New York utility audit planning
New York Utility Audit Questions to Settle First
New York utilities answer to the Public Service Commission, sometimes to the Department of Financial Services and always to state breach law. The planning set keeps those tracks apart, and a few questions about coverage, timing and adopted text decide how the audit is scoped.
What the New York Planning Set Covers
The set organizes a utility audit around three separate sources of duty: the Public Service Commission's utility cybersecurity regulations in Part 1200, the DFS cybersecurity regulation in 23 NYCRR Part 500 where a license brings the utility or an affiliate within it, and New York's breach and safeguards statutes, General Business Law 899-aa and 899-bb and State Technology Law 208. The New York utility audit manual walks each procedure, and the workbook holds a clause matrix of PSC and DFS provisions with a control test register whose rows record the criterion, population, period, sample rationale, method, observation, evidence and reviewer.
Definitions and administrative provisions carry their own labels, so each definition is read as context, and each coverage decision closes when someone records the facts that settle it. You can tailor the detailed tracks with the New York utility audit builder.
Coverage, Timing and Adopted Text Questions
Coverage comes first. Part 1200 excludes smaller water and electric utilities by service connection and service line counts, so confirm the counts and the legal entity first, then record whether the rule applies. DFS Part 500 reaches a utility only through a license or authorization under the Banking, Insurance or Financial Services Law, so check whether the utility or an affiliate holds one and map any shared systems. Municipal utilities, cooperatives and public authorities confirm their charter and PSC jurisdiction, because those records decide which definitions apply, and State Technology Law 208 carries its own local notification policy duty.
Timing comes next. The adopted Part 1200 text pairs a yearly September 15 audit date with a general transition period, so ask DPS in writing for the first required audit date and how a legacy PII audit carries forward. Also compare the adopted attachment against the current codified text where cross references appear inconsistent, including the retention provision, the exemption form and the incident wording, and record the written clarification the utility relies on.
Finally, the instruments the utility holds itself. Request the current DPS staff request list or review rubric for the PII implementation plan, the effective tariff and data security agreements behind any customer data access, and the license and exemption record behind the operative DFS baseline. Breach planning should use the current General Business Law 899-aa definition, which counts access as well as acquisition and sets a 30 day outer limit for notice.
Turn Each Open Question Into a Scoped Task
Global Digital Forensics has supported utilities, compliance officers and security teams since 1992. On the first call a senior examiner reviews your entity, your systems and which of these questions remain open, then recommends how to document the technical facts the legal answers depend on, from shared DFS systems to IT and OT segmentation. The initial consultation is free. Scope your assessment or call (800) 868-8189.
To prepare on your own first, download the manual and workbook from the New York utility planning library. Our audit support is described under Utility Cybersecurity Audit Support and Incident Readiness.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .