Edition 2026-10-16-r2. This HTML manual provides the complete procedural content for reading and navigation. Use the editable workbook or fillable PDF for controlled project records.
Review findings and unresolved questions
This report records the content, usability and accuracy challenges applied to the four planning packs and the state/local companion. It identifies corrections made and questions that remain open.
Review method
Content review challenged scope, authority, unsupported assurances and conflation of legal duties with guidance. Accuracy review checked thresholds, dates, instrument status and citations against the selected primary sources. Usability review walked the project stages and field worksheets from initial scope through stop-work, findings, verification and handover.
These are documented desk and artifact reviews. They are not independent external human assurance or field trials. No plant, technical lead, regulator or customer participated in a live assessment. A completed pack must receive facility-specific technical and compliance approval.
Disposition
Confirmed issues were corrected or removed. A qualified source statement was retained only with its proper scope. An unresolved controlling instrument or facility fact remains an open decision; it was not filled with an assumed rule. Detailed findings and resulting locations follow.
Result
The final planning texts separate binding duties, official guidance, drafts, expired references and proposed assessment procedures. They contain blank site-specific approval fields rather than invented reviewers, dates, evidence or compliance results. The workbook supports the same distinctions.
Using the corrected workbook edition
Edition 2026-10-16-r2 adds structured execution records and separates evidence gaps from supported conclusions.
Before execution
Use the exact criterion, population, period, sampling rationale, permitted method, execution date, actual observation, evidence IDs and reviewer. A proposed test is not an assessment result. Keep sources and operating authority separate.
Open and incomplete decisions
The open count includes blanks, invalid decision text and resolved selections missing required record fields. Fields present still requires qualified review. Actual approvals remain uncompleted until the responsible people review the work.
Scope and authority
Record every proposed exclusion, its reason and responsible reviewer in Scope decisions. Deferred work remains visible. State research is a separately labelled routing register; the 200 state-sector rows are research tasks. For NY use the Clause matrix and Q01-Q10. Missing current instruments and local facts remain unresolved.
Source access and revision
Sources list retrieval status and available snapshot hashes. A restricted URL is not proof that a duty does not exist. Edition record tracks actual project revisions and reviews. Retain the previous edition and do not treat a template publication as a personal technical or legal approval.
Sources: F01 Guide to Operational Technology Security Revision 3, F03 Technical Guide to Information Security Testing and Assessment
Water review findings
W-A01 Accuracy review
The middle-population RRA cohort was assigned June 30 2025 in the working text.
Evidence reviewed: W01 table of certification deadlines identifies December 31 2025.
Disposition: Corrected. Location: Federal drinking water obligations.
W-A02 Content review
Could the pack incorrectly assign AWIA certification to wastewater or substitute a scan for the full RRA?
Evidence reviewed: W01 and W03 distinguish covered community drinking-water systems and voluntary wastewater ERP assistance.
Disposition: Corrected and constrained. Location: Federal drinking water obligations and Wastewater and discharge obligations.
Water review findings
W-A03 Accuracy review
Could Maryland customers, Indiana population and New Jersey service connections be treated as the same threshold?
Evidence reviewed: W04, W05 and W08 use different units and scope tests.
Disposition: Corrected and separated. Location: State water requirements and workbook Applicability.
W-A04 Accuracy review
Could an agency reporting date in Maryland be assigned to operators?
Evidence reviewed: W05 section 9-2706 assigns collection/reporting work to the agency. Operator submission instructions require their own confirmation.
Disposition: Corrected. Location: Maryland profile and State water requirements.
Water review findings
W-U01 Usability review
Can a field technician stop work and identify who owns a safe process response?
Evidence reviewed: The method now contains named stop authority, operator control and a specific field activity permit.
Disposition: Corrected. Location: Safe work and stop authority and Field activity authorization worksheet.
Power review findings
P-A01 Content review
Could every distribution, gas or energy system be described as NERC CIP regulated?
Evidence reviewed: P01, P03 and P05 require different entity/system boundaries.
Disposition: Corrected and constrained. Location: Bulk power applicability.
P-A02 Accuracy review
Could a newly approved CIP revision be presented as immediately enforceable?
Evidence reviewed: NERC distinguishes mandatory standards from future enforcement; P02 describes 2026 approvals. Exact edition and implementation plan are required.
Disposition: Corrected and left site dependent. Location: Bulk power applicability and CIP evidence workstreams.
Power review findings
P-A03 Accuracy review
One state reference attached to a Tennessee paragraph resolved to Texas.
Evidence reviewed: State IDs S42 and S43 identify Tennessee and Texas respectively.
Disposition: Corrected. Location: Distribution DER and state utility programs.
P-U01 Usability review
Could a technician infer permission to trip, switch or alter a relay from a cyber test authorization?
Evidence reviewed: The pack reserves switching/protection authority to operations and requires an exact activity permit and engineering approval.
