Business Continuity Plan

And credit uniondsContinuity Plan for:

Confidential ©Quantivate 2010 1 | P a g e Business Continuity Plan

Table of Contents

Contents

Confidential ©Quantivate 2010 2 | P a g e Business Continuity Plan

Plan Overview

Confidential ©Quantivate 2010 3 | P a g e Business Continuity Plan

Introduction: The BC plan owner is responsible for all aspects of the BC plan, and for keeping plan information current. Each plan will be reviewed and updated yearly as technology components, processes or staff is changed. Plans should be updated after each exercise, event, or after a change/update in the BC plan.

Purpose: This BC plan will establish appropriate departmental responsibilities to respond and recover from emergencies and disasters.

Limitations: No guarantee of a perfect response system is expressed or implied by this plan or any of its appendices, implementing instructions, or Procedures. Since company assets and systems are vulnerable to natural and technological disasters, they may be overwhelmed. BC plan owners and staff can only attempt to make every responsible effort to respond based on the situation, information, and resources available at the time of disaster.

How to use the plan: This BC Plan is a process based plan that allows users to follow a standard sequence of steps if a disaster were to take place. The BC Plan is broken into 5 different sections (see below): Sections 1 & 2 are static action steps that direct staff actions, section 3 holds the detailed recovery steps for each asset, section 4 holds the reports for departments, and section 5 contains the forms used during the event of a disaster. Some steps in this BC plan will be performed many times or not at all, depending on the situation. BC Plan Plan Tab Definitions Detail Areas Information/Data Sections Response Event Response, Life Safety, Day to Day or Disaster, Section 1 Static Data Process Engage Management Continuity and Section 2 Assess Impact, Resume Processes, Validate, Restore Static Data Recovery Process Continuity and Dynamic Continuity Section 3 Assess Impact, Resume Processes, Validate, Restore Recovery Steps Data Section 4 Reports Call List, BIA, Solutions, Gaps, About this Plan Reports Briefing Template, Initial Assessment, Damage Assessment, Skill Set Inventory, Staffing Schedule, Section 5 Forms Static Data Event Log, Expense Log, Deactivation Checklist, After Action Checklist This plan and the documents embedded within it are backed up daily. However, for immediate availability in the wake of a disaster or event, it is the responsibility of the Plan Owner to ensure that copies of the response and recovery plan are available in electronic or hard copy format. The Plan Owner is also responsible for ensuring that all external documents, vital records, and links referenced (example: Standard Operating Procedures) in the plan are backed up and accessible.

Confidential ©Quantivate 2010 4 | P a g e Business Continuity Plan

1.0 Response

Confidential ©Quantivate 2010 5 | P a g e Business Continuity Plan

1.1 Event Response

(Section 1.1 directs employees initial response to an incident, event or problem) Step Action Step Source Notes # Contact the correct internal or external group & report the incident, 1...... event or problem: Contact List FOR ALL EMERGENCIES CALL 911 (See Forms Section)

FIRE, POLICE OR EMT:  When reporting an emergency make sure you give them your building location, floor, and organization name  (Non-emergency) If a problem occurs with 911 when you are trying to reach the Fire Department / Emergency Medical Technician (EMT), call: (xxx) xxx-xxxx  In a non-emergency situation, if a problem occurs with 911, call: (xxx) xxx-xxxx  State Emergency Management: (xxx) xxx-xxxx  FEMA Region X - (xxx) xxx-xxxx  County Emergency Management o Web: o Phone: (xxx) xxx-xxxx SECURITY:  Physical Security: o Alert onsite Manager o Management will contact Facility Team FACILITIES:  Facilities Service o Alert onsite Manager o Management will contact Facility Team TECHNOLOGY:  Help Desk: (xxx) xxx-xxxx

