Passive-first assessment planning
Review legacy systems, vendor access and recovery with a passive-first method. Active validation requires operations approval, defined targets and stop conditions.
Water: AWIA inputs · Power: applicable NERC CIP evidence · NIST SP 800-82 guidance
Drinking water and wastewater
For qualifying community drinking-water systems, cybersecurity evidence can support AWIA risk and resilience assessment and emergency response plan work. Wastewater scope follows its applicable requirements.
Power and energy
For applicable registered entities and BES Cyber Systems, agree the requirements and evidence boundary. Distribution, gas and other energy environments need their own applicability review.
Across OT environments
Review architecture, legacy assets, vendor access and recovery with operating context. Active validation requires separately authorized targets, timing and stop conditions.
Security and engineering
Review asset and access paths, source evidence, limitations, configuration findings, corrective actions and agreed verification methods.
Leadership and counsel
Review operating consequences, priorities, accountable owners, dependencies and the evidence needed for planning or an applicable regulatory review.
01 Scope
Define assets, process dependencies, responsible owners, exclusions and the people who can approve methods. Agree handling restrictions and escalation contacts.
02 Observe
Review diagrams, inventories, configurations, logs and approved passive observations. Reconcile these records with operations and engineering knowledge.
03 Validate
Document targets, methods, operating windows, stop conditions and recovery arrangements. Use a representative or laboratory system when production validation is unsuitable.
04 Prioritize
Record the affected process, supporting evidence, owner, maintenance dependencies and verification criteria. Distinguish a recommendation from an implemented and verified change.
The approach is informed by NIST SP 800-82 Rev. 3. The final scope depends on available evidence and operating constraints. Passive observation also requires an approved collection design; no method eliminates every operational risk.
Illustrative report excerpt. This is a fictional example, not a client result or a completed validation.
Management summary
A support account appears able to reach additional control-zone assets. The operating concern is a possible path from a compromised account to systems supporting the process. Confirm reachability before treating that consequence as established.
Engineering record
Evidence: access approvals, identity groups, jump-host policy and firewall configuration. Limitation: no active reachability check performed. Next step: narrow the approved path, retain session records and agree verification with operations.
The contracted report can include an architecture and access-path record, consequence-ranked findings, corrective owners, a remediation sequence and a defined validation plan. Agree the reporting audience, depth and retesting scope in writing.
Scope can include PLCs, RTUs, HMIs, SCADA servers, historians, engineering workstations, gateways and supporting remote-access systems. Legacy equipment is reviewed in its operating context, including compensating controls and recovery options.
During scoping, identify the protocols in use, such as Modbus TCP, DNP3, IEC 61850 or OPC DA/UA. Agree the relevant specialist capability, available configuration or passive evidence, and permitted validation for each system. Naming a protocol does not mean every implementation or test method is included.
Technical scope record
System or protocol; process owner; evidence available; agreed review method; excluded actions; validation window; recovery support.
Relevant expertise
Review published team qualifications, then agree the technical lead, industrial experience and any specialist duties required for the installed systems.
Use GDF's New York engagement hub to discuss NY/NJ facilities and neighboring PA/CT operations. Agree site access, maintenance windows, technical staffing and travel requirements before scheduling.
For regulated New York utilities, confirm the applicable NY PSC requirements, including the IT cybersecurity regulations adopted in April 2026. Review supporting IT and IT/OT access boundaries within the agreed technical scope. For New Jersey utilities, identify the applicable NJ BPU program and evidence requirements.
NYDFS 23 NYCRR Part 500 applies to covered entities authorized under New York banking, insurance or financial-services laws. Location in New York alone does not establish applicability. Discuss Part 500 technical evidence support when the organization has a relevant covered-entity or contractual requirement.
Technical assessment, regulatory assessment, engineering implementation and independent audit are separate scopes. The operator and its advisers determine applicable duties. An assessment does not guarantee compliance or legal privilege.
Sources checked October 14, 2026: NY PSC IT cybersecurity announcement; NJ BPU Reliability and Security; NYDFS covered entities.
Water planning pack
Preview the applicability prompts, evidence-owner checklist, fictional access finding and fillable planning worksheets. Email is the only contact detail requested for the full PDF.
Power planning pack
Preview the remote-access evidence checklist, authorization boundaries, fictional finding and fillable scope and action records. Email is the only contact detail requested for the full PDF.
The packs are planning aids. You can read the previews without registering. A resource request does not book an assessment or subscribe you to marketing.
Agree the assets, access, responsibilities, exclusions, evidence handling and validation criteria in writing. Technical assessment, regulatory assessment, engineering implementation and independent audit have separate scopes. The operator retains operating and compliance responsibilities.
Frequently asked
We coordinate the assessment around the operating process and approved methods. Documentation review, interviews and passive observation establish the baseline; engineering approves the scope and timing of active validation.
Yes. We examine vendor accounts, authentication, permissions, connection paths, approval procedures and session records, then document findings and practical control improvements.
Yes. We assess legacy equipment in context, including segmentation, controlled access, monitoring, backups and recovery options appropriate to the operating environment.
Yes. We define the common controls and site-specific dependencies, coordinate with each operating team and organize the findings for both local remediation and leadership decisions.
The report prioritizes the findings, explains the operating consequence, identifies the relevant technical evidence and sets out remediation and validation steps.
Download the four sector packs and 50-state companion, or create a workbook set for your states, ownership and operating scope.
Technical review: Joseph Caruso, Founder, CEO and CTO. Reviewed .
Assessment scope
Share your organization and preferred reply method. We review the request, discuss the technical lead and reporting needs, then agree the scope before work starts.
No network diagrams, credentials or detailed vulnerabilities are needed here. Secure exchange is arranged separately.
Active OT incident? Call 1-800-868-8189 for 24/7 intake.