New Jersey utility & industrial audit preparation

Build your NJ OT audit set

Select sectors and record ownership context. Prepare the evidence, permissions, criteria and open questions needed for a GDF assessment.

Prepare a selected NJ set Audit preparation walkthrough

Illustrative water-treatment infrastructure.

Working files and reading copies

Edition NJ-OT-20261016-02. Research date: October 16, 2026.

Read the PDF manual (89 pages)

Prepare a NJ review set

Select the sectors to emphasize. Ownership and project labels are declared context, not legal applicability decisions. Utility and cross-sector screens stay included. The Criteria, Procedures, Gathering and Calendar CSVs and their reading sections follow sector choices. Reporting, sources, project gates and open questions retain the complete inventory for coverage review. The master Excel workbook and PDF retain all sectors.

Sector contextWater and wastewaterPower and energyManufacturingTransportation: surface, ports, aviation and pipelines

Declared ownership / entity contextProject label (optional; avoid sensitive details)Facility, municipality and county references (optional; secure record IDs preferred)

Your entries remain in this page session. Nothing is submitted or saved in browser storage. Downloaded files contain your entries; keep them in an approved repository.

All four sectors selected. Applicability is unresolved.

Information still needed: all collection tasks and the listed unresolved questions require review. No entity facts or evidence have been verified.

How to use the set

Use this set

This dedicated New Jersey planning set covers water and wastewater, power and energy, manufacturing, and transportation, including surface transport, ports, aviation and pipelines. It helps a sponsor, CISO, risk manager, project manager and field examiner prepare an engagement with GDF. It does not determine legal applicability, appoint GDF, certify compliance or complete an independent statutory audit.

What is covered

The set contains 74 candidate criteria records, 57 procedure starters, 42 information-gathering tasks, 7 project gates, 17 reporting-trigger records, 20 calendar starters, 42 source records and 17 unresolved questions. The criteria are a planning inventory, not a complete clause-by-clause program for every facility. Expand it from authenticated current instruments before approving an audit program.

Start with evidence, not assumptions

Identify the actual legal owner/operator, service, facility, municipality/county, systems and contracts. Water service connections and population are separate thresholds. Municipal, authority, private, public-agency, contractor and bistate status can create different duties. No selection in this page resolves those questions.

Read source limits

The Sources and Open questions sections distinguish enacted law, adopted publications, agency summaries, technical guidance and inaccessible/current-text gaps. The adopted 2026 AMI/energy amendments and selected current DEP rule copies have been reviewed. Later codification, privacy-rule status, restricted operator directives and actual permits/local instruments still require the listed resolution work. Before final conclusions, the responsible qualified reviewer must obtain them and reconcile amendments and effective dates.

GDF engagement gate

Agree the objective, intended users, report/assurance basis, criteria and period, competence and independence, deliverables, evidence handling and limitation disclosures. Any regulator-caused independent audit needs its actual trigger/direction and qualified independent engagement. This set does not claim an appointment, approval or personal technical/legal review.

Safe fieldwork

Begin with records, interviews and authorized passive observation. No discovery scan, credential test, packet injection, device connection, logic/setpoint change, interlock bypass, failover, restore or process actuation is authorized by this pack. Record asset/method-specific owner, operations, safety and vendor permission, stop authority and recovery arrangements first.

How to handle missing information

Leave applicability Unresolved until facts and authority support a decision. For every missing item record the required evidence, actual responsible person, target date, secure reference and consequence for scope. Distinguish not received, inaccessible, not tested and proposed not applicable. A proposed exclusion needs a documented basis and reviewer. TBD, pending client records or an unexplained n/a is not evidence.

Workpaper quality

For each execution record the actual examiner, collector and reviewer; criterion/objective; period; population; sample/method/rationale/limits; permission; actual times with zone; observations; evidence IDs and disposition. Check actual-date chronology manually. Future actual events, review before execution or closure before required remediation/retest must be corrected or specifically explained. No automated evidence-quality, completeness or readiness score is supplied.

Extend the workbook

The twelve-sheet master uses unprotected Excel Tables and has no macros or formulas. Append a record using the table final-row Tab key or Table Design > Resize Table. Preserve columns, use unique IDs and confirm filters, formatting and any added validations include new rows. Use child execution/evidence rows for more samples. Save a version and have another person verify the change. Native Excel/printing/assistive-technology acceptance remains an open task.

