Chapter 01 Crisis Management Sample

7/31/2019 Chapter 01 Crisis Management Sample

1/50

ABC Business Continuity Plan

***INTERNAL USE ONLY***

BUSINESS CONTINUITY PLAN CHAPTER 01

Department/Division:Enterprise Risk Management

Subject:Type:

Business Continuity Plan

Chapter 01 Crisis Management /

Command & ControlEffective Date: Supersedes:

May 30, 2011

Last Reviewed: Next Review:

May 30, 2011 May 30,2012

Distribution: Issued By: Approved By:

Business Continuity

Coordinator

Business Continuity Coordinator


2/50


Cha ter 01 Crisis Mana ement/Command & Control***INTERNAL USE ONLY***

DOCUMENT CHANGE RECORD

A summary of changes in this document is contained below. All previous versions of this documentshould be destroyed.

REVISION

NUMBERDATE DESCRIPTION


3/50


Cha ter 01 Crisis Mana ement/Command & Control Pa e i***INTERNAL USE ONLY***

TABLE OF CONTENTS

FORWARD ................................................................................................................................... 1Purpose ................................................................................................................................ 1Audience ............................................................................................................................. 1Roles And Responsibilities ................................................................................................. 2

Corporate Contingency Coordinator (CCC) ........................................................... 2Crisis Management Team (CMT) ........................................................................... 2Business Continuity Coordinator ............................................................................ 3Business Continuity Teams..................................................................................... 3

PLANNING ASSUMPTIONS ..................................................................................................... 4ASSESSMENT & INITIAL RESPONSE ................................................................................... 5

Facility Incident Assessments ............................................................................................. 5General .................................................................................................................... 5ABC Corp HQ Incidents ......................................................................................... 5Branch Incidents ..................................................................................................... 6

Information Technology Assessments ................................................................................ 6CMT Alerts & Disaster Declarations .................................................................................. 6

Alerts ....................................................................................................................... 6Crises....................................................................................................................... 7Disasters .................................................................................................................. 7

Assessment And Notification Flow Diagrams .................................................................... 7Disaster Recovery Initiation- During Work Hours ............................................................. 8Disaster Recovery Initiation- After Work Hours ................................................................ 9

CMT RESPONSE STANDARDS & PRACTICES .................................................................. 11Branch Services ................................................................................................................ 11Facilities ............................................................................................................................ 11Finance .............................................................................................................................. 12General Counsel ................................................................................................................ 13Human Resource ............................................................................................................... 14Information Technology ................................................................................................... 16Insurance Claims ............................................................................................................... 17Member Services .............................................................................................................. 18Public Relations ................................................................................................................ 18Security ............................................................................................................................. 20Vital Records Retrieval & Salvage ................................................................................ 21

CRISIS COMMUNICATIONS ................................................................................................. 22General Guidance .............................................................................................................. 22


4/50


Cha ter 01 Crisis Mana ement/Command & Control Pa e ii***INTERNAL USE ONLY***

Objectives ......................................................................................................................... 22Marketing Responsibilities ............................................................................................... 22Advertising ........................................................................................................................ 24Regulatory Communications ............................................................................................ 24Robbery Communications ................................................................................................ 24

APPENDICES ............................................................................................................................. 27Appendix A Crisis Management Team Contact Information ....................................... 27Appendix B- Initial Incident ReportForm ....................................................................... 29

Initial Incident Report Form ................................................................................. 29Appendix C Initial Crisis Management Team Call Script .............................................. 30Appendix D Status Call Template.................................................................................. 33Appendix E - Command Centers ..................................................................................... 36

Prequalified Locations .......................................................................................... 36Activation .............................................................................................................. 36Staffing .................................................................................................................. 36Buildout................................................................................................................. 37Remote Command Center Diagrams .................................................................... 39

Atlanta Marriott Alpharetta....................................................................... 39Atlanta Marriott Century Center ............................................................... 40

Appendix F- Worker Relocation ...................................................................................... 41Corp HQ Disasters ................................................................................................ 41

In Facility Recoveries ............................................................................... 41Out Of Facility Recoveries ....................................................................... 41Worker Relocation Strategies ................................................................... 42

Branch Disasters ................................................................................................... 43Executive Relocation ............................................................................................ 43

Appendix G- Vital Records Salvage Priorities ................................................................ 44Appendix H- Recovery Task Log .................................................................................... 46


5/50


Cha ter 01 Crisis Mana ement/Command & Control Pa e 1***INTERNAL USE ONLY***

FORWARD

Purpose

Crisis management is a discipline

used to organize, evaluate and

control significant events that

impact an organizations normaloperations. Crisis management

is a part of ABCs Business

Continuity Program and formsChapter 1 of the Corporates

Business Continuity Plan.

The purpose of this chapter is to

set forth standards, practices, and

guidance for the timely, unified response ofABC (the Corporate) Crisis Management

Team (CMT) to crises1 and disasters2

threatening, or impacting, its facilities,

personnel, or services.

This plan provides information for use fromthe time an incident is identified, deemed a

crisis or disaster, and the Crisis Management

Team (CMT) is activated or alerted, until thecrisis/disaster is declared over and the CMT

inactivated by the Corporate Contingency

Coordinator (CCC).

This Plan shall be reviewed annually when directed by the Business Continuity Coordinator (BCC).

Audience

The primary intended audience of this document is the Corporate Crisis Management Team.

1 A crisis is an actual or threatening critical event, which if not handled in an appropriate and timely manner, may dramatically

adversely impact the Corporates profitability, reputation, or ability to operate.2 A disaster is any event which precludes the Corporate from performing/providing its critical business/support services within anacceptable amount of time.


6/50



The Business Continuity Plan

ABCs Business Continuity Plan (BRP) is composed of department specific business continuityplanning chapters and general crisis and contingency response chapters (see Figure 1). This construct

provides the Corporate with both focused department specific business continuity planning andgeneral crisis management planning for unity of effort in responding to disasters or crises.

Roles And Responsibilities

Corporate Contingency Coordinator (CCC)

The Corporate Contingency Coordinator (CCC) is responsible for leadership of the Corporates

response to a crisis or disaster and leads the corporate Crisis Management Team, which is composedof the Vice Presidents of the departments shown in Figure 1.

The Alternate Corporate Contingency Coordinators, act in the place of the CCC should the he/she beunavailable to perform his/her duties and assists the CCC during crisis response and disaster recovery

operations.

The CCC is the CEO of ABC. The

Alternate CCCs are the Senior Vice

President of Marketing & Sales and the

Senior Vice President of Strategy &Research, in that order of succession.

Crisis Management Team (CMT)

The Crisis Management Team (CMT)provides input to the CCC in the

development of Corporate crisis or disaster

response strategies, and leadership of theirdepartments in the implementation of those

strategies.

Generally, the CCC will direct the alerting

or activation of the CMT for events which:

compromise, or may have compromised, critical member information; constitute a breach, or probable breach, of Corporate information technology; require moving substantial numbers of personnel to alternate work locations; significantly adversely impact Corporate operations; involve life-safety events where, hospitalization or deaths have occurred, or might occur; involve interaction with the media, regulatory authorities, or law enforcement, or; have resulted in the robbery of a Corporate branch.

