Solution overview: Karta's NERC Compliance Management Solution

INTEGRATED RISK MANAGEMENT

Karta NERC Compliance Management Solution

kartacorp.com

We transition electric utilities to software that automates NERC O&P & CIP compliance programs Common NERC compliance management challenges Errors inherent in manual data entry Knowledge gaps when staff depart Onerous second job for field staff Rushed audits halt higher-value work and cause stress Misplaced or disorganized NERC evidence— especially when managing multiple facilities

Inefficient use of time on menial, manual tasks Failed audits resulting in expensive fines and reputation loss Lack of timely, accurate reporting for compliance decision-making Keeping up with/preparing for new NERC standards

How the Karta solution helps Workflows assign/track tasks to completion or escalation, ensuring no task is missed Reduces the impact of staff turnover by managing evidence and processes in a central system Integrates compliance into daily routines via email requests/reminders Facilitates less stressful, higher quality audit preparation by organizing NERC evidence so it can be easily referenced on-premise, in the cloud or both Produces timely, customized reports for compliance decision-making Provides dashboards for key compliance status metrics and potential non-compliance alerts Ensures the timely adoption of new NERC standards before their enforcement dates via quarterly updates to the NERC standards library

1

Dashboards alert you to changes to NERC regulatory standards Includes: Quarterly updates tracking all NERC regulatory standards changes Automatic updates to the NERC standards in the Karta NERC Compliance Management Solution The NERC content library provides dashboards displaying the NERC standards subject to future enforcement or inactivation By request: Complete workflows to start the implementation of new standards before the enforcement date

Additional IRM solutions When the need arises, the platform easily add other pre-built solutions, such as:

THIRD-PARTY SUPPLY CHAIN RISK MANAGEMENT

ENTERPRISE RISK MANAGEMENT

POLICY MANAGEMENT

BUSINESS RESILIENCY

ESG

EMERGENCY PREPAREDNESS

REGULATORY & CORPORATE COMPLIANCE

IT & SECURITY RISK

2

Purpose-built for NERC compliance

Purpose-built for NERC compliance

1

CREATION OF APPLICABILITY COLLECTIONS FOR RESPONSIBLE ENTITIES

2

INTERACTION WITH EACH REQUIREMENT

Control Procedures

Standards

Testing & Findings

Responsible Entities Working Requirements

3

EASY ACCESS TO INFORMATION FROM DIFFERENT SOURCES IN AN EVIDENCE REPOSITORY

4

CREATION OF AUDIT SUMMARIES SUCH AS RSAWS Applicability Collection Working Requirements

Compliance Summaries

Procedures Assessments

6

MANAGING NEW & RETIRING NERC STANDARDS

2 Remediation Plan

Tasks

1 Findings

5

CREATION OF REMEDIATION PLANS BASED ON FINDINGS

Old New

3 3

IRM/GRC ecosystem expansion opportunities This solution is built on two industry-leading GRC/IRM platforms, Archer IRM and Onspring. The modularity of both platforms means we can integrate the solution with many use cases, including but not limited to these:

THIRD PARTY GOVERNANCE CIP-013-2: Cyber security, supply chain risk management CIP-011-2: Cyber security, information protection CIP-005-6: Cyber security, electronic security perimeter(s) FAC-014-2: System operating limits methodology for the planning horizon

REGULATORY & CORPORATE COMPLIANCE MANAGEMENT CIP-003-8: Security management controls CIP-008-6: Incident reporting and response planning CIP-009-6: Recovery plans for BE cyber systems CIP-013: Supply chain risk management PER-005-2: System personnel training PRC-005-6: Protection system maintenance & testing EOP-004-4: Event reporting PRC-019-2: Coordination of generating unit or plant capabilities, voltage regulating controls & protection PRC-024-3: Generator frequency & voltage protective relay settings

ENTERPRISE & OPERATIONAL RISK MANAGEMENT CIP-002-5.1a: BES cyber system categorization CIP-003-8: Security management controls CIP-008-6: Incident reporting & response planning PER-005-2: System personnel training EOP-004-4: Event reporting

AUDIT MANAGEMENT Risk-scoped audits Streamlined issue management Audit consistency Proactive audit planning

