Candidate criteria inventory
All applicability remains Unresolved. Record the actual decision owner/date, facts, legal basis, exclusions and evidence. Each grouped topic may need multiple engagement specific clause records.
NJ C01 Board jurisdiction
All · Applicability Unresolved
Conditional scope: Electric, gas, water/wastewater entities potentially within BPU jurisdiction
Determine the legal entity, regulated service, governing orders and system boundary before assigning NJ01 duties.
Gather: Legal entity charter; BPU docket/order history; service territory; ownership; affiliate/shared service map.
Locator: Order scope and critical system definition
Procedures: P01; P02
Sources: NJ01 NJ14
NJ C02 Critical system inventory
Utilities · Applicability Unresolved
Conditional scope: NJ01-covered entity/systems
Review critical ICS/SCADA and customer personal information systems inventory annually and document changes.
Gather: Dated inventory, responsible owner, customer data classification, annual review and changes.
Locator: Requirements 1(a)
Procedures: P03; P04
Sources: NJ01
NJ C03 Annual risk process
Utilities · Applicability Unresolved
Conditional scope: NJ01-covered entity/systems
Conduct and document annual risk assessment/prioritization, methodology and review, including physical risk, vulnerabilities, current threats and recovery/continuity considerations.
Gather: Risk assessment, criteria, methodology review, treatment decisions and annual records.
Locator: Requirements 1(b)-(d)
Procedures: P05
Sources: NJ01
NJ C04 Monitoring and threat review
Utilities · Applicability Unresolved
Conditional scope: NJ01-covered entity/systems
Use risk based critical system log monitoring and a process to evaluate relevant internal/external/vendor threat and vulnerability information.
Gather: Log sources, monitoring rationale, review records, threat advisories and applicability decisions.
Locator: Requirements 2(a)-(b)
Procedures: P06; P07
Sources: NJ01
NJ C05 Patch decisions
Utilities · Applicability Unresolved
Conditional scope: NJ01-covered entity/systems
Review vendor patches in a timely manner and implement as appropriate; record risk, compatibility and compensating controls. No fixed universal patch day deadline is supplied by this order.
Gather: Vendor notices, OT test/maintenance approvals, deferment rationale and safeguards.
Locator: Requirements 2(c)
Procedures: P08
Sources: NJ01
NJ C06 ICS event notices
Utilities · Applicability Unresolved
Conditional scope: NJ01-covered entity with qualifying ICS event
Evaluate the order defined access, unauthorized code/commands and extortion events; reporting path through NJCCIC to designated Board staff is within six hours of detection.
Gather: Detection facts, defined event match, time zone, current recipients/channel, receipt.
Locator: Requirements 3(a)(i)-(iv)
Procedures: P09
Sources: NJ01
NJ C07 Other cyber and customer data notices
Utilities · Applicability Unresolved
Conditional scope: NJ01-covered entity
Evaluate unusual cyber activity with potential critical system compromise and Board copies of statutorily required customer-PI law enforcement notices as separate duties.
Gather: Event scope, law enforcement notice determination, Board copy and acknowledgement.
Locator: Requirements 3(b)-(c); 56:8-163
Procedures: P09; P10
Sources: NJ01 NJ06
NJ C08 Response and exercise
Utilities · Applicability Unresolved
Conditional scope: NJ01-covered entity/systems
Maintain response lifecycle and forensic log retention arrangements; exercise at least once every 24 calendar months, with documented lessons and program updates. A qualifying actual incident may satisfy the order exercise provision.
Gather: Plan, recovery roles, retention rationale, exercise/incident evidence, lessons and closure.
Locator: Requirements 4(a)-(b)
Procedures: P11; P12
Sources: NJ01
NJ C09 Training and awareness
Utilities · Applicability Unresolved
Conditional scope: NJ01-covered personnel
Review general awareness, continuing communications, role training and new personnel training. The order uses biannually for program review; obtain a written interpretation rather than silently choosing a frequency.
Gather: Training matrix, course records, credential holder coverage, actual review frequency and clarification.
Locator: Requirements 5(a)-(d)
Procedures: P13
Sources: NJ01
NJ C10 Annual executive certification
Utilities · Applicability Unresolved
Conditional scope: NJ01-covered entity
Annual authorized executive certification is due December 31 after historical implementation. NERC certification may satisfy the annual certification for the overlapping CIP covered critical systems, not every NJ duty/system.
Gather: Signed certification, scope, receipt; exact NERC overlap and Board acceptance if used.
Locator: Accountability 1-3
Procedures: P14
Sources: NJ01
NJ C11 Service impact cyber reporting
Utilities · Applicability Unresolved
Conditional scope: Public utility within operative Chapter 14:3 scope
2022 adopted 14:3-6.7(a)6-7 requires Board reporting within six hours of awareness for listed cyber attacks and attempted intrusions with the specified service impact conditions. Authenticate current code and later amendments.
Gather: Actual intrusion/outage facts, awareness timeline, consolidated rule, recipients, receipts.
Locator: 14:3-6.7(a)6-7
Procedures: P09
Sources: NJ02 NJ14 NJ15
NJ C12 WQAA threshold
Water · Applicability Unresolved
Conditional scope: Owner of a public community water system with more than 500 service connections
Use service connections and system classification; exactly 500 is not more than 500. Do not substitute AWIA population or automatically include wastewater only systems.
Gather: PWS ID, community classification, owner and dated service connection count/source.
Locator: 58:31-2
Procedures: P01; P15
Sources: NJ03
NJ C13 Program coverage and accountability
Water · Applicability Unresolved
Conditional scope: WQAA covered purveyor
Maintain accountable cybersecurity program, risk management, threat awareness, exercised response/recovery and coverage of all ICS. Former internet connected system exemption was deleted.
Gather: Chief responsible individual; program; full ICS boundary; risk/treatment and exercise records.
Locator: 58:31-4(a)-(c); -4.1(a)
Procedures: P05; P11; P15
Sources: NJ03
NJ C14 Chosen framework and revision
Water · Applicability Unresolved
Conditional scope: WQAA covered purveyor
Reasonably conform to at least one listed framework family: NIST CSF, CIS Critical Security Controls or ISO/IEC 27000. A final revision to the chosen framework triggers revision and NJCCIC submission within 180 days.
Gather: Selected framework/version, final publication date, controls mapping, revision decisions and submission receipts.
Locator: 58:31-4.1(a)-(b)
Procedures: P16
Sources: NJ03 F12
NJ C15 Membership, reporting process and insurance
Water · Applicability Unresolved
Conditional scope: WQAA covered purveyor
Confirm NJCCIC membership, incident reporting process and cyber insurance meeting applicable Board standards; verify historic compliance rather than restarting expired 2017/2021 transition periods.
Gather: Membership receipt, current reporting instructions, policy/declarations/limits/exclusions, applicable insurance standard.
Locator: 58:31-4(b),(d)
Procedures: P17
Sources: NJ03
NJ C16 Annual certification and portal deliverables
Water · Applicability Unresolved
Conditional scope: WQAA covered purveyor
Annual cybersecurity certification has ownership specific signers. DEP currently lists annual controls assessment and annual certification December 31; confirm current forms, recipients and acceptance receipts.
Gather: Corporate officer/authority executive director/municipal mayor or CEO authority; filings and dated portal instructions.
Locator: 58:31-4.1(c); agency deliverables table
Procedures: P14; P17
Sources: NJ03 NJ04
NJ C17 Prompt qualifying incident report
Water · Applicability Unresolved
Conditional scope: WQAA covered purveyor with statutory incident facts
Report qualifying business information compromise or defined ICS physical/service effects promptly after employee awareness. The statute 30-day period belongs to NJCCIC causing an audit after receipt, not purveyor reporting.
Gather: Employee awareness timeline, affected functions, physical effects, notification route and receipt; written resolution of conflicting guidance.
Locator: 58:31-4.2(a)-(b)
Procedures: P09; P18
Sources: NJ03 NJ04
NJ C18 Independent triggered audits
Water · Applicability Unresolved
Conditional scope: WQAA covered purveyor meeting audit trigger
Missing specified submissions and reported qualifying incidents trigger NJCCIC caused audits by a qualified independent cybersecurity company at purveyor expense, with audit/CAP submission. This planning pack is not that audit.
Gather: NJCCIC direction, trigger facts, auditor competence/independence, agreed scope, audit and corrective action submissions.
Locator: 58:31-4.1(d); -4.2(b)
Procedures: P18; P35
Sources: NJ03
NJ C19 Engineering and noncyber WQAA interfaces
Water · Applicability Unresolved
Conditional scope: WQAA covered purveyor
Track noncyber annual certification, asset management, engineering and operator duties with the appropriate specialists; do not claim the OT assessment completes them. Twelve year valve/hydrant records are not a universal cyber retention term.
Gather: Licensed operator/engineer records; annual certification; capital/asset reports; separate ownership of noncyber work.
Locator: 58:31-3; -6 to -8
Procedures: P19
Sources: NJ03 NJ04
NJ C20 AWIA federal applicability
Water · Applicability Unresolved
Conditional scope: Community water system serving more than 3,300 persons
Assess whole federal risk/resilience and emergency plan obligations separately from NJ service connection threshold; ERP certification follows actual RRA certification within six months.
Gather: Population source, RRA/ERP scope, EPA certification receipts and actual cycle dates.
Locator: AWIA Section 2013
Procedures: P15; P19
Sources: F01
NJ C21 NJPDES and physical consequence reporting
Wastewater · Applicability Unresolved
Conditional scope: Actual wastewater permit/operator
Determine applicable discharge, bypass, noncompliance and emergency notice categories from current rule and permit; two hour/24-hour categories are not a universal cyber deadline.
Gather: Complete NJPDES permit/modifications; current 7:14A-6.10; event classification; commencement/awareness timestamps; receiving treatment works where applicable; initial/update/written report receipts.
Locator: 7:14A-6.10; permit specific provisions
Procedures: P20; P09
Sources: NJ12 NJ24
NJ C22 NERC CIP scope and versions
Electric · Applicability Unresolved
Conditional scope: Registered functions and applicable systems
Determine functions, BES categorization and separately applicable control center communications coverage; assign current effective standards and implementation plans. NJ BPU requirements remain a separate screen.
Gather: Registration, BES system categorization, control center map, compliance dates and approved requirement inventory.
Locator: Actual CIP instruments, including applicable CIP-012 scope
Procedures: P21
Sources: F02 NJ01
NJ C23 Energy safety and service interfaces
Utilities · Applicability Unresolved
Conditional scope: Gas, electric, generation, storage or other actual energy operations
Inventory applicable safety/environment/service rules, permits and emergency orders. Do not infer identical cyber duties for all energy assets.
Gather: Asset types, utility orders, pipeline classifications, generation permits, interconnections and emergency plans.
Locator: Entity instruments; controlled operator directives as applicable
Procedures: P22; P09
Sources: NJ01 NJ14 F02 F09
NJ C24 TCPA chemical/process coverage
Utilities · Applicability Unresolved
Conditional scope: Utility facility only if its actual chemicals, quantities, process and applicable program establish coverage. Facility potentially subject to NJ TCPA
Resolve substances, quantities, mixtures, processes, thresholds, exemptions and registration under current N.J.A.C. 7:31 before assigning program duties.
Gather: Chemical inventory/SDS, threshold calculations, process map, registration and current rule/consent orders.
Locator: N.J.S.A. 13:1K-19 et seq.; N.J.A.C. 7:31
Procedures: P23
Sources: NJ10 NJ11
NJ C25 TCPA audit frequency and completeness
Utilities · Applicability Unresolved
Conditional scope: Utility facility only if its actual chemicals, quantities, process and applicable program establish coverage. TCPA covered facility
For covered Program 3 processes, 7:31-4.1(c)13 replaces the federal three year compliance audit interval with every year and adds as built/as operated verification against process safety information. Audit report includes scope, techniques, methods and participant names, plus a written corrective action implementation schedule or completed action statement. The agency checklist alone is insufficient.
Gather: Program/coverage decision; current federal/state crosswalk; annual audit and as built review; named participants; scope/methods; findings/actions schedule; evidence of completion.
Locator: 7:31-4.1(c)13,14,23; incorporated 40 CFR 68.79
Procedures: P24
Sources: NJ10 NJ20 NJ21 NJ22
NJ C26 PSM and RMP integration
Utilities · Applicability Unresolved
Conditional scope: Utility facility only if its actual chemicals, quantities, process and applicable program establish coverage. Actual OSHA PSM and/or EPA RMP covered process
Determine each program independently; OSHA PSM compliance audit cycle is at least every three years when applicable. Do not substitute that cycle for NJ TCPA annual audit. Cyber induced process hazards require safety team review.
Gather: Coverage decisions, process safety information, hazard analysis, MOC, audits, RMP program level/current rule dates.
Locator: 1910.119; 40 CFR 68; NJ incorporation
Procedures: P23; P24; P25
Sources: F06 F07 NJ11
NJ C30 Gas utility pipeline jurisdiction
Gas · Applicability Unresolved
Conditional scope: Actual utility owned or operated gas pipeline, storage or LNG assets; jurisdiction and coverage unresolved
Determine the legal operator, interstate/intrastate status and asset boundaries. Separate BPU gas service and intrastate pipeline requirements from PHMSA minimum safety rules and operator specific TSA instruments. Selecting Gas does not establish coverage, the controlling agency, or authorization to access restricted materials.
Gather: Legal operator/OPID, system maps, utility/franchise status, interstate/intrastate determination, distribution/transmission/storage/LNG functions, current agency/operator instruments.
Locator: Actual orders, certification/jurisdiction records, 14:6/14:7 and applicable 49 CFR Parts 191/192/193
Procedures: P29; P58
Sources: NJ01 NJ14 F09 F14 NG01 NG06
NJ C32 72 hour public/contractor reporting
All · Applicability Unresolved
Conditional scope: Public agency or qualifying government contractor
Notify NJCCIC within 72 hours of reasonable belief that an incident occurred. Contractor definition requires specified public agency network/system/application/information access or hosting, not merely vendor status.
Gather: Entity charter; contracts/access scope; reasonable belief timeline; current submission route and receipt.
Locator: 52:17B-193.2; -193.3(a)
Procedures: P09; P31
Sources: NJ05
NJ C33 NJ resident breach analysis
All · Applicability Unresolved
Conditional scope: Covered NJ resident personal information and entity role
Evaluate actual personal information definition, access/use, exemptions and notice duties. Notify State Police before customer disclosure; customer notice is expedient without unreasonable delay subject to statutory conditions.
Gather: Data elements, resident scope, encryption/key status, controller/maintainer role, law enforcement correspondence, decision and notices.
Locator: 56:8-161; -163(a)-(c)
Procedures: P10
Sources: NJ06
NJ C34 Breach exceptions and special notice paths
All · Applicability Unresolved
Conditional scope: Actual breach facts
Document no reasonable possibility of misuse exception for five years if used; evaluate maintainer immediate notice to owner, law enforcement delay, over-1,000-person CRA notices and credential only notification rules.
Gather: Written exception analysis, delay authorization, recipient counts, account/email role and exact notice sequence.
Locator: 56:8-163(a)-(g)
Procedures: P10
Sources: NJ06
NJ C35 NJDPA threshold and exclusions
All · Applicability Unresolved
Conditional scope: Actual controller conducting NJ business/targeting residents
Screen 100,000 consumers excluding sole payment transactions, or 25,000 consumers plus sale revenue/discount. Evaluate government and other statutory exemptions and household consumer definition.
Gather: Entity classification, annual consumer counts/method, processing purpose, sale/discount flows, statutory exemptions.
Locator: 56:8-166.4 to -166.5; -166.13
Procedures: P32
Sources: NJ07
NJ C36 NJDPA operational controls
All · Applicability Unresolved
Conditional scope: NJDPA covered processing
Use the enacted operational criteria NJ-C64 through NJ-C70 for rights, notice, consent, reasonable security, assessments, processor contracts and opt out mechanisms. Final implementing rule status remains separately unverified; that gap does not erase enacted duties.
Gather: Data inventory, request workflow, processor terms, sensitive data practices, risk assessments, current adopted rule status.
Locator: 56:8-166.6 through -166.16
Procedures: P32; P53; P54; P55
Sources: NJ07 NJ08 NJ09 NJ25
NJ C37 Local instruments and simultaneous notices
All · Applicability Unresolved
Conditional scope: Actual facility and municipality/county
Identify permit, consent order, municipal/authority, OEM/LEPC, fire/health, insurer, contractual and operator duties. Distinguish binding instrument from voluntary coordination and calculate each trigger independently.
Gather: Exact facility locations, permits/orders/contracts, emergency plan, adopted local instruments and current recipients.
Locator: Engagement specific local/permit/contract record required
Procedures: P09; P33
Sources: NJ01 NJ03 NJ05 NJ12
NJ C38 Technical method and authority
All · Applicability Unresolved
Conditional scope: All assessed OT systems
Use approved passive first examination. An inventory, membership, geographic filter or workbook export grants no authority to scan or issue control commands.
Gather: Rules of engagement, owner/operations approval, vendor restrictions, test method, stop conditions and rollback.
Locator: Engagement method; binding only when expressly adopted
Procedures: P02; P34
Sources: F03 F04 F05
NJ C39 Nuclear specific cybersecurity scope
Electric · Applicability Unresolved
Conditional scope: Actual licensee subject to 10 CFR 73.54
Screen actual NRC license conditions, exemptions/orders, approved cyber plan and protected digital system functions. Review 73.55(m) program review and 73.77 notification interfaces through specialized criteria; do not substitute generic NERC/NJ utility testing or restart the historical 2009 submission deadline.
Gather: Actual license/status, exemptions/orders, approved plan, digital asset scope, current review/notice criteria, qualified specialized reviewer and authorized information handling.
Locator: 10 CFR 73.54; actual license and approved plan
Procedures: P44
Sources: F13
NJ C40 Gas pipeline SCADA control room management
Gas · Applicability Unresolved
Conditional scope: Actual gas pipeline facility with controller/SCADA functions; evaluate the exact 192.631(a) coverage and limited activity provisions
Apply 192.631 scope before assigning full duties. Control rooms limited to distribution with fewer than 250,000 services and/or transmission without a compressor station implement only paragraphs (d), (i) and (j). Other covered operations require the applicable full procedure set, including SCADA information, alarms, change management and training.
Gather: Current 192.631, controller/control room functions, service count, compressor station facts, written applicability decision, CRM records and actual paragraph level calendar.
Locator: 49 CFR 192.631(a)-(j)
Procedures: P45
Sources: F14 NG04
NJ C42 AMI scope and data lineage
Electric · Applicability Unresolved
Conditional scope: Actual EDC/AMI operation within 14:5-10 scope
Identify EDC owned smart meter usage/demand data and distinguish validated data from local nonvalidated data. Nonvalidated data is not to be used for billing. These are specific AMI duties, independent of NERC CIP categorization.
Gather: EDC status; meter/data flow inventory; validation and billing lineage; third party roles.
Locator: 14:5-10.1; -10.2; -10.5(a)
Procedures: P46
Sources: NJ16
NJ C43 AMI collection and availability
Electric · Applicability Unresolved
Conditional scope: Actual EDC/AMI operation within 14:5-10 scope
Make validated readings available within 48 hours of capture and collect usage in intervals no greater than 15 minutes at watt level precision. Requested billing intervals tied to Order 2222 follow the applicable PJM implementation date; do not substitute the deleted five minute proposal language.
