Water & wastewater
Drinking water, wastewater, AWIA boundaries, evidence and operating safeguards.
Download Water & wastewater pack (PDF)OT, ICS and SCADA assessment planning
OT Assessment Planning Library for Four Sectors and Fifty States
Four sector planning packs, a fifty state applicability companion and the working records a cybersecurity, risk, project or field team needs to prepare for an OT assessment. Read every guide freely. Choose a download, then share your work email and company or skip.
Gather records before an engagement
Gather the Records an OT Assessment Will Ask For
The related packages below help a utility, plant or transportation operator pull together the entity details, policy records and system evidence that an auditor, consultant, compliance lead or export control specialist will request, and put a named owner beside each item.
Each one prepares the record for the audit, assessment or specialist decision that follows.
Read every guide freely. Choose a download, then share your work email and company or skip. Your selected file starts immediately.
Discuss your evidence and deadline
NYDFS 23 NYCRR Part 500 Audit Preparation
Gather the entity details, policy records, system evidence and questions a Part 500 specialist will want to see.
File: ZIP: guide and editable CSV checklists.
New York SHIELD Act Private Information Preparation
Map the private information, safeguards, service providers and incident records a privacy and breach review will examine.
File: ZIP: guide and editable CSV checklists.
CMMC and NIST SP 800-171 preparation
Organize the contracts, information boundaries, system records and evidence requests for a defense cybersecurity specialist.
File: ZIP: guide and editable CSV checklists.
EAR and ITAR preparation
Gather the product, technical data, access and transaction facts an export control specialist will evaluate.
File: ZIP: guide and editable CSV checklists.
Browse all preparation packages by subject.
Each overview lists its source dates, scope and open questions alongside the download.
Not sure which package your facilities need? Describe the facilities and the deadline to a senior examiner and we will name the right starting place.
Prepare the OT Assessment With Your Own Project Team
Begin with what you know and what you are missing
The OT set includes a record gathering checklist and a register of unresolved scope and authority questions, so the first planning session starts from a documented position rather than a blank page. An auditor will ask for both on the first day, and a team that has filled them in already knows which answers it does not have.
Confirm the legal entity, the facilities, the audit purpose and the period first, because every later record is counted against them. Locate the records that already exist and put an owner and a target date beside each one. Review the missing facts, the current criteria and the proposed exclusions with the people responsible for them, then agree on the scope, the evidence access, the safe methods and the deliverables with GDF. We arrange an authorized evidence exchange with you for any controlled record.
Download with open items when you need to. Bring the package to a call with GDF and we will scope the engagement from there.
- Record gathering checklist (CSV)Records to locate, audit purpose, likely custodian and follow up fields. The complete ZIP includes the same checklist with the workbook and manuals.
- Open questions register (CSV)Missing facts and unresolved authority, the required next evidence and the effect on audit planning.
The workbook adds Preparation and Uncertainty sheets to the 16 core sheets, and the technical PDFs and HTML reference manuals sit alongside it.
Use the preparation walkthrough alongside those references.
If the open questions register is longer than the record list when the first session ends, read OT questions to settle before field work first; it lists the questions only your compliance and legal owners can close.
Choose the Sector Pack That Matches Your Facilities
Power & energy
Entity and system scope, NERC CIP screening, recovery and corrective action.
Download Power & energy pack (PDF)Manufacturing
Process dependencies, safety, supplier access and contract specific requirements.
Download Manufacturing pack (PDF)Transportation
Surface transportation, ports, vessels, aviation and pipelines, with restricted source limits.
Download Transportation pack (PDF)Shared Working Files for Every Sector
- State and local research companionPDF, 19 pages. A starting source for every state and the local decision worksheets.
- Complete assessment project workbookExcel, 22 worksheets. Tasks, applicability, assets, evidence, permits, findings and follow up.
- Source registerCSV, 113 sources. Official citations, publication status and retrieval limits.
Use the Library From Scope to Closeout
Choose the sector packs that match your facilities, then use the open questions register to record what each pack leaves for your team to settle. Define the facilities, the ownership and the operating responsibility, then confirm the federal, state, local and contract requirements with the people responsible for each. Assign the work, the evidence owners, the operating safeguards and the approvals in the workbook. Record observations and limitations as the work proceeds, assign corrective actions, verify closure against the evidence that was defined when the finding was written, and keep the recurring duties on a calendar that names the record proving each one was met.
