1. September 14, 2010 Measuring/Monitoring for Perfect Ground Transportation Services AGTA Meeting – San Antonio 10:45 AM Michael J. Corby, CISSP, CCP, PMP Vice President

2. 2 Agenda – What is Business Continuity Planning? – How Can BCP Help Assure Success? – Summary – Questions

3. 3 What is Business Continuity Planning? 4 Horsemen of the Apocalypse? Pestilence War Famine Death 4 Hideous Horsemen of AA? Terror Bewilderment Frustration Despair

4. 4 What is Business Continuity Planning? 4 Horsemen of Business Catastrophe?

5. 5 Revenue Direct loss Compensatory payments Lost future revenue Billing losses Investment losses What Is Your Cost of Downtime?

6. 6 Revenue Productivity Number of employees affected x hours out x burdened hourly rate What Is Your Cost of Downtime?

7. 7 Productivity Damaged Reputation Customers Suppliers Financial markets Banks Business partners... Revenue What Is Your Cost of Downtime?

8. 8 Damaged Reputation Other Expenses Temporary employees, equipment rental, overtime costs, extra shipping costs, travel expenses, legal obligations... Productivity Revenue What Is Your Cost of Downtime?

9. 9 Other Expenses Financial Performance Revenue recognition Cash flow Lost discounts (A/P) Payment guarantees Credit rating Stock price Damaged Reputation Productivity Revenue What Is Your Cost of Downtime?

10. 10 Know your downtime costs per hour, day, two days... Financial Performance Other Expenses Damaged Reputation Productivity Revenue What Is Your Cost of Downtime?

11. 11 Key BC Differentiators 1. Business Continuity Planning is ongoing – Coordinated program of strategies, plans and procedures that provide for the ability to manage and ensure the ready availability of critical resources in the event of a physical disruption to any part of the business operations. 2. Business Continuity Planning is for survival – Resumption of critical functions following a disruptive event – Is not meant to guarantee business-as-usual – The type, timing and severity of any business disruption is unpredictable. A major disruption to your business WILL happen. Will you be there when it happens? …and what can you do about it?

12. 12 How Can BCP Help Assure Success Don’t Take on an Impossible Task Segregate Resources by Category Concentrate on Improvement, not Perfection Test, Exercise, Drill

13. 13 CONFIDENTIAL Threat-Based Approach: Insufficient and Difficult to Achieve

14. 14 CONFIDENTIAL Best Practice: an “IMPACT”-based Approach Assume the resource is either unavailable for >30 days and/or, worst case, destroyed. Resources Impacted Investors lose confidence, exit market Wide-scale civil unrest and looting destroys facilities Key documentation destroyed Wide-scale civil unrest and looting, destroy facilities Key electronic records destroyed Pandemic – 10% to 15% perish Three orders of succession Destroyed or perished Sole source, critical infrastructure, supplier severely affected Building quarantined, civil unrest damage to facility and vital records Inability to gain access to equipment for service Inability to gain access to service/ install software. Pandemic – 40% of internal and 40% of external work force Three orders of succession Relationships & Interdependencies Physical (facilities, raw materials, equipment) Technology & Processing (data processing networks) People (employees, contractors, support functions) Unavailable and/or inaccessible for an extended period of time Assumption

15. 15 CONFIDENTIAL Map Resources to Critical Processes Address all dependencies and the skills required to maintain operations, whether a public entity, service provider, manufacturer, supply company, or other type of organization Process Process Process Resources People Technology and Processing PhysicalRelationships Employees Contingent work force Electronic data Electronic applications Nonphysical infrastructure: Op. systems, firmware, mgt. tools, services, and utilities Equipment Facility Raw materials Cash and currency (n/a) Inventory Work in progress Vital records Peripherals and supplies Other tangible assets including utilities, telecom, health and safety, transportation General public External suppliers Internal suppliers Investors Insurers Public and external infrastructure: mail, transportation, utilities, telecom, safety, health, Regulators Industry consortiums Auditors Outsourced/third-party service providers Functions Process Resources People Technology and Processing Physical PlantRelationships Employees Contingent work force Electronic data Electronic applications Nonphysical infrastructure: Op. systems, firmware, mgt. tools, services, and utilities Equipment Facility Raw materials Cash and currency (n/a) Inventory Work in progress Vital records Peripherals and supplies Other tangible assets including utilities, telecom, health and safety, transportation General public External suppliers Internal suppliers Investors Insurers Public and external infrastructure: mail, transportation, utilities, telecom, safety, health, Regulators Industry consortiums Auditors Outsourced/third-party - service providers Functions

16. 16 Improvement not Perfection “Perfection is the Enemy of Success” Trying to cost justify BCP Large number (lost revenue) X Tiny number (probability) = Lack of Preparation Starting at the bottom by counting items The items will change before the task ends

17. 17 Risk Asse ssme nt Con tinui ty Plan Event Respo nse Event Respo nse Business Continuity Risk Management  Policies  Strategy  Governance  Budget Cycle of Continuous Improvement Periodic Re-Assessment  Environmental Risk  Technology Risk  Compliance Risk  Business Partner Risk  Pandemic Risk  Other  I/T DR Plan  Crisis Response  Facility Failover Plan  Compliance Management

18. 18 CONFIDENTIAL Training, Drills & Exercises: Keys to Success Training: All employees Members of ERT, CMT, BCP Management Drills: Practice specific skills Use systems & equipment Exercises: Familiarization Validation Identify deficiencies

19. 19 The BCP planning/development process consists of the following steps: Management Awareness 1.Obtain top management commitment Planning 2.Establish a planning committee 3.Perform a scenario assessment and risk assessment 4.Establish priorities for processing and operations 5.Determine recovery strategies 6.Perform data collection 7.Organize and document a written plan Testing 8.Develop testing criteria and procedures 9.Test the plan Management Approval 10. Approve the plan Evergreen Management Awareness Planning Testing Management Approval Establish a planning committee Perform a scenario / risk assessment Establish priorities Determine DR/BCP Strategies Perform data collection Organize & document a written plan Develop testing criteria & procedures Test the plan Evergreen Summary

20. 20 Assure strategy reflects the business’ needs Keep the plan up-to-date Trained recovery teams Ongoing testing Success Summary

21. 21 Wrap-up Questions? Comments? Stories?