Enron Corp. Disaster Recovery/Business Continuity Options

1. Enron Corp.Disaster Recovery/Business Continuity Options June, 2000

2. DRP/BCP Options • Build Recovery Facilities Ourselves • Build facilities to house both operational (ready to run) computer systems and personnel. • Positives: • All equipment and workspace available for Enron’s exclusive use • No risk of giving others access to proprietary systems or data • Some existing infrastructure in place at Ardmore. The Ardmore solution, however, would not cover against widespread disasters in the Houston area • Negatives: • Very expensive • Idle equipment and space tends to be “cannibalized” for other purposes

3. DRP/BCP Options • Contract for Use of Facilities • Contract for facilities and equipment with a service provider, such as Comdisco, SunGard, or IBM • Positives: • Companies have extensive experience in disaster recovery • Facilities are shared so cost of maintaining is defrayed • Much of the infrastructure already exists • Opportunity to partner, notably with Comdisco, on broadband solutions. May create a “win win” situation. • Negatives: • Difficult to keep synchronized • Nearest recovery centers are in Dallas

4. DRP/BCP Options • Mirror between Offices • Set up redundant equipment in other offices (e.g., London mirrors Houston) • Redundant systems are likely to be cannibalized • Still requires a facility where people can relocate with telecommunications links to backup site • Communications bandwidth has recently been expanded between Houston and London from 6 Megabits per second to 90 Megabits per second. This makes mirroring key information much more viable than in the past • Variation.Mirroring could be managed internally or with a vendor. The vendor solution may be preferable, since they would be dedicated to ensuring that the information at the redundant site is current.

5. DRP/BCP Options • Build “Hot” Site and Outsource • Technology infrastructure can be changed in size and configuration without breaking down or needing complete replacement • Build Shared Facility • Legislation requiring recovery plans such as the Health Insurance Portability and Accountability Act may provide an opportunity for Enron to leverage building a site. Hospitals in the Texas Medical Center may be open to paying for the use of a shared facility that would be funded by Enron and another service provider • Insurance • Appropriate steps are taken to protect Enron’s rights and remain in compliance with applicable laws and regulations. Insurance is typically an extra precaution, since effective DRP/BCP solutions are required to obtain a policy. It is also very expensive • Do Nothing • Enron may chose to accept the risk of disasters. Since Enron’s reliance on technology increases daily, this approach is not advised

6. Action Items • Cost Analysis. IT Compliance is currently seeking cost estimatesfrom vendors • Management Support. Management needs to agree to an approach and provide funding and support • Risk Analysis. Much of this was done in the Year 2000 program. Mission critical systems can be loosely categorized into trading applications, pipeline controls systems and, more recently, Internet based systems that interface with customers. These systems should be covered. Enron can tolerate extended down time of most other applications