The workbook builder creates a workbook for each sector you select, filters the open state and sector research tasks to your profile and records the profile you declared. The reference PDFs stay complete so that their context and limitations travel with the work instead of being trimmed away.
Build the workbook set for your own sectors and states in the OT workbook builder, then bring the rows that stay open to the first planning call.
Coverage and Current Source Checks
Sources current to November 3, 2026
The fifty state companion screens selected authorities. Facility location, ownership, operating function, permits and contracts determine the work still required, and local obligations need a facility specific review.
The packs cite the TSA rail and pipeline security directives issued May 1, 2026 (SD 1580/82-2022-01E and SD Pipeline-2021-02G), the CIP-015-1 internal network security monitoring standard approved in FERC Order No. 907, the virtualization versions of the CIP standards approved in FERC Order No. 919, the CIRCIA rule status and the CMMC Phase II suspension, and the facility specific instruments are mapped for each site during planning.
Plan a Scoped Assessment With GDF
Bring the selected scope and the unresolved questions to a planning discussion with a GDF examiner. Global Digital Forensics has served businesses since 1992, and the examiner you speak with is one who would have to stand behind the scope later. Keep engineering files and completed worksheets in your controlled records; the first conversation needs only a summary, and it is free.
New York Utility Audit Planning
For a New York utility project, add the specialist pack that covers DFS entity scope, PSC IT and PII audits, SHIELD safeguards and the state or local reporting procedures.
Read the NY utility planning pack or customize a utility audit workbook set.
The Workbook and Its HTML Manuals
What the procedures record
Ninety nine proposed sector control procedures carry population, sample, actual observation and reviewer fields, so a procedure row reads as a result only once those fields are filled. Two hundred state and sector rows identify open research tasks and fifty separate notes provide selected source routes. This is not complete research for every state, sector or locality, and the manuals say so wherever a row depends on it.
Blank, invalid and unsupported applicability decisions remain in the open count. Sources show retrieval limits and native links. The tagged PDFs retain the fillable records, and the complete HTML manuals below provide the reading and navigation alternative with every procedure, table, worksheet and source register.
The templates organize the evidence and the responsible people that project findings, scope approvals and technical reviews draw on.
Download the Complete Set
Read every guide freely. Choose a download, then share your work email and company or skip. Your selected file starts immediately.
GDF receives your email and the library requested.
Public manuals and builder previews remain readable. Choose a download, then share your work email and company or skip.
How GDF handles this request. If the security check or email is unavailable, email info@evestigate.com for access.
Document the Work and Its Limits
The library adds a field and documentation guide and 22 sheet workbooks. New water procedures cover New York drinking water records, and the power procedures now explicitly screen control center communications.
The 200 state and sector research tasks remain open. Use the Requirements sheet to add the current facility specific clauses, map their procedures and assign every unresolved research dependency before adopting this national set.
Read the field and documentation guide (HTML) or download the guide (PDF, 5 pages).
Dedicated New Jersey Planning Set
Prepare water and wastewater, power and energy, manufacturing and transportation work with New Jersey specific criteria screens, collection tasks and disclosed authority questions.
Open the New Jersey water, wastewater, electric and gas utility set, or customize a New Jersey utility set.
Prepare for an Audit, Security Assessment or Penetration Test
Gather the scope, records, owners and permissions before an assessment begins. Preparation organizes the work.
Assessment preparation walkthrough and checklist.
The coverage notes, the Indiana and Maryland updates and the depth register show where each state profile is deepest.
Current File Use Guidance
The national package includes the 22 sheet workbook and a five page workbook guide. Open legal source and state and sector research matters remain part of preparation.
Before you print or share a workbook, read the workbook format and printing notes.
Information Gathering Packages
Prepare records and questions for your specialist before the first meeting.
The set includes DFS, New York privacy, CMMC and NIST, and EAR and ITAR packages.
Legal gathering guides cover departed employees, contract disputes and medical matters.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .