Karta's NERC Compliance Management Solution, Built on Onspring

INTEGRATED RISK MANAGEMENT

Karta NERC Compliance Management Solution built on

kartacorp.com

A solution to address your NERC compliance management

A purpose-built NERC compliance management solution Designed expressly to make NERC compliance easier, quicker and more cost-effective

Drill-down visibility into

Integrate NERC

Increase accountability

your compliance posture

compliance

Eliminate duplication

management into field

of effort

Fuel management

staff's daily activities

decision-making with

Facilitate access to

accurate, real-time

Decrease reactive

compliance evidence

information

compliance work

from many document sources

Prioritize & automate

Maximize the use of

compliance processes

expensive human

Manage everchanging

across your entire

resources

NERC regulations

environment

Is your company challenged in any of these areas?

Watch this two-minute video to learn how Karta's NERC Compliance Management Solution can help you.

1

Take a risk-based approach to compliance monitoring

Built on a best-in-class platform We built the Karta NERC Compliance Management Solution on a top-rated, secure platform used by organizations around the globe.

Karta’s NERC Compliance Management Solution is designed to make the job of compliance more efficient and far less stressful. From task delegation and escalation to centralized document storage, this invaluable tool helps ensure you're complying with today's regulations and ensures you're prepared if you get audited in the future.

The solution is built on Onspring, industry-leading software that can be adjusted as your needs change and grow. It's user-friendly and has a state-of-the-art interface. In the backend, it connects enterprise workflows, information and technologies, automates critical business activities, and aggregates real-time data for better decisions. We can't wait to show it to you in a demo!

Onspring ranks #1 in GRC software on the market As ranked by real users of governance, risk and compliance (GRC) software in 2022, Onspring placed first in almost all categories, including: Business value created

Ease of customization

Quality of features

Workflow management

2

Take a closer look at Onspring With a no-code, drag-and-drop user interface, your team can make changes to the solution at any time. Onspring is very user-friendly and designed to grow with you.

PROCESS AUTOMATION CAPABILITIES Relate risks, controls, policies & audit procedures in a centralized risk register Conduct risk assessments, audit projects, control tests & policy updates Capture financial, operational, reputational & third-party risks as they surface Auto-assign risk findings by criticality & tasks for appropriate risk remediation Manage controls against corresponding laws, regulations & standards

ANALYTICS CAPABILITIES Visualize & interact with any captured data point Analyze inherent & residual risks by history or heat maps View risks, controls & policies by regulation, owner or compliance status Measure compliance of SOX, GDPR, NERC, NIST & other controls Download or send reports in PDF & Excel formats

3

A powerful tool for NERC compliance If you are an electric utility complying with NERC regulations, then Karta’s NERC solution is a force multiplier! Forget trying to review the dozens of individual PDFs to parse and upload the relevant NERC standards subject to future enforcement or inactivation for your functional entities. Not only does Karta do this for you on a quarterly basis, but we also provide you with a powerful visualization and reminder system in the single pane of the NERC content library dashboard—your own NERC regulatory barometer, so to speak!

ANALYTICS CAPABILITIES ANALYTICS CAPABILITIES

It's an outstanding platform Users Love Us

4

Unite your compliance stakeholders Centralized visibility brings faster collaboration at scale. We'll connect your data in Onpsring to create a shared front for managing risk, compliance and preventing breaches.

GRC SUITE

RISK

AUDIT

POLICY REGULATORY CHANGE

THIRD-PARTY / VENDOR RISK

COMPLIANCE

ESG BUSINESS OPERATIONS SUITE

BUSINESS BCDR CONTINUITY & DISASTER RECOVERY

POLICY

INCIDENT

PROBLEM

SOFTWARE DEVELOPMENT LIFECYCLE (SDLC)

CORPORATE COUNSEL

ITSM SUITE

ASSET

CONTRACT

5

Purpose-built for NERC compliance

Purpose-built for NERC compliance

1

CREATION OF APPLICABILITY COLLECTIONS FOR RESPONSIBLE ENTITIES

2

INTERACTION WITH EACH REQUIREMENT

Control Procedures

Standards

Testing & Findings

Responsible Entities Working Requirements

3

EASY ACCESS TO INFORMATION FROM DIFFERENT SOURCES IN AN EVIDENCE REPOSITORY

4

CREATION OF AUDIT SUMMARIES SUCH AS RSAWS Applicability Collection Working Requirements

Compliance Summaries

Procedures Assessments

6

MANAGING NEW & RETIRING NERC STANDARDS

2 Remediation Plan

Tasks

1 Findings

5

CREATION OF REMEDIATION PLANS BASED ON FINDINGS

Old New

3 6

GRC ecosystem expansion opportunities This solution is built on the industry-leading GRC platform Onspring. The modularity of this platforms means we can integrate the solution with many use cases, including but not limited to these:

