New Jersey Utility OT Audit Planning Set

What the NJ Set Contains

The set carries 79 candidate criteria records, 59 procedure starters, 47 collection tasks, 27 duty calendar starters, 27 reporting records and 50 primary source entries, and every one of them is a starting point for a record the utility has to complete rather than a conclusion it can cite. Its 18 listed questions identify the unresolved authority, facility facts and acceptance work that no template can settle on your behalf, and an auditor will expect each of the 18 to have an owner before the audit period opens.

Customize the NJ preparation set and read the full HTML manual. Your utility selections filter the CSV and HTML records while the common conditional screens remain included, and the thirteen sheet Excel master and the PDF retain all three utility groups so that a mixed utility never loses a track it turns out to need.

Read the manual (PDF, 68 pages) · Download the master workbook (XLSX)

What the Set Prepares You For

This guide helps a utility scope the proposed work, gather the records, assign the owners and organize the permissions. The records it produces are the ones the engagement team reads before proposing a method.

Prepare for an audit, cyber or physical security assessment, or cyber or physical penetration test. The master includes all five preparation tracks.

When preparation is done and the engagement itself has to be scoped, describe the utility and the audit question to GDF, and the written authorization follows from that conversation.

October 17 Update and Closure Checklist

The October 17 update adds a Gap closure worksheet and a downloadable register for 18 tracked preparation matters. Each item names the records, the responsible roles, the dependencies, the planning effort, the remaining uncertainty and a closure test, which is the form an auditor expects an open item to take. The accountable people and the review evidence still have to come from your organization.

The 2026 PHMSA property damage threshold is verified for its stated effective period. Board minutes strengthen the Chapter 14:8 readoption history, while the filed history, the current clauses and the CIAP measurement remain open. CIRCIA pending review is not treated as an operative reporting duty. The gas checklist wording and the P63 procedure reference are current.

Open the 18 item closure checklist and source links. The estimates are project effort, not legal deadlines. The master and the PDF cover all three utility groups, and individual applicability remains unresolved until your advisers resolve it in writing.

Workstreams for Each Utility Type

For water and wastewater, the set covers the WQAA scope, filings, framework changes and the incident and audit triggers, and it keeps the AWIA, drinking water and NJPDES duties separate with their own population and connection measures. Wastewater is not automatically subject to community drinking water thresholds, and a utility that counts its wastewater customers against a drinking water threshold has already misstated its applicability.

For electric utilities, it covers BPU cybersecurity, the adopted 2026 AMI consent, security and reporting provisions, NERC and nuclear license applicability, and the follow up on the current status of CIAP. The evidence an examiner asks for first is the AMI head end access list and the record of who approved each vendor connection to it.

For gas utilities, it addresses state and federal jurisdiction, the current operator instruments, control room scope, the separate incident, follow up, safety related condition and MAOP reporting, the distribution and transmission drill calendars, and the integrity of the source data behind filings. The control room alarm management records and the SCADA data lineage behind a filing are the artifacts that decide those rows.

Conditional utility interfaces appear where they apply: TPS billing and supplier freeze implementation for actual electric and gas roles, and TCPA, PSM and RMP only where a utility site's chemicals, quantities and processes establish coverage. Each conditional screen is answered from the permit and the chemical inventory, not from the utility's own description of itself.

Common preparation runs across all three groups: public agency and contractor reporting, resident breach and NJDPA procedures, actual permits and local instruments, evidence custody, named examiner, collector and reviewer records, and sampling and corrective work. The common failure is the evidence register that names a department where an auditor expects a person.

Facilities outside water, wastewater, electric and gas utilities are served by the national OT planning library; open it from here.

Resolve These Facts Before Anyone Draws an Audit Conclusion

The set identifies what to obtain, who should resolve it and when it affects the project. Actual permits, ownership, regulator directions, restricted operator instruments and facility evidence are gathered securely, outside any public form, and each is filed against the question it answers. Current privacy rule adoption, the operative history of Chapter 14:8, the complete current gas code and the paragraph level federal gas criteria remain explicit research questions. The adopted gas amendments omit unchanged provisions, so obtain the full current rules and the operator instruments before approving a gas audit program.

The enacted WQAA incident language requires prompt qualifying reporting once an employee becomes aware. Its 30 day provision concerns NJCCIC causing an audit after receipt, despite conflicting DEP summary guidance, so obtain written clarification and do not plan around a 30 day reporting grace period; the clock a utility should rehearse is the prompt one. Read enacted 58:31-4.2.

Use the source linked procedures and the separate duty calendar with qualified sector reviewers.

The audit preparation walkthrough shows how to carry these open facts into the scoping conversation with their owners attached.