Utility Cybersecurity Audit Support, Boundary Evidence and Forensic Readiness
Utility Audit Support Built on Evidence, Not Diagrams
A network diagram can show IT cleanly separated from OT while identity services, remote access, historians and engineering support quietly cross the line. GDF tests that line with OT assessment and digital forensics in one engagement, and proves whether your utility can cut the connection during an incident without losing essential operations. The result is boundary evidence an auditor can follow and a forensic readiness plan your team has already rehearsed.
Scope the utility
One Engagement for the Audit and the Incident Plan
Utilities increasingly answer two questions at once: can you show an auditor that the boundary between business IT and plant OT holds, and can you prove you would preserve evidence and recover if it failed? We settle the covered entity, the applicable requirements, the review period and the qualified participants first, then scope the work to one access path, one plant or a defined group of facilities. Shared corporate controls are examined once, and each site keeps its own configuration and responsibility record.
IT and OT Boundary Evidence
The identity, historian, remote access and support services that cross the boundary, mapped and checked against what the isolation procedure assumes.
Vendor Access and Revocation
Account approvals, gateways, session attribution and a tested way to disable an approved vendor's access on demand.
Forensic Readiness on Contract
Incident intake, authority, preservation, secure transfer and logging prerequisites agreed before the first suspicious alert.
New York Part 1200: Audit, Segmentation and a Forensic Vendor
The New York Public Service Commission adopted its information technology cybersecurity rules for regulated electric, gas, steam and water utilities on April 16, 2026, effective June 1, 2026, with operational technology rules for individual industries to follow, as the PSC adoption announcement explains. Covered entities have 180 days from the effective date to comply with most provisions. Section 1200.1 leaves out smaller utilities, among them water works corporations serving fewer than 50,001 service connections and electric corporations with fewer than 50,000 service lines.
Three duties in the Part 1200 adoption order land squarely on this work. Section 1200.18 requires a yearly qualified third party audit of IT cybersecurity that assesses, among other things, the utility's ability to segment IT from OT during an incident. Section 1200.19 requires a contractual relationship with a qualified third party forensic vendor before an incident happens. And the first annual certification of compliance is due June 30, 2027. We supply the boundary evidence, the readiness arrangements and the forensic capability, and the planning approach follows NIST's SP 800-82 Revision 3.
Covered by Part 1200 and weighing your current arrangements against it? Work through the New York utility cybersecurity and privacy planning guide before the scoping call.
Four Kinds of Utility Work
Independent technical audit support
We define the audit requirements, systems and evidence, disclose any earlier design or implementation work we performed, and confirm the independence the assignment needs before accepting it.
IT and OT boundary validation
Dependencies, identities and authorized routes across the boundary are mapped, isolation procedures reviewed and bounded validation approved with the engineer who owns the equipment.
Vendor access and commissioning
Account approvals, gateways, session attribution and revocation are examined, and a new plant, microgrid, storage integration or controls handover gets a defined acceptance testing scope.
Forensic and recovery readiness
Incident intake, authority, preservation, secure transfer, logging prerequisites and response terms are agreed, and a representative recovery workflow is tested under approved conditions. If response terms are the gap, forensic readiness and incident response planning is the place to start.
Methodology
Six Stages That Keep Audit and Response Distinct
01 / Applicability: Entity and Boundary
We confirm the legal entity, facilities, operating arrangements, audit boundary and requirements with you before anything is collected.
02 / Methods: Passive First
Diagrams, interviews, records and passive evidence come first; operating windows, stop authority, exclusions and recovery arrangements are set before any active work.
03 / Validation: Selected Controls
Isolation, vendor access, identity, logging and restoration are checked against the agreed scope, with what was tested and what was not recorded side by side.
04 / Reporting: Built for Action
Management consequences and engineering evidence, with priorities, corrective owners and retest criteria.
05 / Readiness: Response Arranged
Legal, insurer and incumbent vendor arrangements checked, and incident authorization, preservation and transfer defined apart from the audit.
06 / Assurance: The Annual Cycle
Remediation verification, change triggered testing and recovery exercises scheduled against a fixed annual allocation.
Send us the systems and the deadline, and the first call will set the scope, the approvals and the schedule.
Forensic Examiners Who Also Run Utility Tabletops
The same practice that preserves evidence for court runs tabletop exercises for utility leadership and board audiences so the people who will decide during an incident have rehearsed it. Our examiners have testified in federal and state courts, the standard we bring to every preserved log and recovery record. Read about the GDF team.
Start From the Decision in Front of You
Start with the one decision in front of you: an initial review, an open audit finding, a vendor connection, selected control verification or a recovery dependency. We review the work you already have before anyone commissions a replacement, then put the systems, evidence, methods, outputs and responsibilities in writing. For a broader review, start with the power and energy cybersecurity assessment or the water and wastewater cybersecurity assessment; for a bulk electric requirement and review period, NERC CIP audit evidence support is the narrower fit.
Free utility preparation pack
Download the New York Utility Preparation Pack
The New York pack keeps utility oversight, DFS applicability and private information questions in separate workstreams, with a PDF guide, an XLSX workbook and CSV records for the evidence each one needs. Sector planning packs for water and power, and a New Jersey set, cover utilities outside New York or with mixed operations.
New York Utility Preparation Pack
Oversight, applicability and private information records organized for a covered utility.
Format: ZIP with PDF, XLSX workbook and CSV records.
Download the New York Utility Pack (ZIP)
Water and Power Sector Planning Packs
Boundaries, ownership, dependencies and records for water, wastewater, power and energy assessments.
Format: two fillable PDFs.
Download the Water and Wastewater Planning Pack (PDF)
Download the Power and Energy Planning Pack (PDF)
Manuals: water and wastewater and power and energy.
The OT assessment planning library shows how each deliverable is structured, and the OT security review checklist and the full library of preparation packages cover the wider records.
Frequently asked
Utility Audit and Readiness Questions We Hear
Which utilities does Part 1200 cover?
Public utility companies regulated by the New York Public Service Commission, except the smaller ones the definition leaves out, such as water works corporations serving fewer than 50,001 service connections and electric corporations with fewer than 50,000 service lines. We confirm coverage for your legal entity first, then scope the audit and forensic vendor work around it.
How does this relate to NERC CIP compliance work?
They run on separate tracks. NERC obligations depend on registration and BES Cyber System categorization, and our NERC CIP audit evidence service handles that record. Utility audit and readiness work covers the IT and OT boundary, vendor access and forensic arrangements that state rules and your own incident plan call for.
Can you serve utilities and plants outside New York?
Yes. The technical scope covers utility plants, microgrids, storage and building control dependencies wherever we work, and follows the operating environment, the audit or commissioning event and the authority the client holds.
What does an annual assurance agreement include?
An agreed allocation of verification, change triggered testing and exercises across the year. Travel, implementation, specialist engineering and incident response labor are priced in the agreement, so the scope and the cost are clear from day one.
Talk with an examiner
Map Your Part 1200 Work on the First Call
On the first call a senior practitioner confirms which rules reach your utility, identifies whether the audit, the boundary validation or the forensic arrangement is the most urgent gap, and sets out the scope, schedule and price. The consultation is free. Keep sensitive control system records out of this form.
Since 1992 · 24/7 hotline · Court tested experts
Related capabilities
Related Utility and OT Services
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .