Streamlining Critical Infrastructure Compliance and Third-Party Risk with Onspring
OVERVIEW
Duquesne Light Company (DLC) delivers safe and reliable electricity to communities in southwestern Pennsylvania, including the city of Pittsburgh. As a regulated utility, DLC must meet strict NERC CIP requirements while also managing cybersecurity controls, vendor risk, procurement workflows and cross functional compliance activities.
Before implementing Onspring, many of DLC’s compliance, controls and vendor-risk processes were manual, fragmented and time-intensive. Tracking controls, collecting evidence and coordinating reviews required heavy administrative oversight and long timelines.
Over the past year, Onspring has transformed DLC’s GRC operations. Automation replaced manual tasks, integrations now move data without human intervention and teams across the organization rely on Onspring dashboards to stay informed. What once required weeks now takes days. What once required extensive chasing now runs through structured, predictable workflows.
Profile
Company
Industry
Electric Utility
Headquarters
Pittsburgh, PA
Customers
600,000+
Core Values
Safety, integrity, dependability, equity and community; committed to safely powering lives and advancing a clean-energy future
Challenge
DLC must ensure compliance with strict regulatory standards while managing vendor risk, internal controls, procurement reviews and evidence collection across multiple departments. Prior to Onspring, these workflows were manual: heavy on emails, spreadsheets and manual intervention, making them time-consuming, error-prone and difficult to coordinate.
As processes grew more complex, it became harder to scale. Control owners recreated controls each cycle, third-party risk reviews involved multiple teams and extended timelines, and no unified system existed to enforce consistency or automate steps.
“We have to abide by a lot of NERC requirements,” Brenda explained. “Our processes were very manual. Third-party risk alone involved a lot of teams and a lot of steps.”
Solution
DLC deployed Onspring using a hybrid approach: three fully customized modules built with professional services support, followed by a fourth out-of-the-box module once foundational processes stabilized. The implementation focused on:
- Automating repetitive manual tasks
- Integrating Onspring with internal systems
- Centralizing workflows and data
- Providing dashboards for control owners and procurement
- Simplifying configurations to improve usability
“Onspring helped us automate our processes,” Brenda said. “We integrated with some of our systems at Duquesne Light, which really helped take more people out of the process and made it more secure.”
Today, multiple teams across DLC use Onspring daily. Super-users and admins work within the system’s knowledge base, while end-users receive streamlined training tailored to exactly what they need to complete.
One of the biggest lessons: aim for simplicity from the start.
“We had a complicated process and we made it complicated in Onspring,” Brenda said. “Since then we have worked closely with our admin to unwind some of that so it is easier to manage.”
Results
After a year of using Onspring, DLC has seen measurable improvements in both speed and operational efficiency.
- Third-party risk review timelines cut nearly in half: from 8–10 weeks to 4–6 weeks
- Control cycles streamlined: no more recreating controls each cycle, and reminders now run automatically
- Improved stakeholder satisfaction: “Our stakeholders really like the tool.”
- Growing internal demand: more teams are requesting demos and exploring new use cases
- Faster adoption after an initial 3–4 month “burn-in” period
The shift required a cultural change, moving teams from inbox-based coordination to dashboard-driven workflows, but users adapted and now rely on Onspring for clarity and consistency.
-
“Onspring has made us perform our processes faster. We can see the future of more integrations and a system that will continue to support what we are building.”
Looking Ahead
DLC plans to expand its use of Onspring, adding more integrations, more automation and additional workflows to reduce repetitive work and allow teams to focus on higher-value tasks.
“We can see the future of having more integrations with other tools,” Brenda said. “It is not something that is going to go away. We can keep building on it.”
Her advice to others:
“Build the relationship with professional services and make sure you have leadership support. That is what will make you successful.”
For Duquesne Light Company, Onspring has become a stable, scalable platform, helping them power critical compliance operations just as reliably as they power the region’s homes and businesses.