Confidential ©Quantivate 2010 6 | P a g e Business Continuity Plan

HUMAN RESOURCES:  (xxx) xxx-xxxx EMPLOYEE EMERGENCY INFORMATION:  (xxx) xxx-xxxx HOSPITALS:  (xxx) xxx-xxxx ADDITIONAL EMERGENCY TELEPHONE NUMBERS:  Poison Control: (xxx) xxx-xxxx  National Response Center (Toxic Chemical and Oil Spills): (xxx) xxx-xxxx  American Red Cross: (xxx) xxx-xxxx PANDEMIC INFLUENZA :  County Information Web Address:

Confidential ©Quantivate 2010 7 | P a g e Business Continuity Plan

1.2 Life Safety

(Section 1.2 directs employees to prepare for, respond to and recover from life threatening incidents) Step Action Step Source Notes # 1. Accounting for Personnel: ...... The following items list the tasks to be performed by the Evacuation Meeting Place Leader or Alternate Evacuation Meeting Place Leader. � Include Steps here: 2. Reacting to the Disaster: When an emergency or disaster occurs (or is pending), please remain calm. Above all, personal safety is the first concern. The following procedures are to be used as time and safety permit. If evacuation is necessary, proceed to the nearest safe exit. Leave the building and report to your Evacuation Meeting Place. For a specific emergency listed below utilize the following procedures in step number three.  Evacuation  Power failure  Equipment failure  Fire  Severe thunderstorms / high winds  Bomb threat  Suspicious letters or packages  Hurricanes and floods Remember - In the event of an evacuation, the Manager will be attempting to account for personnel. So please, remain at the site listed below until you receive further instructions. � 3. Actions for Specific Disasters: � In Case of Fire: Preemptive Actions 1. All areas of the building should be reviewed on a regular basis to ensure combustible materials are stored safely, electrical outlets are not overloaded, all electrical cords are in good condition, and all exits are clear.

Confidential ©Quantivate 2010 8 | P a g e Business Continuity Plan

2. Management should request the local fire department to inspect the building annually and recommend any corrective actions. 3. Management should ensure all employees receive annual training in the location and use of fire extinguishers. 4. Evacuation route maps should be posted in several places on each floor and employees should be made aware of the placement locations. 5. Fire drills should be conducted at least semi-annually. 6. All employees should be made aware that there are three types of fires: 1. CLASS A. Fires involving ordinary combustibles such as paper, wood, and cloth, which can usually be extinguished with water. 2. CLASS B. Fires involving flammable liquids such as gasoline, oil, alcohol, benzene and ether, which are extinguished by smothering with a carbon dioxide or dry chemical fire extinguisher. 3. CLASS C. Fires involving electrical equipment, appliances and wiring. These are extinguished by the use of a non- conductive extinguishing agent such as a carbon dioxide or dry chemical fire extinguisher. During the Event 1. Remove any member or employee who might be in immediate danger from the fire and close the door to the office or room. 2. Use a fire extinguisher to try to contain the fire, if possible. 3. If the fire extinguisher is not sufficient to put out the fire, call the fire department using 911. 4. Notify the entire building, by telephone if possible. If the telephone system is not operable, the individual discovering the fire will have someone go to each floor with the message. 5. Guide and assist in the evacuation of members from the building to a safe location such as the Evacuation Meeting Place. If the smoke is thick, drop to the floor and crawl to the nearest exit. Cover your mouth to avoid inhaling smoke and gases. The remaining steps should be done only if time permits! 1. Store all files, records, reports and other items in fireproof safes. 2. If time permits, sign off at your workstations. 3. Lock all fireproof safes. 4. Close all exterior office doors. 5. Check all non-working areas to make sure all personnel have been alerted (employee lounge, rest rooms, etc.). 6. Evacuate the building. Go to the Evacuation Meeting Place and wait

Confidential ©Quantivate 2010 9 | P a g e Business Continuity Plan

for further instructions. At the Evacuation Meeting Place, the Managers from each department will attempt to account for all personnel. � In Case of Thunderstorms/ High Winds: Preemptive Actions 1. Include Steps Here During the Event 1. Include Steps Here The remaining steps should be done only if time permits! 1. Include Steps Here At the Evacuation Meeting Place, the Managers from each department will attempt to account for all personnel.

In Case of Bomb Threat: During the Event 1. Include Steps Here The remaining steps should be done only if time permits! 1. Include Steps Here

In Case of Equipment Failure: Preemptive Actions 1. Include Steps Here In Case of Suspicious Letters or Packages: 1. Include Steps Here

Confidential ©Quantivate 2010 10 | P a g e Business Continuity Plan

1.3 Day to Day or Disaster

(Section 1.3 guides plan owners in establishing the incident/event as a disaster (or not) and whether or not to escalate to the Crisis Management Team accordingly) Step # Action Step Source Notes 1. Conduct Initial Evaluation: ...... Conference Bridge Number (See Reports: Activate & mobilize plan members as needed. Call List) Manager or Staff: Initial Assessment (See 1. Include Steps Here Forms section)

Initial Briefing (See Forms section) 2. Day to Day Problem or Disaster? Review the following criteria to decide if the event is a Contact List (See disaster. Reports Section) Disaster criteria: 1. Include Criteria Here Initial Assessment (Completed Form)

3. Execute Standard Operating Procedures (SOPs) Current Standard Follow day to day standard operating procedures (SOPs) Operating Procedures (SOPs) 4. Problem Resolution Is the problem currently resolved? 1. Include Steps Here  5. Return to Normal Return to normal & take no further action. Current Standard  Consider completing a root cause analysis on Operating Procedures problem(s) or document lessons learned from the (SOPs) day to day event.

Confidential ©Quantivate 2010 11 | P a g e Business Continuity Plan

1.4 Engage Management

(Section 1.4 directs the plan owner to assess the impact on: Processes and Technology, Components, and Customers) Step # Action Step Source Notes 1. Assess Impact � ......

Capture the assessment of the following on the DamageTechnology and Assessment Form: Dependency Report (See 2. Include Steps Here Reports Section)

Are the Continuity and Recovery Strategies documented Damage Assessment in the Recovery Step section appropriate for the event? Form (See Forms Section)

1. Include Criteria Here Contact List (See Reports Section)

2. Engage Crisis Management Team ......

Damage Assessment 1. Include Steps Here Form (See Forms Section)

3. Analyzing Triggers ...... The following triggers are guides for determining Form A Initial Briefing whether or not to declare a disaster: (Completed Earlier) Disaster criterion:

Include Criteria Here Form D: Damage Assessment (Completed Earlier) This disaster criterion is a guide; your best judgment should take precedence. Section 1.3 "Execute Standard Operating Procedures"

Confidential ©Quantivate 2010 12 | P a g e Business Continuity Plan

2.0 Continuity and Recovery Process

Confidential ©Quantivate 2010 13 | P a g e Business Continuity Plan

2.1 Assess Impact

(Section 2.1 directs the Plan Owner and staff to activate team members. Depending on the situation, the Plan Owner, staff or Crisis Management Team will contact the customers to coordinate resumption and recovery efforts.) Step # Action Step Source Notes 1. Activate & Notify ...... Form A: Incident Briefing (See Forms Section)

Call List (See Reports Activate Team, Notify Employees, Customers and Section) Dependencies

Form G: Event Log (See Include Steps Here Forms Section)

Form E: Skill Set Inventory (See Forms Section)

Confidential ©Quantivate 2010 14 | P a g e Business Continuity Plan

2.2 Resume Process

(Section 2.2 informs Plan Owners and staff how to use the predefined steps for process dependency, continuity, and technology recovery) Step # Action Step Source Notes 1. Implementing Continuity and Recovery Steps ......