Gather: Capture/validation/availability timestamps with zones; interval settings and precision; actual PJM milestone and request evidence.
Locator: 14:5-10.3(a)1-2
Procedures: P46
Sources: NJ16
NJ C44 Local non validated AMI access
Electric · Applicability Unresolved
Conditional scope: Actual EDC/AMI operation within 14:5-10 scope
On customer request provide access through the customer owned energy monitoring device as close to real time as the meter allows. Document the rule distance/multiunit dwelling inability exception from actual facts.
Gather: Requests; supported meter/device capabilities; response and configuration records; specific inability rationale.
Locator: 14:5-10.3(b)
Procedures: P46
Sources: NJ16
NJ C45 AMI authorized sharing and performance
Electric · Applicability Unresolved
Conditional scope: Actual EDC/AMI operation within 14:5-10 scope
Use the Green Button Data Standard and required access channels. Supplier portal datasets include rolling 14 days delivered daily with automated API access. Transmit to authorized third parties within 60 seconds of customer authorization. Include required billing/meter/rate, multisite address and account fields; do not charge access fees.
Gather: Authorized recipient/data field map; portal/API/EDI records; authorization and transmission times; rolling history evidence; fee schedule.
Locator: 14:5-10.4(a)-(h)
Procedures: P47
Sources: NJ16
NJ C46 AMI consent and eligible third parties
Electric · Applicability Unresolved
Conditional scope: Actual EDC/AMI operation within 14:5-10 scope
Coordinate the Common Release Form. Its web access and confirmation require MFA; disclose third party name, field/time/account scope and authorized use, with one click consent/decline. Preserve revocation without penalty at any time. Obtain actual Board eligibility order/list under subsection (b); this pack does not supply an approved party list.
Gather: Current common form; MFA design/evidence; consent/decline/revocation records; Board eligibility order/list and recipient verification.
Locator: 14:5-10.6(a)-(d)
Procedures: P47
Sources: NJ16
NJ C47 AMI third party protection
Electric · Applicability Unresolved
Conditional scope: Third party receiving described customer information
Take appropriate steps to protect the customer information described in -10.4(g) according to industry cybersecurity/customer information protection standards. Adopt and justify actual criteria; the rule does not name a universal certification.
Gather: Actual recipient/onward transfer inventory; adopted security criteria; contracts; access, storage and transfer evidence; exceptions.
Locator: 14:5-10.6(e)
Procedures: P47; P41
Sources: NJ16
NJ C48 AMI unauthorized release notice
Electric · Applicability Unresolved
Conditional scope: EDC, third party or onward recipient responsible for qualifying unauthorized release
Within 48 hours of discovery notify its customers, the supplying EDC, NJ State Police and BPU Division of Reliability and Security. Keep this duty separate from six hour cyber events and ITPA State Police before customer notice sequencing where both apply.
Gather: Release/discovery facts and times; information and affected customers; recipient/channel verification; legal sequencing analysis; each submission and receipt.
Locator: 14:5-10.6(f); 56:8-163 as independently applicable
Procedures: P48
Sources: NJ16 NJ06 NJ01
NJ C49 AMI permitted use and research access
Electric · Applicability Unresolved
Conditional scope: Actual EDC/AMI operation within 14:5-10 scope
Use validated data for activated-AMI billing and customer load for peak load contribution. Do not sell customer AMI data. Examine noncore use competition, anonymized noncommercial academic access and additional use case exploration under their actual clauses.
Gather: Billing/settlement lineage; uses and sale inventory; authorized party treatment; academic request, anonymization and purpose evidence.
Locator: 14:5-10.5(a)-(e)
Procedures: P46; P47
Sources: NJ16
NJ C50 AMI application change and fairness
Electric · Applicability Unresolved
Conditional scope: Actual EDC/AMI operation within 14:5-10 scope
Give application developers 90 days notice of technical changes adversely affecting functionality unless necessary for an immediate cyber concern/system vulnerability. Document nondiscriminatory access, the limits on surveillance/reverse engineering, and the web issue tracking system.
Gather: Developer notices/timestamps; actual emergency rationale; access comparisons; application review authority; issue records.
Locator: 14:5-10.7(a)-(d)
Procedures: P49
Sources: NJ16
NJ C51 AMI semiannual metrics
Electric · Applicability Unresolved
Conditional scope: Actual EDC/AMI operation within 14:5-10 scope
Report the nine adopted metric categories to the Board and Division of Clean Energy semiannually. Preserve the specified historical/monthly/tariff class detail. The adopted rule changes quarterly to semiannual but does not supply an exact filing date in this section.
Gather: Nine field reporting crosswalk; usage/demand history; access/withdrawal/onboarding/login metrics; actual reporting instructions, submissions and receipts.
Locator: 14:5-10.8(a)1-9
Procedures: P49
Sources: NJ16
NJ C52 TPS billing integrity incident reporting
Utilities · Applicability Unresolved
Conditional scope: Actual licensed TPS with qualifying billing error population; distinguish electric/gas supplier and distribution company roles from ordinary water/wastewater operations
For fewer than 60 customers: report 15 or more incorrectly billed within 30 days or less. For 60 or more: apply the lesser of 25 percent of customer base or 100 customers within 30 days or less. Report within 10 business days of awareness to the listed recipients, describing impact, cause and correction. Examine residential interest/refund rules separately.
Gather: TPS status; dated full customer population; overcharge/error population and window; calculation; awareness; report/copies; refund/credit/interest records.
Locator: 14:4-7.2 billing error definition; -7.14(a)-(d)
Procedures: P50
Sources: NJ17
NJ C53 Supplier freeze future implementation
Utilities · Applicability Unresolved
Conditional scope: Actual LDC/TPS customer enrollment systems; distinguish electric/gas supplier and distribution company roles from ordinary water/wastewater operations
The adopted freeze provisions specify September 8, 2027 applicability; plan changes now, then verify the actual operative date before concluding a violation. Trace direct customer authority, separate switching authorization, one business day implement/lift, two business day confirmation and rejected order notice/EDI rules, including merger/default service exceptions.
Gather: Approved implementation plan; EDI/vendor dependencies; actual rule/date interpretation; authorization/notice and nonproduction acceptance scenarios.
Locator: 14:4-2.6(d)-(e); -2.6A(a)-(n)
Procedures: P50
Sources: NJ17
NJ C54 Drinking water emergency notice
Water · Applicability Unresolved
Conditional scope: Supplier of water with qualifying quality/pressure emergency
Notify DEP by telephone within six hours of the occurrence of an emergency tending to lessen delivered quality/pressure or increase likelihood of nonstandard water. This occurrence trigger is distinct from cyber detection, employee awareness and reasonable belief.
Gather: Emergency onset; quality/pressure/process records; licensed operator review; current daytime/after hours channel; call/receipt evidence.
Locator: 7:10-2.4(b)
Procedures: P51; P09
Sources: NJ19
NJ C55 Planned treatment change notice
Water · Applicability Unresolved
Conditional scope: Supplier planning a qualifying treatment plant/operational change
Written DEP notice is required at least five working days before a planned change tending to lessen water quality or increase the likelihood of nonstandard water. Have the operator determine whether an OT change falls within the clause; a generic change ticket is not regulatory notice.
Gather: Change/MOC; operator engineering consequence review; proposed date; working day basis; notice and receipt; permit review.
Locator: 7:10-2.4(a)
Procedures: P51; P39
Sources: NJ19
NJ C56 Water asset program and signatory interfaces
Water · Applicability Unresolved
Conditional scope: Public community water system within 7:10-6 scope
Coordinate the asset inventory, criticality, revision, funding and certification work with the responsible operator/engineer. Rule copy specifies annual March 15 capital report, asset plan certification every three years or ownership/status change, ownership specific annual compliance signers and annual designated training. Annual water loss audit is specified effective March 31, 2027. These are distinct from the WQAA cyber certification.
Gather: Actual 7:10-6.1 scope; asset plan and prior certification; capital report; signatory/training records; current water loss criteria; qualified engineering lead.
Locator: 7:10-6.1; -6.3(b)9,(c)-(g); -6.4
Procedures: P51; P19
Sources: NJ19
NJ C57 Physical hazardous substance discharge notice
All · Applicability Unresolved
Conditional scope: Actual person responsible for a qualifying NJ discharge
Immediate notice under 7:1E-5.3 is measured from knew/reasonably should have known facts; receipt within 15 minutes is considered immediate. Evaluate only the current specific transformer and motor vehicle conditions, other reporting laws and 5.6 delay justification; no general small spill grace period is supplied here.
Gather: Substance/current Appendix A; discharge/pathway facts; actual knowledge timeline; exception clause/facts; hotline/backup; notification content and receipt.
Locator: 7:1E-5.3(a)-(f); -5.6
Procedures: P52; P09
Sources: NJ18 NJ26
NJ C58 Discharge detection/safety malfunction notice
All · Applicability Unresolved
Conditional scope: Owner/operator of an actual major facility under 7:1E
Immediately report malfunction of discharge detection or other discharge monitoring, prevention or safety system/device. Receipt within 15 minutes of knew/should have known is considered immediate. Within two hours after initial notice report repair, alternate detection activation or protected equipment out of service. An actual spill is not the stated prerequisite to this malfunction duty.
Gather: Major facility determination; covered detection/prevention/safety devices; fault/awareness timeline; initial call; actual follow up disposition/time; authorization for operations actions.
Locator: 7:1E-5.5(a)-(c); -5.6
Procedures: P52
Sources: NJ18
NJ C59 DPCC/DCR plan and OT dependency screen
All · Applicability Unresolved
Conditional scope: Actual major facility/transmission pipeline under applicable 7:1E provisions
Screen capacity, substances, exemption facts and approved DPCC/DCR plans with the environmental owner. Trace detection, alarms, remote valves, response communications, changes, training and exercises into actual plan requirements. Agency requires covered plan submissions through its online service from June 1, 2026. Do not make the OT audit a substitute for required engineering/plan certification.
Gather: Capacity calculations; current appendices; registration; approved plans; change/renewal history; PE/offsite response signoffs; online submission receipts.
Locator: Applicable 7:1E-1.6; -2 through -4; actual approved plans
Procedures: P52
Sources: NJ18 NJ22 NJ26
NJ C60 TCPA annual audit design
Utilities · Applicability Unresolved
Conditional scope: Utility facility only if its actual chemicals, quantities, process and applicable program establish coverage. TCPA Program 3 covered process
Use the state every year interval and verify as built/as operated equipment and process technology against process safety information. Include actual audit scope, techniques, methods and participant names; assign competent process safety reviewers for elements outside OT competence.
Gather: Current incorporation crosswalk; full applicable program index; prior audit/date; PSI/as built evidence; team competence and actual workpapers.
Locator: 7:31-4.1(c)13-14
Procedures: P56
Sources: NJ20 NJ21 NJ22
NJ C61 TCPA corrective action report
Utilities · Applicability Unresolved
Conditional scope: Utility facility only if its actual chemicals, quantities, process and applicable program establish coverage. TCPA Program 3 audit with findings
Include written corrective action implementation schedule or completed action statement in the audit report. Reconcile other open related program findings. Do not close on an owner promise, completed spreadsheet or risk acceptance that conflicts with mandatory duties.
Gather: Audit findings and prior related findings; response basis; actual owners/dates; schedule; remediation and retest/reviewer evidence.
Locator: 7:31-4.1(c)23; incorporated 68.79(d)
Procedures: P56; P35
Sources: NJ10 NJ20
NJ C62 TCPA annual report and anniversary
Utilities · Applicability Unresolved
Conditional scope: Utility facility only if its actual chemicals, quantities, process and applicable program establish coverage. Actual covered Program 3 owner/operator
Report the prior 12-month risk management activity within 90 days of the approval/consent anniversary. Include required updates or no change statements, management changes, applicable PHA/risk assessment, event summaries, compliance audit/corrections and IST reports. Obtain actual approved anniversary; do not use a generic December 31 deadline.
Gather: Signed initial consent/order and approved anniversary change; annual report/checklist; audit and required attachments; submission receipt.
Locator: 7:31-4.9(a)-(b)
Procedures: P56
Sources: NJ20 NJ21
NJ C63 NJRMP refresh and transfer
Utilities · Applicability Unresolved
Conditional scope: Utility facility only if its actual chemicals, quantities, process and applicable program establish coverage. Actual TCPA covered facility/process
Reconcile full NJRMP five year cycle, event driven resubmission/corrections and owner transfer requirements against actual facts. State and federal chemical scope differ. Current federal amendments are incorporated subject to state conflict/stricter rule treatment; the old consolidated copy cannot settle all current duties.
Gather: Last full submission/receipt; process and chemical changes; Program Level; new owner agreement; current federal/state crosswalk and actual dates.
Locator: 7:31-7.1(c)5,11; -7.4; incorporated Part 68
Procedures: P56
Sources: NJ20 NJ21 NJ22 NJ23
NJ C64 Privacy rights and response record
All · Applicability Unresolved
Conditional scope: NJDPA covered controller/processing after actual threshold and exemption review
Provide applicable access, correction, deletion, portability and opt out rights. Verified requests use 45 days from receipt; a reasonably necessary 45-day extension requires notice/reason in the first period. Refusal notice and appeal response have separate 45-day windows. Authentication restrictions and documented fraudulent opt out handling are distinct.
Gather: Request/appeal inventory; receipt dates; authentication/minimization method; decisions and extension/refusal notices; portability/deletion scope; actual exceptions.
Locator: 56:8-166.7; -166.10
Procedures: P53
Sources: NJ07
NJ C65 Privacy notice and contact
All · Applicability Unresolved
Conditional scope: NJDPA covered controller/processing after actual threshold and exemption review
Publish reasonably accessible, meaningful notice covering categories, purposes, third parties, shared data, rights/appeals, material changes/effective date and contact channel. Clearly disclose applicable sale/targeted advertising/profiling and opt out. Do not require a new account merely to exercise a right.
Gather: Versioned notices and effective dates; actual data/use/recipient mapping; working channels; rights and appeal workflows; account prerequisites.
Locator: 56:8-166.6
Procedures: P53
Sources: NJ07
NJ C66 Sensitive data, young consumers and consent
All · Applicability Unresolved
Conditional scope: NJDPA covered controller/processing after actual threshold and exemption review
Obtain required sensitive data consent and apply COPPA to known child processing. Apply the enacted actual knowledge/willful disregard test for consumers at least 13 but younger than 17 in the listed uses. Provide equally easy consent revocation and cease the relevant processing as soon as practicable, no later than 15 days after receipt. AMI is excluded from the precise geolocation definition, not from all personal/sensitive data.
Gather: Data element/age purpose map; actual consent/revocation records; scope of processing stopped; COPPA/specialist analysis; precise geolocation decision.
Locator: 56:8-166.4 sensitive data/precise geolocation; -166.12(a)4,6,7
Procedures: P54
Sources: NJ07
NJ C67 Privacy minimization and reasonable security
All · Applicability Unresolved
Conditional scope: NJDPA covered controller/processing after actual threshold and exemption review
Limit collection to adequate, relevant, reasonably necessary data; control incompatible use and specify purposes. Apply administrative, technical and physical safeguards appropriate to data volume/nature during storage/use. Document exceptions and necessity rather than asserting utility operation purposes waive every privacy safeguard.
Gather: Purpose/collection/retention map; legitimate exception basis; access/encryption/recovery controls; risk and safeguard evidence; deletion/return rules.
Locator: 56:8-166.12(a)1-3,8; -166.15
Procedures: P54; P36; P41
Sources: NJ07
NJ C68 Privacy data protection assessment
All · Applicability Unresolved
Conditional scope: NJDPA covered controller/processing after actual threshold and exemption review
Before heightened risk processing, conduct/document the required assessment for personal data acquired on/after the effective date. Evaluate listed profiling/targeted advertising risks, sale and sensitive data; weigh benefits, rights risks, safeguards, expectations and context. Retain availability for DCA request. Statutory agency confidentiality/nonwaiver is not a blanket privilege for all audit workpapers.
Gather: Processing inventory and acquisition dates; risk trigger; actual assessment; benefits/risks/safeguards; approvals/changes; controlled location.
Locator: 56:8-166.12(a)9,(b)-(d)
Procedures: P54
Sources: NJ07
NJ C69 Processor terms and assessment route
All · Applicability Unresolved
Conditional scope: Actual NJDPA controller/processor relationship
Binding processor terms specify instructions, purpose, data, duration, confidentiality, subcontractors, security allocation, deletion/return subject to law, and compliance information/assessment access. Independent annual assessor route is an alternative with controller consent, at processor expense; it is not a universal independent annual audit mandate for every utility.
Gather: Actual role facts; executed DPA and subprocessor terms; allocation; return/deletion; assessment access or consented independent report, scope/period/competence.
Locator: 56:8-166.16(a)-(g), especially (e)4(b)
Procedures: P55
Sources: NJ07
NJ C70 Universal opt out and authorized agents
All · Applicability Unresolved
Conditional scope: NJDPA covered controller/processing after actual threshold and exemption review
For covered targeted advertising or personal data sale, the statutory universal opt out mechanism start is no later than six months after January 15, 2025. Review actual signals/agent authority and conflict/consent handling against enacted criteria and authenticated applicable rules. Do not describe this as merely a 2026 proposed rule duty.
Gather: Sale/advertising applicability; supported user selected mechanism; agent verification; signal/consent conflict records; dated functional evidence.
Locator: 56:8-166.11(a)-(c)
Procedures: P53
Sources: NJ07 NJ09 NJ25
NJ C71 CIAP authentication and secure data exchange
Electric · Applicability Unresolved
Conditional scope: Actual EDC CIAP within authenticated current 14:8 scope
The January 2026 adopted text requires MFA/secure login, role based access, secure file viewing/transfer and confidentiality, integrity and accessibility within a privacy/security/risk assessment framework. Resolve current chapter status, later orders, tariffs and implementation before treating this dated amendment as currently enforceable.
Gather: Current chapter/readoption and orders; actual CIAP implementation/tariff; role/tenant map; MFA and transfer design; independent evidence and exceptions.
Locator: 14:8-5.13(d)1-2; source currency dependency NJ-Q17
Procedures: P57
Sources: NJ27 NJ14
NJ C72 CIAP availability, workflow and data quality
Electric · Applicability Unresolved
Conditional scope: Actual EDC CIAP within authenticated current 14:8 scope
Adopted text specifies at least 99 percent uptime during stated weekday 8 AM-8 PM EST hours, quarterly public uptime metrics, listed workflow timestamps, payment/status visibility, validation and notifications/opt choices. Verify current operative text and measurement/time zone interpretation. Hosting maps have separate updates/disclosure limits; operational security information is not automatically public.
Gather: Current instruments; uptime definition/window and raw periods; outage exclusions basis; fourteen timestamp events; validation/status records; map publication/security approvals.
Locator: 14:8-5.13(d)3-4; -5.11; NJ-Q17
Procedures: P57
Sources: NJ27
NJ C73 NJPDES oral categories and revision notice
Wastewater · Applicability Unresolved
Conditional scope: Actual permittee with 6.10(a) qualifying facts
Subsection (c) uses two hour hotline notice for (a)1i-iv health/environment exceedances and (a)2 unpermitted listed toxic/hazardous discharge, with receiving DTW if applicable; revisions to that information within 24 hours of awareness of the need. Subsection (d) uses 24-hour notice for (a)1v listed toxic daily maximum exceedance, (a)3 other upset/unanticipated bypass and (a)5 residual standard noncompliance. Apply actual commencement/awareness facts and permit.
Gather: Exact event/permit category; discharge/awareness/revision times; listed pollutants/limits; receiving DTW; initial and revision content/receipts.
Locator: 7:14A-6.10(a)-(d)
Procedures: P20; P09
Sources: NJ24 NJ12
NJ C74 NJPDES written and anticipated bypass duties
Wastewater · Applicability Unresolved
Conditional scope: Actual permittee with applicable 6.10 category
For (a)1-3 and 5, subsection (e) requires written information within five days of commencement or awareness if not previously submitted, and immediate correction of missing/incorrect facts; upset/unanticipated bypass has additional (f) evidence. Anticipated bypass uses (g) notice at least ten days before if possible. Serious violation has separate (i) 30-day written report; other noncompliance is reported with regular MRFs under (j).
Gather: Exact permit/category; contemporaneous signed logs; cause/duration/response/evidence; planned bypass/necessity/alternatives; serious violation decision; current recipient; reports and receipts.
Locator: 7:14A-6.10(e)-(j)
Procedures: P20; P09
Sources: NJ24
NJ C75 Gas utility jurisdiction and complete criteria
Gas · Applicability Unresolved
Conditional scope: Actual gas utility/operator and asset functions
Separate retail gas service, intrastate pipeline safety, interstate federal oversight and actual controlled security instruments. Obtain current full 14:6/14:7 and applicable 49 CFR Parts 191/192/193 with amendments. The adopted 2023 gas publication is not a complete consolidated rulebook.
Gather: OPID; owner/operator; franchise/tariff; maps; pipeline class; distribution/transmission/storage/LNG boundaries; jurisdiction instruments; current code and incorporation history.
Locator: 14:7-1.1; actual 14:6 and federal scope; orders/agreements
Procedures: P58; P29
Sources: NJ14 NG01 NG05 NG06
NJ C76 NJ gas incident reporting and follow up
Gas · Applicability Unresolved
Conditional scope: Gas operator with a reportable event under 14:7-1.17
The selected final state rule requires immediate notice, no later than one hour after learning of a reportable incident. Its event definition includes federal incident coverage and additional listed state categories. Preserve new information updates and the separate follow up report within 15 days after the incident. Do not substitute the federal confirmed discovery clock or a general six hour cyber window.
Gather: Actual event classification and learning time; full state definition; current division/channel; initial/update receipts; incident date and 15-day follow up evidence.
Locator: 14:7-1.17(b)-(h); current full text and later history
Procedures: P59
Sources: NG01 NJ01
NJ C77 Gas distribution drills and spacing
Gas · Applicability Unresolved
Conditional scope: Actual distribution operator subject to 14:7-1.9(f)-(g)
Plan each district/division and call/dispatch center two year coverage; district/division drills must not be within two weeks of each other. Reconcile the initial field/training site transition and subsequent four year field site cycle, with permitted tabletop limits. Keep the five business day advance notice, narrow weather exception and final audit report within two months as separate tasks. This operational drill is not automatically the BPU cyber exercise.
Gather: Districts/divisions; call and dispatch centers; prior drill dates/type/location; two week spacing; actual field cycle; notice and final report receipts; weather exception basis if used.
Locator: 14:7-1.9(f)-(g), final adopted text
Procedures: P60
Sources: NG01
NJ C78 Gas transmission emergency closure drill
Gas · Applicability Unresolved
Conditional scope: Actual transmission operator subject to 14:7-1.10(f)
Review the annual calendar year drill and maximum 15-month interval together. The adopted provision also requires a field site drill at least every three calendar years, normal business hour timing at least once every three years, and limits tabletop use to no more than two of three calendar years. Obtain unchanged surrounding paragraphs before final program approval.
Gather: Transmission closure plan; previous actual dates; three year type/location calendar; operating permissions; drill evaluation and corrective records.
Locator: 14:7-1.10(f) and current complete section
Procedures: P60; P61
Sources: NG01
NJ C79 Gas state filings and source data integrity
Gas · Applicability Unresolved
Conditional scope: Actual gas operator and applicable state report/asset class
Reconcile selected state filings: applicable prior year annual report copies by March 15; leak classification inventory by January 31; gas transmission pressure test records within one month after test; and transmission direct assessment/examination excavation notice at least five business days beforehand. These selected clauses do not enumerate every report in 14:7-1.26. Verify current full section, forms and applicability.
Gather: Report/asset class matrix; current forms; prior year source systems; leak status and municipality records; pressure/temperature charts; test dates; excavation schedule; submission receipts.
Locator: 14:7-1.26(c), (d)1 and 8, (f); current full section
Procedures: P62
Sources: NG01 NG05
NJ C80 Gas MAOP state and federal notice distinction
Gas · Applicability Unresolved
Conditional scope: Actual qualifying overpressure event and relevant pipeline class
The adopted state 14:7-1.26(g) requires immediate notice upon discovery of the specified MAOP exceedance beyond the allowed device margin and a formal report under 191.25. Federal 191.25(b) separately addresses a qualifying gas transmission MAOP exceedance with a five calendar day report. Confirm exact trigger/exclusions and current channels; do not apply the general working day rule to this federal category.
Gather: Actual pressure/time series integrity; MAOP and device margin; asset class; discovery/exceedance timestamps; current trigger decision and state/federal receipts.
Locator: 14:7-1.26(g); 191.23(a)(10); 191.25(b)-(c)
Procedures: P59; P61
Sources: NG01 NG03
NJ C81 Federal gas incident initial and 48 hour update
Gas · Applicability Unresolved
Conditional scope: Operator/event covered by Part 191 and current 191.3 definition
Section 191.5 requires notice at the earliest practicable moment following discovery and no later than one hour after confirmed discovery of a qualifying incident. Within 48 hours after confirmed discovery, revise or confirm the initial notice to the extent practicable; unchanged estimates also require confirmation. Keep discovery and confirmed discovery timestamps distinct.
Gather: Complete current incident definition/exclusions; event date monetary notice (NG07 verifies July 2026-June 2027 only); discovery and confirmed discovery evidence; current NRC instructions; initial and 48-hour receipts.
Locator: 191.5(a)-(c); current 191.1/.3
Procedures: P59
Sources: NG02 NG07
NJ C82 Federal gas safety related condition reporting
Gas · Applicability Unresolved
Conditional scope: Actual condition covered by 191.23(a)(1)-(9), after exclusions
Under 191.25(a), the written report must be received within five working days after the day an operator representative first determines the condition exists, and no later than ten working days after the day of discovery. Saturday, Sunday and federal holidays are excluded. This differs from the five calendar day transmission MAOP category. Preserve discovery, determination and receipt dates separately.
Gather: Current 191.23 trigger/exclusion decision; discovery/determination dates; applicable working day calendar; required report fields and receipt; corrective action schedule.
Locator: 191.25(a),(c); applicable 191.23
Procedures: P59; P62
Sources: NG03
NJ C83 Gas safety telemetry and specialist interfaces
Gas · Applicability Unresolved
Conditional scope: Utility pressure control, alarms, leak detection, storage or LNG interfaces
Trace OT evidence into the actual pipeline safety program and qualified specialist boundaries. Confirm current operating/emergency procedures, control room requirements, integrity programs, operator qualification and any actual LNG/storage criteria. These records are safety interfaces, not a substitute for full pipeline or LNG certification. No live valve operation, pressure test or alarm injection is authorized.
Gather: Approved procedures, safety/engineering specialists, pressure/temperature provenance, calibration, control changes and incident reconstruction; actual specialist program/permit limits.
Locator: Actual 192/193 program, 14:7 and operator procedures
Procedures: P58; P61
Sources: F14 NG01 NG04 NG05 NG06
NJ C84 Gas service interruption and amended report branches
Gas · Applicability Unresolved
Conditional scope: Actual gas operator and qualifying interruption or incomplete incident follow up
Do not merge service interruptions with reportable incidents. Under the selected 14:7-1.17(j), qualifying interruptions are reported within 30 minutes after awareness that service has been interrupted for 30 minutes: the listed heating season 100-customer, defined healthcare facility and designated airport categories. Subsection (k) separately uses awareness of one hour of interruption for nonheating season 100-customer, listed highway lane closure and specified critical customer categories. Contract provided interruptions have an exclusion under (l); prompt detailed written follow up is required under (m). If corrective measures/recommendations were unavailable at the incident follow up, (i) requires an amended report within 30 days of the incident. Obtain exact current category definitions, exclusions, forms and later amendments.
Gather: Affected customer count/type and season; actual interruption start and awareness timestamps; road/critical facility facts; contract exception decision; current reporting forms; written follow up and corrective action availability.
Locator: 14:7-1.17(i)-(m), (p)-(r); current complete section
Procedures: P59; P63
Sources: NG01
Procedure starters and field boundaries
Select after criteria approval. The lead must tailor objectives, depth, population, sample size/rationale and acceptance to the actual engagement. A procedure summary is not proof of execution.
P01 Resolve entity and facility scope
Sector: All · Objective: Assign duties to a documented legal entity and system boundary.
- Obtain charter, ownership and operator agreements.
- Record each facility, county, municipality and legal owner/operator.
- Identify service, PWS/permit/registration IDs and shared IT/OT providers.
- Have qualified compliance counsel/authority resolve disputed coverage; retain exclusion reasons.
Evidence: Charter; ownership evidence; site list; contracts; applicable orders.
Review basis: Signed scope decision names systems, exclusions, decision maker, date and source. Unknowns remain Unresolved with owner and next evidence request.
Stop boundary: Do not assign regulatory coverage from sector or state selection alone.
Candidate criteria: NJ-C01; NJ-C12
P02 Approve audit plan and safety boundary
Sector: All · Objective: Establish authority, criteria, competence and site safety before fieldwork.
- Agree audit objective and assurance/report basis, period, users and limitations.
- Assess examiner competence, conflicts and independence.
- Agree evidence handling, sampling and escalation.
- Obtain owner, operations, safety and vendor approvals.
- Approve ROE, stop authority, recovery and communications.
Evidence: Engagement letter; independence/competence records; signed plan/ROE; safety contacts.
Review basis: Named approvers authorize precise methods, assets and windows; all scope critical criteria/evidence gaps are resolved or scope is expressly limited.
Stop boundary: No active discovery, credential use, write operation or production test before explicit method authorization.
Candidate criteria: NJ-C01; NJ-C38
P03 Reconcile critical inventory
Sector: Utilities · Objective: Find omissions between operating systems and the regulated critical system inventory.
- Obtain dated asset/configuration exports and drawings.
- Reconcile ICS controllers, RTUs, HMIs, historians, engineering stations, telecom and customer-PI systems.
- Trace additions/removals and review approval.
- Record population/source/date and discrepancies.
Evidence: Inventory; diagrams; changes; annual review; customer data inventory.
Review basis: A documented reconciliation covers agreed populations; unresolved omissions become findings rather than assumed absence.
Stop boundary: No unsolicited network probes or new capture ports.
Candidate criteria: NJ-C02
P04 Map dependencies and protocols
Sector: All · Objective: Understand process consequences, legacy constraints and external paths.
- Walk through physical process with operator.
- Mark safety, power, time, communications, cloud/vendor and remote access dependencies.
- Identify actual protocols, versions and supported methods from approved records/passive observations.
- Record unsupported/unseen assets and vendor safety restrictions.
Evidence: Validated zone/conduit diagram; dependency register; protocol/vendor records.
Review basis: Operators validate boundaries and consequence paths; assumptions and unknown protocol coverage are explicit.
Stop boundary: Do not promise all protocols are tested; no packet injection, failover or controller polling without separate approval.
Candidate criteria: NJ-C02
P05 Assess risk and treatment
Sector: All · Objective: Connect cyber failure modes to safety, service, environment and financial exposure.
- Agree risk scales and decision authority.
- Examine current risk methodology and annual review where required.
- Trace credible access and failure paths, dependencies and physical risks.
- Examine controls/compensations and residual decisions.
- Link each finding to consequence and accountable owner.
Evidence: Method; risk register; threat inputs; treatment approvals; BIA/continuity records.
Review basis: Evidence supports risk ratings and treatment; risk acceptance is an authorized decision with expiry, not a substitute for a mandatory duty.
Stop boundary: Do not simulate hazardous process states.
Candidate criteria: NJ-C03; NJ-C13
P06 Examine monitoring and time
Sector: All · Objective: Establish whether relevant events can be detected and reconstructed.
- List sources and retention rationale.
- Examine representative authentication, remote access, configuration and boundary logs from approved exports.
- Check time zone/time synchronization and gaps.
- Trace one authorized alert through triage/escalation.
Evidence: Source inventory; redacted logs; time settings; alert/ticket trail; retention policy.
Review basis: Coverage and missing sources are recorded against agreed objectives; actual collector, collection time and source system are attributable.
Stop boundary: No induced live attack to create evidence; use approved historical event or lab example.
Candidate criteria: NJ-C04
P07 Trace threat and vulnerability handling
Sector: Utilities · Objective: Test whether relevant intelligence leads to timely documented action.
- Define assessment period and advisory population.
- Select high consequence and routine examples with rationale.
- Trace receipt, applicability, owner, disposition and follow up.
- Examine omitted suppliers and assets.
Evidence: Vendor/ISAC advisories; intake queue; tickets; risk decisions.
Review basis: Document the full population, selected sample, exceptions and coverage limits; an interview alone does not prove operation.
Stop boundary: Keep sensitive intelligence in authorized repository.
Candidate criteria: NJ-C04
P08 Review patch and legacy safeguards
Sector: All · Objective: Assess risk decisions without destabilizing production.
- Match approved vendor notices to asset versions.
- Examine compatibility/lab validation and outage coordination.
- Sample applied/deferred patches and compensating controls.
- Review unsupported assets, isolation and replacement plans.
Evidence: Version exports; vendor notices; MOC/maintenance tickets; deferment approvals; compensating controls.
Review basis: Decisions are traceable to actual systems and approved criteria; no invented patch SLA is used.
Stop boundary: No patching, restart, exploit or active vulnerability scan under this document only procedure.
Candidate criteria: NJ-C05
P09 Build and rehearse reporting decision tree
Sector: All · Objective: Keep simultaneous legal triggers and clocks distinct.
- Gather current source text and applicable instruments.
- Record detection, employee awareness, Board awareness, reasonable belief and incident consequence times separately.
- Map each matched duty to trigger, clock, owner, deputy and current official recipient.
- Rehearse with synthetic scenario and evidence preservation plan.
- Retain actual submission/receipt trail separately from rehearsal.
Evidence: Notices register; approved decision tree; current portal instructions; tabletop record; receipts.
Review basis: No longer deadline displaces an earlier applicable duty; prompt reporting has no invented number. Unknown law/channel is escalated before fieldwork.
Stop boundary: Real incident: activate approved response and legal escalation immediately; this worksheet must not delay reporting.
Candidate criteria: NJ-C06; NJ-C07; NJ-C11; NJ-C17; NJ-C21; NJ-C23; NJ-C32; NJ-C37; NJ-C54; NJ-C57; NJ-C73; NJ-C74
P10 Review customer and employee information
Sector: All · Objective: Determine breach and privacy handling using actual data and legal roles.
- Inventory resident data, online credentials, AMI and vendor processing.
- Record controller/maintainer roles and affected population.
- Evaluate each legal definition/exception and exact sequence with counsel.
- Review notices, law enforcement communications and exception retention.
- Use redacted evidence; avoid personal data in workbooks.
Evidence: Data inventory; processor contracts; legal decision record; redacted notice/receipt trail.
Review basis: Conclusions cite operative criteria and facts, not a generic PII label; all exceptions have evidence and authorized decision.
Stop boundary: Do not upload raw customer data, keys or compromised credentials into builder or pack.
Candidate criteria: NJ-C07; NJ-C33; NJ-C34
P11 Examine incident response and recovery
Sector: All · Objective: Verify executable roles and recovery arrangements.
- Review cyber/operations/safety incident integration.
- Trace communications, containment authority, forensic preservation and manual operating limits.
- Examine approved backup/configuration/logic recovery scope.
- Review isolated restore evidence and actual recovery objectives.
Evidence: Approved plans; role/deputy roster; immutable/offline backup design; restore records; manual limits.
Review basis: Recovery claims are supported by relevant observed records; untested restores remain untested.
Stop boundary: No production restore, failover, interlock bypass or manual operation demonstration without separate safety authorization.
Candidate criteria: NJ-C08; NJ-C13
P12 Evaluate exercise record
Sector: Utilities · Objective: Distinguish actual execution from a planned exercise.
- Establish applicable cycle and last qualifying date.
- Review scenario, participants, actual chronology, decisions and observations.
- Trace lessons to owners and closure.
- Verify whether claimed actual incident satisfies stated criteria.
Evidence: Exercise plan; attendance; contemporaneous notes; after action report; action/retest evidence.
Review basis: Cycle, scope and evidence meet the adopted criterion; attendance or future calendar entry alone is insufficient.
Stop boundary: No false event reporting or disruptive live exercise.
Candidate criteria: NJ-C08
P13 Review training coverage
Sector: Utilities · Objective: Assess general, role specific and new personnel coverage.
- Reconcile personnel/credential holder populations to training records.
- Sample new staff and high privilege roles.
- Examine recurring communications and program review.
- Record unresolved biannually interpretation and authorized interim plan.
Evidence: Role/credential roster; training matrix; completion records; awareness messages; written interpretation.
Review basis: Coverage/exceptions use actual populations and dates; an unsourced interpretation is not presented as law.
Stop boundary: Do not collect unnecessary employee personal information.
Candidate criteria: NJ-C09
P14 Reconcile certifications to evidence
Sector: Utilities · Objective: Prevent unsupported executive sign off.
- Identify exact required certification and signer.
- Reconcile assertions to scope, open findings and evidence.
- Verify authority and dates.
- Check filing recipients and receipts.
- For NERC overlap, identify exact systems/duties accepted by BPU.
Evidence: Signed certification; authority record; supporting index; exception/legal decisions; receipts.
Review basis: Certification is separately approved by the proper authorized signatory; this workbook never creates one.
Stop boundary: Do not sign, backdate or submit a regulatory certification through this preparation workflow.
Candidate criteria: NJ-C10; NJ-C16
P15 Separate NJ and federal water scope
Sector: Water · Objective: Avoid mixing service connections, population and ownership.
- Obtain PWS identity and community status.
- Record more than-500 service connection screen separately from AWIA more than-3,300-person screen.
- Validate actual owner and all ICS.
- Record BPU and public agency screens independently.
Evidence: PWS records; dated counts; charter; service/asset map; EPA certifications.
Review basis: Each applicable/excluded decision has source, facts and reviewer; wastewater only is not silently treated as WQAA or AWIA water coverage.
Stop boundary: Unknown counts cannot become a No decision.
Candidate criteria: NJ-C12; NJ-C13; NJ-C20
P16 Test framework revision trail
Sector: Water · Objective: Connect chosen framework to control and submission evidence.
- Identify chosen listed framework(s), final edition and publication date.
- Review requirement/control mapping and treatment.