THIRD PARTY/VENDOR RISK CIP-013-2: Cyber security, supply chain risk management CIP-011-2: Cyber security, information protection CIP-005-6: Cyber security, electronic security perimeter(s) FAC-014-2: System operating limits methodology for the planning horizon

REGULATORY CHANGE CIP-003-8: Security management controls CIP-008-6: Incident reporting and response planning CIP-009-6: Recovery plans for BE cyber systems CIP-013: Supply chain risk management PER-005-2: System personnel training PRC-005-6: Protection system maintenance & testing EOP-004-4: Event reporting PRC-019-2: Coordination of generating unit or plant capabilities, voltage regulating controls & protection PRC-024-3: Generator frequency & voltage protective relay settings

Tenable OT Security CIP-002-5.1a: Discover and maintain an updated inventory of OT devices CIP-003-8: Unauthorized OT environment activities CIP-004-6 R4 & R5: Unauthorized access attempts or suspicious changes CIP-008-6: Cybersecurity threats through proactive monitoring, audit trail insights and forensic support CIP-005-6 R2: Monitor remote access alert for potential perimeter breaches CIP-006-6: Detects changes made to controllers through direct physical access CIP-007-6: Rule-based anomaly detection and open port issues

AUDIT MANAGEMENT Risk-scoped audits Streamlined issue management Audit consistency Proactive audit planning

RISK MANAGEMENT CIP-002-5.1a: BES cyber system categorization CIP-003-8: Security management controls CIP-008-6: Incident reporting & response planning CIP-009-6: Recovery plans for BES cyber systems CIP-011-2: Information protection EOP-004-4: Event reporting EOP-008-2: Loss of control center functionality PRC-005-6: Protection system maintenance & testing

CIP009-6: Recovery planning, execution and testing CIP-010: Configuration change management and vulnerability monitoring

RSA Security CIP-004: Access control using 2FA/MFA and role-based access control CIP-007: Strong user authentication CIP-005: Secure remote access

More about these solutions kartacorp.com\karta-onspring-ecosystem

7

Expertise We developed this solution in collaboration with utility industry experts and we work closely on solution enhancements with NERC SMEs, Archer Energy Solutions and Ampere Industrial Security.

Given our numerous NERC solution implementations and deep experience working with electrical utilities, you can rest assured we understand the regulatory environment. Your project will be delivered by a talented team of GRC consultants who have combined decades of configuration and project management experience. We promise good communication and an expedited project.

Jonathan Kitchin

Julia Haggerty

Angelo Capone

Frances Bierman

Vice President of Solutions and Service Delivery

GRC/NERC Solution Sales

Sr. Service Delivery Manager GRC Consultant

Project Manager

Alexandre Cormier

Ryan Kartavicius

Patrik Miller

Stacy Bresler

GRC Consultant

GRC Consultant

CEO, Ampere Industrial Security

Managing Partner Archer Energy Solutions

STRATEGIC PARTNERS WITH

Our mission is to help you achieve NERC compliance excellence

8

Karta Ascend: helping you traverse risk You deal with enough risk in a day—let’s take your GRC software off that list. Here’s how we deliver great GRC solutions on time and on budget, every time. This experiencedbased formula is called Karta Ascend. Take a look:

PROVEN PROCESS Our rigorous, time-tested service delivery model ensures your business requirements are understood, your team is involved in the process at every step, and your project is completed on time and on budget.

CURATED GRC SOLUTIONS Weeding through dozens of GRC solutions can take hundreds of hours.

We have cut through the noise and chosen the best for you: Onspring. A core part of our process is guiding your team to select a platform that will serve you well today and in the future.

CLARITY We work hard to ensure you have complete clarity from start to finish.

From clear deliverables to frequent reporting, you'll always know what's happened and what's coming next.

DEEP TECHNOLOGY EXPERTISE There’s no substitute for knowledge and experience. Honed over 20+ years and countless projects, our approach is highly collaborative and efficient.

We only assign seasoned consultants to your projects and maintain expertlevel product knowledge through ongoing training and certifications.

GOOD PEOPLE We're a team of down to earth people who genuinely care about the success of your solution. But don't take our word for it—read our case studies and the unsolicited testimonials shared on our website.

9

Get started

Request a live personalized demo Get a close look at Karta’s NERC Compliance Management Solution and get your questions answered live

REQUEST A LIVE DEMO

Speak with a solution specialist EMAIL US

Toll-free (770) 631-5988 Direct (416) 342-0813

kartacorp.com

231220