Implement Continuity & Recovery Steps on process and assets you depend upon by going to SECTION Section 3: Continuity & Recovery Steps (Step #1 3: CONTINUITY & RECOVERY STEPS Pre-Continuity Checklist Include Steps Here Impact Assessment)

2. Continue to Implement Continuity and Recovery ......

Form A: Incident Briefing During implementation: (See Forms Section)

Include Steps Here Call List (See Reports Section)

Form G: Event Log (See Forms Section)

Form H: Expense Report (See Forms Section)

Confidential ©Quantivate 2010 15 | P a g e Business Continuity Plan

2.3 Validate

(Section 2.3 directs the plan owner and staff to validate process dependencies and technology components) Step # Action Step Source Notes Validate Continuity and Recovery 1...... Strategies/Steps Section 3: Continuity & Recovery Steps (Step #3 Recovery & Communicate Steps) 1. Include Steps Here Call List (See Reports Section)  Processes, Dependencies and customers (See Reports, BIA Report) Resume Processes and put 2...... Technology into Production Include Steps Here Processes, Dependencies and 1. Customers (See Reports, BIA Report) 3. Monitor & Support ......

Contact List (See Reports Section) Include Steps Here 1. Current Standard Operating Procedures (SOPs) Shift from Continuity/Recovery to 4...... Restoration Section 2.4: Restore (Step #1 1. Include Steps Here Restoration of Processes) 5. Return to Normal ...... Call List (See Report Section)

Deactivate all event activities if all of the following criteria is met: Section: 2.3 Validate, Step # 3 Monitor DEACTIVATE CRITERIA: & Support 1. Include Steps Here

Confidential ©Quantivate 2010 16 | P a g e Business Continuity Plan

2.4 Restore

(Section 2.4 directs the plan owner to restore from the alternate site back to a new or repaired original site. The primary goal in this stage is to return to normal operations in the new or repaired site.) Step # Action Step Source Notes Restoration of processes and technology to the 1...... primary/restored site: Contact List (See Reports Section) 1. Include Steps Here Process Restoration Steps (Sec. 3: Recovery Steps)

2. Return Implementation ...... Contact List (See Reports Section) Pre Return Implementation activities & reminders: Process Restoration Steps (Section 3: Recovery Steps 1. Include Steps Here Application Restoration Steps (Section 3: Recovery Steps) 3. Restoration ...... Contact List (See Reports Section) Ensure processes are stable and technology is recovered to the primary or rebuilt location. Process Restoration Steps Include Steps Here (Section 3: Recovery Steps)

4. Return to Normal ...... Call List (See Report Section) Deactivate event activities if all of the following criteria is met: Form J: After Action Checklist (Forms Section)

1. Include Steps Here Form I: Deactivation Checklist (Forms Section)

Confidential ©Quantivate 2010 17 | P a g e Business Continuity Plan

3.0 Continuity and Recovery Steps

Confidential ©Quantivate 2010 18 | P a g e Business Continuity Plan

Continuity

Name:  Section Complete Process Number: 1 of X Date:____/____/___ Criticality: Criticality Ranking goes here Time:____:______

Owner: Human Resources Completed by:

Process Continuity - This section includes the steps to ensure the process can continue in the event of a disaster. Process Continuity Steps Sources Notes

Note the dependencies that will need to have their continuity solutions implemented during process recovery:

1. Repeat section for each process in the department plan.

Confidential ©Quantivate 2010 19 | P a g e Business Continuity Plan

Name:  Section Complete Parent Process: Add process name Here Date:____/____/___ Dependency Number: 1 of X Time:____:______Owner: Add Owner Name Here Completed by: Continuity Solution: Add Solution Here

Continuity Steps - The steps to ensure that the 3rd Party Web Hosted applications required for continuing day to day operations have workaround steps. Continuity Steps Sources Notes  Solution for continuing the process if the dependency is Standard Operating not available: Procedures 1. Include Steps Here