- Reconcile final revision changes and 180-day submission duty where triggered.
- Verify actual program revision and receipt.
Evidence: Chosen framework decision; licensed text where needed; change map; revised program; NJCCIC receipt.
Review basis: Final framework versions and actual change dates support the conclusion; SP 800-82 guidance alone is not the named CSF.
Stop boundary: Do not copy licensed standards into public exports.
Candidate criteria: NJ-C14
P17 Assemble NJCCIC and insurance records
Sector: Water · Objective: Prepare current program delivery and insurance evidence.
- Obtain membership/program submission receipts.
- Verify current annual portal instructions and deliverables.
- Review policy period, named insured, exclusions, limits and applicable Board standards with insurance/legal owners.
- Capture open coverage questions.
Evidence: Membership/filing evidence; insurance declarations and review; current instructions.
Review basis: Coverage and submission status use actual records, not historic deadline arithmetic or a portal screenshot alone.
Stop boundary: No insurance adequacy opinion without the relevant policy/standards and qualified review.
Candidate criteria: NJ-C15; NJ-C16
P18 Prepare for independent triggered audit
Sector: Water · Objective: Recognize statutory triggers and qualified independent auditor requirements.
- Determine missed submission/incident trigger and NJCCIC direction.
- Preserve incident and program records.
- Confirm auditor competence, independence and scope.
- Track audit, corrective plan and submission responsibilities.
Evidence: Trigger record; NJCCIC correspondence; engagement/independence records; audit/CAP/receipts.
Review basis: Actual regulator required deliverables are separately planned and accepted; self assessment is not called the independent statutory audit.
Stop boundary: No claim that GDF is appointed or independence accepted without actual engagement facts.
Candidate criteria: NJ-C17; NJ-C18
P19 Coordinate engineering and AWIA work
Sector: Water · Objective: Keep OT evidence connected to broader resilience without overstating scope.
- Inventory AWIA RRA components and ERP linkage.
- Coordinate with operator/engineer for WQAA noncyber certifications and asset plans.
- Assign deliverable owners and exact actual dates.
- Expose work outside the cyber engagement.
Evidence: RRA/ERP scope; licensed specialist records; asset/capital reports; responsibility matrix.
Review basis: No whole program conclusion rests on cyber testing alone; specialist dependencies and omissions are visible.
Stop boundary: Do not perform engineering certification or valve/hydrant operation under OT audit authority.
Candidate criteria: NJ-C19; NJ-C20; NJ-C56
P20 Map cyber to discharge consequences
Sector: Wastewater · Objective: Integrate cyber incident handling with permit based response.
- Obtain complete current permit/modifications, 6.10 text and actual emergency plan.
- Map pump, treatment, aeration, disinfection and telemetry failure consequences with permit owner.
- Classify each scenario into the exact (a) category and independent (c), (d), (e), (f), (g), (i) or (j) duties.
- Review commencement, awareness, revision, initial call and written report records separately, including receiving DTW and signed contemporaneous logs where applicable.
- Verify current recipients/channels and rehearse synthetic communications without real submission or process change.
Evidence: NJPDES permit; current rule; process diagrams; emergency contacts; reporting tree.
Review basis: Reporting categories cite actual permit/rule sections and facts; cyber and physical clocks remain separate.
Stop boundary: No bypass, discharge, process upset or chemical dosing test.
Candidate criteria: NJ-C21; NJ-C73; NJ-C74
P21 Reconcile NERC and NJ programs
Sector: Electric · Objective: Build a requirement level inventory without assumed CIP coverage.
- Verify registered entity/functions and systems.
- Examine categorization and separate control center communications screening.
- Obtain current effective standards/implementation plans.
- Map evidence and NJ duties, including any accepted certification overlap.
Evidence: Registration; categorization; current standards; system/evidence map; overlap decision.
Review basis: Qualified owner approves exact applicable requirements and versions; regional selection is not a CIP determination.
Stop boundary: No relay, protection, dispatch or generation command testing without separate approved method.
Candidate criteria: NJ-C22
P22 Review energy operating interfaces
Sector: Utilities · Objective: Cover gas, electric, generation and emerging asset boundaries.
- Identify substations, DER, storage, plants, gas assets and outsourced control.
- Map safety/dispatch/interconnection and permits.
- Assign regulatory specialist owners.
- Review communications loss/manual operations using records.
Evidence: Asset/interface list; approved operating and emergency plans; permits; vendor agreements.
Review basis: Each asset type has a documented governing program screen and unresolved specialist work.
Stop boundary: No switching, trip, synchronization, gas flow or storage safety test.
Candidate criteria: NJ-C23
P23 Screen covered processes
Sector: Utilities · Objective: Resolve TCPA, PSM and RMP applicability with process safety personnel.
- Obtain chemical quantities, mixtures, process boundaries and exemptions.
- Reconcile NJ and federal threshold methods separately.
- Obtain registration/program levels/consent orders.
- Authenticate current rule/incorporation dates.
Evidence: Inventory/SDS; calculations; registration; current rules/orders; process engineer approval.
Review basis: Safety/compliance owner signs a factual utility site coverage decision; selecting a utility group establishes none.
Stop boundary: Do not estimate chemical thresholds from production descriptions.
Candidate criteria: NJ-C24; NJ-C26
P24 Integrate safety audit and OT findings
Sector: Utilities · Objective: Keep audit cycles and whole program coverage distinct.
- Build applicable TCPA annual, PSM three year and RMP criteria/calendar separately.
- Reconcile prior audits and open related findings.
- Trace OT related safeguards through process hazard analysis and MOC.
- Record excluded safety elements and specialist owners.
Evidence: Current criteria; audit reports; PHA/MOC; corrective records; complete program index.
Review basis: OT findings inform the applicable safety program; checklist is not substituted for the final full audit report.
Stop boundary: No SIL/safety integrity, mechanical integrity or process safety certification is implied.
Candidate criteria: NJ-C25; NJ-C26
P25 Review utility process and safety system separation
Sector: Utilities · Objective: Assess controller/recipe access and safety dependencies without actuation.
- Examine design/configuration records for BPCS/SIS and engineering access.
- Review recipe/logic change approval and vendor access.
- Examine backups, provenance and restore validation.
- Trace one historical approved change with safety owner.
Evidence: Architecture; logic/recipe change records; MOC; backups; vendor approvals.
Review basis: Actual boundaries and shared dependencies are recorded; independence claims require evidence.
Stop boundary: No logic download, interlock test, setpoint/recipe change or safety bypass.
Candidate criteria: NJ-C26
P29 Resolve gas utility operator instruments
Sector: Gas · Objective: Establish gas operator jurisdiction and controlled criteria before designing the audit.
- Obtain legal operator, OPID, ownership and system/function maps.
- Resolve distribution, transmission, gathering, storage and LNG boundaries with pipeline compliance staff.
- Obtain current BPU, PHMSA and any actual TSA operator instruments through authorized channels.
- Record applicability, versions, effective dates, exclusions and outstanding specialist decisions.
Evidence: Operator/jurisdiction records, current rules and orders, controlled criteria register and actual decision evidence.
Review basis: Each instrument has actual effective revision and applicability evidence; expired public copies are not treated as current.
Stop boundary: No flow, valve, compressor, leak detection or emergency shutdown actuation.
Candidate criteria: NJ-C30; NJ-C75; NJ-C83
P31 Screen public agency contractors
Sector: All · Objective: Apply the access/hosting definition to actual contracts.
- Identify public agency and contractor legal entities.
- Read contract scope and actual network/system/application/information access.
- Record current incident process and 72-hour reasonable belief trigger.
- Review supplier flow down without assuming every supplier qualifies.
Evidence: Contracts; access/service records; legal coverage decision; current reporting process.
Review basis: Decision distinguishes qualifying access/hosting from ordinary supply and records actual facts.
Stop boundary: Do not transmit agency information to unauthorized repositories.
Candidate criteria: NJ-C32
P32 Screen privacy and customer data controls
Sector: All · Objective: Assess NJDPA coverage and actual processing duties.
- Confirm legal entity/exclusions.
- Reconcile annual household consumer counts and sole payment exclusions.
- Review sale/revenue/discount facts and processors.
- Authenticate adopted rules.
- Map applicable rights, security and assessment duties to evidence.
Evidence: Entity/data inventory; count method; contracts; current rules; request/security/assessment records.
Review basis: No blanket AMI, utility or employee data conclusion; each exclusion has exact legal basis and facts.
Stop boundary: Do not infer final rule status from a proposal or FAQ.
Candidate criteria: NJ-C35; NJ-C36
P33 Collect local and contractual instruments
Sector: All · Objective: Turn local uncertainty into specific collection tasks.
- List every facility/municipality/county and owner.
- Obtain permits, consent orders, franchise/lease/compact terms and regulator directions.
- Identify binding local enactment versus voluntary emergency coordination.
- Record exact section, current status, trigger, recipient and responsible specialist.
Evidence: Complete instrument copies; adoption/effective evidence; current emergency plan; contractual duty register.
Review basis: Every local duty/exclusion is traceable; absent instruments remain unresolved rather than invented.
Stop boundary: No claim of all municipality legal completeness from this state pack.
Candidate criteria: NJ-C37
P34 Execute traceable field records
Sector: All · Objective: Produce reproducible evidence without unsafe work.
- Record actual examiner, collector, permission, population/sample method and rationale.
- Execute only approved examine/interview/test steps.
- Record observations, exceptions, actual times and evidence IDs.
- Separate criterion, condition, cause and consequence.
- Have actual reviewer evaluate records and limits.
Evidence: Execution record; evidence manifest; ROE; sampling basis; observations; review trail.
Review basis: Evidence supports only the stated population/method; untested, missing and inaccessible are distinguished.
Stop boundary: Stop on safety concern, unexpected process behavior, unauthorized access or scope/method change; notify named stop authority.
Candidate criteria: NJ-C38
P35 Close findings and hand over
Sector: All · Objective: Deliver an honest report and actionable remediation trail.
- Validate factual findings with owners without surrendering examiner judgment.
- Agree corrective owners/dates and evidence.
- Retest relevant correction with authorized safe methods.
- Record actual retester/date and closure approver/date.
- Reconcile exclusions, open questions and source currency; deliver controlled report/records.
Evidence: Findings; treatment/acceptance; retest; closure approvals; final report and receipt.
Review basis: Closure follows actual remediation and retest; no future/reversed actual dates or TBD evidence accepted. Open scope/criteria prevent unsupported whole program assurance.
Stop boundary: Risk acceptance cannot waive law; do not call this preparation pack a regulatory approval or guaranteed compliant audit.
Candidate criteria: NJ-C18; NJ-C61
P36 Examine identities and privileged access
Sector: All · Objective: Assess actual access paths and lifecycle without trying credentials.
- Reconcile approved account exports to named people, services and vendor roles.
- Sample joiner/mover/leaver and privileged approvals.
- Examine remote access MFA, session approval, emergency access and service account safeguards.
- Record legacy constraints and compensating controls against the adopted criterion.
Evidence: Redacted account/role exports; access reviews; approvals; remote access settings; termination tickets.
Review basis: Population and sample rationale support least privilege/lifecycle conclusions; no universal MFA mandate is inferred from NIST guidance.
Stop boundary: No password guessing, login trials, account disabling or copying secrets.
Candidate criteria: NJ-C67
P37 Examine segmentation and remote conduits
Sector: All · Objective: Verify documented boundary intent against approved configuration evidence.
- Reconcile zones/conduits and vendor/cloud/wireless/cellular paths.
- Examine authorized firewall, routing and jump host exports.
- Trace selected necessary flows and denied path design, including actual Modbus, DNP3, EtherNet/IP, IEC 61850, OPC UA or other site protocols.
- Document unobserved paths and protocol specific limitations.
Evidence: Current drawings; sanitized configurations; authorized passive records; vendor connection lists.
Review basis: Each sampled path has a documented purpose/owner and adopted control objective; protocol mention alone is not proof of testing.
Stop boundary: No connectivity probes, packet injection, port mirroring or firewall changes without separate method approval.
Candidate criteria: NJ-C38 (adopt exact objective before execution)
P38 Examine configuration and endpoint safeguards
Sector: All · Objective: Assess approved hardening against platform and process constraints.
- Establish vendor supported baselines and actual platform/firmware versions.
- Examine approved exports for services, access, logging, application controls and endpoint protections.
- Review exceptions and legacy compensations.
- Compare selected systems to the adopted baseline with owner validation.
Evidence: Baseline; version/configuration exports; exception approvals; platform compatibility evidence.
Review basis: Observed deviations and coverage limits are recorded; unsupported devices are not silently judged by an IT only benchmark.
Stop boundary: No agent installation, service stopping, hardening changes or unsupported endpoint query.
Candidate criteria: NJ-C38 (adopt exact objective before execution)
P39 Trace engineering and logic change integrity
Sector: All · Objective: Establish authorization and recoverable provenance of control changes.
- Identify approved engineering tools, project repositories and logic/firmware/recipe baselines.
- Sample actual changes from request through review, safety/MOC, implementation and validation.
- Compare approved stored revisions/checksums where safe and meaningful.
- Review rollback and vendor handover.
Evidence: Change requests; approved logic/project revisions; MOC; checksums/provenance records; validation results.
Review basis: Actual changes and exceptions are attributable and reproducible within the approved evidence scope.
Stop boundary: No online logic comparison, upload/download, firmware or setpoint change without specific operations/vendor authorization.
Candidate criteria: NJ-C55
P40 Examine portable devices and removable media
Sector: All · Objective: Review maintenance and transfer paths into isolated/legacy systems.
- Inventory engineering laptops, portable media and temporary vendor equipment.
- Review approval, custody, scanning/transfer station and configuration practices.
- Sample maintenance entry/exit records and exceptions.
- Check restoration and contamination response arrangements.
Evidence: Device/media register; vendor procedures; custody and maintenance records; approved transfer design.
Review basis: Known temporary paths and exceptions are recorded against adopted policy; evidence avoids malware introduction.
Stop boundary: Do not attach media, connect a laptop or run sample malware.
Candidate criteria: NJ-C38 (adopt exact objective before execution)
P41 Review supplier and shared service controls
Sector: All · Objective: Connect outsourced access and responsibilities to actual evidence.
- Identify critical integrators, MSPs, telecom/cloud services and OEMs.
- Examine responsibilities, incident notice, access approval, support/patch, recovery and evidence access terms.
- Sample access termination and supplier changes.
- Resolve public agency contractor scope separately.
Evidence: Contracts; responsibility matrix; service inventory; assurance reports with scope/period; supplier access records.
Review basis: Third party claims are evaluated for scope, exceptions and period; certificates alone do not prove the operator controls.
Stop boundary: No outreach or supplier disclosure without engagement authorization; retain confidential contracts securely.
Candidate criteria: NJ-C47; NJ-C67
P42 Review physical and environmental dependencies
Sector: All · Objective: Check whether cyber safeguards depend on unexamined physical access or utilities.
- Conduct an authorized nonintrusive walkthrough with escort.
- Review panel/control room access, cabling, remote cabinets, environmental and backup power dependencies.
- Sample authorized access/maintenance records.
- Record safety and engineering specialist dependencies.
Evidence: Escort/permission; observations; access records; power/environment drawings; maintenance evidence.
Review basis: Recorded observations identify time, location, escort and limitation; specialist assurance is not invented.
Stop boundary: No cabinet opening, electrical contact, lock bypass, alarm triggering or unescorted access.
Candidate criteria: NJ-C38 (adopt exact objective before execution)
P43 Review workpaper quality and information handling
Sector: All · Objective: Make the result reproducible, controlled and candid.
- Reconcile criteria to procedures, executions, evidence and findings.
- Verify actual examiner/collector/reviewer and actual chronology.
- Treat TBD, pending, unknown, n/a without basis and absent records as unresolved.
- Check evidence origin, capture time/time zone, classification, integrity and custody; hash where appropriate, recording method.
- Check retention/legal holds, access, versioning, secure transfer and destruction approval.
Evidence: Cross reference index; quality review; evidence manifest/custody; controlled report; actual acceptance receipt.
Review basis: Qualified reviewer checks substantive sufficiency; this pack has no automated compliance/readiness score or evidence quality certification.
Stop boundary: Do not store secrets, raw PII, SSI or exploitable configurations in public exports; do not delete held evidence.
Candidate criteria: NJ-C38 (adopt exact objective before execution)
P44 Resolve nuclear criteria and specialist authority
Sector: Electric · Objective: Keep nuclear cybersecurity review within actual approved license/program boundaries.
- Obtain current license status, orders/exemptions and approved cybersecurity plan through authorized access.
- Have qualified nuclear compliance personnel establish 73.54 scope and protected functions/assets.
- Obtain actual 73.55(m) review and 73.77 reporting criteria and program records.
- Agree specialized competence, independence, safety and protected information handling.
- Limit generic OT work to expressly approved objectives.
Evidence: License/status; exemptions/orders; approved plan; protected asset and criteria inventory; specialist approval and actual program review/notice records.
Review basis: Actual governing instruments and qualified specialized review support the agreed scope; generic workbook completion is not NRC program assurance.
Stop boundary: No plant connection, testing or disclosure of protected information; no nuclear audit claim without the actual criteria and qualified authorized engagement.
Candidate criteria: NJ-C39
P45 Review gas control room safety records
Sector: Gas · Objective: Examine the applicable gas control room management program and its OT evidence without actuating the process.
- Obtain current 49 CFR 192.631 and decide full or limited paragraph coverage from actual functions, service counts and compressor facts.
- Reconcile controller roles, shift/fatigue records, SCADA displays, alarm/change management, operating experience and training to the applicable paragraphs.
- Trace record samples and every applicable review/test cadence to authenticated criteria and actual timestamps.
- Preserve gaps, permitted deviations and corrective work for qualified review. Do not use hazardous liquid 195.446 as the gas rule.
Evidence: Written CRM scope, current rule, procedures, alarm/shift/change/training records, sample rationale, actual reviewer and criteria specific calendar.
Review basis: Evaluate only applicable authenticated paragraphs. This procedure does not replace a complete pipeline safety inspection or authorize production tests.
Stop boundary: No live alarm inhibition, forced values, point actuation, backup switching, fatigue experiment or manual operation test; examine approved historical records.
Candidate criteria: NJ-C40
P46 Trace AMI meter to bill lineage
Sector: Electric · Objective: Establish complete data lineage and the adopted collection/availability measures.
- Confirm actual EDC, meter population, platform and third party boundaries.
- Obtain approved stored exports for capture, validation, release and billing for a defined period.
- Select normal, delayed, corrected, multisite and customer request examples with a recorded selection basis.
- Compare actual precision, intervals, elapsed times and billing sources to each adopted clause.
- Examine clock and zone handling and missing record limits; separate local nonvalidated access and PJM milestone evidence.
Evidence: Meter/system population; sanitized timestamp/interval/validation exports; billing lineage; request and exception records; actual PJM criterion.
Review basis: Trace each sample to source and criterion; report untested populations and actual measured intervals. One successful portal display does not establish all customer operation.
Stop boundary: No meter reconfiguration, HAN pairing, disconnect/reconnect, live query load or production billing change.
Candidate criteria: NJ-C42; NJ-C43; NJ-C44; NJ-C49
P47 Review AMI authorization and onward access
Sector: Electric · Objective: Determine whether customer instructions and recipient controls match adopted AMI duties.
- Obtain common form/version, Board eligibility order/list and recipient/data field map.
- Examine MFA access/confirmation design and approved historical records.
- Sample consent, decline, historical/ongoing scope, revocation and onward transfer, including exceptions.
- Trace authorization to transmission time and API/portal history.
- Review security criteria, use restrictions, prohibited sale and anonymized academic access handling.
Evidence: Forms; actual approved party record; permissions and revocations; redacted transfer logs; contracts/security controls; academic data release basis.
Review basis: Evidence links named recipient, authorized account/field/time scope and actual delivery/revocation handling. Record any absent Board implementation order as an unresolved criterion dependency.
Stop boundary: Use authorized nonproduction/sanitized records; do not grant/revoke real customer permissions, export customer histories or impersonate customers.
Candidate criteria: NJ-C45; NJ-C46; NJ-C47; NJ-C49
P48 Rehearse simultaneous AMI and breach notices
Sector: Electric · Objective: Prepare accurate separate event classifications, recipients and time records.
- Use a synthetic unauthorized release scenario, not a real submission.
- Resolve 14:5-10.6(f) party/information scope and discovery time.
- Independently screen BPU six hour, WQAA, public agency and ITPA triggers.
- Record current recipient/channel and sequencing for every applicable duty.
- Review escalation, deputies, evidence preservation, legal decisions and receipt capture.
Evidence: Scenario/classification; separate clock register; current official channels; approved templates; escalation/receipt procedure.
Review basis: No single notice or longest window is assumed to satisfy all duties. ITPA State Police before customer sequence is evaluated where applicable; unanswered classification stops a readiness conclusion.
Stop boundary: No actual incident notice, customer communication or regulator submission is authorized by the exercise.
Candidate criteria: NJ-C48
P49 Review AMI changes and semiannual reporting
Sector: Electric · Objective: Verify developer impact controls and reproducible adopted metrics.
- Build a nine metric source/definition crosswalk from final 10.8 text.
- Reconcile reporting period, historical detail, counts and login measures to approved system records.
- Obtain actual filing instructions/date and receipts.
- Sample a developer affecting change, 90-day notice or evidenced immediate cyber exception and issue tracking.
- Review nondiscriminatory access and authorized application analysis limits.
Evidence: Metric dictionary/population; query lineage and reconciliations; filed reports/receipts; notices; change/exception/issue records.
Review basis: Semiannual duty is distinguished from any quarterly language retained within metric detail; do not invent filing day or claim an unverified reporting period.
Stop boundary: No production API change, code reverse engineering or third party application testing without specific authority.
Candidate criteria: NJ-C50; NJ-C51
P50 Assess energy customer data integrity changes
Sector: Utilities · Objective: Separate current TPS reporting from future supplier freeze implementation.
- Confirm LDC/TPS roles, effective amendments and the explicit September 8, 2027 freeze applicability date.
- Reconcile actual TPS customer/error populations and 30-day window; calculate applicable reporting threshold from final text.
- Review historical qualifying reports, copies and correction/refund treatment.
- Review freeze project design, direct customer authority, separate switch consent, EDI rejections, notices and merger/default exceptions using nonproduction cases.
- Assign implementation owners/dates and vendor dependencies.
Evidence: Role/license facts; adopted text; dated population/error calculations; report/credit records; project and nonproduction acceptance records.
Review basis: Do not use proposal threshold of 10 customers or classify a future freeze requirement as currently overdue. Report data integrity findings within the approved scope.
Stop boundary: No live supplier switch, freeze, customer notice, billing adjustment or unauthorized customer record disclosure.
Candidate criteria: NJ-C52; NJ-C53
P51 Coordinate OT changes with water safety duties
Sector: Water · Objective: Link OT consequences to actual operator notices and asset program work.
- Confirm system/rule scope independently of WQAA connection count.
- With the licensed operator classify quality/pressure emergencies and planned treatment changes.
- Review occurrence to call and planned change written notice records.
- Reconcile asset plan certification, March 15 capital report, signatory training and future water loss audit interface.
- Record engineering tasks outside the cyber engagement and current recipients/receipts.
Evidence: PWS/system status; operator decision; change/emergency records; notice receipts; asset plan/report/calendar; specialist responsibility.
Review basis: Cyber evidence supports defined interfaces; the operator/engineer owns water quality, asset engineering and certification determinations. Actual event onset differs from cyber detection.
Stop boundary: No treatment change, dosing/pressure manipulation, valve/hydrant operation, water sampling certification or unsigned engineering conclusion.
Candidate criteria: NJ-C54; NJ-C55; NJ-C56
P52 Review spill prevention OT and reporting interfaces
Sector: All · Objective: Prepare environmental response without confusing malfunction, discharge and cyber triggers.
- Have environmental lead determine major facility/pipeline and substance/plan scope with current appendices.
- Map detection, monitoring, prevention and safety devices to actual approved plans.
- Review synthetic or authorized historical discharge and device malfunction cases, preserving knew/should have known times separately.
- Trace immediate notice, two hour malfunction disposition and applicable written follow up to exact clauses; assess only current specific exceptions.
- Reconcile DPCC/DCR submissions, changes, specialist signoffs and independent federal/local duties.
Evidence: Capacity and coverage calculations; current rules/appendices; plans; device/alarm map; awareness/call/disposition timeline; exception evidence; submission receipts.
Review basis: A no spill outcome does not itself remove 5.5 malfunction duty. Major facility exemption does not automatically exempt discharge notification. Delays need actual evidence and regulator/legal assessment, not a programmed grace period.
Stop boundary: No spill simulation, detector disabling, alarm inhibition, valve operation, protected equipment shutdown or real emergency call.
Candidate criteria: NJ-C57; NJ-C58; NJ-C59
P53 Examine privacy rights and notice operations
Sector: All · Objective: Verify enacted consumer rights using traceable safe records.
- Confirm actual legal coverage, role, household consumers and exemption basis.
- Reconcile notice versions to processing/recipient facts.
- Select requests, refusals, extensions, appeals, portability/deletion and opt out/agent cases from a defined population.
- Calculate each actual receipt/response window and review required notices and legitimate exceptions.
- Review universal mechanisms with authorized synthetic/nonproduction evidence; record final rule status separately.
Evidence: Coverage decision; data map; notices; redacted request/appeal population and timestamps; response and signal records; exception analysis.
Review basis: A policy alone does not prove response performance; explain missing populations, untested rights and any unsupportable exemptions. No final rule duty is invented.
Stop boundary: Do not submit real consumer requests, erase data, expose PII, override legal holds or test live customer accounts without authority.
Candidate criteria: NJ-C36; NJ-C64; NJ-C65; NJ-C70
P54 Examine privacy consent, safeguards and risk assessments
Sector: All · Objective: Evaluate actual processing decisions and safeguards against enacted provisions.
- Reconcile purpose/data/age/acquisition date inventory to sensitive data and high risk screens.
- Examine required consent, equally easy revocation and actual cessation chronology.
- Review minimization, incompatible use controls and safeguards proportionate to data nature/volume.
- Trace heightened risk assessments to processing before it starts, benefits/risks, safeguards and authorized decisions.
- Review restricted retention, regulator access and precise legal privilege basis with counsel.
Evidence: Data/purpose map; actual consent/revocation records; age/COPPA decision; safeguard evidence; assessments and changes; retention/hold instructions.
Review basis: Separate ordinary utility necessity, data specific exceptions and full entity exemptions; no assumption every AMI use is exempt or every assessment privileged.
Stop boundary: No production consent withdrawal, destructive deletion, young consumer profiling test or public export of sensitive data.
Candidate criteria: NJ-C36; NJ-C66; NJ-C67; NJ-C68
P55 Examine processor contract and assurance evidence
Sector: All · Objective: Verify actual allocation and permitted assessment route.
- Determine controller/processor roles from actual purposes/instructions.
- Compare executed contract and subprocessor terms to each 166.16 requirement.
- Review confidentiality, security allocation, request/breach assistance and end of service disposition.
- Verify assessment access or actual controller consented annual independent route, qualified assessor, period, scope and exceptions.
- Trace material gaps to corrective owners and evidence requests.
Evidence: Executed terms/instructions; subcontractor register; allocation; service exit/assistance records; assessment rights or consented report; exceptions/actions.
Review basis: A generic certificate or supplier marketing statement does not satisfy missing contractual terms or scope. Annual independent route is not asserted mandatory when statutory alternative used.
Stop boundary: No supplier outreach, contract disclosure, data transfer or deletion without engagement specific authority.
Candidate criteria: NJ-C36; NJ-C69
P56 Reconcile TCPA full program audit and report
Sector: Utilities · Objective: Connect OT findings to the actual annual process safety program.
- Establish facility/process/program and approved anniversary from actual consent/order.
- Reconcile state modifications, 2022 readoption, current federal amendments and their dates in a clause crosswalk.
- Allocate every applicable full program element to competent reviewers; examine as built/operated PSI verification and actual audit participant/method records.
- Reconcile corrective schedules and other open related findings.
- Trace 12-month report contents, 90-day filing and receipt, plus NJRMP event/ownership changes.
Evidence: Coverage/anniversary; complete current criteria crosswalk; team competence; PSI/audit/workpapers; findings/actions; annual report/NJRMP and receipts.
Review basis: OT work is a defined contribution. A complete safety program conclusion requires all applicable elements and qualified reviewers; old consolidated copy and filled checklist do not supply it.
Stop boundary: No process operation, chemical handling, SIS/interlock actuation, startup authorization or process safety certification by generic OT examiners.
Candidate criteria: NJ-C60; NJ-C61; NJ-C62; NJ-C63
P57 Review interconnection portal control evidence
Sector: Electric · Objective: Assess CIAP data protection, availability and workflow only against authenticated actual criteria.
- Resolve Chapter 14:8 status/readoption, effective orders/tariffs and implementation with utility compliance.
- Map CIAP/applicant/EDC/vendor boundaries and actual assigned responsibilities.
- Examine authorized historical/nonproduction MFA, role, secure transfer and account separation records.
- Reconcile uptime definition, stated hours/time zone and public metrics to source records; do not assume UTC/EST/daylight interpretation.
- Sample workflow timestamps, validation, payment/status and notification preferences, plus approved map disclosure controls.
Evidence: Current chapter/status and orders; actual tariff/implementation; architecture/roles; redacted access/transfer records; uptime and workflow populations; map approvals.
Review basis: No current noncompliance finding rests on an unreconciled dated amendment, proposal or future implementation assumption. Report actual tested population/method and unresolved criteria precisely.
Stop boundary: No live interconnection approval, grid control setting, production file upload, account cross access or public release of operational maps.
Candidate criteria: NJ-C71; NJ-C72
P58 Resolve gas jurisdiction and operative instruments
Sector: Gas · Objective: Approve the gas specific criterion inventory before execution.
- Reconcile operator/OPID, legal entity and asset/function maps.
- Obtain current Chapters 14:6/14:7, federal scope and actual TSA/agency instruments through authorized channels.
- Resolve distribution/transmission/storage/LNG and full/limited CRM coverage with specialists.
- Record each clause/version, effective dates, exclusions, owner and missing evidence before criteria approval.
Evidence: Jurisdiction decision; current criteria and amendment history; specialist scope; actual authorization.
Review basis: Evaluate authenticated applicable clauses and actual evidence. An unresolved trigger, source or missing record prevents an unsupported conclusion. Record actual examiner, reviewer and limitations.
Stop boundary: Records/interviews and authorized passive evidence only. Stop on disputed jurisdiction, unavailable controlled criteria, unsafe access or any request to actuate valves, pressure, logic or safety systems without separate approved methods.
Candidate criteria: NJ-C30; NJ-C40; NJ-C75; NJ-C83
P59 Rehearse gas notice decisions without sending
Sector: Gas · Objective: Validate classification, distinct clocks and recipient readiness from historical or controlled tabletop records.
- Select an actual authorized historical event or clearly labeled tabletop.
- Have pipeline compliance staff classify the current state/federal triggers and exclusions.
- Record event, discovery, learning, confirmed discovery and determination times separately with zone.
- Calculate each applicable window using its own calendar and reconcile initial/update/final receipts.
- Record missing fields, current channels, deputy and escalation; send no actual notice during the preparation test.
Evidence: Trigger decisions; timeline; separate deadline calculations; current channels; historical receipts or clearly labeled tabletop observations.
Review basis: Evaluate authenticated applicable clauses and actual evidence. An unresolved trigger, source or missing record prevents an unsupported conclusion. Record actual examiner, reviewer and limitations.
Stop boundary: Records/interviews and authorized passive evidence only. Stop on disputed jurisdiction, unavailable controlled criteria, unsafe access or any request to actuate valves, pressure, logic or safety systems without separate approved methods.
Candidate criteria: NJ-C76; NJ-C80; NJ-C81; NJ-C82
P60 Reconcile gas drill coverage and calendar
Sector: Gas · Objective: Check district, dispatch, field site, notice and report requirements against actual history.
- Obtain current rule and all operator districts/divisions, call and dispatch centers.
- Reconstruct actual drill dates, locations/types and attendance.
- Check two year distribution coverage, prohibited two week proximity, field/tabletop cycles and the separate transmission annual/15-month/three year provisions.
- Reconcile advance notices, any narrow exception and final report receipts.
- Assign gaps and planned corrective work; this review does not authorize a field drill.
Evidence: Complete drill population/history, attendance, current criteria, calendar, notices, evaluations and corrective records.
Review basis: Evaluate authenticated applicable clauses and actual evidence. An unresolved trigger, source or missing record prevents an unsupported conclusion. Record actual examiner, reviewer and limitations.
Stop boundary: Records/interviews and authorized passive evidence only. Stop on disputed jurisdiction, unavailable controlled criteria, unsafe access or any request to actuate valves, pressure, logic or safety systems without separate approved methods.
Candidate criteria: NJ-C77; NJ-C78
P61 Trace gas safety telemetry to operating records
Sector: Gas · Objective: Assess integrity and availability of OT records used by qualified pipeline specialists.
- Select an approved asset/event sample and safety objective.
- Compare SCADA pressure/temperature/alarm timestamps and configuration to independent approved records and calibration evidence.
- Trace approved control changes, operator qualifications and incident reconstruction to the owning safety program.
- Record inconsistencies, evidence custody and process implications with the specialist.
- Propose changes only through the actual safety/change approval process.
Evidence: Asset/sample rationale; raw secure evidence references; clock/calibration/configuration records; independent corroboration; specialist review.
Review basis: Evaluate authenticated applicable clauses and actual evidence. An unresolved trigger, source or missing record prevents an unsupported conclusion. Record actual examiner, reviewer and limitations.
Stop boundary: Records/interviews and authorized passive evidence only. Stop on disputed jurisdiction, unavailable controlled criteria, unsafe access or any request to actuate valves, pressure, logic or safety systems without separate approved methods.
Candidate criteria: NJ-C78; NJ-C80; NJ-C83
P62 Reconcile gas filings and supporting data
Sector: Gas · Objective: Test the relationship between required reports, source records and actual submission evidence.
- Determine applicable report types from the current full rule and asset classification.
- Reconcile annual/leak/pressure test source systems and reporting periods to submitted records.
- Verify actual dates, report content and receipts separately for each state/federal recipient.
- Check known corrections, missing source data and the applicable event/working day/calendar day basis.
- Assign open items and have the qualified compliance owner review the conclusion.
Evidence: Applicable filing matrix; source to report reconciliation; current forms/criteria; period and timestamp evidence; receipts; corrections.
Review basis: Evaluate authenticated applicable clauses and actual evidence. An unresolved trigger, source or missing record prevents an unsupported conclusion. Record actual examiner, reviewer and limitations.
Stop boundary: Records/interviews and authorized passive evidence only. Stop on disputed jurisdiction, unavailable controlled criteria, unsafe access or any request to actuate valves, pressure, logic or safety systems without separate approved methods.
Candidate criteria: NJ-C79; NJ-C82
P63 Reconcile gas service interruption branches
Sector: Gas · Objective: Check the separate interruption categories, awareness thresholds and follow up records without issuing real notices.
- Reconcile the actual interruption population, start times, customer counts/types, season, road and critical customer facts.
- Apply exact current 14:7-1.17(j)-(l) categories and exclusions with the compliance owner.
- Keep awareness of 30 minutes or one hour of interruption separate from the subsequent 30-minute notice window.
- Trace actual notice and prompt written follow up records.
- For reportable incidents, test whether the separate 30-day amended corrective action report is triggered.
- Record forms, receipts, source gaps and actual reviewer.
Evidence: Interruption/event records; season/customer/road classifications; actual timestamps; contract exception decision; receipts; written and amended follow up records.
Review basis: Evaluate authenticated applicable clauses and actual evidence. An unresolved trigger, source or missing record prevents an unsupported conclusion. Record actual examiner, reviewer and limitations.
Stop boundary: Records/interviews and authorized passive evidence only. Stop on disputed jurisdiction, unavailable controlled criteria, unsafe access or any request to actuate valves, pressure, logic or safety systems without separate approved methods.
Candidate criteria: NJ-C76; NJ-C84
Reporting triggers
This is a planning register, not a complete notice inventory or an incident reporting service. Confirm current recipients and channels from official instructions before an incident. Add all actual recurring, permit, federal/operator, contract and local duties.
N01 NJ01 covered utilities
Qualifying event: Defined ICS events
Trigger: Detection
Window: Within 6 hours
Basis: NJ01 Requirements 3(a)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N02 Covered public utility
Qualifying event: Listed cyber attack/attempt with adopted service impact conditions
Trigger: Becoming aware
Window: Within 6 hours; authenticate current code
Basis: NJ02 14:3-6.7(a)6-7
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N03 WQAA covered water purveyor
Qualifying event: Statutory business information compromise or specified ICS effects
Trigger: Employee made aware
Window: Promptly; no numeric grace period asserted
Basis: NJ03 58:31-4.2(a)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N04 Public agency/qualifying contractor
Qualifying event: Covered cybersecurity incident
Trigger: Reasonable belief occurred
Window: Within 72 hours
Basis: NJ05 52:17B-193.3(a)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N05 Covered holder of NJ resident PI
Qualifying event: Breach meeting actual statutory conditions
Trigger: Discovery and applicable statutory analysis
Window: Expedient without unreasonable delay; State Police before customer disclosure
Basis: NJ06 56:8-163
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N06 Maintainer on behalf of another
Qualifying event: Covered breach in maintained records
Trigger: Discovery
Window: Immediately notify owner/licensee as specified
Basis: NJ06 56:8-163(b)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N07 Actual wastewater operator
Qualifying event: Permit/rule defined discharge/bypass/noncompliance
Trigger: Exact permit/rule trigger to determine
Window: Applicable 2-hour/24-hour category; not a generic cyber clock
Basis: NJ12 and actual permit/current rule
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N08 Actual facility/operator
Qualifying event: Physical safety, environmental, federal, contract/insurer and local events
Trigger: Instrument specific trigger to determine
Window: Unresolved until actual criteria obtained
Basis: Actual utility facility, permit, federal/operator, local and contract instruments; see NJ-C23, NJ-C26, NJ-C30 and NJ-C37
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N09 Covered AMI EDC/third party/onward recipient
Qualifying event: Unauthorized release of covered customer information
Trigger: Discovery
Window: Within 48 hours; required recipients separately; coordinate independently applicable earlier/sequence duties
Basis: NJ16 14:5-10.6(f)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N10 Supplier of water
Qualifying event: Qualifying emergency affecting quality/pressure/standards
Trigger: Occurrence of emergency
Window: Within 6 hours by telephone; distinct from cyber detection/awareness triggers
Basis: NJ19 7:10-2.4(b)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N11 Responsible person for qualifying NJ hazardous discharge
Qualifying event: Discharge under actual 7:1E scope and exceptions
Trigger: Knew or reasonably should have known
Window: Immediate; receipt within 15 minutes considered immediate. No generic small spill exception; actual 5.6 delay basis requires review.
Basis: NJ18 7:1E-5.3; -5.6
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N12 Actual major facility owner/operator
Qualifying event: Discharge detection/monitoring/prevention/safety system or device malfunction
Trigger: Knew or reasonably should have known of malfunction
Window: Immediate; 15-minute measure, then disposition notice within 2 hours after initial notification
Basis: NJ18 7:1E-5.5(a)-(c)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N13 Actual TPS meeting adopted customer/error threshold
Qualifying event: Incorrect billing incident meeting actual population/window tests
Trigger: TPS became aware of incident
Window: Written report within 10 business days to specified Board recipients and utility if consolidated billing
Basis: NJ17 14:4-7.14(a)-(b)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N14 Actual NJPDES permittee with 6.10(c) event
Qualifying event: 6.10(a)1i-iv exceedance or (a)2 listed unpermitted discharge
Trigger: Discharge commencement or permittee awareness; actual facts required
Window: Initial telephone notice within 2 hours; revisions within 24 hours after awareness of need to revise
Basis: NJ24 7:14A-6.10(c)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N15 Actual NJPDES permittee with 6.10(d) event
Qualifying event: 6.10(a)1v toxic daily maximum, (a)3 other upset/bypass or (a)5 residual noncompliance
Trigger: Discharge commencement or permittee awareness; actual facts required
Window: Telephone notice within 24 hours; verify no earlier independently applicable category
Basis: NJ24 7:14A-6.10(d)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N16 NJPDES (a)1 3 or 5 category
Qualifying event: Required written information not previously submitted
Trigger: Discharge commencement or awareness; actual applicable basis
Window: Within 5 days; immediately correct missing or incorrect required facts; additional (f) documentation where applicable
Basis: NJ24 7:14A-6.10(e)-(f)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N17 Actual NJPDES serious violation
Qualifying event: Serious violation as defined by applicable rule
Trigger: Violation
Window: Separate written report within 30 days; does not replace earlier applicable oral/written duties
Basis: NJ24 7:14A-6.10(i)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N18 Applicable NJ gas operator
Qualifying event: Reportable state gas incident
Trigger: Operator learns of the reportable incident
Window: Immediately; no later than one hour after learning. Current state event categories and channel must be verified.
Basis: NG01: 14:7-1.17(b)-(f)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N19 Applicable NJ gas operator
Qualifying event: Follow up report of each reportable state incident
Trigger: Actual incident date
Window: Within 15 days after the incident; additional new information notices have separate as soon as practicable requirements.
Basis: NG01: 14:7-1.17(e),(g)-(h)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N20 Actual Part 191 covered gas operator/event
Qualifying event: Qualifying current 191.3 incident
Trigger: Discovery; retain separate confirmed discovery time
Window: Earliest practicable moment following discovery; no later than one hour after confirmed discovery. Do not use a stale adjusted dollar threshold.
Basis: NG02: 191.5(a)-(b); NG07
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N21 Actual Part 191 covered gas operator/event
Qualifying event: Revision or confirmation of initial incident notice
Trigger: Confirmed discovery of qualifying incident
Window: Within 48 hours after confirmed discovery, to extent practicable. Confirm unchanged estimates too.
Basis: NG02: 191.5(c)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N22 Operator with actual 191.23(a)(1) (9) condition after exclusions
Qualifying event: Ordinary safety related condition written report
Trigger: Day first determined; separate day first discovered
Window: Received within five working days after determination day, and no later than ten working days after discovery day. Exclude Saturdays, Sundays and federal holidays.
Basis: NG03: 191.25(a),(c)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N23 Qualifying gas transmission MAOP exceedance
Qualifying event: 191.23(a)(10) category
Trigger: Actual qualifying exceedance
Window: Federal written report received within five calendar days of exceedance. Resolve exact trigger and current channel.
Basis: NG03: 191.25(b)-(c)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N24 Applicable NJ pipeline operator
Qualifying event: Specified MAOP exceedance beyond allowed device margin
Trigger: Discovery of qualifying exceedance
Window: State notification immediately upon discovery; formal report under 191.25 separately classified.
Basis: NG01: 14:7-1.26(g)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N25 Actual 14 for 7 1.17(j) gas interruption category, subject to (l)
Qualifying event: Heating season 100-customer interruption, defined healthcare facility or designated airport category
Trigger: Operator awareness that service has been interrupted for 30 minutes
Window: Report to Board no later than 30 minutes from that awareness. Resolve exact categories, definitions and contract exclusion; prompt detailed written follow up under (m) separately.
Basis: NG01: 14:7-1.17(j),(l)-(m)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N26 Actual 14 for 7 1.17(k) gas interruption category, subject to (l)
Qualifying event: Nonheating season 100-customer interruption, listed highway lane closure or specified critical customer
Trigger: Operator awareness that service has been interrupted for one hour
Window: Report to Board no later than 30 minutes from that awareness, in addition to any applicable (j) notice. Resolve exact categories, definitions and contract exclusion; prompt detailed written follow up under (m) separately.
Basis: NG01: 14:7-1.17(k)-(m)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
N27 Reportable state gas incident where corrective measures/recommendations unavailable at follow up
Qualifying event: Conditional amended corrective action report
Trigger: Incident date; retain evidence that measures/recommendations were unavailable at first follow up
Window: File amended report within 30 days of the incident, stating corrective measures and recommendations. This does not extend the initial or 15-day follow up deadline.
Basis: NG01: 14:7-1.17(i)
Record actual event/trigger/submission times with time zone, current recipient/channel, owner/deputy, due basis, receipt and open questions separately for this duty.
Recurring and event based duty calendar
Use the Calendar sheet to record actual applicability, owner/deputy, last event, next due date and the calculation basis. A starter timing instruction is not a completed deadline determination. Keep reporting triggers separate.
D01 Critical system inventory and risk/method review
Conditional scope: NJ01 covered entity
Trigger: Prior actual annual review
Timing: Annual; establish actual review period
Prepare: Inventory/change reconciliation, risk assessment/treatment and methodology review with actual owners.
Basis: NJ01 Requirements 1
D02 Executive cyber certification
Conditional scope: NJ01 covered entity
Trigger: Annual cycle
Timing: December 31 after historical implementation; verify current instructions
Prepare: Actual authorized signer, scope, evidence and receipt; document limited NERC overlap if used.
Basis: NJ01 Accountability
D03 Cyber response exercise
Conditional scope: NJ01 covered entity
Trigger: Last qualifying actual exercise/incident
Timing: At least once every 24 calendar months under order conditions
Prepare: Actual date, scenario/coverage, lessons and corrective actions; do not invent a new initial grace period.
Basis: NJ01 Requirements 4
D04 Awareness program review
Conditional scope: NJ01 covered entity
Trigger: Actual review/Board interpretation
Timing: Biannually wording remains unresolved; obtain interpretation
Prepare: Record actual interim management practice and written clarification separately.
Basis: NJ01 Requirements 5
D05 WQAA framework revision and submission
Conditional scope: Covered purveyor/chosen framework
Trigger: Final chosen framework revision publication
Timing: Within 180 days of publication; establish actual edition/date
Prepare: Current chosen framework, revised program/control mapping and NJCCIC receipt.
Basis: NJ03 58:31-4.1(b)
D06 Annual cyber certification and assessment filings
Conditional scope: Actual WQAA purveyor and current instructions
Trigger: Annual reporting cycle
Timing: DEP lists December 31; confirm current portal/form instructions
Prepare: Ownership specific signer, controls assessment, current program and receipt.
Basis: NJ03; NJ04
D07 Planned treatment change notification
Conditional scope: 7:10-2.4(a) qualifying change
Trigger: Actual planned change
Timing: Written notice at least 5 working days before change
Prepare: Operator/engineer consequence decision; schedule/notice and receipt.
Basis: NJ19 7:10-2.4(a)
D08 Asset plan and capital reporting
Conditional scope: Actual 7:10-6 scope
Trigger: Annual cycle; last plan certification; ownership/status change
Timing: March 15 annual capital report; plan certification every 3 years or ownership/status change
Prepare: Qualified operator/engineer and responsible individual signoffs; separately track annual compliance/training.
Basis: NJ19 7:10-6.3(c); -6.4(a)
D09 Water loss audit interface
Conditional scope: Actual applicable water system scope
Trigger: Future operative provision and actual cycle
Timing: Rule specifies effective March 31, 2027; authenticate 7:19-6.4
Prepare: Assign engineering/data owners; acquire current actual audit method and scope before stating a completion date.
Basis: NJ19 7:10-6.3(b)9
D10 AWIA RRA and ERP cycle
Conditional scope: Community system over 3,300 people
Trigger: Actual RRA certification and prior review cycle
Timing: ERP certification within 6 months of actual RRA certification; review/update at least every 5 years
Prepare: Actual population, full RRA/ERP scope and EPA certification receipts; not WQAA connection count.
Basis: F01 AWIA Section 2013
D11 AMI reporting metrics
Conditional scope: 14:5-10 covered EDC
Trigger: Actual reporting period
Timing: Semiannual; obtain current specific filing instructions
Prepare: Nine metric crosswalk, monthly/history detail, current recipients and receipt; no invented filing day.
Basis: NJ16 14:5-10.8
D12 AMI developer impact notice
Conditional scope: Covered EDC technical change
Trigger: Planned adversely affecting technical change
Timing: 90 days before change unless necessary for immediate cyber concern/vulnerability
Prepare: Actual impact assessment, developer population, notice receipt or documented emergency basis.
Basis: NJ16 14:5-10.7(b)
D13 Supplier freeze implementation
Conditional scope: Actual LDC/TPS scope
Trigger: Explicit adopted future applicability
Timing: 14:4-2.6(d) for requests on/after September 8, 2027; -2.6A states after September 8, 2027
Prepare: Resolve exact operative wording before edge date cases; plan EDI, authorizations, exceptions and notices.
Basis: NJ17 14:4-2.6(e); -2.6A(a)
D14 TCPA compliance audit
Conditional scope: Actual TCPA Program 3 covered process
Trigger: Last actual covered annual audit
Timing: Every year; separate from OSHA PSM three year interval
Prepare: Full program, as built/operated verification, actual participants/methods and corrective schedule.
Basis: NJ20 7:31-4.1(c)13
D15 TCPA annual report
Conditional scope: Actual Program 3 owner/operator
Trigger: Approved consent/order anniversary
Timing: Within 90 days of anniversary, covering prior 12 months
Prepare: Obtain signed approval/anniversary changes; report and required attachments/receipt.
Basis: NJ20 7:31-4.9
D16 NJRMP resubmission and changes
Conditional scope: Actual TCPA scope
Trigger: Last full RMP; actual process/level/ownership change
Timing: At least every 5 years plus actual earlier event driven requirements
Prepare: Separate resubmission from correction; actual state/federal chemicals and transfer approvals.
Basis: NJ23; NJ20 7:31-7
D17 Privacy rights and consent revocation
Conditional scope: Actual NJDPA covered processing
Trigger: Verified request, appeal or consent revocation receipt
Timing: Request/appeal 45-day duties; properly justified request extension 45 days; consent cessation no later than 15 days
Prepare: Separate clocks/notice requirements and actual response evidence; exceptions need actual statutory basis.
Basis: NJ07 56:8-166.7; -166.12(a)6
D18 Optional independent processor assessment route
Conditional scope: Actual NJDPA processor using alternative with controller consent
Trigger: Chosen permitted contractual assurance route
Timing: At least annually at processor expense when this alternative is selected
Prepare: Actual consent, qualified independent assessor, accepted criteria, report scope/period and access on request.
Basis: NJ07 56:8-166.16(e)4(b)(ii)
D19 Other program specific calendars
Conditional scope: Actual NERC, NRC, gas operator, permit/local/contract scope
Trigger: Actual governing instrument and qualifying facts
Timing: Unresolved until applicable current instrument and actual last/trigger dates are established
Prepare: Create separate rows for every applicable clause, submission, review, training, test and notice; one exercise does not fulfill all duties.
Basis: F02; F09; F12; F13; F14; NJ-C37
D20 Anticipated bypass prior notice
Conditional scope: Actual NJPDES anticipated bypass
Trigger: Planned bypass date and actual conditions
Timing: At least 10 days before if possible; operator must determine exact applicable conditions
Prepare: Necessity, alternatives, signed statements and current agency channel/receipt; no production bypass is authorized by this pack.
Basis: NJ24 7:14A-6.10(g)
D21 Gas distribution drill coverage
Conditional scope: Applicable distribution operator/district/division and call/dispatch center
Trigger: Actual prior drills and covered organizational units
Timing: At least every two years; district/division drills must not be within two weeks of one another. Reconcile initial transition, later four year field site cycle and tabletop limits from the actual rule.
Prepare: Unit population, actual dates/types/locations, attendance and gap plan.
Basis: NG01: 14:7-1.9(f)
D22 Gas drill notice and final audit report
Conditional scope: Actual drill under 14:7-1.9(f)
Trigger: Planned drill and actual drill occurrence
Timing: Notice at least five business days before; narrow rainy day/similar weather exception requires as soon as possible notice no later than two hours before. Final audit report within two months after. Track separate records.
Prepare: Approved schedule, exception evidence if used, notice/report receipts and responsible people.
Basis: NG01: 14:7-1.9(g)
D23 Gas transmission emergency closure drill
Conditional scope: Actual applicable transmission operator
Trigger: Actual prior drill dates and calendar years
Timing: At least once each calendar year with no interval over 15 months; field site and normal business hour conditions at least once every three calendar years; tabletop no more than two of three years.
Prepare: Current full section, actual dates/type/location and permissions; specialist review.
Basis: NG01: 14:7-1.10(f)
D24 Gas state annual report copies
Conditional scope: Applicable operator and asset/report class
Trigger: Close of actual calendar reporting year
Timing: Selected state copies due no later than March 15 for the preceding calendar year. Federal filing classification, exceptions and complete current state section need separate review.
Prepare: Current forms, asset applicability, period reconciliation and state/federal receipts.
Basis: NG01: 14:7-1.26(c); NG05
D25 Gas state leak classification inventory
Conditional scope: Applicable pipeline operator
Trigger: Close of actual calendar reporting year
Timing: January 31 for the preceding calendar year under the selected adopted clause.
Prepare: Open unrepaired leaks by grade, district/division and municipality; current Bureau format; receipt.
Basis: NG01: 14:7-1.26(d)1
D26 Gas test records and excavation notice
Conditional scope: Applicable gas transmission test or integrity examination
Trigger: Actual test date or planned qualifying excavation
Timing: Pressure test records within one month after test; direct assessment/examination excavation notice at least five business days before. Keep separate event records.
Prepare: Pressure/temperature charts, test dates, current complete reporting fields, location and notice/receipt.
Basis: NG01: 14:7-1.26(d)8,(f)
D27 Gas CRM paragraph level review calendar
Conditional scope: Actual 192.631 coverage after full/limited scope determination
Trigger: Authenticated applicable paragraph and last actual activity
Timing: Unresolved until current full 192.631 and applicable paragraph specific timing are obtained. Do not assign one annual interval to every CRM activity.
Prepare: Current rule; full/limited coverage decision; actual past records and individual approved deadline calculations.
Basis: F14; NG04; NJ-Q19
Source register and limits
Only official government/regulatory/standards body sources are used. Technical framework references do not become law unless adopted by a binding instrument. An HTTP success, search excerpt or agency summary is not full current law authentication.
NJ01 BPU Cyber Security Program order AO16030196 (signed order)
Open primary source
Locator: Requirements 1-5; Implementation; Accountability
Basis: Adopted March 18, 2016; effective March 28, 2016. Signed source retained; operative pages 1-8 visually read.
Limitation: Determine actual Board jurisdiction, later orders and current submission instructions. Historic personnel and implementation dates are not current contacts or new project deadlines.
NJ02 BPU 2022 readoption and adopted amendments
Open primary source
Locator: Adopted N.J.A.C. 14:3-6.7(a)6-7; distinguish final text from comments
Basis: Official adopted rule publication.
Limitation: Current consolidated 14:3 text and subsequent amendments still require reconciliation; do not treat this publication alone as complete current codification.
NJ03 Water Quality Accountability Act 2021 amendments, corrected Chapter 262
Open primary source
Locator: N.J.S.A. 58:31-2, -4, -4.1, -4.2, -6 to -8
Basis: DEP hosted enacted law; selected cybersecurity provisions read in full.
Limitation: Later amendments, implementing instruments and actual system facts require engagement level currency review.
NJ04 DEP WQAA implementation page
Open primary source
Locator: Deliverables; cybersecurity; FAQs
Basis: Agency implementation guidance, not a substitute for the statute.
Limitation: Its 30-day incident summary conflicts with statutory prompt reporting; its 500-or more FAQ conflicts with more than-500 statutory definition. Resolve in writing; do not adopt the longer incident window.
NJ05 Public agency and qualifying government contractor incident reporting
Open primary source
Locator: P.L. 2023 c.19; N.J.S.A. 52:17B-193.2 and -193.3
Basis: Enacted chapter; definitions and reporting provisions read.
Limitation: Confirm entity status, qualifying contractor access and current NJCCIC process. A supplier is not automatically a qualifying contractor.
NJ06 Identity Theft Prevention Act 2019 amendments
Open primary source
Locator: N.J.S.A. 56:8-161 and -163
Basis: Enacted chapter; breach definitions, sequence and exceptions read.
Limitation: Authenticate consolidated current law and later amendments before final legal opinion. No uniform 30-day resident notice deadline is asserted here.
NJ07 New Jersey Data Privacy Act enacted chapter
Open primary source
Locator: 56:8-166.4 through -166.16; enacted rights, security, consent, assessments and processor provisions
Basis: Enacted P.L. 2023 c.266 read, including operational provisions; effective January 15, 2025.
Limitation: Authenticate later statutory amendments/current codification and rule status at engagement start. AMI precise geolocation carve out does not exempt all utility data; government/exempt processing decisions require actual legal/entity facts.
NJ08 NJ Consumer Affairs privacy law FAQ
Open primary source
Locator: Scope; rights; implementation dates
Basis: Agency explanatory guidance.
Limitation: FAQ is not operative rule text. Check current adoption and enforcement instructions; do not rely on a proposed rule as final.
NJ09 NJ Consumer Affairs proposals
Open primary source
Locator: Privacy rule status and adoption follow up
Basis: Official proposal listing inspected in browser on October 16, 2026; June 2, 2025 proposal and August 4, 2025 comment extension remain listed.
Limitation: No final rule adoption was authenticated. See NJ25 for the adoption index check. Do not derive a legal lapse or final rule duties from a closed comment period.
NJ10 DEP Toxic Catastrophe Prevention Act program
Open primary source
Locator: N.J.S.A. 13:1K-19 et seq.; N.J.A.C. 7:31; compliance audit guidance
Basis: Official agency program text reviewed, including annual compliance audit, final report and ownership transfer guidance.
Limitation: Selected state clauses and readoption are now available at NJ20/NJ21. Current federal incorporation, facility status and full program scope still require reconciliation. Checklist alone is not the final audit report.
NJ11 DEP TCPA rule index
Open primary source
Locator: N.J.A.C. 7:31 and incorporated 40 CFR Part 68
Basis: Rule index inspected in browser and its full state rule courtesy PDF retrieved; see NJ20.
Limitation: The retrieved state copy is dated 2016. Use the readoption and current federal/state incorporation crosswalk before final criteria approval.
NJ12 DEP wastewater emergency response guidance
Open primary source
Locator: N.J.A.C. 7:14A-6.10; actual NJPDES permit
Basis: Agency guidance distinguishes two hour and 24-hour reporting categories.
Limitation: Authenticate rule and permit; categorize actual discharge/noncompliance. These are not universal cyber event reporting clocks.
NJ14 BPU current rule index
Open primary source
Locator: Chapter 14:3 readoptions and amendment history
Basis: Official index points to OAL/Lexis and later adopted amendments.
Limitation: Index is not the full operative code; reconcile relevant amendments and entity specific orders.
NJ15 OAL public code access
Open primary source
Locator: Public Administrative Code and New Jersey Register access
Basis: OAL identifies the free public code as unofficial and updated semimonthly. Current operative text and update history require separate authentication.
Limitation: Current codified text was not authenticated through this route. Obtain authorized current text plus update history; do not label access gaps resolved.
F01 EPA AWIA Section 2013
Open primary source
Locator: Risk and resilience assessment and emergency response plan
Basis: Federal program: community water systems serving more than 3,300 people; six month ERP interval follows actual RRA certification.
Limitation: Verify population, certification receipts, review cycle and entire statutory RRA scope. Wastewater only service is not automatic coverage.
F02 NERC reliability standards
Open primary source
Locator: Current applicable CIP versions, implementation plans and registration
Basis: Official standards source.
Limitation: Actual registration, functions, BES cyber categorization, control center screening and effective versions are needed. Retail utility status alone does not establish CIP coverage.
F03 NIST SP 800 82 Rev. 3
Open primary source
Locator: Guide to Operational Technology Security
Basis: Final technical guidance.
Limitation: Voluntary unless adopted by a binding instrument. Rev. 4 draft is not a final replacement. SP 800-82 is not the CSF named by WQAA.
F04 NIST SP 800 115
Open primary source
Locator: Assessment planning, rules of engagement and reporting
Basis: Official publication landing page reviewed October 17, 2026.
Limitation: Methodology reference; not a universal mandatory audit standard or permission to test production OT.
F05 NIST SP 800 53A Rev. 5
Open primary source
Locator: Examine, interview and test assessment methods
Basis: Official publication landing page reviewed October 17, 2026.
Limitation: Select suitable methods after agreeing the engagement basis; no automatic legal adoption or assurance conclusion is inferred.
F06 OSHA process safety management
Open primary source
Locator: 1910.119 applicability; management of change; (o) compliance audits
Basis: Federal safety rule; three year audit requirement when applicable.
Limitation: Coverage and New Jersey public worker jurisdiction must be determined. PSM is not a general cybersecurity certification; NJ TCPA annual cycle is separate.
F07 EPA risk management rule
Open primary source
Locator: Current Part 68, covered processes and applicable amendments
Basis: Official federal eCFR route.
Limitation: Current effective and compliance dates, program level, chemical inventory and NJ incorporation must be authenticated for the facility.
F09 TSA surface cybersecurity resources
Open primary source
Locator: Rail and pipeline current operator instruments
Basis: Official agency entry point.
Limitation: Publicly available old directives are not proof of the operator current version; obtain controlled current directives, amendments, approved implementation plans and authorized access. SSI must remain in approved repositories.
F12 NIST Cybersecurity Framework 2.0
Open primary source
Locator: Final CSF; chosen framework and organizational profile
Basis: Voluntary framework, with potential adoption by WQAA or other binding instruments.
Limitation: Retain the actual chosen final publication/version/date and mapping; an assertion of NIST alignment is not a requirement by requirement audit result.
F13 NRC digital systems cybersecurity rule
Open primary source
Locator: 10 CFR 73.54; incorporated 73.55(m) review and 73.77 notifications
Basis: Selected operative cybersecurity section read through federal eCFR; eCFR is authoritative but unofficial.
Limitation: Obtain actual license, exemptions/orders and approved cybersecurity plan, specialized review/notification criteria and authorized information access. Nuclear status alone is not an applicability decision.
F14 PHMSA gas pipeline control room management
Open primary source
Locator: 49 CFR 192.631(a)-(j); incorporated standards in 192.7
Basis: Selected full section read through federal eCFR; scope includes an important limited procedure exception.
Limitation: Determine actual SCADA/controller/control room operation, services and compressor facts. Obtain current licensed incorporated standards and full pipeline safety program; this is not a whole Part 192 audit.
NJ16 AMI data access adopted rules, R.2026 d.085
Open primary source
Locator: 14:5-10.1 through -10.8; final adopted text, Register pages 1860-1861
Basis: Adopted June 30, 2026; effective August 3, 2026. Final operative text read, including changes from proposal.
Limitation: Applies to the defined EDC/AMI context, with particular duties on third parties. Obtain subsequent Board eligibility order/list and actual implementation instructions. Do not substitute the proposal four hour notice or quarterly metrics for the adopted 48-hour and semiannual provisions.
NJ17 Energy competition adopted amendments, R.2026 d.102
Open primary source
Locator: 14:4-2.6(d)-(e), -2.6A, -7.14; final adopted text
Basis: September 21, 2026 Register, 58 N.J.R. 2169(a); selected operative amendments read.
Limitation: Readoption and amendment effective dates differ. The supplier freeze provisions specify September 8, 2027 applicability; do not mark their absence a current October 2026 violation. Customer/billing controls are an IT/OT data integrity interface, not a universal SCADA audit mandate.
NJ18 DEP DPHS rule courtesy copy, January 20, 2026
Open primary source
Locator: 7:1E-1.6, -2, -3, -4, -5.3 through -5.8
Basis: Downloaded from current DEP program link; selected scope, discharge, detection malfunction and follow up sections read.
Limitation: Courtesy copy excludes Appendices A/B; obtain those separately and reconcile later amendments. The 2026 transformer/motor vehicle exceptions differ from older copies. Do not import the older general small spill exception or treat the major facility threshold as a reporting exemption.
NJ19 DEP Safe Drinking Water Act rule courtesy copy
Open primary source
Locator: 7:10-2.4; -6.1 through -6.4; selected operative sections
Basis: Courtesy copy states last amended January 20, 2026; selected sections read.
Limitation: Chapter 7:10 public community system operations/asset provisions need their own scope decision; do not assume the WQAA more than-500 connection screen limits every Chapter 7:10 duty. Engineering and operator work requires qualified specialists.
NJ20 DEP TCPA state rule courtesy copy
Open primary source
Locator: 7:31-1.1; -4.1(c)13,14,23; -4.9; -7.4
Basis: Downloaded through current DEP rule index; selected clauses read. Copy itself is dated February 1, 2016.
Limitation: State text must be read with the 2022 readoption, current incorporated federal Part 68 and stricter state modifications. This older state copy is not a fully consolidated current federal/state rulebook.
NJ21 TCPA notice of readoption
Open primary source
Locator: Readoption notice, both pages
Basis: Notice states effective September 24, 2022 and expiration September 24, 2029; November 7, 2022 Register publication.
Limitation: Notice explains future federal incorporation except conflicting less stringent rules. It is not a newly consolidated full rule and does not itself settle each current federal compliance date.
NJ22 DEP release prevention program updates
Open primary source
Locator: March 2024 TCPA update; April/September 2026 DPHS updates
Basis: Agency implementation guidance reviewed October 16, 2026.
Limitation: Agency says 2024 Part 68 amendments are incorporated and consolidated document is being updated. Later federal changes and state conflict treatment still require clause level reconciliation. June 1, 2026 online DPCC/DCR submission instruction applies to covered plan submissions, not every industrial facility.
NJ23 DEP NJ Risk Management Plan instructions
Open primary source
Locator: Resubmission, correction and ownership instructions; 7:31-7.1(c)5,11
Basis: Agency guidance distinguishes five year full resubmission from event driven changes and corrections.
Limitation: Record actual covered processes, state only chemicals, submission anniversary, changes and consent agreements. Federal RMP and NJRMP contents/destinations are not identical.
NJ24 DEP NJPDES conditions applicable to all permits
Open primary source
Locator: 7:14A-6.10; actual permit and modifications
Basis: Current agency NJPDES index and its scanned Chapter 6 courtesy copy retrieved; 7:14A-6.10(a)-(j), PDF pages 14-18, visually read.
Limitation: Reconcile subsequent rule history and actual permit/modifications. Different categories use two hour, 24-hour, advance and written follow up duties. Historic postal information in the copy must be checked against current agency submission instructions.
NJ25 Consumer Affairs adoption index
Open primary source
Locator: Adoption listing reviewed October 16, 2026; newest visible entry October 5, 2026
Basis: Official proposals and adoptions pages inspected in browser; no 13:45L/Data Privacy adoption entry was found in the inspected listing.
Limitation: Absence from the index is not proof no adoption exists or that a proposal legally lapsed. Rule adoption/current codification remains unverified. Enacted NJDPA duties are treated separately and are not suspended by this research gap.
NJ26 DEP DPHS program and current appendices
Open primary source
Locator: Scope; current rules, Appendix A/B and 2026 plan instructions
Basis: Current agency program page read; last update September 23, 2026.
Limitation: Verify storage capacity method, regulated substances, exemptions, facility status and actual approved plans. Program summaries do not replace the rule or specialist plan certification.
NJ27 DER interconnection and CIAP adopted amendment
Open primary source
Locator: 14:8-5.13(d); selected -5.8 and -5.11; final text Register pages 98-99
Basis: Adopted November 21, 2025; effective January 5, 2026. Selected final clauses read.
Limitation: December 17, 2025 minutes record Board approval of Chapter 14:8 readoption in QX25080483 (NJ28). A later June 2026 final amendment prints a December 17, 2032 expiration (NJ29). Obtain the filed readoption, complete current chapter, tariffs and later orders; actual CIAP implementation and EST/daylight saving measurement remain unresolved.
NG01 NJ natural gas pipeline readoption and final amendments
Open primary source
Locator: 14:7-1.1, -1.9(f)-(g), -1.10(f), -1.17, -1.24 and -1.26; Register pages 1207-1210
Basis: Adopted April 26, 2023; readoption effective May 3, amendments effective June 5, 2023. Final adopted clauses read; printed expiration May 3, 2030.
Limitation: This amending publication omits unchanged paragraphs. Obtain current full Chapters 14:6 and 14:7, federal incorporation, later amendments and operator orders. Search excerpts omitted the word not in the drill spacing requirement; use final text.
NG02 Federal gas incident immediate notice
Open primary source
Locator: 191.5(a)-(c); current 191.3 and Part 191 scope
Basis: Full section text read October 16, 2026; displayed Title 49 current through October 15, 2026, with April 24, 2026 amendment history.
Limitation: Authenticate the qualifying incident definition and current adjusted thresholds. The one hour outer limit follows confirmed discovery; earliest practicable duty starts following discovery. Current recipient/channel must be confirmed before use.
NG03 Federal gas safety related condition and MAOP reporting
Open primary source
Locator: 191.25(a)-(c), distinguished from 191.23 triggers/exclusions
Basis: Full section text read October 16, 2026; displayed current through October 14, 2026, including April 24, 2026 amendment history.
Limitation: Resolve the actual 191.23 trigger/exclusion first. Ordinary safety related condition working day rules and transmission MAOP calendar day rule are different. Verify current submission instructions; this is not a general cyber event clock.
NG04 PHMSA control room management program
Open primary source
Locator: Gas 192.631 versus hazardous liquid 195.446; operator/control room functions
Basis: Official agency program description reviewed October 16, 2026.
Limitation: Guidance does not replace current rule text. A new direct current section retrieval was challenged; advertised developer API returned 406. Obtain current full 192.631 and paragraph specific scope/cadences before final criteria approval.
NG05 PHMSA Part 191 reporting index
Open primary source
Locator: 191.1/.3/.5/.7/.9/.11/.15/.17/.23/.25 and current forms
Basis: Official agency section/form routing reviewed October 16, 2026.
Limitation: This index is not full current legal text. Incident/annual reporting forms and exceptions depend on asset class. Some full text requests were challenged, and the official developer API returned 406; the exact remaining sections must be obtained.
NG06 BPU pipeline and utility cybersecurity oversight
Open primary source
Locator: Bureau of Pipeline Safety; Cyber Security Unit; actual jurisdiction and orders
Basis: Official BPU description reviewed October 16, 2026.
Limitation: Agency description is routing context, not a substitute for statutory jurisdiction, federal/state agreements, actual orders or current rules. Do not infer NJ jurisdiction over every interstate gas asset.
NG07 PHMSA 2026 gas property damage threshold notice
Open primary source
Locator: April 2026 notice; effective period history table
Basis: Official notice read October 17, 2026. The property damage threshold is $153,600 from July 1, 2026 through June 30, 2027. Web posting month is not the effective date.
Limitation: This verifies only the monetary subquestion. Obtain the complete current incident definition, exclusions, asset specific reports and actual event facts before classification. Other qualifying incident grounds remain independent; a cyber incident is not automatically a reportable gas incident.
NJ28 BPU minutes for Chapter 14 and8 readoption approval
Open primary source
Locator: PDF pages 15-16; docket QX25080483
Basis: Board approval of the readoption recommendation recorded; reviewed October 17, 2026.
Limitation: Minutes evidence Board action, not the filed Register notice, exact effective history or complete current CIAP criteria.
NJ29 Final June 2026 Chapter 14:8 solar amendments
Open primary source
Locator: Publication header; Chapter 14:8-13 amendments
Basis: Final publication effective June 15, 2026; printed chapter expiration December 17, 2032. Header reviewed October 17, 2026.
Limitation: Corroborates later chapter history; it does not authenticate every unchanged CIAP paragraph or implementation fact.
NG08 PHMSA current gas transmission/gathering/storage incident instructions
Open primary source
Locator: Page 1 version and form routing; Parts A and D as applicable
Basis: Actual PDF header identifies instructions revision January 2026 for form revision September 2023; reviewed October 17, 2026.
Limitation: The parser title retains an old label; use actual document headers. Select asset specific current instructions after coverage review; these instructions do not replace complete current Part 191.
F16 OIRA CIRCIA regulatory review record
Open primary source
Locator: RIN 1670-AA04; received October 1, 2026; pending review record
Basis: Official pending review status read October 17, 2026.
Limitation: Final Rule stage is not proof of publication or operative duties. Recheck final Federal Register/CISA instruments and actual coverage before criteria approval; unsuccessful searches do not prove no later rule exists.
F17 W3C accessibility conformance evaluation guidance
Open primary source
Locator: Scope, representative evaluation and expertise
Basis: Standards body methodology reviewed October 17, 2026.
Limitation: Automated passes do not establish formal conformance. Define actual standard, level, scope, user tasks and expert/manual acceptance; workbook/native/printer acceptance is separate.
F18 NIST SP 800 115 full technical guide
Open primary source
Locator: Assessment planning and Appendix B rules of engagement template
Basis: Official full publication inspected October 17, 2026.
Limitation: Methodology reference only. These GDF preparation tasks are proposed collection and planning aids, not mandatory legal requirements or permission to test.
Close the information gaps
These 18 matters separate library research, client preparation, interpretation, engagement governance and GDF product acceptance. P0 marks a decision gate, not a proven violation or a failure to prepare. Assign actual people and secure evidence references. Estimates describe active work after records arrive; they are not legal deadlines or promised external response times. Collection may run in parallel. Draft questions have not been sent.
NJ-Q01 Current BPU code and orders | All utilities
Workstreams: Library research; Client preparation
Source verification: Further operative source review required
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Public research + entity records
Responsible role: Compliance/legal
Needed before: Before final criteria approval
Next action: Obtain full current 14:3 and all amendments/orders; reconcile entity jurisdiction and system boundary. Build a clause/version/effective date table, retaining older wording and supersession evidence.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 1-2 active days after complete instruments arrive
Remaining uncertainty: Full current code, intervening orders and actual Board jurisdiction are not yet approved.
Initial Evidentiary Records to Gather
- Full code/source notes
- later Register items
- utility charter
- tariff/franchise and relevant BPU orders.
Closure acceptance: Compliance/legal signs the actual jurisdiction and source currency matrix; every included/excluded clause has a supported basis.
Draft question for discussion; not sent: For each named utility/entity and facility, which current 14:3-6.7 provisions and later BPU orders govern, and what instrument supports each inclusion or exclusion?
Sources: NJ01 NJ02 NJ14 NJ15
NJ-Q02 WQAA guidance conflict | Water
Workstreams: Client preparation; Interpretation
Source verification: Partially verified: reviewed enacted text separates prompt reporting and agency audit timing; uses more than 500 connections
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Written regulator clarification + legal decision
Responsible role: Legal/incident lead
Needed before: Before approving reporting tree
Next action: Place exact enacted 58:31-4.2 and current DEP/NJCCIC guidance side by side; isolate prompt reporting versus 30-day audit language and more than-500 versus 500-or more screening. Draft a focused question without sending it.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 2-4 active hours for a precise clarification pack; external response unknown
Remaining uncertainty: Current agency guidance and any additional controlling authority need reconciliation; actual system facts and recipients remain engagement-specific. The reviewed statutory wording is not marked unknown.
Initial Evidentiary Records to Gather
- Exact statute/guidance versions
- responsible recipient instructions
- system classification and independently supported connection count.
Closure acceptance: Retain the verified textual subanswers. Qualified legal review reconciles controlling current authority and actual facts. Seek written clarification only for a material interpretation that remains unresolved; a regulator reply is not a universal prerequisite for preparation.
Draft question for discussion; not sent: For 58:31-4.2, please reconcile prompt employee awareness reporting with the DEP 30-day summary and distinguish the separate agency audit clock. Which enacted provision supports coverage at exactly 500 connections, and which recipients/channels apply?
Sources: NJ03 NJ04
NJ-Q03 WQAA implementation and filings | Water
Workstreams: Library research; Client preparation
Source verification: Further operative source review required
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Public instructions + operator evidence
Responsible role: Water compliance
Needed before: Before certification support
Next action: Obtain current NJCCIC program, portal/form/signatory instructions and insurance standards. Reconcile actual framework final publication/revision date, controls assessment and submission receipts.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 0.5-1 active day, plus utility collection time
Remaining uncertainty: Current portal/signatory instructions, applicable insurance standards, framework timing and actual filing evidence are missing. Collection need not await a Q02 response.
Initial Evidentiary Records to Gather
- Current official instructions/forms
- entity/signatory facts
- actual framework/version
- membership, filing and insurance records.
Closure acceptance: Water compliance owner approves a complete filing/recipient/receipt matrix and the framework change calendar from actual dates.
Draft question for discussion; not sent: Which current program, framework version, publication/revision dates, signatory rules, portal/form and adopted insurance standards apply to this purveyor, and can the owner supply submission receipts and policy evidence?
Sources: NJ03 NJ04
NJ-Q04 Biannually | All covered utilities
Workstreams: Interpretation
Source verification: Review relevant authenticated basis for this engagement
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Written BPU interpretation
Responsible role: Utility compliance
Needed before: Before closing training criterion
Next action: Locate the exact awareness program review phrase and any later authoritative interpretation. Ask whether biannually means twice per year or every two years in this order. Keep interim management practice separately labeled.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 1-2 active hours to prepare question; response unknown
Remaining uncertainty: No authoritative interpretation of biannually has been authenticated.
Initial Evidentiary Records to Gather
- Original signed order
- later orders/correspondence
- actual training review history and documented interim decision.
Closure acceptance: Written authoritative interpretation or a legally reviewed limitation remains attached; do not close from dictionary preference.
Draft question for discussion; not sent: For the awareness program review provision in order AO16030196, does biannually mean twice each year or once every two years? Please identify any controlling later order or written interpretation and its effective application.
Sources: NJ01
NJ-Q05 Privacy codification | Covered utility/customer processing
Workstreams: Library research; Client preparation
Source verification: Further operative source review required
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Public research + privacy counsel
Responsible role: Privacy counsel
Needed before: Before privacy criteria sign off
Next action: Authenticate current statute, any final 13:45L adoption, Register history, effective/compliance dates and amendments. Separate proposals from enacted duties and actual governmental/processing exemptions.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 1-2 active days once full operative instruments are accessible
Remaining uncertainty: Enacted privacy duties and actual exemptions need current-history review; final 13:45L adoption has not been authenticated.
Initial Evidentiary Records to Gather
- Current statute/rule/source notes
- filed adoption if present
- entity and personal data processing map
- contracts and supported exemption analysis.
Closure acceptance: Privacy counsel approves current clause level criteria and entity/processing coverage; unresolved access is disclosed and not called nonadoption.
Draft question for discussion; not sent: What filed adoption, Register citation, complete current 13:45L text and effective/compliance dates exist, if any, and which entity/processing exemptions actually apply to this utility?
Sources: NJ06 NJ07 NJ09 NJ25 NJ15
NJ-Q06 Utility chemical/process safety coverage | Utility chemical/process interfaces
Workstreams: Client preparation
Source verification: Review relevant authenticated basis for this engagement
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Facility evidence + process safety specialist
Responsible role: Process safety/legal
Needed before: Before utility process safety criteria approval
Next action: Collect actual chemicals/mixtures, quantities and process boundaries; calculate coverage under current TCPA, incorporated federal RMP and PSM independently, including public worker jurisdiction. Reconcile conflicting or stricter state provisions.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 1-3 active days after complete inventory and rules; physical program audit separate
Remaining uncertainty: Actual chemicals, quantities, process boundaries and current incorporation/exemptions determine coverage; no engineering program audit has been performed.
Initial Evidentiary Records to Gather
- Inventory/SDS
- quantity and process calculations
- current state/federal clauses and compliance dates
- registrations, consent orders and approved program records.
Closure acceptance: Qualified process safety/legal reviewers sign the actual coverage and incorporation matrix; no cyber only certificate substitutes for the safety program.
Draft question for discussion; not sent: For each listed utility process and maximum intended inventory, which TCPA, RMP and PSM provisions apply, what calculation and current incorporated version support that result, and who has public/private worker jurisdiction?
Sources: NJ20 NJ21 NJ22 NJ23 F06 F07
NJ-Q07 Wastewater operative criteria | Wastewater
Workstreams: Library research; Client preparation
Source verification: Further operative source review required
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Permit specific records + current law
Responsible role: Permit owner/legal
Needed before: Before approving reporting tree
Next action: Obtain complete current NJPDES permit and modifications, local/receiving treatment works conditions, current 6.10 text and channels. Build separate event category and follow up branches from actual clauses.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 1-2 active days per representative permit after collection
Remaining uncertainty: Actual permit conditions, modifications, receiving-treatment-works obligations and independent clocks remain unknown.
Initial Evidentiary Records to Gather
- Complete permit/modifications
- discharge/process and DTW facts
- approved emergency contacts
- current forms
- past notice/receipt samples.
Closure acceptance: Permit owner/legal approves a clause linked trigger/clock/channel table with each independent duty retained and actual receipt evidence.
Draft question for discussion; not sent: Please provide the complete current NJPDES permit and modifications, local/receiving treatment works conditions, event categories and current notice channels. Which exact clauses require each immediate, oral, written and follow up notice?
Sources: NJ12 NJ24
NJ-Q08 Current controlled gas operator security criteria | Gas
Workstreams: Client preparation
Source verification: Review relevant authenticated basis for this engagement
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Controlled operator documents
Responsible role: Operator security lead
Needed before: Before gas criteria approval or applicable tests
Next action: Have the actual operator establish designation and provide controlled current TSA instruments, amendments and approved plans through its authorized repository. Record version and access authority without copying SSI into public assets.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 0.5-1 active day for secure index/review plan; authorized access time unknown
Remaining uncertainty: Designation, current controlled directives, approved plans, amendments and permitted review access are operator-controlled.
Initial Evidentiary Records to Gather
- Designation/applicability evidence
- controlled instrument index
- approved plan/version
- amendments
- authorized specialist access and handling rules.
Closure acceptance: Authorized operator compliance/security reviewer confirms scope, versions and permitted audit access; public old directives alone cannot close the gap.
Draft question for discussion; not sent: Through the operator’s authorized security repository, can the designated owner confirm current TSA applicability, exact directive/amendment versions, approved plan and authorized reviewer access/handling restrictions? Do not send SSI through public forms.
Sources: F09 NJ01 NG06
NJ-Q10 Local and bistate instruments | All; facility dependent
Workstreams: Client preparation
Source verification: Review relevant authenticated basis for this engagement
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Facility/local/bistate records + legal research
Responsible role: Facility/legal/PM
Needed before: Before final facility scope approval
Next action: Create one inventory per legal entity and site: municipality/county, authority/compact, franchise, permits, contracts, consent orders, emergency/insurance duties. Search only the actual jurisdictions and obtain signed/current documents.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 1-2 active days for initial inventory; grows with sites and instruments
Remaining uncertainty: No generic statewide library can establish every actual local, authority, compact, permit or contract duty.
Initial Evidentiary Records to Gather
- Entity/site IDs
- charters/compacts
- permits
- local ordinances
- tariffs/franchises
- contracts
- insurance and emergency plan records.
Closure acceptance: Legal and facility owners approve the site specific applicability/notice matrix, exclusions and search boundaries; do not claim every local rule was covered generically.
Draft question for discussion; not sent: For each legal entity and site, which municipality/county, authority or compact, franchise, permit, consent order, contract, insurance and emergency plan instruments govern, and who can supply the signed current versions?
Sources: NJ05 NJ12
NJ-Q11 Assurance basis and auditor appointment | All
Workstreams: Engagement governance
Source verification: Review relevant authenticated basis for this engagement
Applicability: Engagement purpose and basis must be agreed
Evidence collection: Actual engagement documents prepared with client
Acceptance: Sponsor and qualified engagement lead approval required
Route: GDF/client engagement decision
Responsible role: Engagement sponsor/GDF
Needed before: Before fieldwork
Next action: Agree objective, users, audit/assurance basis, period, criteria, competence, independence, deliverables and limitations. Obtain actual regulator direction/appointment where required. Define examiner/reviewer responsibility and safety authority.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 0.5-1 active day to scope and document; approval time unknown
Remaining uncertainty: Intended assurance, audit basis, appointment, independence, competence and safe methods require an actual engagement decision.
Initial Evidentiary Records to Gather
- Signed engagement/scope
- qualifications and independence record
- actual regulator direction
- ROE
- reporting and secure evidence agreement.
Closure acceptance: Sponsor and qualified GDF lead approve the engagement and fieldwork gates; preparation materials are never treated as an appointment or completed statutory audit.
Draft question for discussion; not sent: What decision will the audit support, for whom and for which period? Which criteria and assurance basis are agreed; is a regulator directed independent audit or appointment required; and who approves independence, evidence access and safe fieldwork authority?
Sources: NJ03 F04 F05
NJ-Q12 Other actual federal/contract duties | All; federal/operator dependent
Workstreams: Library research; Client preparation
Source verification: Further operative source review required
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Public status research + entity/contract records
Responsible role: Sector legal/compliance
Needed before: Before final criteria approval
Next action: Check actual published final CIRCIA text, effective date, coverage and any operative exceptions; pending OIRA review is not final law. Separately resolve actual nuclear licenses, federal/operator and contract duties.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 0.5-1 active day for initial federal/contract screen
Remaining uncertainty: Federal/operator/contract coverage remains fact-specific. The pending OIRA record is not proof of an operative final CIRCIA duty or of no later publication.
Initial Evidentiary Records to Gather
- Federal Register/CISA instruments and effective dates
- actual licenses, operator designation, contracts and qualified specialist decisions.
Closure acceptance: Current dated legal status matrix and independent applicable obligations approved; future/watchlist items remain separate from currently due duties.
Draft question for discussion; not sent: Which actual federal licenses, registrations, operator designations and contracts add obligations? Before any CIRCIA conclusion, what published final instrument, effective/compliance date and coverage analysis support it?
Sources: F13 F09 NJ01 NG06 F16
NJ-Q13 Native and accessibility acceptance | All tool users
Workstreams: GDF product acceptance
Source verification: Review relevant authenticated basis for this engagement
Applicability: GDF must define intended support and conformance scope
Evidence collection: GDF native/client/accessibility acceptance evidence pending
Acceptance: Product acceptance pending; not a client compliance issue
Route: Native client, usability and accessibility acceptance
Responsible role: GDF product QA and qualified accessibility reviewer
Needed before: Before distribution for field use
Next action: GDF defines the supported Excel/browser/printing and assistive technology matrix, then records actual task based native and expert/manual acceptance, defects and retests. Keep client specific acceptance separate. Automated/browser readback does not close native or conformance work.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 2-3 active days for a scoped pilot, then remediation according to actual findings
Remaining uncertainty: Native Excel, printers, representative assistive technology and defined-scope expert accessibility acceptance remain outstanding.
Initial Evidentiary Records to Gather
- Agreed client/browser/AT matrix
- representative users and tasks
- unchanged artifact hashes
- pass/fail evidence
- defects and retests
- expert accessibility review.
Closure acceptance: Recorded task based acceptance with intended users and actual clients; any conformance claim is limited to a defined, assessed scope. Automated checks alone are insufficient.
Draft question for discussion; not sent: Which Excel/client, browser, printer, assistive technology and user combinations are actually required, what conformance target applies, and who will execute and approve the representative task based acceptance evidence?
Sources: F04 F17
NJ-Q14 AMI implementation instruments | Electric/EDC and actual third parties
Workstreams: Library research; Client preparation
Source verification: Further operative source review required
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Public Board instruments + EDC implementation records
Responsible role: EDC compliance/data owner
Needed before: Before AMI criteria acceptance
Next action: Locate the actual 14:5-10.6(b) implementation order/process/list, common release form and semiannual filing instructions. Obtain actual EDC implementation, authorization/revocation and reporting records. Do not infer missing approval from unsuccessful search.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 1-2 active days after orders and EDC records are obtained
Remaining uncertainty: Actual implementing Board order, approved recipients/list, common form, EDC implementation and filing dates have not been authenticated.
Initial Evidentiary Records to Gather
- Current Board order/list
- common form/version
- EDC instructions
- AMI data lineage
- consent and recipient records
- metrics and receipts.
Closure acceptance: EDC compliance/data/privacy owners approve source and implementation crosswalk; approved recipients and filing dates are evidenced.
Draft question for discussion; not sent: For 14:5-10.6(b), what current implementing order, eligibility/approval process, recipient list, common customer release form and semiannual filing instructions govern this EDC? Please identify current versions and effective dates.
Sources: NJ16
NJ-Q15 Environmental and water source reconciliation | Water/wastewater and conditional utility facilities
Workstreams: Library research; Client preparation
Source verification: Further operative source review required
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Current law + actual permits/environmental facts
Responsible role: Environmental/water specialist
Needed before: Before reporting and fieldwork approval
Next action: Obtain omitted 7:1E appendices and later amendments; reconcile current water/environmental rules, chemical/capacity exceptions and actual approved plans. Keep reporting scope distinct from major facility plan coverage.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 1-2 active days for source reconciliation after collection
Remaining uncertainty: Complete appendices, current histories, actual capacity/chemical facts and approved environmental plans require specialist reconciliation.
Initial Evidentiary Records to Gather
- Current complete rules/appendices and histories
- storage capacities/chemicals
- actual permits and approved DPCC/DCR, water and emergency plans.
Closure acceptance: Environmental/water specialist approves exact clauses, facts and independent notice duties; courtesy copy retrieval alone does not close applicability.
Draft question for discussion; not sent: Please provide complete 7:1E Appendices A/B, intervening amendments, current water/environmental rules and this site’s capacities, permits and approved DPCC/DCR/emergency plans. Which reporting duties apply independently of major facility plan coverage?
Sources: NJ18 NJ19 NJ24 NJ26
NJ-Q16 2027 implementation calendar | Water/electric/gas as applicable
Workstreams: Library research; Client preparation
Source verification: Further operative source review required
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Public future instruments + implementation facts
Responsible role: PM and sector compliance
Needed before: Before approving future duty schedule
Next action: Verify supplier freeze wording at the exact boundary date, operative PJM/FERC Order 2222 implementation instrument and actual water loss audit scope/method. Separate effective date, compliance date and operator project milestone.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 0.5-1 active day after governing schedules are authenticated
Remaining uncertainty: Supplier-freeze boundary wording, actual PJM/FERC milestone and water-loss-audit coverage/method are not approved scheduling inputs.
Initial Evidentiary Records to Gather
- Final instruments, current PJM/FERC tariff/order schedule and EDC program, actual water system scope and planned projects.
Closure acceptance: PM and sector compliance approve a versioned current/future duty calendar with an explicit calculation basis and no invented deadline.
Draft question for discussion; not sent: Which final instrument fixes each 2027 supplier freeze boundary, current PJM/FERC Order 2222 implementation milestone and applicable water loss audit method/date? Is the date an effective date, compliance deadline or internal project milestone?
Sources: NJ16 NJ17 NJ19
NJ-Q17 DER/CIAP operative status and measurement | Electric/EDC
Workstreams: Library research; Client preparation; Interpretation
Source verification: Partially verified: Board readoption approval; filed current text and implementation remain
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Public readoption history + implementation + clarification
Responsible role: EDC compliance/legal and platform owner
Needed before: Before CIAP criteria acceptance
Next action: Use QX25080483 minutes and June 2026 final publication as leads to the filed Chapter 14:8 readoption. Obtain full current chapter, later orders and tariffs. Separately obtain actual CIAP deployment and clarify EST/daylight saving, availability window and measurement rules.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 1-2 active days for history and matrix; platform clarification time unknown
Remaining uncertainty: Board approval of readoption is verified; filed history/current chapter, actual CIAP implementation and EST/daylight-saving measurement remain open.
Initial Evidentiary Records to Gather
- Filed readoption/effective history
- current chapter
- orders/tariffs
- actual platform/developer agreements
- uptime/time zone and exception evidence.
Closure acceptance: Legal/EDC/platform reviewers reconcile operative history and actual measurement rules. New minutes/expiration corroboration may close only a subquestion, not the whole criterion.
Draft question for discussion; not sent: For QX25080483, what filed readoption notice/current 14:8 text and later implementation orders govern? For CIAP availability, is stated EST fixed standard time or local civil time, and what window, denominator, maintenance exclusions and outage evidence govern measurement?
Sources: NJ14 NJ27 NJ28 NJ29
NJ-Q18 Complete current NJ gas rules and jurisdiction | Gas
Workstreams: Library research; Client preparation
Source verification: Further operative source review required
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Current consolidated law + operator jurisdiction
Responsible role: Gas compliance/legal owner and qualified pipeline safety specialist
Needed before: Before gas criteria approval and any field method authorization
Next action: Obtain current full 14:6 and 14:7, later changes and incorporated federal editions. Resolve legal operator, OPID, interstate/intrastate and distribution/transmission/gathering/storage/LNG functions with specialists. Crosswalk selected adopted clauses to current text.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 1-2 active days after complete code/operator records arrive
Remaining uncertainty: Complete current 14:6/14:7 and actual operator/function jurisdiction are not authenticated; amending pages omit unchanged provisions.
Initial Evidentiary Records to Gather
- Current full chapters/source notes
- actual orders/jurisdiction instruments
- OPID/operator maps
- functions
- permitted specialist access.
Closure acceptance: Qualified gas compliance/legal and pipeline safety reviewers approve clause level scope and current history. Final amending pages are not treated as a complete current rulebook.
Draft question for discussion; not sent: Please provide complete current Chapters 14:6/14:7, source notes and later orders, and confirm the legal operator, OPID, interstate/intrastate status and distribution/transmission/gathering/storage/LNG functions with supporting jurisdiction records.
Sources: NG01 NJ14 NG06
NJ-Q19 Current federal gas definition, reporting and CRM detail | Gas
Workstreams: Library research; Client preparation
Source verification: Partially verified: 2026 monetary notice and identified instructions; complete definition/reporting/CRM review remains
Applicability: Client/entity determination required
Evidence collection: Client records requested at engagement start; no named client deficiency inferred
Acceptance: Qualified engagement review required; no outcome inferred
Route: Public federal criteria + operator records + licensed standards
Responsible role: Pipeline compliance owner with legal and control room specialists
Needed before: Before gas reporting decision tree, calendar approval or an audit conclusion
Next action: Use the verified 2026 monetary notice and current identified instructions, then authenticate complete Part 191 definitions, exclusions, asset specific report sections/forms and actual 192.631 full/limited paragraph scope and timing. Obtain incorporated standards lawfully and retain licensed access/version.
Dependencies and coordination: Collect in parallel. Block only the decision or method that requires a missing source, fact or permission.
Active effort estimate: 1-2 active days for public instruments; specialist/operator access additional
Remaining uncertainty: The adjusted monetary threshold and identified 2026 instructions are supported. Complete definitions/exclusions, function-specific reporting and CRM paragraphs/standards still need review.
Initial Evidentiary Records to Gather
- Current complete rule/history
- official annual threshold notice
- asset specific current forms/instructions
- CRM functions, service/compressor facts and actual program records
- licensed incorporated standards.
Closure acceptance: Pipeline compliance/legal and CRM reviewers approve each trigger, form, scope and calendar paragraph. Threshold only verification must not mark the entire gap resolved.
Draft question for discussion; not sent: For the actual gas facilities, what current Part 191 clauses, exclusions, asset specific forms and 192.631 full/limited paragraph duties apply? Please supply service/compressor/controller facts and lawful access to each incorporated standard. Keep controlled TSA review separate under Q08.
Sources: F14 NG02 NG03 NG04 NG05 NG07 NG08 F09
Retain the exact operative clause/version, actual entity/site/period, applicability facts, evidence and provenance, method and sample rationale, conflicting evidence, decision, scope limitation, named preparer/reviewer and approval date. An interim precaution or documented limitation does not resolve a legal ambiguity. Never upload controlled operator material or secrets to a public form.