Figure 1


7/50



Business Continuity Coordinator

The Business Continuity Coordinator (BCC) is charged with leadership of the Business Continuity

Program, to include3:

Oversight of annual updates to the Corporate Business Continuity Plan.

Annual business unit and IT business continuity/disaster recovery testing. Crisis Management Team training and exercises. Providing best practices recommendations and assistance to the Corporate Contingency

Coordinator and CMT during crises and disasters.

Monitoring of severe weather and alerting CMT of any significant weather events threateningCorporate facilities or operations.

Facilitation of CMT alert calls and activation calls.4 Best practices consulting with departments and IT on business continuity planning,

provisioning and testing.

Annual June business continuity/disaster recovery risk assessments for the CCC.Business Continuity Teams

Business Continuity Teams are the Teams assigned to implement the various chapters in the Business

Continuity Plan, and thus, generally align with the major departments in the Corporate.

Specified Team Leaders and Alternate Team Leaders are assigned and trained during plan

development, and team members (and alternates) representing major functional groups within the

Team are also specifically identified. Not all department personnel are listed as Team Members,however, all personnel are expected to take part in any recovery effort.

3 See also Chapter 14- Hurricane, Tropical Storm of the Business Continuity Plan for additional Branch Services responsibilitiesduring such crises.4 Reference Appendices C and D.


8/50



PLANNING ASSUMPTIONS

The Corporate Continuity Plan is built upon the following Corporate assumptions:

Pre-configured worker relocation sites (i.e., Site 1 and Site 2) will be available if ABC CorpHQ becomes unusable.

Contracted for IT disaster recovery sites and network will be operational. Transportation infrastructure to support movement of personnel, equipment, etc. to recovery

sites or support remote branch recoveries will be functional.

Off-site storage locations for critical backup files, vital records, or equipment will remainintact and accessible.

Salvaged equipment and vital records stored in an affected facility will notbe available forrecovery operations.

If relocation of workers from ABC Corp HQ is required, the Crisis Management Team willallocate existing worker relocation workstations in the Site 1 and Site 2 branches to high

priority workers from various business units while the Facility and IT teams continue to build

out additional workstations as required.

Executive relocation space will be accommodated by relocation within ABC Corp HQ,relocation in prepared Corporate branches, or relocation to a CMT designated hotel withinternet access.

Members, vendors, government agencies, and others, will be reasonably understanding andcooperative during the recovery period.


9/50



ASSESSMENT & INITIAL RESPONSE

Any incident which may prevent the Corporate from performing some, or all, of its critical businessfunctions for an unacceptable amount of time, or which mightresult in substantial monetary or non-monetary losses5 must be quickly assessed and a strategy for effectively mitigating the risk quickly

developed and implemented.

Facility Incident Assessments

General

Upon notification of an incident which might affect the use of ABC Corp HQ or one of the

Corporates Branches for business purposes, the Facility Team Leader will notify the Business

Continuity Coordinator (BCC), and commence an incident assessment as set forth in this Plan.

Should the BCC be notified first, the BCC shall notify the Facility Team Leader and stand prepared

to join the Corporate incident/disaster assessment team.

The objective of the initial assessment of a facility incident is to determine the scope of impact on the

Corporate, the degree to which the facility might still be utilized, and whether the notification of the

CMT and implementation of the Business Continuity Plan is in order.

If adequate information is available based upon initial incident reports for an assessment andrecommendation to be made for the CCC on how best to proceed, the Facility Team Leader and BCC

will recommend to the Corporate Contingency Coordinator (CCC) a course of action based upon the

status of the facility.

If a more detailed assessment is required, the Facility Team Leader will alert the BCC and Facility

Team Liaison personnel6

and proceed to the facility to perform an onsite assessment.

ABC Corp HQ Incidents

For an incident affecting ABC Corp HQ, the Facility Team Leader and BCC will meet with

appropriate Facility Team members, vendors, and liaison personnel to assess the situation and decide

upon a recommendation for the CCC. The recommendation may entail recommending:

that the Crisis Management Team (CMT) be alerted or activated7; a disaster be declared for some, or all, of the business departments implementation of the Business Continuity Plan;5 Image, prestige, market share, or adverse member, legal, regulatory impact.6 Facility Team Liaison personnel assist the Team Leader in assessing the damage to the facility and determining if a disaster

declaration is justified. Liaison personnel will include, as required, representatives from Information Technology, Marketing, and keyvendors.7 Alerting or activating of the CMT may occur before the Facility Team assessment in some crisis/disaster scenarios.


10/50



recovery of damaged work areas be accomplished within other areas within ABC Corp HQ,or, workers whose work locations are damaged be relocated to alternate sites, and;

whether the IT Disaster Recovery Plan should be implemented with relocation of processing.Branch Incidents

For an incident damaging a Corporate branch facility, the Facility Team Leader, Branch Services, andBCC will coordinate with Information Technology, the Branch Manager and local facility vendors to

assess the situation and decide upon a recommended course of action for the CCC.

Information Technology Assessments

Only select Corporate people are allowed into restricted Information Technology work andequipment areas, thus necessitating the CIO to either lead, or designate an IT staff member to lead, all

physical damage assessments into IT restricted work and equipment areas.8

Standards and practices for other Information Technology damage assessments (e.g., breach, viruses,etc) are covered within the Security Standard and Practices IT.9

CMT Alerts & Disaster Declarations

Alerts-

If the initial information on an incident is insufficient to warrant activation of the CMT, but does

indicate the incident poses a potential threat to the Corporate, the CMT will- at CCC direction- be

placed on alert.

The Business Continuity Coordinator (BCC) shall work with the IT Team to implement a CMT alertnotification call and subsequent alert status call. The initial Alert call template is contained in

Appendix C of this document.

While on Alert, the Crisis Management Team (CMT) will reference the CMT Response Standardsand Practices contained in this document and prepare to implement appropriate measures to mitigate

the escalation of the event into a crisis/disaster, or respond to the event should it be deemed a

crisis/disaster and the CCC so direct:

The BCC shall schedule and conduct regular CMT status updates on the Alert.

8 Reference the Security Standard and Practices - IT9 Copies of this document can be obtained from the Corporate Security Officer.


11/50



Crises-

If an incident or event (or an impending/anticipated incident or event) poses a significant threat to

ABC, the CMT will be activated.The Business Continuity Coordinator (BCC) shall work with the IT Team to implement a CMT

activation notification call and subsequent CMT status call. The initial CMT status call template iscontained in Appendix C of this document.

CMT members shall reference the CMT Response Standards and Practices contained in this

document and their Business Continuity Plans, and assist the CCC in developing a Corporate crisis

response strategy. Upon finalization of a response strategy, CMT members shall develop andimplement department tasks in support of the Corporate response strategy.

Disasters

Should an event occur which prevents ABC from accomplishing/providing its critical information

business functions for an unacceptable amount of time, the CCC declare a disaster has occurred, andwill direct the implementation of applicable portions of the Business Continuity Plan.

Assessment And Notification Flow Diagrams

High level assessment and disaster declaration flow diagrams follow which visually detail incident

response, assessment and notification procedures.