IT & SECURITY RISK MANAGEMENT CIP-002-5.1a: BES cyber system categorization CIP-003-8: Security management controls CIP-008-6: Incident reporting & response planning CIP-009-6: Recovery plans for BES cyber systems CIP-011-2: Information protection EOP-004-4: Event reporting EOP-008-2: Loss of control center functionality PRC-005-6: Protection system maintenance & testing

RESILIENCE MANAGEMENT CIP-008-6: Incident reporting & response planning CIP-009-6: Recovery plans for BES cyber systems CIP-014-2: Physical security EOP-004-4: Event reporting EOP-005-3: System restoration from black start resources EOP-011-2: Emergency operations PRC-023-4: Transmission relay loadability

More about these solutions

kartacorp.com\ecosystem

4

Tenable OT Security CIP-002-5.1a: Discover & maintain an updated inventory of OT devices CIP-003-8: Unauthorized OT environment activities CIP-004-6 R4& R5: Unauthorized access attempts or suspicious changes CIP-008-6: Cybersecurity threats through proactive monitoring, audit trail insights & forensic support CIP-005-6 R2: Monitor remote access alert for potential perimeter breaches CIP-006-6: Detects changes made to controllers through direct physical access CIP-007-6: Rule-based anomaly detection & open port issues

CIP009-6: Recovery planning, execution & testing CIP-010: Configuration change management & vulnerability monitoring

RSA Security CIP-004: Access control using 2FA/MFA + rolebased access control CIP-007: Strong user authentication CIP-005: Secure remote access

More about these solutions

kartacorp.com\ecosystem

Achieve NERC complience excellence Karta’s NERC solution is built on two exceptional IRM software platforms which are trusted by hundreds of large enterprises worldwide, including government and utility clients in North America to help manage multiple dimensions of risk in a single platform.

STRATEGIC PARTNERS WITH

5

Expertise This solution was developed in collaboration with utility industry experts. and is continuously expanded and upgraded with help from our partners at Ampere Industrial Security and Archer Energy International.

You can count on efficient solution fulfillment thanks to delivery by a talented team of IRM experts with combined decades of configuration and project management experience. Our numerous implementations and deep understanding of the utility sectors mean we get your regulatory environment, challenges and corporate culture.

Jonathan Kitchin

Glenn Coker

Angelo Capone

Frances Bierman

Vice President of Solutions and Service Delivery

Director of Sales

Sr. Service Delivery Manager IRM Consultant

Project Manager

Alexandre Cormier

Ryan Kartavicius

Patrik Miller

Stacy Bresler

IRM Consultant

IRM Consultant

CEO, Ampere Industrial Security

Managing Partner Archer Energy Solutions

6

Karta Ascend: helping you traverse risk You deal with enough risk in a day—let’s take your IRM program off that list. Here’s how we deliver great IRM solutions on time and on budget, every time. This experiencedbased formula is called Karta Ascend. Take a look:

PROVEN PROCESS Our rigorous, time-tested service delivery model ensures your business requirements are understood, your team is involved in the process at every step, and your project is completed on time and on budget.

CURATED IRM SOLUTIONS Weeding through dozens of IRM solutions can take hundreds of hours.

We have cut through the noise and chosen the best for you: Onspring. A core part of our process is guiding your team to select a platform that will serve you well today and in the future.

CLARITY We work hard to ensure you have complete clarity from start to finish.

From clear deliverables to frequent reporting, you'll always know what's happened and what's coming next.

DEEP TECHNOLOGY EXPERTISE There’s no substitute for knowledge and experience. Honed over 20+ years and countless projects, our approach is highly collaborative and efficient.

We only assign seasoned consultants to your projects and maintain expertlevel product knowledge through ongoing training and certifications.

GOOD PEOPLE We're a team of down to earth people who genuinely care about the success of your solution. But don't take our word for it—read our case studies and the unsolicited testimonials shared on our website.

7

Get started

Request a live personalized demo Get a close look at Karta’s NERC Compliance Management Solution and have your questions answered live

EMAIL US

Speak with a solution specialist USA (770) 631-5988 CAN (416) 342-0813

kartacorp.com

231106