Solution overview: Karta's NERC Compliance Management Solution built on Archer

Karta NERC Compliance Management solution

built on

kartacorp.com

You need clarity and actionable data to manage your NERC compliance

Karta’s NERC Compliance Management Solution is purpose-built for NERC compliance teams, workflows, and deliverables. You don’t have to worry about an ill-fitting solution to the highly specific processes of NERC. Drill down into your

Integrate NERC

Increase accountability

real-time compliance

compliance management

posture

into field staff's daily

Reduce duplication of

activities

effort

decision-making with

Decrease reactive

Facilitate secure access

accurate information

compliance work

to compliance evidence

Fuel management

from many document Prioritize & automate

Empower your team for

compliance processes

more value-add work and

across your entire

less mundane tasks

operations

sources Plan for and manage ever-changing NERC regulations

Is your company challenged in any of these areas?

Watch our two-minute video to learn how our NERC Compliance Management solution can help you.

Watch at kartacorp.com/nerc-compliance 1

Achieve NERC compliance excellence

Built on an industry-leading IRM platform Karta’s NERC Compliance Management Solution is built on the Archer Integrated Risk Management (IRM) platform. Existing Archer users will appreciate the seamless all-in-one experience, and organizations new to Archer can rest assured that this tool is built on one of the best compliance management platforms in the world.

Find us on the

From task delegation and escalation to centralized document storage and highly customizable reporting options, this invaluable tool helps ensure you're complying with today's regulations and your utility is always well-prepared for an audit.

Gartner Magic Quadrant leader Archer has been ranked as a Leader within the Gartner Magic Quadrant report for two decades in the following business management categories: IT Risk Management Solutions in 2015, 2016 and 2017 IT Vendor Risk Management in 2014, 2016 and 2017 Business Continuity Management Program Software, Worldwide in 2012, 2014, 2016 and 2017

IT Vendor Risk Management - 2021 IT Risk Management - 2020 Business Continuity Management – 2019 Integrated Risk Management - 2018 Operational Risk Management Solutions in 2014, 2015 and 2016 2

Reduce the burden of manual NERC compliance or outdated software solutions Common NERC compliance management challenges Errors inherent in manual data entry

Inefficient use of time on menial, manual

Knowledge gaps with staff changes

tasks

Onerous second job for field staff

Failed audits resulting in expensive fines

Rushed audits halt higher-value work and

and disruptive sanctions

cause stress

Lack of timely, accurate reporting for

Misplaced or disorganized NERC evidence—

compliance decision-making

especially when managing multiple facilities

Keeping up with and preparing for new NERC standards

How the Karta solution helps Curating ongoing NERC standards updates - We regularly update your NERC standard library, so teams don’t have to download and parse the standards on their own.

Maintaining your evidence repository - No more dragging and dropping email attachments to folders or hoping files follow proper naming conventions. The structured evidence repository allows teams to quickly identify what they have, what’s missing, and what can be used to address multiple requirements.

Helping teams know what to do and when - Auto-generated task and obligation management can handle complex scheduling requirements and outbound communications in the centralized platform.

Informing leadership - Aggregated dashboards across all areas allow teams to report status on-demand and provide early indicators of potential missed activities and audit concerns.

Collecting employee-reported NERC concerns & organizing for NERC self-reporting Manage investigations related to potential noncompliance of NERC standards and export investigation results into the required NERC reporting template.

3

Answer your key questions with Karta’s NERC Compliance Management solution What’s on the

Can we prove we’re doing it right?

What do I need to do today?

Where are the hot spots?

horizon?

What’s on the NERC horizon?

Karta’s NERC Compliance Management solution includes dashboards to help you visualize new and updated standards for your planning and preparation. Use these dashboards to see: Quarterly updates tracking NERC regulatory standards changes Karta-managed updates to the NERC standards in the solution NERC standards subject to future enforcement or inactivation By request: Complete workflows to start the implementation of new standards before the enforcement date

4

What do I need to do today?

For the field staff and

For the NERC Compliance

managers:

team:

Review open/overdue evidence

Initiate and review status of

requests

evidence requests

Review the calendar of recurring

Track progress of recurring task

task assignments

assignments

Re-assign tasks or reviews if

Add new assignments to the task

needed

inventory Review trends and concerns

Can we prove we’re doing it right?

Maintain your time-stamped, real-time evidence repository Automate the evidence request cycle based on NERC-mandated timelines Align evidence across multiple standards, where relevant

5

Where are the hot spots?

Receive, investigate, and assess potential areas of noncompliance Analyze trends and work distribution Assign remediation activities to address noncompliance issues and improve compliance program Track root-cause analyses and incremental improvements

Stakeholder transparency Share subject matter expert (SME) and leadership dashboards including indicators, such as: Overutilized teams for evidence collection and task assignments All requests and tasks in my department/team Upcoming deadlines In-tool collaboration & approvals history

Extensions of the solution When the need arises, you can add other pre-built solutions, which can act independently of NERC compliance or connect where it makes sense, such as:

BUSINESS RESILIENCY

SUPPLY CHAIN RISK MANAGEMENT

CONTROLS & COMPLIANCE MANAGEMENT

6

ENTERPRISE RISK MANAGEMENT

Purpose-built for NERC compliance

1

2

MANAGE EVIDENCE REQUESTS FOR ANY NUMBER OF REGISTERED NERC ENTITIES

SCHEDULE ONGOING REVIEWS AND TESTING OF YOUR COMPLIANCE NARRATIVES Compliance narrative