12/50



DISASTER RECOVERY INITIATION- DURING WORK HOURS


13/50



DISASTER RECOVERY INITIATION- AFTER WORK HOURS


14/50



DISASTER RECOVERY CONTINUED


15/50



CMT RESPONSE STANDARDS & PRACTICES

Branch Services-

Responsible for coordination and interface with Branch staffs during response to crises anddisasters.10

Robbery Response- Branch Services will send an officer as a member of the CorporateEmergency Response Team to all events at a Branch where staff and/or members may havebeen traumatized, injured, or killed. Branch Services will be responsible for:

Providing notification of a robbery to the Security Officer and Human Resources. Assist or augment the Security Officer in initial notification of known facts concerning

the robbery to Marketing, which in turn shall commence Crisis Management Team

(CMT) and other notifications as documented in this chapter under Crisis

Communications.

Providing Branch Services leadership to the affected Branch staff.

Assisting the Emergency Response Team Human Resources representative in: Obtaining the names and contact information of all members and staff affected. Determining the status of all members and staff affected. Providing trauma and benefits counseling referral information as applicable-

to all affected members and staff.

In coordination with Marketing, providing notification of event to other branches. Assisting the Security Officer in:

Ensuring the protection of any crime scenes. Ensuring completion of robbery checklists and procedures.

Overseeing the auditing of cash drawers and vault as applicable to determine amountsof funds lost.

Assist the Security Officer, or a member of ERM Audit in: Having every cash drawer recounted and each tellers totals pulled. Auditing each robbed tellers drawer and vault if robbed. Making copy of totals, Teller Balance Sheet and Teller Over/Short sheet for

the Bond claim.

Facilities-

Pre-Disaster Responsibilities- Prequalification of salvage and other vendors which might be required for ABC Corp

HQ or branch facility disasters. Prequalification of vendors required to robust ABC branches for relocation of ABCCorp HQ workers, should the need exceed existing relocation workstations.

Ensure availability of after hour contact information for vendors which might berequired to assist the Team in the inspection of a the Corporate facility following adisaster (e.g., HVAC, electrical, plumbing, structural engineers).

10 See also Chapter 14- Hurricane, Tropical Storm of the Business Continuity Plan for additional Branch Services responsibilitiesduring such crises.


16/50



Maintenance off site of suitable equipment to facilitate initial inspection of ABC CorpHQ when access is permitted by First Responders.

Disaster Recovery Responsibilities- Phase 1-

Lead the Corporate initial building damage assessment.

Work to ensure damage containment (e.g., boarding up broken windows,shutting power off to damaged building, etc).

Recommendation of disaster declaration and high level relocation strategy(e.g., recover in place, relocate 5th floor workers) to the Corporate Contingency

Coordinator (CCC).

Work with the Corporate Security Officer to ensure security to preventpilfering and unintended building access.

Where an internal relocation of the Corporate workers is required, organizeand implement the relocation of personnel within ABC facilities.

Phase 2-

Arrange and oversee salvage operations. Set up damaged work area inspection by Business Recovery Teams andBusiness Recovery Team removal of select equipment & vital records.

Lead restoration of ABC facility or areas within a leased facility, orprocurement and build out of a new facility if one is to be procured.

Phase 3- Support movement of workers back into ABC facility or into new facility if

applicable.

Finance

Responsibilities:

Assess the adverse impacts of an event, or potential event, upon the corporations financesand recommend strategies to mitigate those risks and support the corporate crisis/disaster

response strategy.

If damage to a facility has occurred, determine how much of incurred damage will be coveredby insurance?

Work with Enterprise Risk Management and General Counsel to determine: what business resumption/ recovery costs associated with the crisis may be covered

by insurance, what documentation will be required by the bond holder, when payments can reasonably be expected, and assess recovery cost and insurance

payment impacts on Corporate finances.

Ensure procedures for capture and accounting for all expenses have been communicated toaffected areas of the company.


17/50



Review approval authority for various expense levels and/or types of expenditures anddetermine if changes are warranted during crisis response or recovery operations.

If deemed appropriate, authorize the use of verbal purchase orders for key vendors insupport of the recovery effort.

Review and verify all recovery related expenditures, to include: office equipment, furniture, and supplies; technology equipment and software; commercial facility rental; unique equipment; restoration and salvage; and, temporary personnel.

Ensure that a unique General Ledger Account or Project Number is used to record and trackrecovery expenses.

Review the following issues and concerns to ensure that the best interests of the corporationare met: ability to monitor and record all recovery-related expenditures; status of short-term investments; status and potential for short-term borrowing; and, ability to control money flows.

Has the company hired an insurance adjuster to work with insurers?General Counsel

The General Counsel is a member of the Crisis Management Team (CMT) and is the control andcoordination point for all legal and regulatory reviews and matters directly pertaining to business

continuity activities, to include review of all new contracts acquired as a result of the event.

Responsibilities include, but are not limited to:

Working with Marketing on public relations and formal communication, to provide adviceand legal counsel on risks associated with proposed public relations and employeecommunications.

Assist CEO and Marketing in notification of the Board of Directors. Provide, as directed, updates to the Board of Directors, both written and oral, for the

duration of the recovery effort.

Lead notification of Regulatory Agencies, Associations, and vendors. Serve as primary point-of-contact with Outside Counsel. Legal reviews of:

Contractual commitments- existing and made in response to the crisis/disaster.


18/50



Current contractual negotiations- to include merger and acquisitions. Report filing (NCUA, etc.). Current litigation. Timely response to customer complaint inquiries. Safety and insurance claims.

Possible litigation resulting from injury or death. Personnel management (e.g., pay and overtime policies). Compensation for trauma. Injury of visitors to the facility resulting in litigation.

Human Resource

Human Resources (HR) will:

Assess11- Assess the adverse impacts of an event, or potential event, upon Corporate personnel

and develop strategies to mitigate those impacts and support the corporate recoverystrategy.

Participate in the CMT status meetings. Acquire as much detail as possible regarding: Number and status of employees, members, or visitors fatally or seriously

injured.

Status and needs of impacted employees, members, or visitors families. Potential for additional injuries or fatalities.

Communications- Work with Marketing to craft a communications strategy and message on the event for

employees. Consider:

Using radio stations to announce a message with instructions for employees. Use of the employee severe weather line and make changes to the message

during response and/or recovery activities to keep employees informed.

Automated voice messages by IT to employee phones. Assign a Human Resources staff member, or obtain a vendor, to function as the

Employee Assistance Coordinator to assist dependents of injured employees and

establish a liaison with local medical authorities having jurisdiction and/or

involvement with affected persons.

Consider sending an HR Support Team to the site of the event, if a remote site. Ensure ongoing updates on injured persons.

File injury and fatality reports that may be required by federal, state, or localregulations.12 Coordinate this activity with the General Counsel.

Have Employee Assistance Coordinator provide families with the following: Telephone numbers for contacting Corporate officials who can provide

additional information to employees and their families.

11 If appropriate, direct the use of the Employee Assistance Assessment form available in the appendices of all departments BusinessContinuity Plan chapters as a tool for fully assessing employee status..12 Remember the OSHA 8 Hour Report if applicable.


