OT regulatory assessment planning library
Water and wastewater, power and energy, manufacturing, and transportation
Planning edition | Research cutoff October 15, 2026
This library combines four sector manuals, a 50-state and local applicability companion, an editable project workbook and the review record. It supports scoping through field examination, corrective work, verification and handover.
Planning packs and working records
| Volume | Use |
|---|---|
| Water and wastewater35 pages | 24 fillable fields | AWIA coverage and certification, wastewater permits, selected state duties, treatment and telemetry examination, safe work, evidence, recovery and verification. |
| Power and energy35 pages | 24 fillable fields | NERC applicability and evidence workstreams, distribution and DER, nuclear and pipeline boundaries, control centers, substations and operating authority. |
| Manufacturing34 pages | 24 fillable fields | Process safety, contract information boundaries, product and quality records, production cells, controlled changes and restart acceptance. |
| Transportation36 pages | 24 fillable fields | Surface transportation, ports and vessels, aviation and pipelines. Includes mode boundaries, maritime milestones and recurring work, and restricted-instrument questions. |
| 50-state and local applicability companion72 pages | 12 fillable fields | One selected-authority profile for each state, the local determination method, facility inputs and fillable local and notification worksheets. |
| Review findings and unresolved questions27 pages | Adversarial content, accuracy and usability desk reviews; corrections and exclusions; eight open questions with the evidence needed to resolve them. |
| Editable project workbook13 worksheets | 200 state-sector screening prompts | 88 proposed tasks | Applicability, assets, control checks, evidence, activity permits, findings, notification decisions, local duties, recurring calendar, sources and review findings. Site decisions begin Unresolved. |
| Source register101 authorities and publications | Portable register with full URLs, locators, legal/publication status, research date and retrieval limitations. |
First use
- CISO and risk owner: select the sector pack and review the open questions. Define the decision, business consequence and intended assurance.
- Compliance owner: review federal scope and each relevant state profile. Retrieve controlling instruments and record signed site decisions. A missing rule or document remains unresolved.
- Project manager: assign the 22 proposed tasks for the selected sector, name people and alternates, and populate dates around evidence access and operating windows.
- Technical lead and field technician: follow the approved method and operating owner. Use existing evidence first; obtain exact activity authorization, baseline, stop and recovery arrangements before field work.
- Reviewer and sponsor: challenge findings against evidence and scope, separate implementation from verified closure, and sign the facility adoption decisions.
The PDF contents and source IDs are clickable. The worksheets are interactive; save a completed copy in the approved record location and check that entered values persist in the selected PDF reader. The workbook contains no completed facility assessment or inferred personal approval.
Questions requiring discussion
These questions were retained after the content, usability and accuracy reviews. They require the identified evidence; an assumed legal obligation or exemption was not substituted.
| Question | Unresolved information | Next evidence |
|---|---|---|
| Q01 Current CIRCIA instrument | An effective final rule and its operative coverage/date were not established. | Obtain the current final Federal Register instrument and implementing CISA instructions. Record whether and when the named entity is covered. |
| Q02 Current TSA rail and pipeline instruments | Public copies obtained expire May 2 2026. Current replacements, extensions and operator-specific approved plans were not authenticated. | The operator security official supplies the currently issued instruments, applicability notice and approved plans through the authorized handling process. |
| Q03 Aviation cybersecurity criteria | Current airport/aircraft security-program amendments and applicable airworthiness/operating conditions were not supplied. | Obtain the actual approved program and qualified aviation review. Do not reconstruct SSI or product certification criteria from public summaries. |
| Q04 CMMC implementation direction | An official indexed July 2026 announcement reports Phase II suspension. Current detailed procurement direction and effect on each awarded contract remain unresolved. | Obtain current implementing direction and the contracting-officer determination for the specific award. Existing safeguarding clauses require a separate assessment. |
| Q05 State gaps and restricted retrieval | Louisiana and Vermont sector-wide duties remain research gaps. Some New York, Minnesota and Massachusetts full text could not be retrieved; Illinois/Pennsylvania enactment/finality was not established. | Retrieve controlling state text and current agency instructions before a site-specific conclusion. Do not interpret these gaps as exemptions. |
| Q06 Facility local and contractual inputs | No facility list, complete permits, leases, grants, insurer terms, ownership matrix or local operating agreements were supplied. | Provide the site and operator inventory. Complete the local worksheets and retain each controlling instrument, trigger and verified contact. |
| Q07 Licensed standards and specialist regimes | Full normative ISA/IEC texts and product-specific, nuclear, safety or quality approvals were not obtained. | Obtain the applicable edition and the responsible specialist. Agree assessment criteria and evidence before claiming conformity. |
| Q08 Current NERC requirement editions | The public register distinguishes current and future enforcement but does not complete the entity-specific matrix. | Freeze current requirement versions, implementation dates, registration and BES categorization with the compliance owner. |
Source register with direct links
Government, regulator and standards-publisher sources support regulatory and standards statements. Selected peer reviewed research supports qualitative assessment context. Social media and vendor marketing are excluded as authorities. Drafts, expired instruments and restricted retrieval remain labeled.
| ID | Authority or publication | Status | Locator and limitation |
|---|---|---|---|
| F01 | Guide to Operational Technology Security Revision 3NIST | Final guidance | September 2023 final publication; chapters 4 through 6 and OT control tailoring |
| F02 | Guide to Operational Technology Security Revision 4NIST | Draft guidance | September 21 2026 initial public draftRevision 4 is not the final baseline in this edition. |
| F03 | Technical Guide to Information Security Testing and AssessmentNIST | Final guidance | Assessment planning and rules of engagementApply OT operating constraints; this IT testing guide does not authorize production testing. |
| F04 | Incident Response Recommendations and Considerations Revision 3NIST | Final guidance | April 2025 final publication |
| F05 | CIRCIA public rulemaking noticeCISA and Federal Register | Rulemaking record | 2026 notice referring to the proposed rule and further town hallsThis notice does not establish an effective final reporting rule. A current final rule was not established in this research. |
| F06 | State PlansOSHA | Jurisdiction directory | State and federal occupational safety jurisdictionCheck public employee coverage and industry exceptions for the actual workplace. |
| F07 | Emergency Release Notifications under EPCRAEPA | Agency guidance | EPCRA 304 and CERCLA release notificationChemical thresholds, release facts and recipients require a separate EHS determination. |
| F08 | ISA IEC 62443 Series of StandardsISA | Standards publisher overview | Published series and applicable partsFull normative texts were not obtained. No clause-level conformity or security level is certified here. |
| R01 | A survey of cyber security management in industrial control systemsKnowles and colleagues in International Journal of Critical Infrastructure Protection | Peer reviewed research | Volume 9 June 2015 pages 52 to 80Used for qualitative management context, not contemporary law or numeric effectiveness claims. |
| R02 | Threat modeling of industrial control systems A systematic literature reviewComputers and Security | Peer reviewed research | Volume 136 January 2024 article 103543Supports structured threat modeling; it does not validate a specific plant assessment. |
| R03 | ICSSIM A framework for building industrial control systems security testbedsComputers in Industry | Peer reviewed research | Volume 148 June 2023 article 103906Laboratory results do not establish safety or coverage on installed production equipment. |
| W01 | AWIA Section 2013 and SDWA Section 1433EPA | Agency implementation guidance | Covered systems; RRA and ERP content; certification cycles |
| W02 | Certification of Risk and Resilience Assessments and Emergency Response PlansEPA | Agency implementation guidance | Certification and secure retention of actual plans |
| W03 | Emergency Response Plan Templates for Drinking Water and WastewaterEPA | Agency guidance | Separate drinking water and wastewater templatesEPA identifies the wastewater template as voluntary under SDWA 1433. |
| W04 | Cybersecurity for Water and Wastewater FacilitiesIndiana IDEM | Agency implementation guidance | IC 13-18-16.5; covered facility types; 2026 assessments and incident reporting |
| W05 | Community Water and Sewerage System CybersecurityMaryland General Assembly | Enacted chapter law | Chapter 495 of 2025; Environment Article 9-2704 through 9-2707Read final added text and strikeouts correctly; customers are not the same unit as AWIA population. |
| W06 | Guidance on Senate Bill 871Maryland MDE | Agency guidance | April 2026 guidance; system assessments, certification and ERP workAgency collection or legislative reporting dates must not be assigned to operators as unverified filing deadlines. |
| W07 | Water Quality Accountability ActNew Jersey DEP | Agency implementation guidance | Cybersecurity plans; annual assessment; scope over 500 service connectionsFull-page retrieval was restricted; selected official search excerpts were checked against chapter law W08. |
| W08 | Water cybersecurity amendmentsNew Jersey Legislature | Enacted chapter law | P L 2021 chapter 262 and N J S A 58:31-4.1 |
| W09 | New York drinking water cybersecurity applicabilityNew York DOH | Current rule page | 10 NYCRR Appendix 5-E.1; Subpart 5-1.33Full-page retrieval was restricted. The January 1 2027 transition and immediate training/reporting exceptions are supported by official indexed text; obtain the full rule before facility signoff. |
| W10 | Wastewater cybersecurity resources and adopted rulesNew York DEC | Agency implementation guidance | 6 NYCRR Parts 616 650 and 750; March 2026 adoption; reporting |
| W11 | Wastewater cybersecurity regulations compendiumNew York DEC | Agency guidance | March 2026 compendium; POTW compliance dates and referenced documents |
