BT Security

1. BT Security BT Security is the provider of choice for secure solutions

2. Agenda • BT Security Performance Andy Talbot • Process Re-engineering Andy • People Plan Jacky West • Behaviours Programme Keith Bezant

3. Andy Talbot Security performance

4. BT Security team Scorecard P5 August 2010 Miss Thresh Target Stretch Gross Managed Costs - £m Revenue Fraud Improvement- £m debt Customer Experience – % targets hit - std + custom contract revenues Revenue Earning Transformation Delivery - % benefits - % IAD actions/date agreed Security Programme Security Risks Mgt – # satisfactory

5. Andy Talbot Process re-engineering

6. Risk Line of Sight Driven by risk appetite – what we are prepared to lose whilst maintaining acceptable service delivery Metrics Risk ControlStrategy RiskAssessment Key RiskIndicators ExistingControlServices Control KPIs& Owners Change Projects & CSFs How Risk Owner knows if the risk is increasing or decreasing. Key aspects of the controls are monitored for efficiency & effectiveness. Standard BT VTC riskassessment& management cycle. maintained to achieve a proportionate response to the risk (i.e. within appetite). Controls are related to the KRIs and vice-versa to allow clear & defined management focus as issues arise. Programme to achieve target level of risk exposure and benefits. Provided from the BTS Unified Services Catalogue. Controls are made up of a set of related parts that combine to achieve the risk mitigation outcome Vulnerability KRI Control KPI Project Strategy Triggers KRI Control KPI Project Consequences Etc.. Etc.. Etc.. Etc.. Failing controls and accepted audit reqs lead to corrective projects. A mix of lagging and leading KRIs. Can highlight environment drivers or controls inadequacy. Appetite Performance feedback loop on controls. Potential De-railers At any time all or part of the Strategy may be implemented in controls. The remainder may be prioritised into change projects or as candidates for future investment. Audit may also raise reqs that will accepted into change projects in line with the strategy. Identified items beyond our control that may have a material effect on the risk and/or the ability of the controls to be effective. We may be able to lobby/influence and monitor. E.g. people’s behaviour. Projects also driven from Risk Control Strategy.

7. Our Approach to selection • Follow the BT Operate Selection Process once we have finalised the rationalisation and completed the reorganisation • Pre-deployment of people where possible into growth roles • Quality proofed selection procedure (BTO) • Commitment to train/re-skill our people as appropriate • Displaced people to move to Career Transition Centre • Underpinned by a joined up consultation and communications plan

8. Jacky West People Plan

9. People Plan Engagement Organisation Design and Transformation • Organisation review and integration of recent Global transfer • OD review of overlaps into wider BT group • Flexible resource model critical to success • Future skills work – 7 MAs and 2 Fast Trackers • Process realignment • Phase 3 Transfers • Strategic comms plan – for a Global organisation • HR Surgeries • SLT Meetings around the country with roundtables • Simply Security 2 Roadshows – completed with great feedback • Formal visibility plan for Leadership Team • CARE Agile – EEI 3.76 (+0.23) - PCI 3.9 (+0.11) - Bullying & Harassment – 10% (-9%) • B&H awareness sessions rollout - good take up started in August – extra sessions being planned Excellent Skills Creating a High Performance Culture • Regretted leavers – especially CLAS skills • Security Professional Community • Training planlinked to Professional Community • YSC investment for SMT • Knowledge Management • Focus on re-skilling training - CLAS accreditation • New Security Job Family – phase 2 • SLT Leadership impact assessment • Development Centres • Security Academy Performance management • High Performance Culture roll out • Standards set across BT Security Talent • Security talent pool • Group talent pool (11) • Local security talent pool event 14 September • Pivotal roles and succession plan • Retention plans – individual

10. Keith Bezant Behaviours programme

11. The Problem • Security vulnerabilities caused by poor behaviour, raising the likelihood of a serious incident • Personal injury • Theft/damage of critical equipment • Undermines the considerable proactive investment being made in physical security measures • Presents a poor image to third parties, including the general public, contractors and clients

12. What we are trying to achieve • Ensure the Health & Safety of our staff • Maintain a secure working environment • Ensure equipment is not tampered with/stolen • Improve security awareness of our staff • Maintain customer service • Reduce likelihood and impact of incidents • Encourage compliance to policy • Develop greater pride in the workplace, make it personal • Focus on positive consequences wherever positive • Use negative consequences as a last resort

13. What we need your help with Working in partnership with security • Help shape the behaviours programme (active member involvement) • Reframing security in terms of personal welfare • Help to articulate the impact/consequence of poor behaviours • Offer ‘independent’ support to the programme • Support the communications and awareness campaigns • Support the positive consequences for good behaviour • Help develop and support the negative consequences for consistent poor behaviours