19/50



Hot-line number that will address Workers Compensation issues. Contact number for health care professionals to address counseling, childcare,

and eldercare.

Ensure timely casualty notifications.

Staffing- Determine temporary and permanent replacement staffing requirements of affectedbusiness units.

Determine the availability of idle personnel who could temporarily fill business unitstaff requirements or support Command Center operations.

Ensure the rotation of personnel required to work overtime occurs throughout therecovery effort to prevent worker burnout.

CMT Reporting- Be prepared to verbally cover the following applicable issues in CMT callsand status updates:

status of all persons seriously injured; status of next-of-kin and employer notifications; statements and reactions of local civil authorities; potential employee relations exposures resulting from the event or business continuity

strategies, and,

temporary changes in corporate HR policy as required to support business continuityactivities, including such issues as:

payment of idle staff; dependent care and support; employee direct and indirect expenses; deferment of vacations, raises, promotions, etc.; and, rewards and compensation for personnel who have worked overtime, etc.,

during the recovery effort.

Robbery Response- A representative of the Human Resources department will respond as amember of the Corporate Emergency Response Team to all events at any Corporate facility

where staff and/or members may have been traumatized, injured, or killed. This member willbe responsible for:

Obtaining the names and contact information of all members and staff affected. Determining the status of all members and staff affected. Providing trauma and benefits counseling referral information as applicable- to all

affected members and staff.

Ensure proper notification of families of injured or killed staff and members occurs. Provide, as required, transportation home for affected employees and members. Providing post-event follow-up status checks with all members and staff.

Post Crisis/Disaster- Upon completion of recovery operations, work with the CMT onpossible rewards to employees who made significant contributions to the recovery.


20/50



Information Technology

The CIO- as Information Technology Team Leader and a member of the CMT is responsible forleadership of the Information Technology Team.

Information Technology (IT) Team is responsible for13

:

Event Assessments- The CIO, will ensure IT augmentation of the Facilities Team in theassessment of events wherein there is damage, or threat of damage, to Corporate facilities that

might affect either Corporate information technology or telephony.

Damage Assessment Responsibilities- The Information Technology (IT) team members, when augmenting the

Facilities Team in damage assessments, shall concentrating their efforts on

assessing damage/impact on information technology and telecommunications

equipment (e.g., mainframe/mid-range systems, Shortel, PCs, printers, faxes,

etc.) If the Data Center is adversely affected by a disaster and cannot perform its

critical business support functions, the IT Team will assess the situation and

make recommendation to the Corporate Contingency Coordinator on whetherto recover IT in place, or shift production to the remote disaster recovery

systems.

Strategy Development- The IT Team is responsible for assessing the adverse impacts of anevent, or potential event, upon information technology and telephony and developing

strategies and actions to mitigate those impacts and support the corporate recovery strategy.

See also the Security Standards and Practices IT.

Communications- The IT Team will coordinating the IT recovery/mitigation strategy andactions with other business units through the CMT.

Worker Relocation Support- The IT Team is responsible for supporting the relocation ofworkers, to include:

Pre-qualification of personal PCs to be used by workers designated to telecommutein their department business continuity plans.

PC buildout at alternate work locations in accordance with department requirementsand CMT designated relocation sites.

Restoration of IT and telephony within damaged work areas in Corporate facilities. Telephony for alternate work locations. Printer and fax support at alternate work locations and restoration of services in work

areas.

Salvage- The IT Team will coordinate the removal of salvageable IT items through Facilities.

13 See also the Security Standards and Practices- IT.


21/50



Insurance Claims

Enterprise Risk Management (ERM) is responsible for managing claims such as property loss,

business interruption insurance losses, auto liability, general liability, and worker compensation.

ERM will:

Notify the insurer of the loss. Determine and provide to Finance a list of damages and business resumption costs the bond

company should cover, and deductibles for the various categories.

Ensure permission is proved by insurer to begin procurement of equipment and services forrecovery of the facility and/or operations.

Coordinate for a professional claims adjuster to represent the Corporate in dealing with, andprocessing claims with, the insurer.

Coordinate site reviews and oversee initial insurance adjustment activities. After the initial inspection has been performed, meet with insurance broker representative and

adjusters:

Based on specific details of the incident and the current condition of thefacility/contents, review applicable insurance coverage.

Discuss any reporting requirements and forms and request assistance in completing aninitial claim submission.

Prepare an estimate of initial funds that are required. Engage IT, Facilities, andFinance in developing this estimate.

Obtain a commitment for the availability of funds. Discuss any site and equipment restoration restrictions and procedures, including

coordination with insurance adjusters and the number of bids required for restoration

work. Have Facilities participate in this discussion.

Determine if additional temporary insurance coverage is required for resumptionactivities or alternate facilities and equipment.

Ensure Finance coordinated procedures are available and disseminated to all departments fordocumenting costs associated with the recovery and covered by insurance. NOTE: businessresumption insurance, and what is covered by that insurance will not be well understood by

Corporate personnel.

Ensure Corporate claim adjuster works with departments suffering a loss on properlydocumenting claims.

Determine insurance concerns associated with contents and extra expense for: Damage assessment; Site and equipment restoration;


22/50



Recovery operations; Acquisition of commercial facilities; and, Actions being taken to prevent or reduce additional damage.

Ensure timely preparation and presentation of preliminary claims for insurancereimbursement.

Member Services

Member Services shall make every effort to ensure targeted operational measurements are maintained

during the crisis or disaster analyzing:

Staffing needs to support anticipated call levels. Need to re-direct calls to vendors. Coordination with Marketing for approved answers to anticipated member questions on thecrisis and its impacts on the Corporate.Public Relations

Marketing will be responsible for all statements, comments, and information disseminated to the

news media, members, and all other external entities.

Marketing will work with the General Counsel and Human Resources in drafting internal employee

communications and general communications releases.

Detailed crisis communications guidance is contained later in this document under the CrisisCommunications section. The following checklist provides a quick reference of items to consider inthe early hours of a crisis/disaster response.

Assess the adverse impacts of an event, or potential event, upon Corporate public relationsand determine what communication strategy is best and how is it to be implemented?

Are media releases or interviews going to be required and if so, has a mediaspokesperson been named?

Will media training for the spokesperson be required? Is a technical expert required to provide clarity to the situation and/or

disseminate information to the media?

Should a media center be established? If so, where? How will this be communicated to the media/others? Ensure the media center is large enough to accommodate several media

representatives as well as one-on-one interviews.

If interviews will be used, provide the spokesperson with: Spokesperson guidelines. List of potential questions. Appropriate statements and responses.


23/50



How should the status of disaster and/or events be communicated to employees, members,and vendors?

Are appropriate security measures established to prevent unauthorized access of the media torestricted and damaged areas? (Work with Security on this)

Acquire updates regarding the event occurrence and disposition of the injured from the CrisisManagement Team.

Media strategy best practices summary: Contact the news desk editor at each newspaper, television, and radio station using

trade press contacts.

Provide each with a telephone number where the Marketing spokesperson canbe reached.

