Utility audits, technical records and incident readiness
Utility Cybersecurity Audit & Incident Readiness
Support a defined utility audit and prepare the technical records needed for an incident. GDF reviews the agreed IT/OT boundaries, vendor access, recovery and evidence with the responsible utility team.
Gather records before an engagement
Related preparation packages
Choose a guide to identify records, assign owners and prepare questions for your auditor, consultant, counsel or export-control specialist.
These are preparation aids. They do not replace an audit, assessment, legal opinion or specialist decision, and they do not authorize testing.
Read the overviews without a form. Downloads require your name and email; we email a seven-day access link. Organization and phone are optional.
Water and wastewater OT preparation
Gather system boundaries, ownership facts, operating dependencies and records for a water or wastewater assessment.
File: Fillable PDF planning pack.
Power and energy OT preparation
Organize facility facts, system scope, responsibility and evidence for power and energy assessment planning.
File: Fillable PDF planning pack.
New York utility preparation set
Keep utility oversight, DFS applicability and private-information questions separate while gathering supporting records.
File: ZIP: PDF, XLSX workbook and CSV records.
New Jersey utility preparation set
Gather water, wastewater, electric or gas utility facts, evidence and owner decisions, including 18 tracked open questions.
File: ZIP: PDF, XLSX workbook and CSV records.
Browse all preparation packages by subject.
Check each overview for source dates, scope limits and unresolved questions before using a download.
Utility audit evidence and incident readiness
This service supports a defined utility audit, the technical records behind it and arrangements for an incident. Establish the covered entity, applicable requirements, review period and qualified participants before accepting a formal audit assignment.
New York Part 1200 addresses covered utilities' information technology. Its IT audit and incident-readiness duties are distinct from a general control-system assessment. The utility and its responsible advisers retain applicability, certification and submission decisions.
For a broader operating-system review, begin with Power & Energy Cybersecurity Assessment or Water & Wastewater Cybersecurity Assessment. For a defined bulk-electric requirement and review period, see NERC CIP Audit Evidence Support.
Prove the controls that support continuity
A diagram can show separation between IT and OT while identity, remote access, historian services or engineering support still cross the boundary. We work with security, operations and engineering to document those dependencies and evaluate approved isolation and recovery procedures.
The initial scope can cover one access path, a plant or a defined group of facilities. Each site retains its own configuration and responsibility record. Shared corporate controls can be examined once where appropriate, with site evidence showing how each installation inherits and operates them.
Independent technical audit support
Define the applicable audit requirements, systems and evidence. Disclose prior design or implementation work and establish any independence or specialist-review requirements before accepting the assignment.
IT/OT boundary validation
Map dependencies, identity and authorized routes across operational boundaries. Review isolation procedures and approve bounded validation with the operating engineer.
Vendor access and commissioning
Examine account approvals, gateways, session attribution and revocation. A new plant, microgrid, storage integration or controls handover can provide a defined acceptance-testing scope.
Forensic and recovery readiness
Agree on incident intake, authority, preservation, secure transfer, logging prerequisites and response terms. Review backups and test a representative recovery workflow under approved conditions.
New York Part 1200: IT assurance and a forensic-vendor relationship
New York's Part 1200 took effect June 1, 2026. The Public Service Commission describes the adopted rule as an IT cybersecurity regime, with industry-specific OT rulemaking separate. It is not a universal SCADA penetration-testing mandate.
For covered utilities, section 1200.18 requires a yearly qualified third-party IT audit and includes the ability to segment IT from OT during an incident. Section 1200.19 requires a contractual relationship with a qualified third-party forensic vendor. That requirement does not prescribe a retainer price or prepaid-hours arrangement.
Coverage, exclusions, phased controls and first-cycle audit timing must be checked for the actual entity. The first annual certification is due June 30, 2027. GDF's technical work supports the owner's evidence and readiness decisions; the owner and its advisers determine legal obligations and compliance status.
Sources checked October 6, 2026. Official sources: New York PSC adoption announcement (opens in a new tab); PSC adoption order and Part 1200 (opens in a new tab); NIST Guide to Operational Technology Security (opens in a new tab).
Methodology
Separate the audit, validation and response work
-
Establish applicability
Confirm the legal entity, facilities, operating arrangements, audit boundary and requirements with the client and appropriate specialist.
-
Approve safe methods
Start with diagrams, interviews, records and passive evidence. Define operating windows, stop authority, exclusions and recovery arrangements before active work.
-
Validate selected controls
Review isolation, vendor access, identity, logging and restoration against the agreed scope. Record what was tested and what remains untested.
-
Report for action
Deliver management consequences and engineering evidence, with priorities, assigned corrective actions and practical retest criteria.
-
Establish response readiness
Check counsel, insurer and incumbent-vendor arrangements. Define incident authorization, preservation, transfer and actual response labor separately from the audit.
-
Schedule assurance
Agree on remediation verification, change-triggered testing, recovery exercises and a bounded annual work allocation.
Evidence commonly examined
Evidence reviewed
- IT/OT diagrams, asset boundaries and service dependencies
- Identity, vendor-access and segmentation configurations
- Isolation procedures, monitoring and time-source records
- Configuration baselines, backups and recovery exercises
What you can expect
What you receive
- Technical audit or assessment report for the agreed scope
- Boundary and vendor-access findings with supporting evidence
- Corrective-action ownership and remediation-verification plan
- Forensic-readiness procedures and separately defined response terms
Choose the audit, validation or readiness work you need
Start with the decision: an initial review, an unresolved audit finding, a vendor connection, selected control verification or a recovery dependency. Review existing work before commissioning a replacement assessment.
Agree the systems, evidence, authorized methods, outputs and responsible parties. Technical plan support does not automatically include a complete compliance program, regulatory filing or engineering implementation.
For recurring work, define a funded calendar, site and system limits, review rounds and evidence ownership. Independent audit requires separate competence and independence screening. Monitoring and incident-response labor are separately contracted.
Frequently asked
Common questions
Does Part 1200 apply to every utility?
No. Applicability and exclusions depend on the legal entity and regulatory definitions. Do not apply a water threshold to electric or gas operations or assume municipal utilities are covered.
Is this the same as NERC CIP compliance work?
No. NERC obligations require separate registration, asset and impact-category analysis. GDF's NERC CIP audit-evidence service supports defined technical work; sector-specialist qualifications and compliance mapping must be established for each engagement.
Can this cover energy plants outside New York?
Yes, the technical scope can address utility plants, microgrids, storage and building-control dependencies. New York rules are not applied to facilities outside their coverage. Scope follows the operating environment, buying event and client authority.
Does an assurance agreement include unlimited incident response?
No. Annual assurance has an agreed work allocation. Travel, implementation, specialist engineering and incident-response labor are separately defined unless expressly included.
Talk with an examiner
Discuss your utility and operating boundary
Tell us the utility or facility type, location, audit or commissioning deadline and the systems involved. We will discuss authority, specialist needs and operating constraints before proposing the technical scope. Do not submit sensitive control-system records through this form.
Since 1992 · 24/7 dispatch · Court-tested experts
Related capabilities