| P01 | Critical Infrastructure Protection reliability standards registerNERC | Standards register | Family status and mandatory versus future enforcementFreeze the exact applicable standard, requirement and US implementation plan for the engagement. Approval and enforcement dates differ. |
| P02 | New bulk power reliability safeguardsFERC | Agency order announcement | March 19 2026 approvals including virtualization and low impact controlsUse the underlying orders and implementation plans; the announcement is not a universal immediate enforcement date. |
| P03 | Reliability standards and US effective date resourcesNERC | Standards register | US effective date status and functional applicability |
| P04 | Electric Emergency Incident and Disturbance ReportDOE | Agency reporting source | Current DOE-417 form and event instructionsDetermine the applicable incident category and clock from current instructions; no single clock covers all events. |
| P05 | Nuclear cybersecurityNRC | Agency implementation source | 10 CFR 73.54 and approved licensee cybersecurity plansNuclear licensing scope is separate from NERC CIP scope. |
| P06 | Electric distribution cybersecurity baselinesNARUC and DOE | Government supported guidance | Distribution and distributed energy resource baselinesNot a nationwide binding rule; identify state adoption or contract incorporation. |
| P07 | Utility IT cybersecurity regulations announcementNew York DPS | Agency announcement | April 16 2026 announcement; June 1 2026 effectivenessThe announcement explicitly distinguishes IT regulations from prospective industry OT rulemaking. |
| M01 | Process safety management of highly hazardous chemicalsOSHA | Federal regulation | Paragraphs e j l m and o; PHA, mechanical integrity, management of change and compliance auditsCoverage is process and substance dependent. The three-year PSM audit is not a universal OT cybersecurity audit rule. |
| M02 | Safeguarding Covered Defense Information and Cyber Incident ReportingAcquisition gov | Federal contract clause | DFARS 252.204-7012; covered information and rapid reportingThe contract, incorporated revision and system boundary control applicability. |
| M03 | CMMC Phase II suspension announcementOffice of Industrial Base Growth | Official agency announcement | July 13 2026 announcementOfficial indexed content reports suspension of the planned Phase II rollout. Full-page retrieval was restricted. Obtain current procurement direction and contracting-officer interpretation; do not infer amendment of an existing contract. |
| M04 | CMMC program documentationDefense CIO | Program source | Program instruments and contract implementationReconcile current instructions with M03 and the awarded contract before using historical phase dates. |
| M05 | Risk Management Program guidanceEPA | Agency guidance | 40 CFR Part 68 applicability and program levelsCovered chemical process duties do not create a generic cybersecurity certification. |
| M06 | CFATS program statusCISA | Archived agency notice | Statutory authorization expired July 28 2023No current reauthorization was established here. Do not treat an archived CFATS checklist as proof of an active 2026 duty. |
| M07 | Manufacturing Profile Revision 1NIST | Final guidance | October 2020 final profile aligned to CSF 1.1 |
| M08 | Manufacturing Profile Revision 2NIST | Draft guidance | September 2025 initial public draft aligned to CSF 2.0A final Revision 2 was not established; do not call this draft a final requirement. |
| T01 | Cybersecurity in the Marine Transportation SystemUS Coast Guard and Federal Register | Final rule | 90 FR 6298; 33 CFR 101 Subpart F; 101.605 and 101.630 through 101.665Check subsequent amendments and operator-specific approval, waivers and equivalents. |
| T02 | Maritime cybersecurity implementation timelineUS Coast Guard | Agency implementation notice | January 12 2026 training and July 16 2027 principal compliance milestoneOfficial indexed notice checked against T01; full-page retrieval restricted. |
| T03 | Pipeline Cybersecurity Mitigation Actions Contingency Planning and TestingTSA | Expired directive copy | Security Directive Pipeline-2021-02F; effective May 3 2025; expires May 2 2026Historical public reference only. Obtain the currently issued instrument and applicability notice from the operator. |
| T04 | Rail Cybersecurity Mitigation Actions and TestingTSA | Expired directive copy | Security Directive 1580/82-2022-01D; expires May 2 2026No replacement or extension was authenticated here. Do not issue a current compliance opinion from this expired copy. |
| T05 | Pipeline control room managementPHMSA | Agency implementation guidance | 49 CFR 192.631 and 195.446; controller and SCADA scopeThese are safety requirements alongside any applicable TSA cybersecurity instrument. |
| T06 | Cybersecurity Resources for Transit AgenciesFTA | Agency implementation guidance | 49 USC 5323 v and security directives; distinction between covered operators |
