Karta's NERC Compliance Management Solution, Built on Archer

INTEGRATED RISK MANAGEMENT

NERC Compliance Management Solution built on

kartacorp.com

A tool that addresses your NERC compliance management

Karta’s NERC Compliance Management Solution is built specifically for NERC compliance.

It helps you comply with NERC regulations more efficiently and confidently.

Drill-down visibility into

Integrate NERC

your compliance posture

compliance

Increase accountability

management into field

Eliminate duplication

staff's daily activities

of effort

accurate, real-time

Decrease reactive

Facilitate access to

information

compliance work

compliance evidence

Fuel management decision-making with

from many document Prioritize & automate

Maximize the use of

compliance processes

expensive human

across your entire

resources

environment

sources Manage everchanging NERC regulations

Is your company challenged in any of these areas?

Watch our two-minute video to learn how our NERC Compliance Management Solution can help you.

1

Achieve NERC compliance excellence

Built on an industry-leading IRM platform Karta’s NERC Compliance Management Solution is built on the Archer Integrated Risk Management (IRM-aka GRC) platform.

Existing Archer users will appreciate the seamless all-in-one experience, and organizations new to Archer can rest assured that this tool is built on one of the best compliance management platforms in the world.

From task delegation and escalation to centralized document storage and highly customizable reporting options, this invaluable tool helps ensure you're complying with today's regulations and your utility is always well-prepared for an audit.

Find us on the Archer Exchange!

Gartner Magic Quadrant leader Archer has been ranked as a Leader within the Gartner Magic Quadrant report for two decades in the following business management categories: IT Vendor Risk Management - 2021 IT Risk Management - 2020 Business Continuity Management – 2019 Integrated Risk Management - 2018 Operational Risk Management Solutions in 2014, 2015 and 2016

IT Risk Management Solutions in 2015, 2016 and 2017 IT Vendor Risk Management in 2014, 2016 and 2017 Business Continuity Management Program Software, Worldwide in 2012, 2014, 2016 and 2017 2

A tool for even the most complex risk & compliance challenges Karta’s NERC solution is built on RSA’s Archer Integrated Risk Management platform, which has a long track record of excellence and a pedigree of over 1500 deployments to date, including at 92 of the Fortune 100. It's available as SaaS or on-prem. We've chosen to work with Archer because it is highly customizable, reliable and robust. Plus, the company continues to invest in new features, software integrations and functionality for continuous improvement.

PURPOSE-BUILT PLATFORM Tailor-made for risk analysis and compliance management Proven to drive efficiency & effectively coordinate stakeholders

ADAPTABLE TO YOUR NEEDS Whether you have an advanced risk management function or compliance that needs to consolidate visibility, or if you’re just getting started with one area of risk, the tool is highly flexible

A PROVEN SOLUTION We've been implementing Archer solutions for 18 years Archer is deployed successfully in thousands of environments

HIGHLY CUSTOMIZABLE This no-code software means no programming is required. Drag and drop configuration allows users to make changes in-house on their schedule or outsource tasks as they so choose.

3

Dashboard to provide you with NERC regulatory standard changes Includes: Quarterly updates tracking all NERC regulatory standards changes Automatic updates to the NERC standards in our Karta NERC Compliance Management Solution The NERC content library provides dashboards displaying the NERC standards subject to future enforcement or inactivation By request: complete workflows to start the implementation of new standards before the enforcement date

4

Purpose-built for NERC compliance

Purpose-built for NERC compliance

1

CREATION OF APPLICABILITY COLLECTIONS FOR RESPONSIBLE ENTITIES

2

INTERACTION WITH EACH REQUIREMENT

Control Procedures

Standards

Testing & Findings

Responsible Entities Working Requirements

3

EASY ACCESS TO INFORMATION FROM DIFFERENT SOURCES IN AN EVIDENCE REPOSITORY

4

CREATION OF AUDIT SUMMARIES SUCH AS RSAWS Applicability Collection Working Requirements

Compliance Summaries

Procedures Assessments

6

MANAGING NEW & RETIRING NERC STANDARDS

2 Remediation Plan

Tasks

1 Findings

5

CREATION OF REMEDIATION PLANS BASED ON FINDINGS

Old New

3 5

Unites your compliance stakeholders Centralized visibility brings faster collaboration at scale. We'll connect your data in Archer to create a single tool for managing risk, compliance and breaking down information silos.

AUDIT RISK MANAGEMENT

IT & SECURITY RISK MANAGEMENT

ENTERPRISE & OPERATIONAL RISK MANAGEMENT

ENVIRONMENTAL, SOCIAL & GOVERNANCE POLICY

THIRD-PARTY / VENDOR RISK

REGULATORY & CORPORATE COMPLIANCE MANAGEMENT

PUBLIC SECTOR SOLUTIONS

BUSINESS RESILIENCY

ESG

BCDR

6

IRM/GRC ecosystem expansion opportunities This solution is built on Archer IRM. The modularity of this platform means we can integrate the solution with many use cases, including but not limited to these:

THIRD PARTY GOVERNANCE CIP-013-2: Cyber security, supply chain risk management CIP-011-2: Cyber security, information protection CIP-005-6: Cyber security, electronic security perimeter(s) FAC-014-2: System operating limits methodology for the planning horizon

REGULATORY & CORPORATE COMPLIANCE MANAGEMENT CIP-003-8: Security management controls CIP-008-6: Incident reporting and response planning CIP-009-6: Recovery plans for BE cyber systems CIP-013: Supply chain risk management PER-005-2: System personnel training PRC-005-6: Protection system maintenance & testing EOP-004-4: Event reporting PRC-019-2: Coordination of generating unit or plant capabilities, voltage regulating controls & protection PRC-024-3: Generator frequency & voltage protective relay settings

ENTERPRISE & OPERATIONAL RISK MANAGEMENT CIP-002-5.1a: BES cyber system categorization CIP-003-8: Security management controls CIP-008-6: Incident reporting & response planning PER-005-2: System personnel training EOP-004-4: Event reporting

AUDIT MANAGEMENT Risk-scoped audits Streamlined issue management Audit consistency Proactive audit planning

IT & SECURITY RISK MANAGEMENT CIP-002-5.1a: BES cyber system categorization CIP-003-8: Security management controls CIP-008-6: Incident reporting & response planning CIP-009-6: Recovery plans for BES cyber systems CIP-011-2: Information protection EOP-004-4: Event reporting EOP-008-2: Loss of control center functionality PRC-005-6: Protection system maintenance & testing

RESILIENCE MANAGEMENT CIP-008-6: Incident reporting & response planning CIP-009-6: Recovery plans for BES cyber systems CIP-014-2: Physical security EOP-004-4: Event reporting EOP-005-3: System restoration from black start resources EOP-011-2: Emergency operations PRC-023-4: Transmission relay loadability

More about these solutions

kartacorp.com\ecosystem 7

Tenable OT Security CIP-002-5.1a: Discover & maintain an updated inventory of OT devices CIP-003-8: Unauthorized OT environment activities CIP-004-6 R4& R5: Unauthorized access attempts or suspicious changes CIP-008-6: Cybersecurity threats through proactive monitoring, audit trail insights & forensic support CIP-005-6 R2: Monitor remote access alert for potential perimeter breaches CIP-006-6: Detects changes made to controllers through direct physical access CIP-007-6: Rule-based anomaly detection & open port issues

CIP009-6: Recovery planning, execution & testing CIP-010: Configuration change management & vulnerability monitoring

RSA Security CIP-004: Access control using 2FA/MFA + role-based access control CIP-007: Strong user authentication CIP-005: Secure remote access

More about these solutions

kartacorp.com\ecosystem

Karta’s strategic partners

5 7

Expertise This solution was developed in collaboration with utility industry experts. and is continuously expanded and upgraded with help from our partners at Ampere Industrial Security and Archer Energy International.

You can count on efficient solution fulfillment thanks to delivery by a talented team of IRM experts with combined decades of configuration and project management experience. Our numerous implementations and deep understanding of the utility sectors mean we get your regulatory environment, challenges and corporate culture.

Jonathan Kitchin

Julia Haggerty

Angelo Capone

Frances Bierman

Vice President of Solutions and Service Delivery

GRC/IRM/NERC Solution Sales

Sr. Service Delivery Manager IRM Consultant

Project Manager

Alexandre Cormier

Ryan Kartavicius

Patrik Miller

Stacy Bresler

IRM Consultant

IRM Consultant

CEO, Ampere Industrial Security

Managing Partner Archer Energy Solutions

Achieve NERC compliance excellence Karta’s NERC solution is built on two exceptional IRM software platforms which are trusted by hundreds of large enterprises worldwide, including government and utility clients in North America to help manage multiple dimensions of risk in a single platform.

8

Karta Ascend: helping you traverse risk You deal with enough risk in a day—let’s take your IRM program off that list. Here’s how we deliver great IRM solutions on time and on budget, every time. This experiencedbased formula is called Karta Ascend. Take a look:

PROVEN PROCESS Our rigorous, time-tested service delivery model ensures your business requirements are understood, your team is involved in the process at every step, and your project is completed on time and on budget.

CURATED IRM SOLUTIONS Weeding through dozens of IRM solutions can take hundreds of hours.

We have cut through the noise and chosen the best for you: Onspring. A core part of our process is guiding your team to select a platform that will serve you well today and in the future.

CLARITY We work hard to ensure you have complete clarity from start to finish.

From clear deliverables to frequent reporting, you'll always know what's happened and what's coming next.

DEEP TECHNOLOGY EXPERTISE There’s no substitute for knowledge and experience. Honed over 20+ years and countless projects, our approach is highly collaborative and efficient.

We only assign seasoned consultants to your projects and maintain expertlevel product knowledge through ongoing training and certifications.

GOOD PEOPLE We're a team of down to earth people who genuinely care about the success of your solution. But don't take our word for it—read our case studies and the unsolicited testimonials shared on our website.

9

Get started

Request a live personalized demo Get a close look at Karta’s NERC Compliance Management Solution and get your questions answered live.

REQUEST A LIVE DEMO

Speak with a solution specialist EMAIL US

Toll-free (770) 631-5988 Direct (416) 342-0813

kartacorp.com

240102