Business Continuity Maturity Model SM

1. Business Continuity Maturity ModelSM Presented by Scott Ream, President, Virtual Corporation

2. BCMMSM Pilot Assessment OverviewAgenda • Virtual Corporation Overview • BCMMSM Conceptual Overview • Assessment Methodology & Toolkit • Questions & Discussion

3. Business Continuity is our core competency 95% of project revenues 20+ active BCM consultant stable 50+ screened consultants available Extensive stable of technically skilled consultants Corporate Philosophy centered on “nurturing” and “interdependence” Know what the client wants and deliver it every time Deliver knowledge transfer within each engagement Begin each engagement planning for our departure Produce timely results by adapting our methods to specific client requirements Extensive relevant “large corporate” Business Continuity background Kaiser Permanente United Government Services Pfizer Nike Business Continuity CredentialsVirtual Corporation’s Value

4. BC Program Implementation Building the “business case” BC program design Emphasis on “sustainability” Proven toolkit minimizes work Example: Kaiser Permanente Crisis Management / Incident Command Emergency Operations Models Executive awareness and exercises Example: Citigroup Disaster Recovery DR organizational design Internal recovery strategy determination 3rd party vendor selection Example: Schering Plough Business Continuity Maturity ModelSM Where are we now and what’s next? “Public Domain” reference model BCMMSM program assessments “Intuitive” and “Rigorous” methods Innovative Training Services “How to” Workshops Sustainable BC Program Launch BCMMSM Assessment Building internal consulting teams Comprehensive toolkits Sustainable Planner Large-scale BC program software platform Open architecture (Oracle / ASP) Development licensing Integrates data collection & document mgmt Makes BC planning accessible to company management team Virtual Corporation UpdateBusiness Continuity Service Offering

5. Business Continuity Maturity ModelSMDevelopment History • 1997 • Initial Research • 2000 • CPM Baseline Survey • 2001 • Introduction Article in CPM • Formation of BCMMSM Working Team • 2002 • Professional Practices Mapping Project Initiated • Corporate Competencies Identified • 2003 • Follow-Up Article in Disaster Resource Guide • On-going work with BCMMSM Working Team • Pilot Assessment Workshop at Continuity Insights • BCMMSM Assessment Toolkit Developed • Numerous Self-Assessment Workshop • Public launch – Q4/03

6. What is Business Continuity?The four central disciplines • Incident Management • All aspects of emergency response, crisis management, and any other activities involved in command, control, and communications during a disastrous event • Security Management • Physical security, information security, and any other activities associated with protecting the integrity of targeted information and resources • Technology Recovery • Ensuring that critical information systems hardware, software, networks and applications are recoverable within defined recovery time objectives • Business Recovery • Ensuring that critical business functions and resources are recoverable within defined recovery time objectives

7. Business Continuity Maturity ModelSMConceptual Overview Increasing Business Continuity Competency Maturity Original Business Continuity Maturity ModelSM Attributes • Program Basics • Senior Management Commitment • Professional BC Support • BC Program Governance • Program Development • All Business Units Participating • Conducting Integrated Planning • Implementing Cross-Function Capabilities

8. Business Continuity Maturity ModelSMConceptual Overview Increasing Business Continuity Competency Maturity Level 1 - Self-Governed Business continuity management has not yet been recognized as strategically important by senior management.

9. Business Continuity Maturity ModelSMConceptual Overview Increasing Business Continuity Competency Maturity Level 2 - Supported Self-Governed At least one business unit or corporate function has recognized the strategic importance of business continuity and has begun efforts to increase executive and organization-wide awareness.

10. Business Continuity Maturity ModelSMConceptual Overview Increasing Business Continuity Competency Maturity Level 3 - Centrally-Governed Participating business units and departments have instituted a rudimentary governance program, mandating at least limited compliance to standardized BCM policy, practices and processes to which they have commonly agreed.

11. Business Continuity Maturity ModelSMConceptual Overview Increasing Business Continuity Competency Maturity Level 4 - Enterprise Awakening All critical business functions have been identified and business continuity plans for their protection have been developed across the organization. For the first time, all four BC disciplines have been “fully” implemented.

12. Business Continuity Maturity ModelSMConceptual Overview Increasing Business Continuity Competency Maturity Level 5 – Planned Growth Business continuity plans and tests incorporate multi-departmental considerations of critical enterprise business processes.

13. Business Continuity Maturity ModelSMConceptual Overview Increasing Business Continuity Competency Maturity Level 6 - Synergistic All business units have a measurably high degree of business continuity planning competency. Business protection strategies that accurately model the critical business functions are formulated and tested successfully.

14. Business Continuity Maturity ModelSMLatest Work of the BCMMSM Working Team Summary Descriptors for How an Organization Evolves • The “Athlete Model” • Describes each Level of the Business Continuity Maturity ModelSM in terms of a maturing runner • The “Comparative Model” • Clusters Levels into three groups of relative competency valuation

15. Business Continuity Maturity ModelSMLatest Work of the BCMMSM Working Team • The Corporate Competencies • Used to objectively measure the organization’s developmental maturity. • Rankings shown above represent strawman “standard” scores at each Level of maturity.

16. Business Continuity Maturity ModelSMLatest Work of the BCMMSM Working Team Leadership The commitment and understanding demonstrated by executive management regarding the implementation of a scaled, organization-wide business continuity program. The degree to which the “business case” has been articulated and understood.

17. Business Continuity Maturity ModelSMLatest Work of the BCMMSM Working Team BC Awareness The breadth and depth of business continuity conceptual awareness throughout all staff levels of the organization.

18. Business Continuity Maturity ModelSMLatest Work of the BCMMSM Working Team BC Program Structure The scale and appropriateness of the business continuity program implemented across the organization. The degree to which the BC Program matches the articulated business case.

19. Business Continuity Maturity ModelSMLatest Work of the BCMMSM Working Team Program Pervasiveness The level of business continuity coordination between departments, functions and business units. The degree to which business continuity considerations have been incorporated in other business initiatives / programs.

20. Business Continuity Maturity ModelSMLatest Work of the BCMMSM Working Team Metrics The development and regular reporting of quantifiable criteria used to monitor the BC Program performance. The establishment of a baseline and on-going tracking of established business continuity competency goals.

21. Business Continuity Maturity ModelSMLatest Work of the BCMMSM Working Team Resource Commitment The application of sufficient, properly trained and supported personnel, financial and other resources to ensure the sustainability of the BC Program.

22. Business Continuity Maturity ModelSMLatest Work of the BCMMSM Working Team External Coordination Coordination of business continuity issues and requirements with external community including customers, vendors, government regulatory bodies, unions, local 1st responders, etc. Insure that critical supply chain partners have in place adequate BC Programs of their own.

23. Business Continuity Maturity ModelSMLatest Work of the BCMMSM Working Team • BC Program Content – Business Continuity Disciplines • The degree and quality of implementation of each of the four central disciplines of BC: • Incident Management • Technology Recovery • Business Recovery • Security Management

24. BCMMSM Assessment Toolkit“Controlled-Access” public domain & proprietary materials • “Controlled” Public Domain Materials • Key Concepts • Competency Grids • Requirements (Corporate Competencies) • Requirements (BC Disciplines) • Proprietary Materials • Delivered to participants in Assessment Training • Proofs • Assessment Questionnaire • Assessment Methodologies • Acquisition & Analysis Checklist • BCMMSM Calculator • Submit completed questionnaire to be scored • Data retained for aggregation • The BCMMSM Service Center • Regularly scheduled and custom Assessment training • Web-based access to BCMMSM resources • Maintains aggregate databank – publish benchmark results • Maintains / updates Business Continuity Maturity ModelSM

25. BCMMSM Assessment ToolkitCorporate Competency Grids • Key Concepts • Summary descriptions of how the Corporate Competency evolves from Level to Level • Criteria Categories • Specific characteristics inherent to each Corporate Competency • Criteria Descriptors • Descriptions of how each Criteria evolves from Level to Level • 7 Corporate Competency Grids • BC Program Content treated summarily – defies “patterning”

26. BCMMSM Assessment ToolkitSample Competency Grid – BC Program Structure

27. BCMMSM Assessment ToolkitAdditional Toolkit Materials • Performance Requirements • Content • Criteria used to determine completion percentage • Documents completeness of each Corporate Competency at each BCMMSM Level • Format • “Master BCMMSM Assessment Questionnaire” • Use: Intuitive and Rigorous Assessments • Proofs • Content • Auditable measures and deliverables that verify completeness at each BCMMSM Level • Format • “BCMMSM Proofs Acquisition and Analysis Checklist” • Use: Rigorous Assessments only • BCMMSM Calculator • Content • Algorithmic tool using Performance Requirement data and proprietary weighted algorithm • Format • Automated program accessible on Virtual’s website (available Q4/03) • Use: Returns Business Continuity Maturity ModelSM Scorecard

28. BCMMSM Assessment ToolkitPreview BCMMSM Assessment Methodologies • Primary Assessment Ground Rules • Target holistic “organization” for most accurate results • Apply methodology and tools consistently and thoroughly • Share feedback with BCMMSM Service Center for aggregation and model enhancement • Intuitive Assessment • Assessment Focus: Where are we now & where should we be headed next? • Quick turn-around (< 4 weeks elapsed time) • Minimally invasive process (analysis based on questionnaire) • Assumes “expert” knowledge available • Identifies BC program gaps and immediate opportunities • Deliverables: • Business Continuity Maturity Level Scorecard • State-of-Preparedness Report including recommendations for immediate action • Rigorous Assessment • Customized implementation includes Intuitive Assessment deliverables plus these options: • Executive briefings and other business continuity awareness training programs • Enterprise business impact analysis • BC program design plan including staffing and budget models • BC program implementation plan • Auditable proofs collected and evaluated • Granularity of proofs review can be tweaked to meet specific assessment requirements

29. BCMMSM Assessment ToolkitSample Timeline for an Intuitive BCMMSM Assessment • Step 1 – Scope the Assessment (week 1) • Determine organizational scope • Review BCMMSM Master Questionnaire • Identify respondents • Prepare and distribute Assessment announcements • Step 2 – Collect Assessment Data and Information (weeks 2 and 3) • Prepare & distribute respondent questionnaires • Respond to questions as needed • Collect and validate questionnaires • Step 3 – Complete Assessment Analysis (week 4) • Apply answers to BCMMSM Assessment Calculator • Document findings and validate where appropriate • Step 4 – Prepare Assessment Report (week 4) • Calculate BCMMSM Organizational Maturity Rating • Document BC program strengths, gaps, and recommended next steps assessed against BCMMSM Corporate Competencies including high-level BC Program Content: • Incident Management • Security Management • Business Recovery • Technology Recovery

30. Innovative & Adaptive Solutions for Business 227 Route 206, Building #1 Flanders, New Jersey 07836 (973) 927-5454 (973) 927-1807 (F) www.virtual-corp.net