DFS coverage and shared services
Part 500 depends on a qualifying financial services authorization. Review the licenses, exemptions, Class A criteria and affiliate boundaries before assuming coverage either way.
NYDFS, utility IT and customer privacy
New York Utility Cybersecurity and Privacy Planning by Track
Utility status alone does not make an organization a DFS covered entity, and a Part 1200 IT audit does not settle its SHIELD obligations. This planning set lets a New York utility define the entity, the systems and the duties on each track before anyone schedules an audit.
Gather records before an engagement
Start With the Two New York Preparation Sets
Each guide helps a New York utility identify the records, assign the owners and prepare the questions its auditor, consultant, compliance lead or export control specialist will need answered.
The guides are preparation aids. Each one prepares the record for the audit, assessment or specialist decision that follows.
Read every guide freely. Choose a download, then share your work email and company or skip. Your selected file starts immediately.
Discuss your assessment scope
NYDFS 23 NYCRR Part 500 Audit Preparation
Gather the entity details, policy records, system evidence and questions a Part 500 specialist will ask for.
File: ZIP: guide and editable CSV checklists.
New York SHIELD Act Private Information Preparation
Map the private information, safeguards, service providers and incident records for a privacy and breach review.
File: ZIP: guide and editable CSV checklists.
Browse all preparation packages by subject.
Each overview lists its source dates, scope and open questions alongside the download.
If you cannot yet tell whether your utility is on the DFS track, the PSC track or only the privacy track, say so to a senior examiner; sorting that out is the first job of the scoping call.
Prepare a New York Utility Audit With Your Team
Start With What Is Known and What Is Missing
The utility set records the missing entity, filing, data and audit information alongside the unresolved authority questions, so the gaps are visible before the audit period opens and the first thing an auditor asks for is already written down.
Confirm the legal entity, the facilities, the audit purpose and the period first, because a holding company, an operating company and a licensed affiliate can share one billing system and owe three different regulators. Locate the records that already exist and put an owner and a target date beside each one. Review the missing facts, the current criteria and the proposed exclusions with the people responsible for them, then agree on the scope, the evidence access, the safe methods and the deliverables with GDF. We arrange an authorized evidence exchange with you for any controlled record.
Download with open items when you need to. Bring the package to a call with GDF and we will scope the engagement from there.
- Record gathering checklist (CSV)Records to locate, audit purpose, likely custodian and follow up fields. The complete ZIP includes the same checklist with the workbook and manuals.
- Open questions register (CSV)Missing facts and unresolved authority, the required next evidence and the effect on audit planning.
The workbook adds Preparation and Uncertainty sheets to the 16 core sheets, and the technical PDFs and HTML reference manuals sit alongside it.
Use the preparation walkthrough alongside those references.
Once the five steps have owners, call (800) 868-8189 and we will agree scope, evidence access and safe methods from where your team has reached.
Three Separate Audit Tracks in One Planning Set
Utility IT and customer privacy
Part 1200 and the existing PSC PII orders require their own jurisdiction, size, ownership and transition decisions.
Private information safeguards
Review the SHIELD safeguards, the breach roles, the resident information and the state or local notification procedures.
Safe assessment work
Plan the evidence, the samples, the field permissions, the findings, the corrective actions and a verified handover.
Download the Planning Set
- Utility audit manualPDF, 33 pages. Applicability, project gates, field procedures, control tests and the DOH and DEC water rules.
- Editable audit workbookExcel, 21 worksheets. Decisions, tasks, data flows, tests, evidence, findings, notices and handover.
- Source registerCSV, 23 primary and official technical sources, with status, locators and limitations.
Use It From Scope to Handover
Confirm each legal entity, its ownership, its operating function and the review period, then resolve applicability against the current instruments with named compliance reviewers, because every later record is counted from those decisions. Assign the tasks, the safe methods, the populations, the samples and the evidence owners in the workbook. Record the results as they are obtained, escalate incidents on the clock each regime sets, correct failures and verify closure against the evidence defined when the finding was written. Transfer the open questions and the recurring duties with actual technical, compliance and operating approvals, so the handover carries signatures rather than assumptions.
Current Rules and the Questions Still Open
Sources current to November 3, 2026. New York adopted utility IT cybersecurity rules in April 2026, effective June 1, with phased requirements. NYDFS coverage follows the entity's licence or charter, which is the first thing we map.
Use the final PSC adoption and Appendix A, the State Register adoption notice, the DFS resource center and the current GBL breach statute, safeguards statute and state/local notification provisions.
Obtain the current utility orders, tariffs, local policies and written clarification before adopting any conclusion. The pack is a planning resource; completed work requires actual evidence and approvals.
Drafting errors and first year timing are exactly the items we help utilities turn into written questions for DPS, so read the New York utility audit questions to settle first before you adopt a date.
Consult a Senior Examiner on The Audit Boundary With An Examiner
Bring the entity profile and the unresolved questions to a scoped planning discussion; the first consultation is free. Keep completed worksheets and evidence in controlled records rather than in the inquiry form.
The Workbook and Its HTML Manuals
What the procedures record
Forty one proposed procedures are mapped to a 469 record PSC and DFS clause and context matrix, with definitions, administrative text and forms labelled separately so a definition is never tested as a duty.
Blank, invalid and unsupported applicability decisions remain in the open count. Sources show retrieval limits and native links. The tagged PDFs retain the fillable records, and the complete HTML manuals below provide the reading and navigation alternative with every procedure, table, worksheet and source register.
The templates organize the evidence and the responsible people that project findings, scope approvals and technical reviews draw on.
Download the Complete Set
Read every guide freely. Choose a download, then share your work email and company or skip. Your selected file starts immediately.
GDF receives your email and this utility library request. No assessment is booked and no marketing subscription is created. Keep completed workbooks and utility records in your controlled system.
You can read the utility manuals and preview builder choices without a request. Choose a download, then share your work email and company or skip.
How GDF handles this request. If the security check or email is unavailable, email info@evestigate.com for access.
Document the Work and Its Limits
The NY workbook adds an explicit sampling rationale, observations, examiner review records and documentation follow up. Its evidence repository has one authoritative input, while the field view links to a selected test for printing.
The PSC and DFS clause matrix remains a source mapping with unresolved entity decisions. Obtain the current utility instructions, the operative DFS text and written resolution of questions Q01 to Q10 before relying on scope, transitions or a filing.
Read the field and documentation guide (HTML) or download the guide (PDF, 4 pages).
Prepare for an Audit, Security Assessment or Penetration Test
Gather the scope, records, owners and permissions before an assessment.
Assessment preparation walkthrough and checklist.
The coverage notes, the Indiana and Maryland updates and the depth register show where each state profile is deepest.
What to Expect From the Current Files
The NY set includes the 21 sheet workbook with Excel table definitions, consistent populated cell styles and row resizing on protected workflows. File checks establish normal Excel 16 opening within the tested configuration.
Before you print or share a workbook, read the workbook format and printing notes.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .