THE PURPOSE OF A BCP: TO GET YOUR BUSINESS UP-AND-RUNNING AS QUICKLY AS POSSIBLE, FOLLOWING A DISASTER -- WHETHER NATURAL OR MAN-MADE.

If time or staff is limited--or your company just needs guidance to get you on the right tract-consider engaging a BCP consultant to assist with project planning, testing, updating and maintenance. At Business Continuity - BCP, we provide inventory and analysis of your existing human and physical infrastructure to evaluate and determine your crucial Business Continuity Planning needs. A BC plan is a dynamic instrument that, once complete, must be consistently updated and maintained, over time. But rewards, for effort expended, can be tremendous in the face of a natural or man-made catastrophe. Today, we live and work in a fast-paced, risk prone environment. It necessitates facilitation of business continuity and disaster recovery planning in order to protect your investment of time, talent, effort, and resources. In turn, it helps our economy thrive in the good times...and survive during difficult periods. To do this, you must analyze and assess all potential risks to--and impacts upon--your business that could possibly shut you down. Depending on circumstances, the risks could include a tornado, hurricane, flash flood, fire, earthquake, power blackout or power spikes, terrorist attacks, a biological epidemic, or other disasters. Determine what you can do to provide added protection to your own business. Consider what needs to be done to protect your employees, their families, and the economy of your community. After all, why take chances that--in spite of all your brilliant efforts--your company could permanently close due to a natural or man-made disaster such as a blizzard or ice storm, a chemical spill, or a cyber attack. A "BC" plan is not meant to be overblown. Not every element needs to be completed at one time. Nor does every element (below) need to be in a plan. Begin with the segments that best suit your immediate needs. Then, over time, fine-tune and improve on the model. Finally, test and evaluate, and maintain your plan at least on an annual basis.

THE BCP OUTLINE, BELOW, IS ONLY MEANT TO BE A GUIDE. THERE ARE A NUMBER OF WAYS TO ESTABLISH A PLAN. THIS IS ONE EXAMPLE. CONTACT US IF YOU NEED ASSISTANCE IN BUILDING OR COMPLETING YOUR OWN PLAN.

HERE ARE YOUR COMPLIMENTARY FOUNDATION BASICS--IN OUTLINE FORM-TO CONSIDER WHEN YOU OR YOUR BUSINESS CONTINUITY TEAM, OR CONSULTANT ESTABLISHES A BC PLAN: FREE SAMPLE BCP OUTLINE: A. INDEX B. STATEMENT OF MISSION What objectives do you wish to accomplish? Be specific C. MANAGEMENT ENDORSEMENT LETTER You must gain management endorsement to have a successful plan D. Part I - STANDARD DISASTER RECOVERY POLICIES 1. Introduction a. The full scope and objectives of the plan b. Project background description 2. Establish Key Personnel & Form Emergency Teams a. EMT - Emergency Management Team (Including HR) b. DAT - Damage Assessment Team (Including Security) c. SMT - Senior Management Team d. BURs - Business Unit Representatives 3. Form / Negotiate Joint-Powers Agreements e. External Vendor Contacts, Agencies , & Community Reps 1. Upstream & Downstream Suppliers 2. Police, Fire, EMTs, Public Health 3. FBI, CDC, and other Government Agencies 4. Assign Damage, Emergency and Other Team Responsibilities a. SMT - Senior Management Team

b. EMT - Emergency Management Team (Including HR) c. DAT - Damage Assessment Team d. Various Business Unit Team &/or Union Leaders e. Key Emergency Contacts 1. Fire, Police, Medical 2. Suppliers / Vendors 3. CDC, FBI, Public Health, etc. 5. Internal and External Risk Analysis a. Internal Risks (Natural & Man-made) b. External Risks (Natural & Man-made) c. IT & Physical Security Risks d. Employee / Family / Community Risks (Including Bio-Chem) 6. Define Various Disaster Possibilities a. Disaster Types (Natural & Man-made) b. Projected / Anticipated Losses 1.Severity (Consider Bio Epidemic) 2. Overall Impact (Consider Govt.-imposed Quarantine) 7. Business Impact Analysis (BIA) a. Business Unit Operations b. Information Systems /Telecommunications c. Physical & Human Infrastructure d. Home Office / Regional & Satellite Operations 8 Disaster Mitigation Programs / Security Analysis

a. Standard Operational Analysis b. Special Mitigation Programs for Staff / Families / Community 9. Disaster Mitigation, Recovery & Relocation Strategies a. Specific Type Event Mitigation (Include Bio-Chem) b. Critical Information Recovery Process c. Employee, Operations Relocation Process (Include Bio-Chem) 1. Hot or Cold Sites 2. Mirroring IT operations 3. Home-office Options, etc. a. Consider "Shelter-in-Place" Possibilities 1. On-Site / Off-Site 2. Govt. Commandered Facilities (for Bio-event) d. Health exams / physical exams (if necessary for Bio-event) 1. Include Exec and Staff Travel Overseas 2. Include Temp and Loaned Employees e. Business Recovery/Continuity Activities (Include Bio-Chem) 1. Consider Home-office / Supplies benefits 2. Consider Wireless Laptops & Various Comm Devices 10. Employee & Community Awareness and Training Programs a. Meetings / Workshops for Employees, Families, Community b. Emergency Team Training (Include C.E.R.T. program) c. Employee Training Programs d. Other Training Activities (Include C.E.R.T. program for Community) 11. Disaster Response & Recovery Programs (Including Restoration)

a. Immediate Crisis Response Programs (Include Employees, Families, Community) 1. Determine Employee / Families Condition 2. Joint-powers Govt. / Private Agency Contacts 3. Initiate Insurance Followup / Coverage 4. Creditor Contacts 5. Employee Disaster Benefits / Supplies 6. Community Contact & Assistance b. Internal / External Damage Assessment Programs c. Prioritize Salvage & Cleanup Needs 1. Consider possible decontamination (from Bio-Chem) d. Immediate to Long-Term Recovery Operations 1. Vendor / Supplier / Customer Contacts 2. Maintain or Reestablish Web Presence e. Facility / Equipment Restoration Programs 12. Documentation & Update Schedule for the Plan a. Policies / Procedures / Forms for Documentation b. Required Documentation Format for Company & Agencies c. Update Authority / Requirements / Timing / 13. Distribution List & Policies / Procedures (Consider Proprietary Confidentiality) a. Distribution Policies b. Distribution Procedures 14. BCP Testing Schedule a. Testing Polices / Procedures b. Calendar

15. Plan Maintenance Policies & Schedule a. Policies and Procedures to Maintain BCP b. Updating / Maintenance Calendar 16. Budget & Funding Procedures a. Policies and Procedures b. BC Plan Budgeting / Controls c. Financial Records 17. Key Records, Assets, & Other Inventory a. IT / Mission Critical Data (Include Web Presence for Customer/Vendor Contact) b. Paper vs. Digital Data / Records c. Communication Networks / Systems 1. Consider Wireless & Walkie-Talkies for Human Rescue and/or Asset Coordination 2. Consider "Carrier-class" Communications Outsourcing a. Employee / Families / Community Notification b. Key Customer / Vendor / Supplier Notification d. Security & Building Infrastructure e. Key Customer Lists / Data f. Mission-Critical Machinery 18. Inventory Needs a. Create "emergency stock" levels or maintain just-in-time levels b. Determine automated / robotic vs. human input / control 19. Furniture, Office Equipment a. Recovery vs. Restoration

b. Decontamination 20. Office vs. Manufacturing / Warehouse Space a. Recovery vs. Restoration b. Decontamination 21. Insurance Needs a. Human & Physical Infrastruture b. Workman's Comp 21. Recovery of Voice, Data, & Other IT Systems a. Data vs. Tele-Communications Recovery Questions / Solutions b. Physical Comm-Equipment Infrastructure Recovery Questions / Solutions d. Unique Comm-System Recovery Questions / Solutions

E. PART II - RESPONSE / RECOVERY& RESTORATION NEEDS 1. Introduction 2. Emergency Teams & Key Employee Responsibilities 3. Planned / Anticipated Response & Recovery Strategies / Guidelines 4. Emergency Declaration Guidelines a. Staff Members Authorized to Declare a Disaster 1. Include at Least 3 Tiers b. Criterion for Disaster Declaration 5. Expected Recovery Time-Frames (hours to days) a. 1-3 Hours From Notification (Immediate Priority) b. 4-12 Hours From Notification (Mid-level Priority) c. 13-24 Hours After Being Notified

d. 25-72 Plus Hours After Being Notified 1. Consider Bio-Chem Quarantine That Could Heavily Affect Human Infrastructure / Productivity / Customer Service 6. Specific Actions / Responsibilities For Disaster Response a. Initial Assessment of Disaster / Damage b. Crisis Management in Place (Emergency Operations Center) c. Employee Evacuation or Shelter-in-Place d. Assess Physical Infrastructure Damage e. Mitigation of Circumstances f. Prioritize Response g. Additional Response 1. Families / Community Assistance 2. Disaster Supplies Distribution 7. Specific Response for Disaster Recovery Activities a. Prioritization of Response / Strategies Enacted b. Telecomm & IT Systems Recovery Response c. Staff Shelter-in-Place / Quarantine / Relocation and/or Reactivation Response d. Reactivate Business Process According to Set Priorities / Available Resources e. Recovery of Business Units (prioritized by Recovery Plan Stratagies) f. Cut Losses Decision Time 8. Specific Recovery Actions - Restoration of Infrastructure a. Prioritize Response b. Restore Business Units Process c. Reactivate Communications / IT / Web Systems

d. Employees Allowed to Return to Facilities (or Not) e. Business Unit Restoration Plans (based on Restoration Activities) 9. Post-Recovery Activities a. Review BCP (Plan vs. Actuality) b. Update BCP (Based on Lessons Learned or New Information) F. Appendices 1. Disaster Emergency Teams 2. Disaster Recovery Teams 3. Key Suppliers / Vendors 4. Communications Service Provider & Outsourcing 5. Disaster Supply Houses 6. Insurance Policies & Brokers 7. Creditor Contacts 8. Key Valuable Customers / Clients 9. Special Emergency Forms for Human / Physical Infrastructure 10. Restoration / Recovery Support Agreements 11. Disaster Supply Checklists 12. Joint-Cooperative Agency & Private-sector Agreements 13. Glossary / BCP Terms