Confidential ©Quantivate 2010 20 | P a g e Business Continuity Plan

4.0 Reports

Confidential ©Quantivate 2010 21 | P a g e Business Continuity Plan

Call Lists

Employee List Employee Name Division Work Phone Home Phone Cell Phone Add Employee Call List Data Here

Vendor List Vendor Name Vendor Contact Name Phone Add Vendor Call List Data Here

Confidential ©Quantivate 2010 22 | P a g e Business Continuity Plan

5.0 Forms

Confidential ©Quantivate 2010 23 | P a g e Business Continuity Plan

Overview This section contains the forms referenced in the source column through the response and recovery action steps found in the plan. The source column is used to capture information, location and/or materials required or helpful for accomplishing the action step. The forms below are built to be used as wall charts which are blown up and utilized to display useful information. Table of Contents:

Briefing Templates

Form A: Initial Briefing

Form B: Meeting or Conference Briefing

Form C: Initial Assessment

Form D: Damage Assessment

Form E: Skill Set Inventory

Form F: Staffing Schedule

Form G: Event Log

Form H: Expense Log

Form I: Deactivation Checklist

Form J: After Action Checklist

Form A: Initial Briefing

Location: ______Date: _____/___/______Time: ______

Completed by: ______Contact#: ______Dept/Plan Name: ______

The following is a checklist of items for discussion during the initial briefing. Document Present Situation and Actions Needed Present Situation:

Immediate Needs or Actions:

Crisis Management Reminders Roles Executive Crisis Manager: ______

Legal: ______

Business Continuity / Disaster Recovery:  Life Safety is the #1 concern ______ Use Event Log Finance: ______ Use Expense Log (purchasing is approved at the management level) Claims:  Use Skill Set Inventory Log ______

 Complete Staffing Schedule Public Relations / Media: ______ Participate in working meetings and conference calls Information / Documentation /  Validate conference bridge #’s Communications: ______ Validate reoccurring meeting times Technology:  Participate as requested on management status meetings ______ Raise issues, concerns and problems in working meetings & status Security: meetings ______

 Assess impact & communicate ASAP Travel and Food: ______ Review and validate current recovery strategy Human Resources:  Communicate to management, lead or supervisor, gather facts, set ______priorities and implement response and recovery steps Life Safety: ______

Business Operations:: ______

Sales and Marketing: ______End Form: A

Form B: Meeting or Conference Briefing

Location: ______Date: _____/___/______Time: ______

Completed by: ______Contact#: ______Dept/Plan Name: ______

The following is a checklist of items for discussion during a standard working meeting, status meeting, or briefing meeting. Meeting Preparation: Invite Teams to Meetings or Conference calls, Conduct roll call, Make sure All Life Safety is being addressed, See Detail Assessment Recommended Impact Current Resolution (Use Resource Approved Description Control Situation Current BC Requirements Priority (EOC (Down or Up) # (Detail Solution/Steps or (what will be (H-M-L) Approves (Risk Assessment) Rebuild BC need) or Not) Elements) Solution/Steps) 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. Discuss Recommendation ECO: Meeting with

ECO Get Approval from ECO: Build Action Plans to Meet Objectives Set by the ECO: Milestones or ET to Resource Action Plan Assigned to Status Deliverables Implement Required 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. End Form: B Reminder: Document and report current situation, and work with EOC to determine priorities and objectives.

Form C: Initial Assessment

1. Include Form here

Form D: Damage Assessment 1. Include Form here

Form E: Skill Set Inventory 1. Include Form here

Form F: Staffing Schedule 1. Include Form here

Form G: Event Log 1. Include Form here

Form H: Expense Log 1. Include Form here

Form I: Deactivation Checklist 1. Include Form here

Form J: After Action Checklist 1. Include Form here

INSERT IN BINDER BACK COVER

Forms Reports Continuity and Recovery Continuity and Recovery Response Steps Process