ServingNew York, New Jersey, and Connecticut
24/7 incident response212-561-5860Contact GDF

New York / assessment and evidence preparation

New York cybersecurity audit preparation

Resources prepared October 27, 2026

NYDFS, drinking-water, wastewater and power-sector preparation tools, evidence checklists and free downloads for New York organizations.

Get a free consultation
The preparation record links scope and control questions to evidence, exceptions and corrective verification.
The preparation record links scope and control questions to evidence, exceptions and corrective verification. View full-size diagram (opens in a new tab)

Start with the work your organization needs

Financial-services review, drinking-water assessment, wastewater preparation and power-sector evidence have different authorities and records. Choose the closest preparation track, then have the responsible professionals confirm the actual scope. These original GDF worksheets are preparation aids, not government forms, a complete control catalog or a compliance opinion.

NYDFS

NYDFS Part 500 evidence preparation

Start with the covered entity, review period, exemption analysis and accountable officers. This worksheet organizes technical records for a professional review. It does not decide applicability, certify compliance or replace an independent audit.

Drinking water

New York drinking-water cyber assessment preparation

Build a preparation record for the actual drinking-water system and its operating constraints. Determine the relevant DOH system tier and current instructions before selecting a deadline or signing a statement. Keep sensitive engineering and vulnerability records in the operator's approved repository.

Wastewater

New York wastewater cybersecurity preparation

Separate permit-wide incident reporting, POTW control requirements and individual operator training. Keep the facility, design flow, permit and responsible municipal authority attached to the preparation record. The operator retains process and safety authority.

Power and energy

New York power and energy cyber audit preparation

Determine the entity and asset boundaries before combining utility IT records, operational systems and electricity-sector requirements. A distribution system, DER operator, generator and BES-related entity do not automatically have the same obligations.

Turn the checklist into a usable evidence record

  1. Define. Record the entity, review period, asset boundary, operating authority and open applicability questions.
  2. Gather. Use the PDF to prepare the discussion and the CSV to record owners, evidence references and gaps.
  3. Review. Distinguish a located document from a tested control. Retain exceptions and missing records.
  4. Validate. Agree a technical review or safely controlled test plan with the people authorized to act.

The browser planner keeps status choices in the current page and exports them locally. It asks for no customer names, files, credentials or infrastructure identifiers. It does not scan systems, submit a filing or send the choices to GDF. Ordinary site analytics follows the existing site policy; planner choices are not added to analytics.

Download the complete preparation set

The ZIP contains four two-page guides, four editable checklists, a source register and instructions. It is available without an email gate. Store populated versions in your approved repository.

Use the existing GDF workbenches when you need more depth

For a larger utility engagement, the evestigate NY utility audit builder (opens a new tab) and NY utility authority review (opens a new tab) provide a separate, deeper workflow. NYCF focuses this entry point on New York scoping and the first evidence handoff. It does not duplicate those workbooks or imply that every authority applies.

Keep the authority and source date attached

Resource preparation date: October 27, 2026. Confirm the current complete DOH table and instructions directly for the system in scope. Guidance and deadlines can change. No agency endorsement or independent legal review is asserted.

Discuss your New York preparation scope

Identify the sector, responsible team and the records you need to assemble. Do not submit evidence through the public form.

Contact New York Computer Forensics