Standards

Testing & findings

Responsible entities Evidence request

3

4

REFERENCE YOUR KEY COMPLIANCE INFORMATION FROM A COMMON EVIDENCE REPOSITORY

VIEW A SUMMARY OF NERC COMPLIANCE FROM A COMMON DASHBOARD Compliance narratives Recurring tasks

Compliance summaries

1 2 Remediation plan

3

Remediation tasks

Issues of noncompliance

5

MANAGE REMEDIATION PLANS BASED ON ISSUES OF NONCOMPLIANCE

7

Issues of noncompliance Open remediations

Karta: A high voltage partner Our numerous implementations, deep understanding of the utility sector, and vast governance, risk and compliance (GRC) knowledge mean we get your regulatory environment, challenges, and corporate culture. Check out the power behind the Karta team below.

RIGHT-SIZED SOLUTIONS

DELIVERY

SERVING CLIENTS OF ALL SIZES, WITH EMPLOYEE TOTALS RANGING FROM

<100

TO

10K+

FLEXIBILITY

CLOUD SOLUTIONS

~7,000 HOURS OF UTILITY PROJECTS DELIVERED TRUSTED

KARTA IS ARCHER’S PREFERRED PARTNER FOR NERC COMPLIANCE

ON-PREM SOLUTIONS

featured on the

you get to decide EXPERIENCE

HAPPY CLIENTS

80+

100%

COMBINED YEARS OF TECHNOLOGY/GRC EXPERIENCE

CLIENT RETENTION

TENURE

11 years AVERAGE GRC YEARS OF EXPERIENCE FOR OUR TEAM

FOOTPRINT SUPPORTING ELECTRIC UTILITIES COAST TO COAST ACROSS THE

United States & Canada 8

Partners

A network of expertise Karta’s solution development has been bolstered by ideas and needs from our client community, as well as utility industry experts. We work closely with our partners at Ampyx Cyber and Archer Energy Solutions to ensure our software solution aligns with the needs of compliance teams just like yours.

Providers

Centralized data We collaborate with leading data providers like RiskRecon and Tenable. When you license these additional products, we can seamlessly integrate their real-time data into your NERC Compliance Management solution, providing comprehensive and up-to-date views of your operational compliance status. This enriched data empowers you to effectively identify NERC compliance risks and foster ongoing regulatory adherence.

9

One platform, many possibilities Retire and streamline from siloed, outdated technologies by integrating your key GRC workflows in a single powerful tool. Expand your GRC ecosystem by taking advantage of these other solutions and products:

Platform

Tenable OT Security

SUPPLY CHAIN RISK

License Tenable, and connect data to your platform and NERC Compliance data, including:

CIP-013: Cyber security, supply chain risk management CIP-011: Cyber security, information protection CIP-005: Cyber security, electronic security perimeter(s) FAC-014: System operating limits methodology for the planning horizon

CIP-002: Discover & maintain an updated inventory of OT devices CIP-003: Unauthorized OT environment activities CIP-004: Unauthorized access attempts or suspicious changes CIP-008: Cybersecurity threats through proactive monitoring, audit trail insights, & forensic support CIP-005: Monitor remote access alert for potential perimeter breaches CIP-006: Detects changes made to controllers through direct physical access CIP-007: Rule-based anomaly detection & open port issues CIP-009: Recovery planning, execution, & testing CIP-010: Configuration change management & vulnerability monitoring

RECOVERY & RESILIENCE CIP-008: Incident reporting & response planning CIP-009: Recovery plans for BES cyber systems CIP-014: Physical security EOP-004: Event reporting EOP-005: System restoration from black start resources EOP-011: Emergency operations PRC-023: Transmission relay loadability

RiskRecon by Mastercard

IT & SECURITY RISK CIP-002: BES cyber system categorization CIP-003: Security management controls CIP-008: Incident reporting & response planning CIP-009: Recovery plans for BES cyber systems CIP-011: Information protection EOP-004: Event reporting EOP-008: Loss of control center functionality PRC-005: Protection system maintenance & testing

License RiskRecon, and connect data to your platform and NERC Compliance data, including: CIP-013: Cyber security, supply chain risk management

ENTERPRISE & OPERATIONAL RISK CIP-002: BES cyber system categorization CIP-003: Security management controls CIP-008: Incident reporting & response planning PER-005: System personnel training EOP-004: Event reporting

Learn more about these solutions

kartacorp.com/ecosystem

CONFIGURATION CHANGES CIP-007: Vulnerability monitoring & remediation CIP-010: Configuration change management

10

Had Karta just delivered us a solution with no opportunity to iterate, or discover and implement new requirements, we may not have had such a smooth rollout.

We’re thrilled to be working with you and your team. It was obvious you all are accustomed to delivering top quality work products tailored to the customers’ processes, and even helping the customers where those processes are fully formed. Karta will up our game!

Director, NERC Compliance

Director, NERC Compliance

I wanted to pass along my compliments and a huge appreciation shout-out for your team’s effort to get our “CIP Compliance Management” over the finish line. Establishing [the platform] as an approved CIP repository was a goal for my team, and you were available to address any concerns with establishing “CIP Orders” and working with my team and IT to ensure that the data was imported correctly (i.e., due dates) into “CIP Compliance Management.” You have been very helpful with validating our access matrix and ensuring our employees are set up correctly. Thanks again for the support!

NERC Compliance Manager

11

CONNECT WITH US

kartacorp.com 241031