Disposition: Corrected. Location: Safe work and Substation and control center examination.
Manufacturing review findings
M-A01 Content review
Could the three-year PSM compliance audit be sold as a universal OT audit requirement?
Evidence reviewed: M01 paragraph o applies to covered PSM processes and the full PSM program.
Disposition: Corrected and constrained. Location: Process safety and change management.
M-A02 Accuracy review
Could the old November 2026 CMMC Phase II date be used without checking later agency direction?
Evidence reviewed: M03 official indexed announcement reports a suspension; controlling procurement direction and contract treatment were not authenticated.
Disposition: Open question with text corrected. Location: Defense information and contract boundaries.
Manufacturing review findings
M-A03 Accuracy review
Could archived CFATS obligations or a draft Manufacturing Profile be presented as current mandatory requirements?
Evidence reviewed: M06 reports statutory expiry; M08 is an initial public draft.
Disposition: Corrected and classified. Location: Manufacturing recurring calendar and source register.
M-U01 Usability review
Could restored IT be confused with safe production restart or product release?
Evidence reviewed: The revised procedure requires separate production, safety and quality acceptance.
Disposition: Corrected. Location: Production cell and quality examination and Manufacturing incident and restart exercise.
Transportation review findings
T-A01 Accuracy review
Could expired public TSA directive copies be used as the current audit criteria?
Evidence reviewed: T03 and T04 explicitly expire May 2 2026. No authenticated replacement or extension was obtained.
Disposition: Open question with text corrected. Location: Rail and transit and Pipeline planning.
T-A02 Content review
Could every port or waterfront operator be assigned the maritime rule?
Evidence reviewed: T01 section 101.605 limits scope by required security plans under Parts 104, 105 and 106.
Disposition: Corrected and constrained. Location: Maritime obligations and milestones.
Transportation review findings
T-A03 Accuracy review
Could maritime annual assessment, drills, exercises and penetration testing be described as one annual audit?
Evidence reviewed: T01 separately specifies assessment, plan/audit, at least two drills each calendar year, annual exercise with 18-month maximum, and the applicable penetration-test cycle.
Disposition: Corrected and separated. Location: Maritime obligations and milestones.
T-U01 Usability review
Could one corporate approval authorize live work across vessels, aviation, signaling and pipelines?
Evidence reviewed: Each mode/owner retains its own operating approval and current security instruments.
Disposition: Corrected. Location: Mode boundaries and Aviation ports and roadway field boundaries.
Transportation review findings
T-U02 Usability review
Could an operator miss the separate annual plan audit or new-personnel training deadline when using the summary maritime page?
Evidence reviewed: T01 and T10 distinguish the recurring records and personnel triggers.
Disposition: Corrected with a dedicated calendar. Location: Maritime recurring work register and workbook Recurring duties.
State companion review findings
S-A01 Content review
Would 50 profiles imply that every state and local rule was conclusively resolved?
Evidence reviewed: The research contains selected sources, two identified state research gaps and missing facility/local inputs.
Disposition: Corrected and expressly limited. Location: State and local research scope.
S-A02 Accuracy review
Could a bill or proposed Pennsylvania rule be treated as enacted?
Evidence reviewed: S13 and S38 do not establish enacted/final operative duties from the retrieved records.
Disposition: Corrected and watchlisted. Location: Illinois and Pennsylvania profiles.
State companion review findings
S-A03 Content review
Should a government-hosted percentage risk reduction claim be repeated without reviewing its basis?
Evidence reviewed: The Wisconsin guidance statistic had no evaluated causal basis in this research.
Disposition: Excluded. Location: Wisconsin profile and all sector packs.
All packs review findings
ALL-A01 Accuracy review
Can lack of an authenticated final CIRCIA rule be replaced by an assumed active 72/24-hour reporting duty?
Evidence reviewed: F05 is a 2026 rulemaking record. This research did not establish an effective final rule. Other existing reporting duties remain separate.
Disposition: Open question with universal clock excluded. Location: Applicability records and Review report.
ALL-U01 Usability review
Are prerequisites, evidence and acceptance separable, or does a checked task imply legal compliance?
Evidence reviewed: The workbook begins with Unresolved site decisions. Preallocated finding rows are Not recorded. Actual findings distinguish observed, recommended, implemented and verified records.
Disposition: Corrected. Location: Workbook and all four field worksheet sets.
All packs review findings
ALL-C01 Content review
Could the planning edition be mistaken for a signed facility assessment or independent external assurance?
Evidence reviewed: The planning materials have not been adopted for a named facility. Technical, compliance and operating approval fields remain blank.
Disposition: Approval fields retained blank. Location: Facility adoption and review fields.
Questions requiring resolution
Q01 Current CIRCIA instrument
An effective final rule and its operative coverage/date were not established.
Required next evidence: Obtain the current final Federal Register instrument and implementing CISA instructions. Record whether and when the named entity is covered.