| T07 | FY2026 Certifications and AssurancesFTA | Agency funding instrument | Current grant certifications and assurances |
| T08 | Public Transportation Agency Safety PlansFTA | Agency implementation guidance | 49 CFR Part 673; applicability and safety managementDoes not by itself establish the same cyber audit frequency for every transit mode. |
| T09 | TSA Year in Review 2023TSA | Agency historical report | Public confirmation of airport and aircraft cybersecurity security-program amendmentsCurrent operator security programs and amendments may be SSI and were not obtained. Public summary is insufficient for clause-level assessment. |
| T10 | Maritime cybersecurity current codified provisionsOffice of the Federal Register eCFR | Current codified rule | 33 CFR 101.625 d 3; 101.635; 101.640; 101.650 d and e; current display through October 13 2026Read the applicable compliance dates in 101.655 and any approved equivalent or waiver. The eCFR is authoritative but unofficial. |
| F09 | Cybersecurity Resource CenterNew York DFS | Agency implementation source | 23 NYCRR Part 500 covered entity scopeNew York location alone does not make an industrial operator a DFS covered entity. |
| M09 | Electronic Records and Electronic Signatures Scope and ApplicationFDA | Agency guidance | 21 CFR Part 11 and predicate-rule recordsDetermine the actual regulated records and product regime; not every PLC record is automatically within Part 11. |
| S01 | Alabama selected authorityADEM | Agency guidance | Selected state authority and applicability research as of October 15 2026 |
| S02 | Alaska selected authorityAlaska DEC | Agency guidance | Selected state authority and applicability research as of October 15 2026 |
| S03 | Arizona selected authorityArizona Legislature | Selected enacted law | Selected state authority and applicability research as of October 15 2026 |
| S04 | Arkansas selected authorityArkansas Division of Elementary and Secondary Education | Official implementation memo | Selected state authority and applicability research as of October 15 2026 |
| S05 | California selected authorityCalifornia PUC | Regulator routing source | Selected state authority and applicability research as of October 15 2026 |
| S06 | Colorado selected authorityColorado Secretary of State and PUC | Selected rule text | Selected state authority and applicability research as of October 15 2026 |
| S07 | Connecticut selected authorityConnecticut DPH | Historical agency circular | Selected state authority and applicability research as of October 15 2026 |
| S08 | Delaware selected authorityDelaware PSC | Regulator program | Selected state authority and applicability research as of October 15 2026 |
| S09 | Florida selected authorityFlorida Senate | Selected enacted law | Selected state authority and applicability research as of October 15 2026 |
| S10 | Georgia selected authorityGeorgia Technology Authority | Agency reporting source | Selected state authority and applicability research as of October 15 2026 |
| S11 | Hawaii selected authorityHawaii PUC | Regulator directory | Selected state authority and applicability research as of October 15 2026 |
| S12 | Idaho selected authorityIdaho Technology Authority | Agency standard | Selected state authority and applicability research as of October 15 2026 |
| S13 | Illinois selected authorityIllinois General Assembly | Bill status unresolved | Selected state authority and applicability research as of October 15 2026 |
| S14 | Indiana selected authorityIDEM | Agency implementation guidance | Selected state authority and applicability research as of October 15 2026 |
| S15 | Iowa selected authorityIowa Utilities Commission | Selected utility rule | Selected state authority and applicability research as of October 15 2026 |
| S16 | Kansas selected authorityKansas Legislature | Selected enacted law | Selected state authority and applicability research as of October 15 2026 |
| S17 | Kentucky selected authorityKentucky PSC | Regulator routing source | Selected state authority and applicability research as of October 15 2026 |
| S18 | Louisiana selected authorityLouisiana Legislature | Research gap | Selected state authority and applicability research as of October 15 2026 |
| S19 | Maine selected authorityMaine Legislature | Selected enacted law | Selected state authority and applicability research as of October 15 2026 |
| S20 | Maryland selected authorityMaryland General Assembly and MDE | Enacted sector law | Selected state authority and applicability research as of October 15 2026 |
| S21 | Massachusetts selected authorityMassDEP | Agency program with scope review | Selected state authority and applicability research as of October 15 2026 |
| S22 | Michigan selected authorityMichigan PSC | Regulator implementation source | Selected state authority and applicability research as of October 15 2026 |