Inform each of the existence of the "Media Center. Produce "media kits" containing the following information for distribution to various

newspaper, television stations, and radio stations:

Location of incident; General description of incident; Presence or absence of injuries; Date Business Recovery Plan first created; Date of the last Business Recovery Plan exercise; Corrective measures being taken; and, Description of impacts.

Arrange interviews and press conferences, as required.

Coordinate information dissemination in the following manner: Prepare and distribute scripts to all Corporate locations that can be used asacceptable responses from non-management staff. Coordinate this activity

with Branch Services.

In coordination with the General Counsel, communicate with federal, state, andcity officials to notify them of the crisis situation. If deemed appropriate,provide anticipated recovery strategies.

Prepare written and oral communications detailing the situation and corporateplan of action. Coordinate efforts with business units in disseminating

information to various external entities; and,

Determine if event related advertising should be used. If so, develop anappropriate advertising strategy.

Proactively addresses reputation issues with the media, community andstakeholders.

Enlist the aid of external public relations and advertising firms, as required, toassist in the following:


24/50



Security

The Corporate Security Officer is responsible for security. Responsibilities include:

Assessment of all incidents to determine threat to Executives, staff, and members.

Notification of, and liaison with, local authorities having jurisdiction and/or involvement in anincident.

Coordination with Facilities to ensure the security of vacated or damaged facility(ies) as soonas possible following an incident.

Coordination of activation of security command posts at alternate operating locationsif required, and implementation of access control procedures.

Reporting status of and coordinating crowd control (e.g., looters, trespassers, generalpublic).

Coordination with Facilities and vendors to ensure procedures are in place for the properdocumentation of removal or delivery of company supplies and other assets (e.g., salvageoperations).

Identification of, and providing for, security arrangements required at worker relocation sites. Oversight of security system repairs and/or replacement in coordination with Facilities. Develop security measures required for any new facility occupied as a result of the crisis. Close coordination with CIO on any IT security breaches or incidents affecting IT. See alsoSecurity Standards and Practices- IT. Robbery Response- The Corporate Security Officer will respond as a member of the

Corporate Emergency Response Team to all events at any Corporate facility where staff

and/or members may have been traumatized, injured, or killed. The Security Officer, orhis/her representative, will be responsible for:

Providing notification of a robbery to Branch Services and Human Resources. Initial notification of known facts concerning the robbery to Marketing, which in turn

shall commence Crisis Management Team (CMT) and other notifications as

documented in this chapter under Crisis Communications.

Notification of the FBI. Liaison with law enforcement and other first responders. Providing color DVR pictures of robbers to law enforcement and AVI copies of the

videos within 48 hours of the robbery.

Protection of the crime scene. Full completion of robbery checklists and procedures. Ensuring security of staff, members, and facilities affected. Status reporting to the CMT.


25/50



Authoring a post-event Incident Report for senior management. The Security Officer, or a member of ERM Audit will:

Have every cash drawer recounted and each tellers totals pulled. Audit each robbed tellers drawer and vault if robbed. Make copy of totals, Teller Balance Sheet and Teller Over/Short sheet for the

Bond claim.

Vital Records Retrieval & Salvage

Records Management is represented in the CMT by Facilities, which is responsible for records

retrieval from offsite storage and salvage of onsite records. The Facilities Team will:

Assess the adverse impacts of an event, or potential event, upon on site Corporate vital paperrecords.

Coordinate salvage priorities with CMT members and oversee salvage operations. To thatend, Facilities will: If/when conditions permit, schedule departments back into their work areas to retrieve

undamaged paper records and files.

Contract with a salvage vendor and providing a prioritized list of paper records to besalvaged, oversee salvage operations.

Coordinate record retrieval of departments critical paper records from offsite storage asrequired by the departments.

Archival and recovery data should be separately stored and clearly marked accordingto functional area and department. Recovery materials should be easy to identify,

access, and retrieve.

Determine changes to current pick-up and delivery schedules for storage and retrieval ofrecords.


26/50



CRISIS COMMUNICATIONS

General Guidance

The Vice President, Marketing, working with the Crisis Management Team, will direct all

communications in response to any controversial issue, crisis, or disaster.

This section of the Business Continuity Plan provides policies and procedures for the co-ordination ofcommunications within the Corporate, and between the Corporate and any applicable outside

agencies (e.g. - the media, regulatory agencies, customers, suppliers, stakeholders [e.g., board of

directors] and the public) in the event of controversial issue, crisis, or disaster. Crises/disasters mayinclude fires, bomb threats, natural disasters, or major crimes. Controversial issues may include

police investigations, protests or other situations that demand a public response.

Objectives

To factually assess any controversial issue, crisis, or disaster and determine whether acommunications response is warranted, and if so, how to communicate to the media,

employees, and members.

To facilitate the rapid: Identification of those parties that should be informed about the situation. Accurate determination of facts about the situation. Squelching of rumors.

Control of information flow concerning the situation.

Marketing Responsibilities

The VP of Marketing as the Corporate Crisis Communications manager will:

Internal Preparation Prior to Crisis. Have policies, phone lists, personnel and samplemedia responses in place.

Designation Of Spokesperson. Designate a spokesperson to release information to staff,media, and the public. Only the designated spokesperson is authorized to release information

to the media and to the public. All other staff, board, and CMT members should beprofessional and helpful to the media by connecting them with the spokesperson, but will

neither speak to the media, nor provide any information.

Issue e-mail reminder in all crisis/disaster alerts or CMT activations to all staff thatany media calls must be referred to Marketing.


27/50



Availability- Position media relations personnel at appropriate sites where media can be expected

to appear.

Determine whether photography of the site will be permitted if it is company property.

Provide escorts for media as required.

Communications. In coordination with HR and General Counsel will: Prepare, if required, a statement for media inquiries. Statement will reflect the

organizations overall messages, leadership role, and resource status. Will attempt toreinforce the positive and be action/solution oriented if possible

Create scripts for internal stakeholders and external stakeholders to include: Scripts for Member Services use in answering member inquiries on any

incident.

Corporate web messages/warnings for members on any incidents. Develop employee notification messages.

Ensure, if appropriate, the media has access to background, statistics, photographs orother existing materials.

Message Best Practices Keep messages to all stakeholders simple and focused. Ensure the messages are factual situation reports. Define action being taken by the company to correct the problem or minimize its

effects.

Do not speculate on causes, potential effects on the companys ability to provideservice, financial implications, the extent of damage or injuries, costs of correcting orresolving the problem, potential legal challenges, liabilities, or any other unapproved

information, including frequency of such occurrences in the industry.

Record Keeping. Document all formal communications on the crisis/disaster and mediaquestions regarding the crisis situation in order to effectively evaluate crisis communicationsmanagement.

Log all media contacts, including names of reporters, dates, times, questions asked andresponses given.

Media/Message Evaluation. Evaluate appropriateness and traction of messages throughoutthe situation and revise as appropriate.

Communication Updates. Ensure key audiences are kept up to date. Methods may include: Sending communications to members via the listserv or broadcast email. Promptly returning phone calls. Posting a statement on the web site and updating it regularly. Updating the organizations voicemail. Social web sites.