Affected scope: All sectors.
Q02 Current TSA rail and pipeline instruments
Public copies obtained expire May 2 2026. Current replacements, extensions and operator-specific approved plans were not authenticated.
Required next evidence: The operator security official supplies the currently issued instruments, applicability notice and approved plans through the authorized handling process.
Affected scope: Transportation and pipeline energy.
Questions requiring resolution
Q03 Aviation cybersecurity criteria
Current airport/aircraft security-program amendments and applicable airworthiness/operating conditions were not supplied.
Required next evidence: Obtain the actual approved program and qualified aviation review. Do not reconstruct SSI or product certification criteria from public summaries.
Affected scope: Transportation.
Q04 CMMC implementation direction
An official indexed July 2026 announcement reports Phase II suspension. Current detailed procurement direction and effect on each awarded contract remain unresolved.
Required next evidence: Obtain current implementing direction and the contracting-officer determination for the specific award. Existing safeguarding clauses require a separate assessment.
Affected scope: Manufacturing and federal contractors.
Questions requiring resolution
Q05 State gaps and restricted retrieval
Louisiana and Vermont sector-wide duties remain research gaps. Some New York, Minnesota and Massachusetts full text could not be retrieved; Illinois/Pennsylvania enactment/finality was not established.
Required next evidence: Retrieve controlling state text and current agency instructions before a site-specific conclusion. Do not interpret these gaps as exemptions.
Affected scope: State and local companion.
Q06 Facility local and contractual inputs
No facility list, complete permits, leases, grants, insurer terms, ownership matrix or local operating agreements were supplied.
Required next evidence: Provide the site and operator inventory. Complete the local worksheets and retain each controlling instrument, trigger and verified contact.
Affected scope: All sectors.
Questions requiring resolution
Q07 Licensed standards and specialist regimes
Full normative ISA/IEC texts and product-specific, nuclear, safety or quality approvals were not obtained.
Required next evidence: Obtain the applicable edition and the responsible specialist. Agree assessment criteria and evidence before claiming conformity.
Affected scope: All sectors.
Q08 Current NERC requirement editions
The public register distinguishes current and future enforcement but does not complete the entity-specific matrix.
Required next evidence: Freeze current requirement versions, implementation dates, registration and BES categorization with the compliance owner.
Affected scope: Power and energy.
Source quality and verification limits
Sources in the packs are current or explicitly dated primary government and regulator material, standards-publisher material and selected peer reviewed journal research.
Sources excluded
Social media, vendor marketing and unsourced commercial summaries were not used as authorities. Search results that concerned insurance-licensee statutes were excluded as a basis for industrial operator duties. A government host alone was not treated as proof of scientific effectiveness.
How to read the source register
Final legislation and operative rules have a different legal role from agency interpretation, implementation notices, historical documents and research. The register records those roles and restricted retrieval. Drafts and expired directives remain useful history only within the stated limits.
What has not been demonstrated
The packs do not establish that every locality or every state-sector rule was found, that a facility is compliant, that a live test is safe, that a regulatory report was accepted, or that a control reduces risk by a quantified percentage. Those claims require additional facts or evidence.
Adoption decision
Resolve the applicable open questions, complete the facility records and obtain the authorized technical and compliance signoff. The resulting scope and evidence determine the assessment conclusion, not the existence of this planning edition.
Sources and instrument status
F01 Guide to Operational Technology Security Revision 3
NIST. Final guidance. September 2023 final publication; chapters 4 through 6 and OT control tailoring.
F03 Technical Guide to Information Security Testing and Assessment
NIST. Final guidance. Assessment planning and rules of engagement. Apply OT operating constraints; this IT testing guide does not authorize production testing.
W04 Cybersecurity for Water and Wastewater Facilities
Indiana IDEM. Agency implementation guidance. IC 13-18-16.5; covered facility types; 2026 assessments and incident reporting.
T10 Maritime cybersecurity current codified provisions
Office of the Federal Register eCFR. Current codified rule. 33 CFR 101.630(f); 101.635; 101.640; 101.650(d)-(e); implementation under 101.655. Current display checked October 13 2026; retrieved provisions reviewed October 16 2026.. Read the applicable compliance dates in 101.655 and any approved equivalent or waiver. The eCFR is authoritative but unofficial.
S12 Idaho ITS Information Security Policy Manual, version 4.0
Idaho Technology Authority. Official agency policy manual. Incident Response IR-06; establish actual agency and system scope. Replaces the unavailable S6010 link as the selected research route. Verify current operative adoption and entity scope. Does not bind every private facility.
Sources: F01 Guide to Operational Technology Security Revision 3, F03 Technical Guide to Information Security Testing and Assessment, W04 Cybersecurity for Water and Wastewater Facilities, T10 Maritime cybersecurity current codified provisions, S12 Idaho ITS Information Security Policy Manual, version 4.0