Mapping

The key to successful audits is being able to present exactly what will be required during audit time. Through the methodology, every word of the NERC Standard is identified within an algorithm which points you to the correct existing document in your organization. Compliance becomes a matter of mapping or adding all of the elements to your compliance evidence.

ColorCodeIt™is Dashboard-inspired software that gives you real-time updates on your NERC compliance status, based on indisputable metrics derived from the NERC compliance standards themselves.

• Pre-loaded with NERC standards (updated frequently)
• Delivers hard numbers to achieve continuous compliance
• And more…

See a Demo

NERC Compliance Simplified

• Streamlines compliance efforts: templates are preconfigured to gaps and improvements determined during your assessment
• Immediately ready and configured to your specific registrations
• Compliance project management solution with DL2C templates and task-specific methodology guidance
• Most current interpretation of NERC requirements (links are updated and maintained by DL2C)
• Library is maintained and up to date
• Immediately ready for use
• Applies to both Reliability and CIP standards

The quality of a NERC Gap Analysis is measured upon how well evidence is accounted for by a solid, proven framework.

For instance, by the DL₂C method, CIP-001-1, R1 has exactly 4 elements which are critical for compliance. If one or more of these items is missing, this constitutes a compliance gap. The numbers of elements are extracted directly from the NERC Requirement.

NERC Region: “We can’t tell you how to be compliant…”

Heard this before? When using the DL₂C Color-Coded Compliance System™ Gap Analysis, you literally tell your Regional Auditors, “This is how we plan to be compliant…” After providing them your itemized Gap Analysis, Regional Auditors will be able to comment on any items that you will still need up to 90 days before your audit occurs. This is the definitive strategy not to be surprised at evidence requests during your audit.

---

Entity: What do we get as a “Leave Behind?”

The DL₂C GAP Analysis invites the opportunity for a friendly look into compliance status, without the stress and expense of a pass/fail inspection. Reliable results are assured within 72 hours.

DL₂C GAP Analysis Deliverables:

According to CIP-005-1 NERC standards DL2C can gather your mandatory documentation and review all procedures and policies each yearly.
We also help develop processes for maintaining and archiving access logs for a defined period of time.

The quality of a NERC Gap Analysis is measured upon how well evidence is accounted for by a solid, proven framework.

For instance, by the DL₂C method, CIP-001-1, R1 has exactly 4 elements which are critical for compliance. If one or more of these items is missing, this constitutes a compliance gap. The numbers of elements are extracted directly from the NERC Requirement.

NERC Region: “We can’t tell you how to be compliant…”

Heard this before? When using the DL₂C Color-Coded Compliance System™ Gap Analysis, you literally tell your Regional Auditors, “This is how we plan to be compliant…” After providing them your itemized Gap Analysis, Regional Auditors will be able to comment on any items that you will still need up to 90 days before your audit occurs. This is the definitive strategy not to be surprised at evidence requests during your audit.

---

Entity: What do we get as a “Leave Behind?”

The DL₂C GAP Analysis invites the opportunity for a friendly look into compliance status, without the stress and expense of a pass/fail inspection. Reliable results are assured within 72 hours.

DL₂C GAP Analysis Deliverables:

• Analysis of existing evidence by using DL₂C Color-Coded Compliance System™ data
• US Dollar-Based Risk Exposure Calculation
• Scoring of compliance to percentage points to the Requirement level
• Prioritization of Compliance Activities by Risk Level
• Review of your company’s current Internal Compliance Program
• Evaluation of your company’s audit status, e.g., BW (Begun Work), SC (Substantially Compliant), C (Compliant), AC (Audibly Compliant) to the requirement level
• A Gap Analysis report, documenting recommendations for achieving compliance
• A Gap log to manage the remediation of gaps, with DL₂C recommendations for remediation towards achieving compliance

NERC CIP standards require centralized access, information on field components, and the ability to provide access and security of these components. These standards also require documentation and auditing of all critical infrastructure protection programs.

DL2C’s team of project managers and Compliance Audit Specialists will accurately and quickly document all evidence of your Critical Infrastructure Protection programs.

The Cost of Non-Compliance

Due to the importance of securing the North American power supply, financial penalties for NERC non-compliance are detrimental – entities can be fined up to $1 million per day until they have brought themselves back into a compliant state.

Although NERC audits are regularly scheduled, additional NERC audits can result if there is a power outage or other incident.

Therefore, DL2C’s clients are taking a proactive approach to vulnerability management, endpoint and data protection to ensure continuous NERC compliance.

DL2C CIP Documentation Deliverables:

• >>> CVA (Cyber Vulnerability Assesment) ability assessment.
• >>> Development of a Cyber Security Plan.
• >>> We perform passive penetration tests on your infrastructure.
• >>> We perform an overall evaluation of your network security design.
• >>> We perform passive penetration tests on your infrastructure.
• >>> PXP (Physical Security Perimeter) and DPB (Designed Perimeter Boundry) controls evaluation and anlaysis.

The quality of a NERC Gap Analysis is measured upon how well evidence is accounted for by a solid, proven framework.

For instance, by the DL₂C method, CIP-001-1, R1 has exactly 4 elements which are critical for compliance. If one or more of these items is missing, this constitutes a compliance gap. The numbers of elements are extracted directly from the NERC Requirement.

Auditor: “We can’t tell you how to be compliant…”

Heard this before? When using the DL₂C Color-Coded Compliance System™ Gap Analysis, you literally tell your Regional Auditors, “This is how we plan to be compliant…” After providing them your itemized Gap Analysis, Regional Auditors will be able to comment on any items that you will still need up to 90 days before your audit occurs. This is the definitive strategy not to be surprised at evidence requests during your audit.

---

Entity: What do we get as a “Leave Behind?”

The DL₂C GAP Analysis provides the opportunity for a customized look into compliance status, without the stress and expense of a pass/fail inspection. Reliable results are compiled instantly during the process.

DL₂C GAP Analysis Deliverables:

• >>>Analysis of existing evidence by using DL₂C Color-Coded Compliance System™ data.

• >>>Scoring of compliance to percentage points to the Requirement level.

• >>>Prioritization of Compliance Activities by Risk Level.

• >>>Review of your company’s current Internal Compliance Program.

• >>>Evaluation of your company’s audit status, e.g., BW (Begun Work), SC (Substantially Compliant), C (Compliant), AC (Audibly Compliant) to the requirement level.

• >>>A Gap Analysis report, documenting recommendations for achieving compliance.

• >>>A Gap log to manage the remediation of gaps, with DL₂C recommendations for remediation towards achieving compliance.