Passive-first assessment planning
Assess treatment dependencies, vendor access and recovery with a passive-first approach. Agree active methods and stop conditions with operations before validation.
Gather records before an engagement
Choose a guide to identify records, assign owners and prepare questions for your auditor, consultant, counsel or export-control specialist.
These are preparation aids. They do not replace an audit, assessment, legal opinion or specialist decision, and they do not authorize testing.
Read the overviews without a form. Downloads require your name and email; we email a seven-day access link. Organization and phone are optional.
Gather system boundaries, ownership facts, operating dependencies and records for a water or wastewater assessment.
File: Fillable PDF planning pack.
Keep utility oversight, DFS applicability and private-information questions separate while gathering supporting records.
File: ZIP: PDF, XLSX workbook and CSV records.
Gather water, wastewater, electric or gas utility facts, evidence and owner decisions, including 18 tracked open questions.
File: ZIP: PDF, XLSX workbook and CSV records.
Browse all preparation packages by subject.
Check each overview for source dates, scope limits and unresolved questions before using a download.
AWIA Section 2013 / SDWA Section 1433 requires community drinking-water systems serving more than 3,300 people to prepare or update risk and resilience assessments (RRAs) and emergency response plans (ERPs), and certify completion to EPA. Wastewater systems do not automatically fall under these certification requirements.
Within the agreed scope, document cyber scenarios affecting treatment or distribution, remote-access dependencies, existing safeguards, monitoring gaps and restoration needs. Assign an evidence owner and record which findings inform the RRA and ERP. The cyber assessment is one contribution to the broader planning work.
Check the system's certification dates. EPA lists December 31, 2026 as the latest ERP date for the 3,301-49,999 population cohort when the RRA was certified on its final due date. ERP certification is due within six months of the actual RRA certification, so an earlier RRA date brings an earlier ERP deadline.
Sources checked October 14, 2026: EPA AWIA scope and deadlines. Confirm the current schedule for your system.
Drinking-water treatment and distribution, wastewater collection and treatment, and industrial water operations have different processes and responsibilities. Agree on the facility, operating question and people who can authorize the work.
Start with a whole-system assessment, one vendor connection, a planned controls change or a recovery question. An existing assessment can be useful: review its coverage and open findings before commissioning replacement work.
Each option has its own systems, methods and deliverables. Agree on operating safeguards and specialist responsibilities before work begins.
Understand the system and its exposure
Review plant and remote-site dependencies, control networks, engineering access, vendor connections, logging and recovery records.
Receive a system-specific findings report, an action register and technical material for the owner's planning work.
Resolve a finding or recovery question
Examine a selected support connection, network boundary, account change or restoration dependency. Review a proposed correction against the available records and agreed validation.
Receive the results, evidence, remaining uncertainty and next actions. Production changes and active testing require separate operating approval.
Keep the review current as systems change
Agree on a calendar for selected site changes, vendor-access reviews, open findings, incident records and recovery exercises.
Define the facilities, review dates, deliverables and available specialists. Monitoring, emergency response and accredited operator training have separate requirements and terms.
Review available architecture, asset and configuration records with the people responsible for engineering, operations and IT. Examine where business services connect to the control environment and whether the intended network boundaries are supported by configuration and authorized validation.
Findings should identify the observed condition, supporting evidence, affected operational dependency and remaining uncertainty. A device inventory or automated scan alone does not explain the risk to a treatment process.
Remote support can be essential to operations. Establish which vendor accounts, gateways and support tools exist, who authorizes their use and how access is restricted, recorded and removed. Shared credentials, persistent sessions and undocumented connections require a clear evidence-based review.
Compare intended access with available configuration and session records. Define the authorized question before any connection test, including the systems a vendor may reach and the circumstances in which access must stop.
Begin with interviews, existing records, configuration review and approved passive evidence. Operations and engineering identify sensitive equipment, maintenance windows, stop-work contacts and recovery arrangements. Active techniques require specific approval of the target, method, timing and operating conditions.
A laboratory or representative system may be the appropriate place to validate a concern. Exclude unsuitable techniques and document untested areas. Safeguards reduce risk, but no assessment can promise that production disruption is impossible.
A backup record does not, by itself, demonstrate that a system can be restored. Review the configurations, software versions, licenses, communications, vendor support and people needed to recover a selected function. Agree on a representative recovery review or exercise only where operating conditions permit it.