Control information

Keep working records in an approved repository. Use secure evidence references instead of raw PII, credentials, SSI, secrets or exploitable configurations. Record source, collection time/zone, collector, custody, classification and integrity method; hash when appropriate. Apply actual retention/legal hold requirements and approved secure handover. No blanket privilege or universal retention period is asserted.

Refresh before use

Research date: October 16, 2026. Edition NJ-OT-20261016-02. Record the actual current criteria publication/effective dates, later amendments, jurisdiction and source retrieval limitations before each engagement. The as-of label is not proof every cited source is fully current or substantively authenticated.

Decisions that need particular care

Water threshold

WQAA uses more than 500 service connections for an owner of a public community water system. AWIA uses more than 3,300 persons for a community water system. Exactly 500 connections is not more than 500. Wastewater-only service is not automatically covered by either water-specific screen.

Sources: NJ03 F01

Prompt water reporting

The enacted 58:31-4.2(a) requires prompt qualifying incident reporting after employee awareness. The 30-day period in subsection (b) is NJCCIC causing an audit after receipt. DEP summary guidance conflicts with that distinction. Use the statutory prompt trigger for planning, escalate immediately, and obtain written clarification. Do not grant a 30-day reporting grace period.

Sources: NJ03 NJ04

Separate clocks

NJ BPU six-hour, WQAA prompt, public-agency/qualifying-contractor 72-hour, resident breach, physical/permit and federal/operator duties can coexist. They have different triggers and coverage. The longest window does not replace an earlier applicable duty.

Sources: NJ01 NJ02 NJ03 NJ05 NJ06 NJ12

Framework and audit distinctions

WQAA names CSF, CIS Controls or ISO/IEC 27000 families, not SP 800-82 alone. NERC certification overlap does not remove every NJ utility duty. NJ TCPA annual audit guidance must not be replaced by the OSHA PSM three-year cycle. Maritime assessments, plan audits, drills, exercises and penetration tests are separate duties.

Sources: NJ01 NJ03 NJ10 F03 F06 F08

Walkthrough and project gates

M01 Initiate

Role to assign: Sponsor, legal/compliance, GDF lead
Inputs: Charters, instruments, engagement and independence
Procedure references: P01; P02
Exit condition: Agreed objective/assurance basis, accountable entity and scope; unresolved criteria named
Timing basis: Before detailed audit design

Actual owner, planned dates, status and approval evidence: record in Work plan.

M02 Gather and resolve

Role to assign: PM and criteria owners
Inputs: Checklist and Open questions
Procedure references: P01; P09; P15 to P33; P44; P45 as applicable
Exit condition: Every critical gap has an owner/evidence request; no unsourced coverage conclusion
Timing basis: Before criteria approval

Actual owner, planned dates, status and approval evidence: record in Work plan.

M03 Design

Role to assign: GDF lead and operations/safety
Inputs: Approved criteria, ROE, population/sample design
Procedure references: P02; P34
Exit condition: Named approvers authorize actual methods; stop authority and repository ready
Timing basis: Before fieldwork

Actual owner, planned dates, status and approval evidence: record in Work plan.

M04 Execute

Role to assign: Named examiners and collectors
Inputs: Actual execution and evidence records
Procedure references: P03 to P57 as individually authorized
Exit condition: Contemporaneous observations, attribution, limits and evidence quality
Timing basis: Within approved window

Actual owner, planned dates, status and approval evidence: record in Work plan.

M05 Review

Role to assign: Actual reviewer, legal/criteria specialists
Inputs: Complete workpapers and facts
Procedure references: P34; P35; P43
Exit condition: Criterion/condition/evidence/implication reconciled; missing/TBD/future dates rejected
Timing basis: Before draft report

Actual owner, planned dates, status and approval evidence: record in Work plan.

M06 Correct and retest

Role to assign: Control owner, authorized retester, closure approver
Inputs: Remediation and retest evidence
Procedure references: P35
Exit condition: Chronological actual actions; remaining risk/mandatory duty distinguished
Timing basis: Agreed dates, not invented legal deadlines

Actual owner, planned dates, status and approval evidence: record in Work plan.

M07 Handover

Role to assign: Sponsor, GDF lead and signatories
Inputs: Report, limitations, filing support, receipt
Procedure references: P14; P18; P35
Exit condition: No unsupported compliance assertion; open matters and recurring calendar assigned
Timing basis: Before engagement close

Actual owner, planned dates, status and approval evidence: record in Work plan.

Information-gathering checklist

Every item starts Not provided. Assign an actual owner, planned target, record reference and next action in the workbook. A file located for review is not evidence accepted.