28/50



Advertising

Crisis/Disaster Related Paid Advertising- Paid advertising addressing in some fashion thecrisis/disaster and anticipated member concerns may offer greater control over the companys

message and targeting of the message to specific external, and sometimes internal, audiences.

Existing Advertising- Immediate decisions must be made concerning on-going advertisingefforts if the crisis will continue for a period of time.

Considerations Pre-crisis advertising, for example, in anticipation of an approaching storm, may be an

opportunity to provide preparedness messages as a community service.

Advertising during a crisis usually is required when the companys messages are notbeing speedily or adequately reflected in media coverage.

Post-crisis advertising can acknowledge the efforts of employees and showcase thecompanys service reliability, or offer services to assist in community recovery efforts(e.g., low cost loans).

Consider polling for effectiveness among key audiences.Regulatory Communications

Communications with Regulatory Agencies will only be initiated in close coordination with the

General Counsel.

Robbery Communications

Security- Responsible for initial notification of Branch Services and Marketing of anyrobberies.

Marketing- Orchestrate all additional communications on the robbery with pre-designation ofspokespersons as follows:

Marketing will handle All media inquiries and statements. Updates of the CMT.

The Corporate Contingency Coordinator14 shall notify the Board. Branch Services will notify all other branches. Human Resources will notify the general employee population.

Sample Communications For Use In Robberies Media Statement

At approximately , the XXX branch of ABC, located at XXXXRoad, was robbed and an undisclosed amount of funds was taken.

Corporate protocols to ensure the safety of employees and members

present in the branch were followed precisely by the Georgias Own

14 The Corporate Contingency Coordinator is the CEO.


29/50



employees and police arrived on the scene shortly thereafter. There wereno injuries and staff is currently working with officials to resolve the

incident, OR, there are initial reports of some injuries at the Branch,

however, we cannot confirm these reports or expand upon them at thistime.

Branch CommunicationsUrgent & Confidential

Please be advised that the XXX location was robbed at approximately

. No one was injured and the police have responded OR there

are initial reports of some injuries at the Branch, however, we cannot

confirm these reports or expand upon them at this time. In accordancewith our robbery procedures the Branch has been closed and should not

be contacted at this time. Do not access the Branch DVR, as this will

interfere with Security robbery response requirements for access to theDVR. We will keep you posted as we learn more. Please direct any

media inquiries to the SVP of Marketing, and feel free to contact me

with questions. All StaffAt approximately , our XXX Branch was robbed. Fortunately,

no employee or member was injured OR there are initial reports of someinjuries at the Branch, however, we cannot confirm these reports or

expand upon them at this time. While police are currently on the scene

and we are awaiting details, we do know that the XXX staff responded

according to all robbery procedures and guidance, and we are proud oftheir professionalism and composure during this high stress situation. As

you know, our number one priority is the safety of our staff and ourmembers and we remain grateful for their well-being. Our emergency

response team has been dispatched, and is currently at the scene. Media

inquiries should be directed to the SVP of Marketing.

Vice President/Crisis Management TeamPlease be advised that the XXX location was robbed at approximately

. No one was injured, OR, there are initial reports of someinjuries at the Branch, however, we cannot confirm these reports or

expand upon them at this time..

Until we learn more, the paragraph below will serve as the official media

statement. Human Resources will be communicating with all members

of the staff as quickly as feasible. Please direct any media inquires to the

SVP of Marketing.---------------------------------------------------------------------------------------

At approximately , the XXX branch of ABC, located at XXXX

Road, was robbed and an undisclosed amount of funds was taken.Corporate protocols to ensure the safety of employees and members

present in the branch were followed precisely by the Georgias Own

employees and police arrived on the scene shortly thereafter. There wereno injuries and staff is currently working with officials to resolve the

incident, OR, there are initial reports of some injuries at the Branch,


30/50



however, we cannot confirm these reports or expand upon them at thistime.

Board EmailAt approximately , the XXX branch of ABC, located at XXXXRoad, was robbed and an undisclosed amount of funds was taken.

Corporate protocols to ensure the safety of employees and memberspresent in the branch were followed precisely by the Georgias Ownemployees and police arrived on the scene shortly thereafter.

At present, it is our understanding that the teller drawers were emptied.

Fortunately, no members or employees were injured OR, there are initialreports of some injuries at the Branch, however, we cannot confirm

these reports or expand upon them at this time.

Currently, police are on the scene, as is the Georgias Own Robbery

Response Team. We are awaiting details of the investigation. Both

involved staff and members will be offered professional counselingservices, and we continue to grateful for the safety of those involved. I

will provide an additional update as we learn more.


31/50



APPENDIX A Crisis Management Team Contact Information

Corporate Contingency Coordinator (CCC)Name

Office:

Home:

Cell:

Address:

Comments:

Alt Corporate Contingency Coordinator Alt Corporate Contingency Coordinator

Name Name

Office: Office:

Home: Home:

Cell: Cell:Address: Address:

Comments: Comments:

Business Continuity Coordinator Alt Business Continuity Coordinator

Name Name

Office: Office:

Home: Home:

Cell: Cell:

Address: Address:

Comments: Comments:

Facility Team Leader Alt Facility Team Leader

Name Name Office: Office:

Home: Home:

Cell: Cell:

Address: Address:

Comments: Comments:

Member Services Team Leader Alt Member Services Team Leader

Name Name

Office: Office:

Home: Home:

Cell: Cell:

Address: Address:

Comments: Comments:


32/50



IT Team Leader Alt IT Team Leader

Name Name

Office: Office:

Home: Home:

Cell: Cell:

Address: Address:Comments: Comments:

Human Resources Team Leader Alt Human Resources Team Leader

Name Name

Office: Office:

Home: Home:

Cell: Cell:

Address: Address:

Comments: Comments:

Lending Team Leader Alt Lending Team Leader

Name Name

Office: Office:

Home: Home:

Cell: Cell:

Address: Address:

Comments: Comments:

General Counsel Alt Legal Leader

Name Name

Office: Office:

Home: Home:

Cell: Cell:

Address: Address:

Comments: Comments:

Branch Services Team Leader Alt Branch Services Team LeaderName Name

Office: Office:

Home: Home:

Cell: Cell:

Address: Address:

Comments: Comments:


33/50



APPENDIX B- Initial Incident Report Form

INITIAL INCIDENT REPORT FORM

LOCATION: Date: Time:

DESCRIPTION OF INCIDENT-

Fire Storm Power HAZMAT IT Bomb Other:

Other:

STATUS Under ControlNot under control; can be

handled with local

resources

Not under control;

requires additional

resources

Not under control; disaster

declaration needed

IMPACTS

PERSONNEL

Injured: Fatalities: Unaccounted for:

PROPERTY

OPERATIONS

COMMUNITY

ENVIRONMENT

RESPONSE

STRATEGY

HELPREQUESTED

Technical

Legal

HR

PR

Environmental

Medical

Financial

Insurance

Facilities


34/50



APPENDIX C Initial Crisis Management Team Call Script

INITIAL CMT STATUS CALLRESPONSIBLE SUBJECTS NOTES

OPENING REMARKS

Corporate

Contingency

Coordinator

Or

Business

Continuity

Coordinator

This is a confidential internal theCorporate call. All vendors and suppliers

must identify themselves

There has been an incident at XXX.This incident represents a threat to theCorporate and requires the

(Alerting/Activation) of the CrisisManagement Team.

At this time a disaster (has/has not) beendeclared

We are now going to go over what weknow, answer what questions we can,

and conduct a follow-up status call in 3hours.

(No Disaster Declaration) During thattime each of you should review your

Crisis Management Checklists andBusiness Continuity Plans to be prepared

to respond to this even should we declarea disaster or need to respond.

(Disaster Declared) Following this call,those Teams directed to do so will begin

to implement their chapters of thebusiness continuity plan. Other teams

should review their Crisis Management

Checklists and Business Continuity Plan

chapters to determine how they cansupport the recovery effort and/or be

prepared to implement their Business

Continuity Plans if later required.

RESPONSIBLE SUBJECTS NOTES


35/50



FACILITIES IMPACT & AFFECTS ON the Corporate(Only if a Facility Crisis or Disaster)

Facility Team

Leader, or Branch

Manager

Physical Building

Impacto Building structureo Access to the buildingo Building infrastructure (e.g., power,

HVAC, water)

o Damage by floor Building furnishings Workstations

Estimated time when building will be

accessible

Rules for accessing the building

Estimate for return to normal operations in

facility (if practical)

IT IMPACT & AFFECTS ON the Corporate(Only if a Crisis or Disaster affecting IT)

IT

(if Facility Team Leader isunavailable for thismeeting, be prepared to

address Facility informationabove if a ABC Corp HQdisaster)

Data Center Status

Physical

Summary of impact on ITo Networko emailo Phone Systemo Core Systemo Other Systemso PCso User impacts

Status of any ongoing recovery/responseefforts

Action plan and time until affectedsystems are expected to be brought back

online/repaired

Each Recovery

Team Leader(as applicable)

Personnel status & availability, to include:

Status of personnel- injured/killed/availableAre any key people unavailable (travel,

injured, etc)

Are enough team members available torecover the Teams functions

CMT GUIDANCE


36/50



CCC

Initial Crisis/Disaster Recovery Response

Strategy discussion

Goals, objectives, and milestones for therecovery operation sketched out, ordirectTeams to develop same for their areas

prior to next Status Call.GENERAL GUIDANCE FOR ACTION PRIOR TO NEXT STATUS CALL

(If Applicable)

Finance Leader

Purchasing

Emergency requisition and procurementprocedures- if any are to be used

Finance

Status on fundsAccount codes to use for recovery

purchases and expenses

Instructions to track cost/expenses-o use form in Business Continuity Plan,

or other?

ERM Information needed for insurance claim

Marketing

Communications

Howo Employeeso Mediao Members

WhenContact information for press

Business

Continuity

Coordinator

Command Centero location (if known)o opening time (if known)

Next CMT Status call- time (generally 3hours)

Make available copies of CMP to CMT


37/50



APPENDIX D Status Call Template

The CMT ongoing status reported will occur at periodic intervals during the crisis or disaster. This

status report form will be used to gather and document information from the status call andsubsequently sent, if possible, by email to CMT and other key stakeholders. Topics to be covered

and responsible parties are listed below

CMT STATUS CALL

Crisis/Disaster:

Disaster Start Date

& Time

Call Date and Time:

CMT Call Chair

OPENING REMARKS


Call Chair

This is a confidential internal the Corporatecall. All vendors and suppliers must

identify themselves.


38/50



FACILITIES IMPACT & AFFECTS ON the Corporate(Only if a Facility Crisis or Disaster)

Facility Team

Leader, or Branch

Manager

Physical Building

Impacto Building structureo Access to the buildingo Building infrastructure (e.g., power,

HVAC, water)

o Damage by floor Building furnishings Workstations

Update on estimated time when buildingwill be accessible

Rules for accessing the buildingUpdate on estimate for return to normal

operations in facility (if practical)

IT IMPACT & AFFECTS ON the Corporate(Only if a Crisis or Disaster affecting IT)


IT

Update on Data Center statusPhysical

Summary of recovery effortso Networko emailo Phone Systemo Core Systemo Other Systemso PCso User impacts

Status of worker relocation sites (ifapplicable)

Action plan and time until affectedsystems are expected to be brought back

online/repaired

Each RecoveryTeam Leader

(as applicable)

If in recovery operations, status ofrecovery operations for Team

If Team is supporting the Corporateresponse to a crisis or disaster which

does not require the Team to recover its

critical business processes, what actionsare they recommending or taking to

support the corporate response? Status?


39/50



GENERAL GUIDANCE


Marketing

Communications

How and whato Employeeso Mediao Members

Contact information for press


40/50



APPENDIX E - Command Centers

Prequalified Locations

The following Command Center locations have been pre-qualified by the Business ContinuityCoordinator as having sufficient facilities and infrastructure to support ABCs Command Center and

relocation of Executives if required.

Facility Address Contact Number

ABC Corp HQ Peachtree

Room

1155 Peachtree

2nd Floor

Atlanta, GA 30309

Marriott Century Center2000 Century Boulevard NE

Atlanta, GA 30345404.982.9963

Marriott Alpharetta

5750 Windward Parkway

Alpharetta, GA 30005 770.754.9600

Loews Hotel Atlanta1065 Peachtree Street NE

Atlanta, GA 30309404.745.5740

Activation

Activation of a Command Center and/or Executive relocation site will be at the direction of the

Corporate Contingency Coordinator. Notification and contracting of the selected facility, setup of theCommand Center and its operational support shall be the responsibility of the Enterprise Risk

Management AVP of Compliance, referred to hereinafter as the Command Center/Executive

Relocation Leader.

Should none of the pre-qualified Command Center/Executive Relocation Sites be available, the

Command Center/Executive Relocation Leader shall work with the BCC and Facility Team Leader toprocure another site.

Staffing

The Command Center Support Staff shall report to the Command Center/Executive Relocation Lead,

and is initially staffed by Enterprise Risk Management and the Crisis Management Teams

Administrative Assistants.

When required, this staff will be augmented by, and in longer term recovery operations replaced by,other personnel from various departments when and as directed by the Corporate ContingencyCoordinator (CCC).


41/50



The Support Staff will assist the Command Center/Executive Relocation Lead in:

Notifying the selected Command Center facility of activation of the command center andcontract for its use and space for Executive offices if required.

Begin setup of the Command Center, ensuring that adequate furniture, fixtures, telephones,web connectivity, PCs, and space are provided in accordance with this Plan.

Determine working arrangement and post signs showing where CMT department groups sit. Coordinate for personnel to secure the command center and restrict access to Corporate

personnel and vendors required for Command Center setup. Ensure security personnel at theCommand Center have a CMT roster to permit timely entry of the CMT into the facility.

Buildout

Requirements for the buildout of the Command Center and Executive relocation offices will vary

based upon the nature and expected duration of the crisis or disaster. Many time, neither will berequired, however, in a protracted loss of accessibility and use of ABC Corp HQ, both may be

required. This Plan supports the latter.

Initial preparation of the Command Center for CMT meetings early in the disaster response- Overhead projector Whiteboard ~35 chairs Post Restricted Area signs outside of room and arrange for security to keep all but the

CMT members (primaries and alternates) out.

Subsequent buildout of the Command Center if the CMT will work from the CommandCenter will require:

At least one mini-conference room for small meetings and a large conference room setup as described below.

One mid size conference room (or hotel room) for mail handling. ~ 15 tables with two chairs and signage designating which table serves which

department/group One table per CMT department (i.e., Facilities, HR, Branch Services, Marketing,

Member Services, Lending, EFT/Payment Services, Finance, IT, ERM,

Consumer Lending, General Counsel) One for Business Continuity Coordinator (BCC) and Alternate BCC One for Command Center/Executive Relocation Lead

13 wireless internet capable corporate PC (1 per table) Wireless internet connectivity within the Command Center capable of supporting a

minimum of ~26 internet connections

13 cell phones ( 1 assigned per table) or wired telephones if available Projection of television news Transistor radio Printers and copiers (ready access to) 1 Fax (ready access to) Office supplies

paper and pens


42/50



markers tape and staplers

7x24 Administrative support


43/50



Remote Command Center Diagrams

Atlanta Marriott Alpharetta


44/50



Atlanta Marriott Century Center


45/50



APPENDIX F- Worker Relocation

The initial assessment of an event affecting a Corporate facility must determine not only if theBusiness Continuity Plan should be activated, but also if the facility and infrastructure affected by the

event can sustain corporate business functions while restoration of the facility is completed, or if part,or all, of the Corporate workers in the facility should be relocated to alternate work locations.

ABC Corp HQ Disasters

In Facility Recoveries -

If work areas have been damaged within ABC Corp HQ, but alternate work locations for all affected

workers can be provided within other areas in ABC Corp HQ, affected workers may be relocated to:

Unoccupied cubes elsewhere in the facility. Share workstations elsewhere in the facility using shift work. Pre-wired conference rooms. Emergency work areas set up utilizing new PCs, wireless connectivity, and VPN.Out Of Facility Recoveries-

In a disaster wherein ABC Corp HQ becomes unusable, the below tables reflect the department

requirements for alternate work locations.

Figure 2 reflects thenumbers of workers the

various recovery teams

plan on working fromhome, with annotation as to

whether the workers will

be using personal PCs orcompany laptops.

The IT Team must pre-qualify personal PCs to

ensure they can connect tothe corporate systems and

ensure they can beconnected in a timely

manner.

Figure 3 shows, byFigure 2


46/50



department, the requirements for workstations15 at an alternate work location.

Figure 3

Worker Relocation Strategies-

At present there are approximately 29 emergency workstations in the Site 1 and Site 2 branches

equipped with tables, chairs, credit union PCs and some limited phones. These are obviouslyinsufficient to support worker relocations requirements in a disaster which makes ABC Corp HQ

unavailable for an extended period of time.

In such a situation, the Crisis Management Team will examine available assets and worker relocation

requirements, and assigned workers to:

Telecommute from their homes utilizing company laptops and personal PCs. Available workstations in Site 1 and Site 2 branches.16 Unoccupied offices within branches. Alternate work stations built out at qualified hotels.Using Hotels For Alternate Work Locations

Hotels designated as potential Command Center sites in this document have also been qualified as

potential alternate work locations.17 All hotels have convention facilities with:

Conference rooms of suitable number and size to support a substantial number of workers. Adequate internet wireless capacity and power to handle 100+ PCs. Adequate staff and equipment to rapidly build out the conference rooms with tables, chairs

and power cords.

15 Workstation is defined as a desk, chair, corporate PC, phone, and access to the internet, mail, copier, printer and fax.16 These two branches can support 29 workstations, which should accommodate ~43 workers in working shifts.17 See Appendix E.


47/50



Adequate breakout rooms for discussions. Large hallways for wireless printers and faxes. Adequate parking for large numbers of workers. Adequate facilities and food access. Rooms for Executive office relocations.Workstations

Bearing in mind that disaster recovery is not business as usual, for planning purposes, eachworkstation built out should generally be able to handle 1.5 workers through the use of shift work.

Thus to relocate 60 workers, properly utilized, 40 workstations should, in most cases, be adequate.

In a mass relocation, either laptops with wireless cards installed, or wireless adapters for desktop

computers should be procured for relocating workers. Use of VPN connectivity would be required,

per the Security Standards and Practices for IT, as the network would not be dedicated to theCorporate.

For telecommunications, those workers which require telephones should use company providedBlackberries or other company provided cell phones.

18

While there are no guarantees that all qualified hotels will be fully available, several have been

qualified and should provide adequate space. If, on the remote chance, none area available, Marriottshould be contacted for available full service Marriott conference facilities within the metropolitan

area.

Branch Disasters19-

Damage to a branch shall generally result in the Facility Team taking the lead in refurbishing the

branch with IT and Security assisting. Whether the branch remains in operation or not depends uponthe extent of the damage to the facility and/or staff. If a branch is closed for renovation, relocation of

branch personnel to other branches will be at the discretion of Branch Services.

Executive Relocation-

Most Executives at, or above, the Vice President level serve as core members of the CrisisManagement Team (CMT). If during a crisis, or following a disaster, ABC Corp HQ is unavailable

for use by the Crisis Management Team, one of the pre-designated Corporate Command Centers will

be opened for use by the CMT and 13 hotel rooms in the hotel providing the Command Center will beset up to serve as offices for Executives. If relocation will be for a protracted period the Command

Center staff will ask the hotel to remove beds and make additional tables, chairs and lighting available.

18 Substantial numbers of cell phones with prepaid but rechargeable cards can be procured on relatively short notice and without

contracts. These phones can be kept and stored by the company after the disaster at little-to-no cost for reactivation in future disasters.19 See also Chapter 14, Hurricane/Tropical Storms for additional guidance on Branch disasters.


48/50

AB


APPENDIX G- Vital Records Salvage Priorities

Department Vital RecordLocation

and

Storage

If not stored offsite, where canrecovered?

Lending Mortgage In-process Files 1 Prime Alliance

Branch

ServicesCombinations 11 None

FacilitiesDrawings, receipts, photos of ABC

Corp HQ and Branches not digitized5

Most are not available from other so

to be added to salvage plan when co

General

Counsel

Contracts, litigation files, bond copies,

etc.11

Contracts could be recovered froparty.

New legal paperwork being scanstored on shared file server.

Historical garnishment, subpoenlevies sent to Iron Mountain

ERM Fraud Case Files 5 Sent off site periodically

Lending Home Equity Files- In Process 1 None

Consumer

Lending Auto titles 4 Have to get a replacement title

ERM BSA CTR/SARs/OFAC Scans 5 Sent off site periodically


49/50

AB


Department Vital Record

Location

and

Storage

If not stored offsite, where can

recovered?


50/50


APPENDIX H- Recovery Task Log

TEAM RECOVERY TASKS LOG

Recovery Strategy Place summary of Team strategy here

TASKSTo Be Assigned

To

Expected

Completion

StatusOn Schedule

At Risk

Late

Complete

Documents

Chapter 01 Crisis Management Sample