H UMAN R ESOURCES M ANAGEMENT August 18, 2009

O UTLINE Key Results Ensure all stakeholders are well informed of cybersecurity and its financial impact to the organization Commit to clear and consistent cyber security procedures Establish reinforcing infrastructure and talent support systems I. Importance of the human capital element A. New section for Phase II B. Incorporates all stakeholders C. Critical to both pre-emptive and defensive activities II. Questions III. Considerations for answering questions A. Creating a cyber secure culture B. Leadership and talent C. Organizational structure D. Standard operating procedures Account management policy and procedure Network access and administration Layered defense Disciplinary process E. System integrity Backup and recovery process F. Training and communication Regular schedule for employees Intervention at all levels of engagement (intake, periodic and termination) General communications G. Reinforcing infrastructure Stakeholder identification and leadership responsibilities Performance management and incentives Investigative process and follow-through IV. Charts and graphs A. Stakeholder roles and responsibilities B. Training effectiveness chart

Q UESTIONS 6.1How do we attract, develop and retain critical cyber security technical and leadership talent, including those in functional areas requiring cyber security savvy? 6.2Does our organizational structure support key functional integration to ensure threat mitigation and rapid crisis response? 6.3How does our cyber security communications plan address and measure the effectiveness of threat awareness and training for all network stakeholders? 6.4What is our monitoring and auditing operating procedure for online activity? Updated password and account management policies Stakeholder compliance audits Layered defense against remote attacks 6.5How does our SOP address elevated access possessed by system administrators and privileged users? 6.6Have we assessed the need for protection of our social networking and share center sites? 6.7How do we routinely audit network access throughout the network stakeholder lifecycle, especially at termination or out-processing? 6.8Does our progressive discipline policy address our need for threat investigations involving any network stakeholder for suspicious or disruptive behavior? 6.9How do we ensure integrity and continued operations of our employee database and related systems like recruiting, benefits, travel and payroll? 6.10Do our performance management and compensation strategies provide adequate support for our cyber security mission?

S CHEDULE DateMeetingObjective August 7 th Initial mtgEstablish schedule; R&R August 13 th Outline due August 14 th Weekly statusClarify R&R; update outline August 18 th ISA/ANSI Mtg August 21 st Weekly statusWorking draft August 28 th Weekly statusDraft Update September 4 th RescheduleDraft Update September 11 th Weekly statusDraft Update September 17 th Weekly statusDraft Update September 24 th Weekly statusSubcomm Review October 1 st Weekly status Final review October 8 th Weekly statusSubmittal Weekly schedule – Friday at 8am Sept 4 th meeting TBD due to holiday Will update calendar based on ISA/ANSI schedule

C RISIS M ANAGEMENT Backup and recovery process Investigations Stakeholder identification and leadership responsibilities Investigative process and follow- through Disciplinary process Communications