| S23 | Minnesota selected authorityMinnesota Department of Health | Agency expectation needing confirmation | Selected state authority and applicability research as of October 15 2026 |
| S24 | Mississippi selected authorityMississippi ITS | Agency reporting source | Selected state authority and applicability research as of October 15 2026 |
| S25 | Missouri selected authorityMissouri Legislature | Selected enacted sector law | Selected state authority and applicability research as of October 15 2026 |
| S26 | Montana selected authorityMontana Department of Administration | Agency guidance | Selected state authority and applicability research as of October 15 2026 |
| S27 | Nebraska selected authorityNebraska Information Technology Commission | Standards directory | Selected state authority and applicability research as of October 15 2026 |
| S28 | Nevada selected authorityNevada Legislature | Selected enacted law | Selected state authority and applicability research as of October 15 2026 |
| S29 | New Hampshire selected authorityNew Hampshire Legislature | Enacted sector law | Selected state authority and applicability research as of October 15 2026 |
| NH-WW | Wastewater cybersecurity protection programNew Hampshire Legislature | Enacted sector law | RSA 485-A:5-f; current codified text |
| S30 | New Jersey selected authorityNew Jersey DEP and Legislature | Enacted sector framework | Selected state authority and applicability research as of October 15 2026 |
| S31 | New Mexico selected authorityNew Mexico DoIT | Policy directory and scope review | Selected state authority and applicability research as of October 15 2026 |
| S32 | New York selected authorityNew York DEC and DOH | Adopted sector rules | Selected state authority and applicability research as of October 15 2026 |
| S33 | North Carolina selected authorityNorth Carolina DIT | Agency implementation guidance | Selected state authority and applicability research as of October 15 2026 |
| S34 | North Dakota selected authorityNorth Dakota Legislature | Selected enacted law | Selected state authority and applicability research as of October 15 2026 |
| S35 | Ohio selected authorityOhio EPA | Selected operational reporting rule | Selected state authority and applicability research as of October 15 2026 |
| S36 | Oklahoma selected authorityOklahoma OMES | Agency reporting directory | Selected state authority and applicability research as of October 15 2026 |
| S37 | Oregon selected authorityOregon Legislature | Selected enacted law | Selected state authority and applicability research as of October 15 2026 |
| S38 | Pennsylvania selected authorityPennsylvania DEP and PUC | Guidance and rulemaking watchlist | Selected state authority and applicability research as of October 15 2026 |
| S39 | Rhode Island selected authorityRhode Island Legislature | Selected utility law | Selected state authority and applicability research as of October 15 2026 |
| S40 | South Carolina selected authoritySouth Carolina DES | Agency guidance | Selected state authority and applicability research as of October 15 2026 |
| S41 | South Dakota selected authoritySouth Dakota Legislature | Criminal statute only | Selected state authority and applicability research as of October 15 2026 |
| S42 | Tennessee selected authorityTennessee Secretary of State | Filed utility rule | Selected state authority and applicability research as of October 15 2026 |
| TN-DOCKET | Annual utility cybersecurity plan reportsTennessee PUC | Implementation docket | 2025 annual utility filing docket under TCA 65-4-127Individual reports are confidential and were not obtained. |
| S43 | Texas selected authorityTexas Legislature | Selected enacted utility law | Selected state authority and applicability research as of October 15 2026 |
| S44 | Utah selected authorityUtah DEQ | Agency guidance | Selected state authority and applicability research as of October 15 2026 |
| S45 | Vermont selected authorityVermont Legislature | Research gap | Selected state authority and applicability research as of October 15 2026 |
| S46 | Virginia selected authorityVirginia Legislature | Selected enacted operational law | Selected state authority and applicability research as of October 15 2026 |
| S47 | Washington selected authorityWashington Legislature | Selected enacted agency law | Selected state authority and applicability research as of October 15 2026 |
| S48 | West Virginia selected authorityWest Virginia Legislature | Selected enacted agency law | Selected state authority and applicability research as of October 15 2026 |
| S49 | Wisconsin selected authorityWisconsin DNR | Agency guidance | Selected state authority and applicability research as of October 15 2026 |
| S50 | Wyoming selected authorityWyoming ETS and PSC | Standards directory | Selected state authority and applicability research as of October 15 2026 |