The hidden cost of not using modern compliance tools

Dalton here from the Raptor Comply team.

Have you ever been told, “We don’t need to spend on new software, we can get by with the tools we have now”?

Research across compliance and GRC teams shows that 40-60% of compliance time is spent on evidence collection and audit preparation, not improving the program itself.

When there’s “no budget” for compliance tooling, teams stitch together spreadsheets, inbox approvals, and shared folders.

To leadership, that looks like cost savings. In practice, it creates a hidden tax.

Extra hours assembling evidence. Delayed access approvals. Audit prep fire drills.

We built Raptor Comply to free you from these unnecessary time sinks, and level up your team’s efficiency (and frankly, their morale).

See how it works

Industry Update ⚡️

NERC CIP Roadmap Released

“The CIP Roadmap emphasizes that improving grid security does not mean layering new compliance requirements indiscriminately. It calls for targeted, risk-driven evolution of the CIP standards, strengthening coverage where threats have outpaced current CIP scope, and leveraging guidance where flexibility is needed.”

NERC has evaluated material changes to the grid and outlined where existing CIP standards are no longer sufficient to mitigate emerging risk. Several priority risks are highlighted: failure to use MFA in password management, gaps in foundational cyber hygiene, and reliance on unencrypted public telecommunications.

The roadmap signals a shift toward a less prescriptive, more objectives-based evaluation framework, drawing from NIST-style risk management.

Near-term, practical takeaways for compliance teams:

• Consider treating Cat 2 IBR cybersecurity risk as in-scope for CIP. Expect changes to cybersecurity control minimums and NERC CIP applicability for these sites in the medium term.

• Expect increased scrutiny on Low Impact BES Cyber Systems. Focus areas highlighted include: information protection, identify and access management, asset identification, configuration management and lifecycle management.

Teams that can continuously generate audit-ready evidence as part of daily operations will be best positioned as CIP scope continues to evolve.

Read the full report here.

NERC revision of Cat 2 IBR reliability standards

NERC has finalized the revision of reliability standards for Category 2 IBRs (20-75 MW). This brings eight Reliability Standards into effect on May 16, 2026.

The standards:

BAL-001-TRE-2

PRC-017-1

IRO-010-5

TOP-003-6.1

MOD-031-1

VAR-001-5

PRC-012-2

VAR-002-4.1

Any changes to O&P and CIP standards for Cat 2 IBRs will follow under separate implementation plans.

If you are an IBR owner or operator, you should confirm your Category 2 status and start building towards a compliant program now - if you haven’t already.

Read the report here