the Company

1
the Companys Business Continuity Program
Randy Till Business Continuity

• Pandemic A People Impacting Event

2
The Greatest Threat in Our Life Time?
3
All Countries Will Be Affected

• Global spread will be inevitable once a fully
  contagious virus emerges
• Countries might attempt to contain the virus
  through measures such as border closures and
  travel restrictions
• Pandemics of the previous century encircled the
  globe in 6 to 9 months (even when most
  international travel was by ship)
• Given the speed and volume of international air
  travel, the virus could spread more rapidly,
  possibly reaching all continents in less than 3
  months
• Severe acute respiratory syndrome (SARS) -- a
  watershed event..
• The SARS virus traveled rapidly along the routes
  of international air travel to infect more than
  8,000 people around the world. (SARS killed
  almost 800)

World Health Organization
4
Capture the competitive advantage by acting now
Crisis begins
Lost competitive advantage
Acceleratedrecovery ?
Delayedrecovery ?
Well-prepared
Poorly-prepared
Long-term damage to strategic interests,
customer relations, brand reputation and
employee commitment
Lost business
Dave Kieffer, Mercer Consulting
Time
5
How to Prepare Create A Pandemic Task Force
6
Task Force Creation

• The Pandemic Preparedness Task Force was created
  in September of 2005.
• A Pandemic expert was hired to assist in
  development of a Pandemic Plan
• Established a cross-functional task force to
  define an approach and strategy for pandemic
  planning
• .

7
Task Force Activities

• Risk Management
• Educate teams on pandemic planning
• Define mission-critical activities
• Facilitate cross-functional pandemic plan and
  update/test existing business continuity
  procedures
• Corporate Security
• Monitor sources to assess current situation
• Develop procedures to manage security events
  during a pandemic
• Procure supplies for personnel safety
• Determine travel restrictions and track employee
  travel.

8
Task Force Activities (Cont.)

• Corporate Services
• Define policies to ensure safe work environment
• Review supply chain issues and status of
  preparedness for mission-critical vendors
• Define and implement social distancing procedures
• Develop policies for monitoring/closing
  facilities and canceling corporate sponsored
  events
• Legal
• Provide legal review of pandemic plan, policies,
  procedures, and communications
• Monitor WHO and other public policy sources to
  assess the current situation

9
Task Force Activities (Cont.)

• Global Communications
• Identify stakeholders for internal and external
  communications
• Obtain legal approval and medical expert review
  of communications as necessary
• Enhance crisis communications plan with messages
  for pandemic (global and local)
• Customer Group/Regions
• Anticipate business impacts associated with a
  pandemic event
• Identify mission-critical employees

10
Task Force Activities (Cont.)

• Human Resources
• Review and update existing HR polices/procedures
  (e.g., sick leave, FMLA, absenteeism, insurances,
  disability, vacation, travel).
• Coordinate activities with nursing staff, oversee
  admin of flu vaccination, and determine whether
  to obtain antiviral drugs.
• Provide input on employee communications
  regarding pandemic plan and associated policies.
• Assist in the development of pandemic information
  sessions and provide educational materials.
• Train on protective devices, infectious disease
  protocols, and handling of infected personnel.
• Work with legal, medical, health, and insurance
  providers.

11
Task Force Activities (Cont.)

• Global Technology Operations
• Enhance existing technology to support
  work-from-home solution
• Identify mission critical software/equipment
  procure additional requirements needed
• Identify single points of failure considering
  people, locations, and equipment

12
Pandemic Planning
13
Pandemic Planning Task Force -- Governance Body
Pandemic Planning Task Force
Audit Committee of the BOD


Executive Management
Global Business Continuity Strategic Planning

• Addressed unique requirements for pandemic events
• Gained appropriate management commitment and
  involvement in the pandemic planning requirements
• Integrate pandemic planning requirements into the
  Business Continuity Program with appropriate
  adjustments

14
Task Force Deliverables

• Distributed multiple employee communications
• Responded to customer inquiries
• Updated Executive Management
• Linked Pandemic Planning into existing business
  continuity practices
• Obtained professional services and input from
  experts
• Developed the Pandemic Plan and associated
  guidelines

15
Corporate Security Activities

• Corporate Security will monitor reported cases of
  avian influenza.
• Although the WHO pandemic alert periods have been
  used as general triggers during the planning
  process, the situation at any given office
  location or city around the world will vary
  during an actual pandemic event.
• To assist with local response, Corporate Security
  implemented country risk ratings that correlate
  with the severity of avian influenza impact
  within a country.

