© PreEmpt, Inc. Common Misconceptions 1 In Business Continuity Planning

© PreEmpt, Inc. Meeting Format  I will act as the Facilitator 2 Your participation is required! And there is plenty of room for different opinions!

© PreEmpt, Inc. Common BCP Misconceptions 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization Your participation is required! And there is plenty of room for different opinions!

© PreEmpt, Inc. Common BCP Misconceptions 1. IT is the Center of the Universe 4  If not IT, who/what is the center of the universe?  Business process  In most organizations, IT is a resource - not a product or service Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions 2. Emergency Response has nothing to do with Business Continuity 5  Emergency Response & BCP  Life safety – protection of resources  Facility stabilization  Notification & escalation  Damage assessment Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions 3. All departments should have an RTO 6  All business processes in a department do not have the same importance  Each business process should have an RTO  Define RTO Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions 4. A BC plan must meet all RTOs 7  The “O” stands for objective  When actual capability will not meet the RTO  GAP analysis Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions 5. If you don’t have an alternate site, you don’t have a plan 8  Do all plans require an alternate site?  If you need one and don’t have one – what?  The do-nothing option Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions 6. If you have an alternate site, you have a plan 9  An alternate site is a resource Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 10  Must all defined tasks be performed (based on the actual event)?  Variable strategy  Seasonal issues  What business cycle are we in?  Will all plans be activated? Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions 8. All plans should be scenario specific 11  Hurricanes  Pandemic  Worst Case  Anything between minor & worst case  We cannot possibly define all possible scenarios Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions 9. No plans should be scenario specific 12  Hurricanes  Pandemic  Worst Case  Anything between minor & worst case  We cannot possibly define all possible scenarios Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 13  What is a BIA?  What are deliverables from a BIA?  Why the granularity provided by the BIA is important Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions RTOs are a “de facto” computer restoration schedule  What is an RTO?  The relationship between RTO and computer restoration Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions The RPO should be set by IT  The process owner and the RTO  IT’s role in setting the RTO Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions RTOs should be set by the CIO  The CIO’s role  Things that are not the CIO’s role Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions A properly developed BC plan will prevent all disruptions  If only we had that within our power  It will not be business as usual Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions A BC plan for manufacturing is nonsensical  Can we develop BC plans for:  Manufacturing?  Labs?  Rehabilitation centers?  Any equipment intensive operation? Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions Of necessity, good BC plans will be voluminous  Historically  Voluminous plans will not be used under duress  What to do with all those equipment schedules, etc. Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions You can’t test a business unit plan  Test vs exercise  Test equipment  Exercise plans  Train people Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions Business as usual following a disruption is BC’s primary goal  All parties should understand…  It will not be business as usual Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions Disruption prevention is NOT a Business Continuity issue  If it never happens, we have achieved business continuity Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. Common BCP Misconceptions To be of value, a BC plan must address the entire organization  The entire organization is our goal  If I need to fix both the brakes and the wipers on my car, and I only fix the brakes, does the fix still have value? Back 1. IT is the Center of the Universe IT is the Center of the Universe 2. Emergency Response has nothing to do with Business Continuity Emergency Response has nothing to do with Business Continuity 3. All departments should have an RTO All departments should have an RTO 4. A BC plan must meet all RTOs A BC plan must meet all RTOs 5. If you don’t have an alternate site, you don’t have a plan If you don’t have an alternate site, you don’t have a plan 6. If you have an alternate site, you have a plan If you have an alternate site, you have a plan 7. If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list If a plan is well written, no decisions will be required following a disruption i.e. just follow the task list 8. All plans should be scenario specific All plans should be scenario specific 9. No plans should be scenario specific No plans should be scenario specific 10. A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? A BIA is a useless exercise – processes will be resumed when IT is resumed – What’s the point? 11. RTOs are a “de facto” computer restoration schedule RTOs are a “de facto” computer restoration schedule 12. The RPO should be set by IT The RPO should be set by IT 13. RTOs should be set by the CIO RTOs should be set by the CIO 14. A properly developed BC plan will prevent all disruptions A properly developed BC plan will prevent all disruptions 15. A BC plan for manufacturing is nonsensical A BC plan for manufacturing is nonsensical 16. Of necessity, good BC plans will be voluminous Of necessity, good BC plans will be voluminous 17. You can’t test a business unit plan You can’t test a business unit plan 18. Business as usual following a disruption is BC’s primary goal Business as usual following a disruption is BC’s primary goal 19. Disruption prevention is NOT a Business Continuity issue Disruption prevention is NOT a Business Continuity issue 20. To be of value, a BC plan must address the entire organization To be of value, a BC plan must address the entire organization

© PreEmpt, Inc. 24 PreEmpt, Inc.