DFS coverage and shared services
Part 500 depends on qualifying financial-services authorization. Review licenses, exemptions, Class A criteria and affiliate boundaries.
NYDFS, utility IT & customer privacy
New York utility audit planning
Plan a utility cybersecurity and privacy audit with separate DFS, PSC and personal-information tracks. Define the entity, examine evidence and carry findings through verified closure.
Three separate audit tracks
Utility IT and customer privacy
Part 1200 and existing PSC PII orders require their own jurisdiction, size, ownership and transition decisions.
Private-information safeguards
Review SHIELD safeguards, breach roles, resident information and state or local notification procedures.
Safe assessment work
Plan evidence, samples, field permissions, findings, corrective actions and verified handover.
Download the planning set
Download the complete set (ZIP)
- Utility audit planning packPDF, 52 pages and 15 fillable fields. Applicability, project gates, field procedures and control tests.
- Editable audit workbookExcel, 13 worksheets. Decisions, tasks, data flows, tests, evidence, findings, notices and handover.
- Review findings and unresolved authorityPDF, 16 pages. Content challenges, corrections and ten questions requiring further resolution.
- Source registerCSV, 23 primary and official technical sources, with status, locators and limitations.
Use it from scope to handover
- Confirm each legal entity, ownership, operating function and review period.
- Resolve applicability with current instruments and named compliance reviewers.
- Assign tasks, safe methods, populations, samples and evidence owners.
- Record results, escalate incidents, correct failures and verify closure.
- Transfer open questions and recurring duties with actual technical, compliance and operating approvals.
Current rules and unresolved questions
Planning edition: October 15, 2026. New York adopted utility IT cybersecurity rules in April 2026, effective June 1, with phased requirements. Utility status alone does not establish NYDFS coverage.
Use the final PSC adoption and Appendix A, the State Register adoption notice, the DFS resource center and the current GBL breach statute, safeguards statute and state/local notification provisions.
The review report identifies apparent drafting errors, first-year timing questions and unavailable entity-specific criteria. Obtain current utility orders, tariffs, local policies and written clarification before adopting conclusions. The pack is a planning resource; completed work requires actual evidence and approvals.
Discuss the audit boundary
Bring the entity profile and unresolved questions to a scoped planning discussion. Keep completed worksheets and evidence in controlled records.