16
Country Risk Ratings
Plan Globally, Act Locally
Blue Country Has No Reported Cases of Avian
Influenza
Green Country Has Reported a Confirmed Case of
Avian Influenza in Birds Or Animals
Yellow Country Has Reported A Confirmed Human
Case Contracted Through Contact With An Animal
Orange Country Has Reported Confirmed Human
Case(s) Contracted Through Humans Clusters
Emerging
Red Country Has Reported Multiple Confirmed
Cases Contracted Through Humans Virus Spreading
Efficiently
17
Pandemic Plan
18
Pandemic Plan Assumptions

• 30 50 absenteeism of staff, vendors, and
  providers of community services
• Pandemic may last as long as 18 months in 3
  separate waves (mortality and morbidity will
  increase and decrease)
• Critical functions carried out by contractors,
  consultants, and vendors cannot be guaranteed
• Civil society infrastructure will be stressed,
  but remain functional
• There will potentially be closure of gathering
  places in the community

19
Pandemic Plan Assumptions

• There may be less than six weeks of warning from
  the time the pandemic is announced until it
  spreads the globe.
• No remedies will be available (Tamiflu and other
  antivirals will be in very limited supply)
• WHO phase levels do not provide any indication
  regarding the time interval between levels
• WHO phases 1 3 are for planning activities and
  WHO phases 4 6 are for plan execution

20
WHO Phases
Six distinct phases have been defined to
facilitate pandemic preparedness planning

• Phase 1 2. No new influenza virus subtypes have
  been detected in humans.
• Phase 3. Human infection(s) with a new subtype,
  but no human-to-human spread, or at most rare
  instances of spread to a close contact.
• Phase 4. Small cluster(s) with limited
  human-to-human transmission.
• Phase 5. Larger cluster(s) but human-to-human
  spread still localized.
• Phase 6. Pandemic increased and sustained
  transmission in general population.
• Pandemics usually last approximately 18 months
• The first 90 - 120 days are likely to be the most
  deadliest.

21
Using the Pandemic Plan

• Manage each aspect of the crisis at the
  appropriate organizational level
• Give functional experts room to operate
• Avoid over-reaction
• Continually anticipate and assess alternate or
  worst case scenarios
• Consider consequences
• Manage the media

22
Contents of the Pandemic Plan
Pandemic Planning Objectives and Background
Information
WHO Alert Periods and Plan Globally, Act Locally
(Triggers)
Informational Sections
Planning Assumptions
Task Force Team Roles and Responsibilities
Incident Command System for Emergency Management
Structure and Use of the Plan
Pandemic Preparedness Guidelines
Execution Sections
Pandemic Preparedness Tasks By Phase
Functional Team Pandemic Guidelines and Action
Plans
Appendix Information
23
Building a Resilient Organization

• The good news
• All of the pandemic planning will make our
  organization a much more resilient organization.
• AND Allow for Business Continuity Integration

24
Business Continuity Integration
Randy Till Business Continuity
25
General Business Continuity Planning

• Business Continuity Planning generally has two
  assumptions
• Back to business as usual in 30-45 days or less
  in most cases
• Business location or facility impacted --
  unavailable
• Go from the affected site to the unaffected
  site and resume business
• These dont apply with Pandemic Event

26
Business Continuity Program Key Components
Awareness Management

Awareness and Management - Maintain the
appropriate level of knowledge and experience
while providing a structured process to ensure
business continuity needs are addressed
27
Breadth of the Program
28
Business Continuity Planning Cycle

• Challenges
• Maintaining Business Continuity Plans with
  dynamic information
• Keeping business personnel ready to execute in an
  emergency

