecurity instrument.
T06Cybersecurity Resources for Transit AgenciesFTAAgency implementation guidance49 USC 5323 v and security directives; distinction between covered operators
T07FY2026 Certifications and AssurancesFTAAgency funding instrumentCurrent grant certifications and assurances
T08Public Transportation Agency Safety PlansFTAAgency implementation guidance49 CFR Part 673; applicability and safety managementDoes not by itself establish the same cyber audit frequency for every transit mode.
T09TSA Year in Review 2023TSAAgency historical reportPublic confirmation of airport and aircraft cybersecurity security-program amendmentsCurrent operator security programs and amendments may be SSI and were not obtained. Public summary is insufficient for clause-level assessment.
T10Maritime cybersecurity current codified provisionsOffice of the Federal Register eCFRCurrent codified rule33 CFR 101.625 d 3; 101.635; 101.640; 101.650 d and e; current display through October 13 2026Read the applicable compliance dates in 101.655 and any approved equivalent or waiver. The eCFR is authoritative but unofficial.
F09Cybersecurity Resource CenterNew York DFSAgency implementation source23 NYCRR Part 500 covered entity scopeNew York location alone does not make an industrial operator a DFS covered entity.
M09Electronic Records and Electronic Signatures Scope and ApplicationFDAAgency guidance21 CFR Part 11 and predicate-rule recordsDetermine the actual regulated records and product regime; not every PLC record is automatically within Part 11.
S01Alabama selected authorityADEMAgency guidanceSelected state authority and applicability research as of October 15 2026
S02Alaska selected authorityAlaska DECAgency guidanceSelected state authority and applicability research as of October 15 2026
S03Arizona selected authorityArizona LegislatureSelected enacted lawSelected state authority and applicability research as of October 15 2026
S04Arkansas selected authorityArkansas Division of Elementary and Secondary EducationOfficial implementation memoSelected state authority and applicability research as of October 15 2026
S05California selected authorityCalifornia PUCRegulator routing sourceSelected state authority and applicability research as of October 15 2026
S06Colorado selected authorityColorado Secretary of State and PUCSelected rule textSelected state authority and applicability research as of October 15 2026
S07Connecticut selected authorityConnecticut DPHHistorical agency circularSelected state authority and applicability research as of October 15 2026
S08Delaware selected authorityDelaware PSCRegulator programSelected state authority and applicability research as of October 15 2026
S09Florida selected authorityFlorida SenateSelected enacted lawSelected state authority and applicability research as of October 15 2026
S10Georgia selected authorityGeorgia Technology AuthorityAgency reporting sourceSelected state authority and applicability research as of October 15 2026
S11Hawaii selected authorityHawaii PUCRegulator directorySelected state authority and applicability research as of October 15 2026
S12Idaho selected authorityIdaho Technology AuthorityAgency standardSelected state authority and applicability research as of October 15 2026
S13Illinois selected authorityIllinois General AssemblyBill status unresolvedSelected state authority and applicability research as of October 15 2026
S14Indiana selected authorityIDEMAgency implementation guidanceSelected state authority and applicability research as of October 15 2026
S15Iowa selected authorityIowa Utilities CommissionSelected utility ruleSelected state authority and applicability research as of October 15 2026
S16Kansas selected authorityKansas LegislatureSelected enacted lawSelected state authority and applicability research as of October 15 2026
S17Kentucky selected authorityKentucky PSCRegulator routing sourceSelected state authority and applicability research as of October 15 2026
S18Louisiana selected authorityLouisiana LegislatureResearch gapSelected state authority and applicability research as of October 15 2026
S19Maine selected authorityMaine LegislatureSelected enacted lawSelected state authority and applicability research as of October 15 2026
S20Maryland selected authorityMaryland General Assembly and MDEEnacted sector lawSelected state authority and applicability research as of October 15 2026
S21Massachusetts selected authorityMassDEPAgency program with scope reviewSelected state authority and applicability research as of October 15 2026
S22Michigan selected authorityMichigan PSCRegulator implementation sourceSelected state authority and applicability research as of October 15 2026
S23Minnesota selected authorityMinnesota Department of HealthAgency expectation needing confirmationSelected state authority and applicability research as of October 15 2026
S24Mississippi selected authorityMississippi ITSAgency reporting sourceSelected state authority and applicability research as of October 15 2026
S25Missouri selected authorityMissouri LegislatureSelected enacted sector lawSelected state authority and applicability research as of October 15 2026
S26Montana selected authorityMontana Department of AdministrationAgency guidanceSelected state authority and applicability research as of October 15 2026
S27Nebraska selected authorityNebraska Information Technology CommissionStandards directorySelected state authority and applicability research as of October 15 2026
S28Nevada selected authorityNevada LegislatureSelected enacted lawSelected state authority and applicability research as of October 15 2026
S29New Hampshire selected authorityNew Hampshire LegislatureEnacted sector lawSelected state authority and applicability research as of October 15 2026
NH-WWWastewater cybersecurity protection programNew Hampshire LegislatureEnacted sector lawRSA 485-A:5-f; current codified text
S30New Jersey selected authorityNew Jersey DEP and LegislatureEnacted sector frameworkSelected state authority and applicability research as of October 15 2026
S31New Mexico selected authorityNew Mexico DoITPolicy directory and scope reviewSelected state authority and applicability research as of October 15 2026
S32New York selected authorityNew York DEC and DOHAdopted sector rulesSelected state authority and applicability research as of October 15 2026
S33North Carolina selected authorityNorth Carolina DITAgency implementation guidanceSelected state authority and applicability research as of October 15 2026
S34North Dakota selected authorityNorth Dakota LegislatureSelected enacted lawSelected state authority and applicability research as of October 15 2026
S35Ohio selected authorityOhio EPASelected operational reporting ruleSelected state authority and applicability research as of October 15 2026
S36Oklahoma selected authorityOklahoma OMESAgency reporting directorySelected state authority and applicability research as of October 15 2026
S37Oregon selected authorityOregon LegislatureSelected enacted lawSelected state authority and applicability research as of October 15 2026
S38Pennsylvania selected authorityPennsylvania DEP and PUCGuidance and rulemaking watchlistSelected state authority and applicability research as of October 15 2026
S39Rhode Island selected authorityRhode Island LegislatureSelected utility lawSelected state authority and applicability research as of October 15 2026
S40South Carolina selected authoritySouth Carolina DESAgency guidanceSelected state authority and applicability research as of October 15 2026
S41South Dakota selected authoritySouth Dakota LegislatureCriminal statute onlySelected state authority and applicability research as of October 15 2026
S42Tennessee selected authorityTennessee Secretary of StateFiled utility ruleSelected state authority and applicability research as of October 15 2026
TN-DOCKETAnnual utility cybersecurity plan reportsTennessee PUCImplementation docket2025 annual utility filing docket under TCA 65-4-127Individual reports are confidential and were not obtained.
S43Texas selected authorityTexas LegislatureSelected enacted utility lawSelected state authority and applicability research as of October 15 2026
S44Utah selected authorityUtah DEQAgency guidanceSelected state authority and applicability research as of October 15 2026
S45Vermont selected authorityVermont LegislatureResearch gapSelected state authority and applicability research as of October 15 2026
S46Virginia selected authorityVirginia LegislatureSelected enacted operational lawSelected state authority and applicability research as of October 15 2026
S47Washington selected authorityWashington LegislatureSelected enacted agency lawSelected state authority and applicability research as of October 15 2026
S48West Virginia selected authorityWest Virginia LegislatureSelected enacted agency lawSelected state authority and applicability research as of October 15 2026
S49Wisconsin selected authorityWisconsin DNRAgency guidanceSelected state authority and applicability research as of October 15 2026
S50Wyoming selected authorityWyoming ETS and PSCStandards directorySelected state authority and applicability research as of October 15 2026