Inside the pack
An evidence checklist with owners
Power: organize remote-access approvals, identities, boundary configuration, monitoring, recovery and requirement applicability.
A practical guide for operators, engineering and security teams
Prepare for a Power & Energy Cybersecurity Assessment
Prepare facility boundaries, system records, operating constraints and specialist responsibilities for a power and energy cybersecurity assessment.
Preview the NERC CIP scoping pack
Read this preview without registering. The examples are fictional and do not contain client records.
Inside the pack
Scope and action worksheets
Record the process boundary, approved methods, exclusions, stop conditions, recovery support and corrective owner. Fill the PDF locally after downloading it.
Example evidence record
Question: Can a vendor account reach assets beyond its support task?
Evidence: Account approval, access-group membership, jump-host rules and a dated firewall configuration.
Limit: Configuration review alone does not prove actual reachability.
Next step: Assign an owner and agree an operations-approved verification method. Map only to applicable NERC CIP requirements and system categorization.
Get the fillable planning pack
Five-page PDF with fillable scope and action worksheets. Download it after a successful request.
Your email and selected pack go to GDF. No callback or marketing subscription is requested. Keep completed worksheets in your own records.
Record the facility, assets and owners
Identify the generating plant, electric-network assets, renewable sites, storage systems or microgrid included in the request. Record site owners, operators, vendors and the engineering, operations and security contacts who can authorize work.
Choose the operating question
Describe whether the need concerns an assessment, a new integration, an open finding, vendor access, incident evidence or recovery. Supply existing summaries and action lists through an agreed exchange so new work can build on what is already known.
Prepare relevant records
- Available architecture, asset, network and supporting-service records.
- Engineering and vendor-access accounts, gateways and approvals.
- Relevant control-system, historian, site-controller and fleet-service interfaces.
- Configuration baselines, change records, backups and restoration evidence.
- Incident responsibilities, logs, time sources and previous exercise results.
Identify specialist responsibilities and exclusions
Agree who provides plant, electrical, protection, OEM and integrator expertise. Set operating windows, sensitive assets, allowed methods, stop authority and recovery arrangements. The assessment does not authorize live equipment changes or protection-setting changes.
Establish the requirements in scope
For a NERC-related assignment, the responsible entity supplies the applicable registration, asset categorization, requirement versions and review period. Distribution and distributed-energy reviews may use DOE's sector guidance. New York utility IT audit work has its own scope; do not substitute one program for another.
Keep the initial inquiry broad
Start with the facility type, location, role and timing. Keep diagrams, credentials and incident records out of the marketing form. Information handling is agreed before controlled records are exchanged.
Review Power & Energy Assessment Deliverables ยท Discuss the assessment
OT assessment planning library
Download the four sector packs and 50-state companion, or create a workbook set for your states, ownership and operating scope.
Technical review: Joseph Caruso, Founder, CEO and CTO. Reviewed .