What follows is planning guidance. The applicable instrument and the facts of your entity set the actual duties, so treat every prepared item as a record for the auditor to examine.
1. Define the Proposed Scope Before Anyone Gathers a Record
The project manager and the sponsor identify the legal entity, the operating owner, the actual facilities, the objective of the audit, the review period and the people who will read the report, and they write those facts on one page with the source for each. Locate the charter, license, registration and operating agreement records that establish them, because the auditor's first request is for the documents that prove the entity is what the scope says it is. A city's permits and a utility's governing orders come from the instruments themselves, so retrieve them alongside the state selection.
Record every external deadline with the source that controls it and keep internal project target dates separate, so every planning goal and every legal clock reads for what it is. Where ownership, counts or coverage are still being confirmed, choose the unresolved answer and keep the follow up action visible. An unresolved row with an owner and a next action is a controlled record that moves the file forward.
The OT builder filters sector and state research and procedures, and the New York builder filters selected detailed tracks. Ownership, service and other profile facts are declarations for review. Legal determinations rest with the people who make them, and the record shows who decided each point.
If the entity, the facilities or the review period are still being debated inside your own organization, bring that dispute to the scoping conversation; it is quickest and least costly to settle there.
2. Gather the Records That Already Exist
Open the record gathering step in the builder or the Preparation sheet in the downloaded workbook. Each action explains what to locate, why GDF needs it, who is likely to hold it and what GDF verifies once it is found. Most of these records already exist in engineering, identity and records systems; the work is finding them and writing down who holds each one.
- Scope and criteria
- Entity and facility lists, current instruments and correspondence, exclusions, prior reports and open corrective actions. Ask legal, regulatory affairs and the operating owner.
- Systems and evidence
- Existing inventories, architecture and data flows, access records, record populations and the review period. Ask engineering, security and the responsible data owners, and agree collection and sampling with GDF.
- Operations and handoff
- Operating constraints, supplier permissions, stop authority, response and recovery records and controlled evidence handling instructions. Ask operations, safety, records management and the incident lead.
Apply the five record statuses consistently
Mark a record Not reviewed until someone assesses its availability. Mark it Still needed once an owner and a next action have been identified. Mark it Located for review when a controlled record reference exists, and GDF then examines its currency, scope and sufficiency. Mark it Needs clarification when a question remains, and record the responsible person or role. Mark it Proposed not applicable with a reason, and it becomes a decision once the responsible scope review is recorded.
For example, mark the asset inventory Located for review and enter a non sensitive reference such as ENG-INV-04 while the actual network drawing stays in the controlled repository. The package flags Reference missing on a record awaiting its reference and Reason missing on a proposed exclusion awaiting its reason, because those are the two details auditors check most often in a preparation file.
Use a role or a non sensitive label for the owner. Dates in these registers are optional project targets. Builder entries live only in this page's memory and clear on reset or reload; renaming preserves entries, and other scope changes ask you to download, clear or cancel. Download before you leave, because your evidence stays on your own machine.
Download the registers before you leave the page, then call (800) 868-8189 for a record category that sits between the five statuses.
3. Work Through the Open Questions Honestly
The Uncertainty sheet and the open questions CSV sort open items into profile facts to confirm, site records to locate, state and sector research and authority questions. Each entry says what to obtain, who may hold it and how it affects the audit plan. Record the actual decision, the responsible review and the supporting evidence in the workbook, because the recorded decision is what resolves the question, and an auditor reads the decision column before the record column.
For all state OT planning, treat the state and sector rows as a client research checklist: the source notes point to where each rule lives, and the current text for each sector and local facility completes the answer. Retrieve the current rules and orders, permits, contracts and local instructions themselves and file the copy with its retrieval date.
For water systems, obtain the actual system identifiers, the system type and the dated population, connection and customer measures, which are three distinct measures, together with any existing assessment, plan and certification records and their receipts.
For power, obtain the registration and functions, the system categorization, the applicable requirement versions and the implementation dates, and freeze them for the review period.
For manufacturing, obtain the actual covered process, safety, quality and executed contract criteria. Contract implementation and licensed standards are read from the current instrument with the responsible specialist.
For transportation, obtain the current operator issued directions, approved plans and mode specific permissions through authorized channels. The operator issued directions carry the current criteria, and public copies and summaries serve as background.
For New York utilities, retain questions Q01 through Q10. First year timing, apparent discrepancies in adopted text, current DPS utility instructions, entity scope, data access instruments and the operative DFS baseline are each settled with the identified evidence or written clarification.
Read the OT questions to settle before field work and the New York utility audit questions to settle first. An open question is a research task, recorded as planning work for its owner.
Where an answer is still on its way, identify the dependency and the proposed next action. GDF and the accountable owner then agree whether the affected work proceeds now, after further research or in a later phase.
Owners for open questions are the first thing we ask about on a scoping call, so bring the list as it stands.
4. Agree Access and Safe Work Before Anything Is Touched
Use existing approved records first. This checklist is completed from existing records, and scans, configuration changes, live failovers, switching operations and customer record collection each belong to the authorized engagement that follows. Before any activity that could affect operations, agree in writing the operating permission, the methods, the vendor restrictions, the maintenance windows, the stop authority and the recovery arrangements, with a named person and a tested phone number for the stop authority.
GDF and the evidence owners agree on the population, the sampling, the collection permissions, the time basis, the evidence references and the access limits. Preserve contrary evidence and note each record's availability. The workbook records a documented procedure and a demonstrated control in separate fields, and a proposed fix and a verified correction the same way, so each stage reads clearly later.
Keep personal information, passwords, network details and restricted transport directions in your controlled systems, and use non sensitive references in the public builder and the initial contact. Agree on the authorized recipients, the classification and an exchange method before any controlled file changes hands.
Which activities need written operating permission is a question to settle with GDF well ahead of the site visit; raise it in the scoping conversation.
5. Arrange the Scoping Conversation With GDF
Bring a non sensitive summary of the entity and facility scope, the audit purpose and period, the available record categories, the open questions with their owners, the proposed exclusions with their reasons, the external dates and the operating constraints. The preparation HTML, the checklist CSV and the workbook registers are the starting point for that discussion, and the initial consultation is free.
We agree scope, current criteria, research work, team responsibilities, evidence handling, safe methods, timing and deliverables before any assessment work begins. Actual technical, compliance and operating decisions are recorded by the people responsible for them.
Planning References and Package Contents
NIST SP 800-115 informs assessment planning, evidence and reporting, and NIST SP 800-82 Revision 3 informs OT security with its operational reliability and safety constraints. These technical guides shape the method; the legal audit requirements come from the instruments that apply to you.
For current DFS materials, start with the DFS cybersecurity resource page and reconcile the controlling text against the entity records. The New York workbook marks the points where further authority is gathered.
Each generated set includes an offline preparation walkthrough, two preparation CSVs and the project workbooks. The technical reference PDFs and the manuals remain useful alongside the preparation registers.
Open the OT planning library or the NY utility planning library for the full package contents.