Consider the evidence needed during an incident: relevant access and change records, synchronized time sources, isolation decisions and preservation responsibilities. Missing or short-lived records should be identified while the owner can still improve readiness.
Cybersecurity can form part of a broader risk and resilience assessment and emergency-response planning effort. For an AWIA-related engagement, define the cybersecurity workstream and how it will be used alongside the other required assessment and planning components.
A cybersecurity review is not automatically a complete AWIA assessment or an entire state compliance program. The owner and its responsible advisers establish applicability, required submissions and certifications. GDF provides the technical work and evidence agreed in the engagement.
The report connects a finding to the affected system and the decision it supports. It distinguishes an observed condition from a concern that still needs validation.
Cybersecurity findings can support a broader water-system risk assessment and emergency plan. The written engagement identifies the technical work; the owner and responsible advisers retain the full planning, certification and submission duties.
Start with the facility type, general location, your role, the decision to be supported and any relevant planning date. Identify the operations, engineering and IT contacts who can authorize the work.
Keep security plans, credentials, network diagrams and incident evidence out of the inquiry form. Controlled information exchange is arranged separately. For an active incident, call to discuss the situation and response availability.
New York community drinking-water and wastewater programs have different coverage and dates. Confirm the responsible entity, system and applicable exclusions before defining a compliance-related scope.
DOH Appendix 5-E generally covers community drinking-water systems serving more than 3,300 people. January 1, 2027 is the general compliance milestone, with exclusions and earlier training and reporting provisions. Some personnel and monitoring requirements use a population tier greater than 50,000.
DEC identifies March 11, 2027 for New York publicly owned treatment works emergency plans and cybersecurity controls, and March 28, 2027 for initial annual certifications. Program requirements apply to all New York POTWs; the 10-MGD tier concerns network monitoring and logging, not whether the entire program applies.
A technical workstream is not automatically the complete required assessment, plan or certification. A commercial operator contract does not automatically transfer municipal certification authority. The owner and responsible advisers confirm obligations and signatory authority.
Sources checked October 6, 2026. New York DOH Appendix 5-E (opens in a new tab); New York DEC wastewater cybersecurity guidance (opens in a new tab).
AWIA risk and resilience assessment and emergency-plan certification applies to community drinking-water systems serving more than 3,300 people. By October 7, 2026, every risk-assessment deadline in EPA's published 2025-2026 cycle table has passed. For systems serving 3,301-49,999 people, emergency-plan certification is due six months after risk-assessment certification, with December 31, 2026 the latest deadline in EPA's table. Wastewater systems are not subject to this particular EPA certification requirement. Confirm the system's own certification date, regulator direction and any separate state duties. EPA AWIA requirements (opens in a new tab).
Frequently asked
An engagement can include both when the scope identifies each system, responsible entity and authorized boundary. Their operating dependencies and regulatory requirements should be recorded separately.
The assessment reviews the agreed environment, access, dependencies, recovery and technical evidence. Penetration testing is a separate technique that requires a specifically authorized target and method. It is not automatically suitable for every production control system.
Yes. Review the existing work for coverage, currency and limitations, then define the unresolved questions and evidence needed. New work can focus on a vendor connection, selected correction, recovery dependency or other agreed gap.
The agreed cybersecurity workstream can support a broader risk and resilience assessment and emergency-response planning. It should not be treated as all required assessment components, planning work or certification obligations. Confirm the full scope with the owner and responsible advisers.
No. Start with general facility and scope information. Do not upload security plans, credentials, architecture or incident evidence through the marketing form. An approved controlled exchange can be arranged after the handling requirements are established.
Assessment scope
Share your organization and preferred reply method. We review the request, discuss the technical lead and reporting needs, then agree the scope before work starts.
No network diagrams, credentials or detailed vulnerabilities are needed here. Secure exchange is arranged separately.
Active OT incident? Call 1-800-868-8189 for 24/7 intake.
Use the fillable water pack to assign evidence owners, connect cyber findings to RRA and ERP questions, and record the scope before an assessment.
Preview the water planning pack. The preview is open; the full PDF request asks for email only.
For NY/NJ water facilities, identify the relevant state program and the people responsible for its evidence. Confirm applicability of NY PSC or NJ BPU requirements alongside the drinking-water or wastewater scope.
Review NY/NJ engagement planning and official regulatory sources. Agree specialist availability, site access and maintenance windows before scheduling.
Technical review: Joseph Caruso, Founder, CEO and CTO. Reviewed .