Preparation edition 2026-10-16-r3. These are planning recommendations. The applicable instrument and entity facts determine actual duties. No preparation count establishes compliance or audit readiness.
1. Define the proposed scope
The project manager and sponsor should identify the legal entity, operating owner, actual facilities, objective, review period and intended report users. Locate charter, license, registration and operating-agreement records. A state selection does not identify a city's permits or a utility's governing orders.
Record external deadlines with their controlling source. Keep internal project target dates separate. If ownership, counts or coverage are unknown, choose the unresolved answer and retain the follow-up action.
The OT builder filters sector/state research and procedures. The NY builder filters selected detailed tracks. Ownership, service and other profile facts are declarations for review; neither builder makes a legal determination.
2. Gather existing records
Open the record-gathering step in the builder or the Preparation sheet in the downloaded workbook. Each action explains what to locate, why GDF needs it, the likely custodian and what still needs verification.
- Scope and criteria
- Entity/facility lists, current instruments and correspondence, exclusions, prior reports and open corrective actions. Ask legal, regulatory affairs and the operating owner.
- Systems and evidence
- Existing inventories, architecture/data flows, access records, record populations and the review period. Ask engineering, security and the responsible data owners. Agree collection and sampling with GDF.
- Operations and handoff
- Operating constraints, supplier permissions, stop authority, response/recovery records and controlled evidence-handling instructions. Ask operations, safety, records management and the incident lead.
Use the statuses consistently
- Not reviewed: nobody has assessed availability yet.
- Still needed: identify an owner and the next action.
- Located for review: provide a controlled record reference. GDF still needs to examine currency, scope and sufficiency.
- Needs clarification: record the question and the responsible person or role.
- Proposed not applicable: record the reason. It remains a proposal until the responsible scope review is recorded.
Example: mark the inventory Located for review and enter a non-sensitive reference such as ENG-INV-04. Keep the actual network drawing in the controlled repository. Without a reference, the package flags Reference missing. A proposed exclusion without a reason is flagged Reason missing.
Use a role or non-sensitive label for the owner. Dates in these registers are optional project targets. Builder entries remain in this page's memory and clear on reset, reload or a changed profile. Download before leaving or changing scope; there is no website evidence upload.
3. Work through open questions
The Uncertainty sheet and open-questions CSV distinguish missing profile facts, unavailable site records, state-sector research and unresolved authority. Each entry says what to obtain, who may hold it and how it affects the audit plan. Record the actual decision, responsible review and supporting evidence in the workbook. Preparing or locating a record does not itself resolve the question.
- All-state OT planning: the 200 candidate state-sector rows are research tasks. Fifty selected-source notes do not provide complete legal research for every sector or local facility. Retrieve the actual current rules/orders, permits, contracts and local instructions.
- Water: obtain actual system identifiers, type and dated population, connection and customer measures. Those measures are not interchangeable. Retrieve existing assessment, plan and certification records.
- Power: obtain registration/functions, system categorization, applicable requirement versions and implementation dates. Do not assume all energy assets are subject to NERC CIP.
- Manufacturing: obtain actual covered-process, safety, quality and executed contract criteria. Contract implementation and licensed standards require the current instrument and responsible specialist.
- Transportation: obtain the current operator-issued directions, approved plans and mode-specific permissions through authorized channels. Expired public copies and public summaries cannot supply every current criterion.
- New York utilities: retain Q01-Q10. First-year timing, apparent adopted-text discrepancies, current DPS utility instructions, entity scope, data-access instruments and the operative DFS baseline require the identified evidence or written clarification.
Read the OT source review and NY authority review. Open questions are research limitations; they are not findings that a particular operator has breached a duty.
If an answer cannot yet be obtained, identify the dependency and proposed next action. GDF and the accountable owner must agree whether the affected work can proceed, needs further research or must be deferred. The tool does not grant an exception.
4. Agree access and safe work
Use existing approved records first. Completing this checklist does not require a scan, configuration change, live failover, switching operation or collection of customer records. Before affected activity, agree written operating permission, methods, vendor restrictions, maintenance windows, stop authority and recovery arrangements.
GDF and the evidence owners need to agree the population, sampling, collection permissions, time basis, evidence references and access limits. Preserve contrary evidence and unavailable records. A documented procedure is different from a demonstrated control; proposed fixes are different from verified corrections.
Keep personal information, passwords, network details and restricted transport directions out of the public builder and initial contact. Agree authorized recipients, classification and an exchange method before sharing controlled files.
5. Arrange the GDF scoping conversation
Bring a non-sensitive summary of the entity/facility scope, audit purpose and period, available record categories, open questions, proposed exclusions, external dates and operating constraints. The preparation HTML, checklist CSV and workbook registers are a starting point for that discussion.
Agree scope, current criteria, research work, team responsibilities, evidence handling, safe methods, timing and deliverables before assessment work. Actual technical, compliance and operating decisions must be recorded by the responsible people. No booking, signed audit, filing or approval is created by a download.
Planning references and package contents
NIST SP 800-115 informs assessment planning, evidence and reporting. NIST SP 800-82 Revision 3 informs OT security with operational reliability and safety constraints. These technical guides do not establish every applicable legal audit requirement.
For current DFS materials, start with the DFS cybersecurity resource page and reconcile the controlling text and entity records. The NY workbook identifies where further authority is needed.
Each generated set includes an offline preparation walkthrough, two preparation CSVs and 18-sheet workbooks. The technical reference PDFs and complete HTML manuals retain reference edition 2026-10-16-r2. They remain useful alongside the new preparation registers. Native Excel, formal assistive-technology and PDF/UA conformance reviews remain pending.