Entity and authority map
Record the entity, PSC status, registrations, contracts and responsible compliance owner.
New York / assessment and evidence preparation
New York power and energy cybersecurity assessments
Resources prepared October 27, 2026
Plan utility IT and OT evidence reviews with New York authority scoping, power-sector preparation checklists and free downloadable records.
Get a free consultation
Separate utility IT, plant OT and electricity-sector requirements
Determine the entity and asset boundaries before combining utility IT records, operational systems and electricity-sector requirements. A distribution system, DER operator, generator and BES-related entity do not automatically have the same obligations.
PSC adopted 16 NYCRR Part 1200 in Case 25-M-0302. Its definitions, exclusions and phase-in provisions matter. Utility IT requirements and applicable NERC CIP obligations are different scopes; neither is a universal requirement for every power or energy organization.
Start with the company and asset functions, the applicable authority or contract, and the current version and effective date. Do not presume that municipal, investor-owned, generation, distribution and DER organizations have the same coverage. The preparation record should retain unresolved authority questions for the responsible professionals.
Prepare the power and energy evidence package
Use the two-page guide to prepare a scoping meeting and the editable checklist to assign owners and record source references. The browser planner exports a working status record locally, without collecting infrastructure details.
IT, OT and BES scope
Prepare a controlled asset/function map distinguishing business IT, plant OT and any applicable BES scope.
Risk and consequence record
Gather risk assessments and dependencies affecting service, safety, customer information and recovery.
Access and third-party paths
Gather identity records, vendor pathways, approvals and privileged-access settings.
Tie the review to operating consequence
A technical review should connect account and vendor access, configuration changes, network boundaries, logging reach and recovery dependencies to the service at risk. Findings need an owner, a documented risk decision and verification that addresses the original condition. Records from IT and OT are correlated only within the agreed scope and available evidence.
GDF plans technical work with operations and engineering. Passive records and controlled replicas are considered before live interaction. Any active production work needs operator approval, device-specific review, stop conditions and a recovery plan. No checklist authorizes access or testing.
NERC CIP evidence has its own applicability path
Where relevant, the organization and its compliance professionals establish registration, asset categorization, applicable standard versions and required evidence. GDF NERC CIP technical evidence support helps structure the record within that scope. It is separate from an official audit, certification or regulator determination. DOE distribution and DER baselines provide useful implementation resources without making every energy system subject to the same rule.
Plan the next controlled step
OT and SCADA assessment · Passive-first asset discovery · Segmentation validation · All preparation resources
- PSC adopted utility IT cybersecurity regulations, Case 25-M-0302, April 17, 2026 (opens a new tab)
- DOE cybersecurity baselines for electric distribution systems and DER (opens a new tab)
- NERC Critical Infrastructure Protection standards (opens a new tab)
Define the power-sector review boundary
Bring the entity and asset scope, relevant authority and operating constraints to the first discussion. Do not submit evidence through the public form.