29
Work From Home (WFH) Infrastructure Integration

• Evaluated WFH Infrastructure
• - Circuits
• - Licensing Agreements
• - Capacity
• Defined WFH equipment, software and communication
  network requirements
• Expanded WFH infrastructure to address People
  Impacting Events

30
Business Continuity Plan Enhancements

• BIA Identified and Coded WFH Business Functions
• Developed WFH Recovery Strategy
• Expanded Business Recovery Rosters
• Identified and Coded WFH Employees
• Certified Employees WFH Capabilities
• Developed Social Distancing Program

31
Integrating Expanded Work-From-Home into Business
Continuity Plans
Business Function 1 (W-F-H Y)
Business Function 2 (W-F-H N)
Validate W-F-H for Employees and Business
Functions
32
Incident Command System (ICS) Critical to
Managing A Pandemic
Randy Till Business Continuity
33
General Emergency Management Planning

• Emergency Management Planning general
  assumptions
• Event impacts specific Business locations
• Event impacts a geographic region
• People are available and willing to support the
  event
• None apply with a Pandemic Event
• Existing Emergency Management Plans are geared
  towards the above situation
• Requires rethinking
• Move towards the Incident Command Systems

34
ICS Structure to Manage a Pandemic Event
35
Benefits of Incident Command System

• Flow of information communications across the
  organization (horizontal and vertical)
• Especially helpful for companies with multiple
  locations
• Coordination and sharing of resources between
  teams and locations
• Use of common terminology, which is readily
  understood
• Proven practice used by law enforcement,
  government, and the military

36
ICS Organizational Structure
Command (manages)

• Command
• Manages

Operations (does)
Logistics (care/gets)
Planning Intelligence (plans)
Financial (pays/records)

• Logistics
• Cares/Gets

• Finance
• Pays/Records

• Planning Intelligence
• Plans

• Operations
• Does

37
ICS Team Types at the Company

• CIRT Corporate Incident Response TeamCorporate
  Headquarters Purchase, NY
• Manages the events locally impacting the Purchase
  Headquarters
• Supports all global incidents with the potential
  to impact thecorporation from an enterprise
  business perspective
• LIRT Local Incident Response TeamRegional
  Headquarters and Large offices
• Manages the events locally and supports small
  regional offices
• Communicates up to Corporate Headquarters, CIRT
• IAT Initial Assessment TeamSub-team of
  CIRT/LIRT or team for small regional offices
• Assembles to assess and address incidents
• Determines weather to activate the CIRT/LIRT or a
  subset of the team based on the incident

38
Corporate Incident Response Team (CIRT)
Corporate Headquarters only
Executive Management
Corporate Incident Response Team (CIRT)
Incident Commander
Operations
Planning Intelligence
Logistics
Financial
Operations Team Lead
PI Team Lead
Financial Team Lead
Logistics Team Lead

• Responsibility of the CIRT
• Manages the events locally impacting the
  Corporate Headquarters
• Supports all global incidents with the potential
  to impact thecorporation from an enterprise
  business perspective

39
Local Incident Response Team (LIRT)
Regional Headquarters and Large Staffing
Executive Management Region
Local Incident Response Team (LIRT) Office
Location
LIRT Commander
Operations
Planning Intelligence
Logistics
Financial
Operations Team Lead
PI Team Lead
Financial Team Lead
Logistics Team Lead

• Responsibility of the LIRT
• Manages the events locally
• Communicates up to Corporate Headquarters

40
Initial Assessment Team (IAT) for Regional
offices
Asia LIRT
41
Example of Local Response Concept
42
Scenario Walkthrough
EVENT
Notify GSCC
First Response process
Global Security Control Center (GSCC) Process
LIRT Regional HQs Large Staffing
Monitoring Continues
IAT Process activated Assess (use Situation
Assessment Form)
Activate LIRT? (appropriate components)
Cross Office Notification
No
IAT continues monitoring
Activate CIRT? (appropriate components)
No
Yes
IAT continues monitoring

• LIRT activated
• Notifies Executive Management
• Notifies CIRT Incident Commander

Yes
CIRT activated