Establish Command & Control For BCM Program Success

Wednesday, March 8, 2017 Establish Command & Control for BCM Program Success 2017 Fusion Risk Management, Inc.

Whether your focus is Business Continuity, Disaster Recovery or Crisis/Incident Management, success as a leader requires that you have command of your program, and demonstrate that you are in control every step of the way. This webinar will provide new perspectives on the challenges facing today's BCM practitioners, and help you redefine your strategies for achieving program success. Our discussion will include: Gathering and managing information to more fully understand risks and impacts. Driving engagement, ownership and accountability from your program contributors and executives. Organizing and orchestrating to achieve successful risk mitigation, disaster response, and recovery. Now more than ever, successfully managing an enterprise BCM program means much more than conducting BIAs, developing plans, and running tests. With the right approach you will find command and control is clearly achievable for BCM success. 2

Introductions David Halford Joe Robinson Andy Mercker Director Advisory Services Fusion Risk Management Sr. Director Global Risk & Resilience Micron Technology Vice President, Marketing & Business Development Fusion Risk Management dhalford@fusionrm.com www.linkedin.com/in/dahalford 3 www.linkedin.com/in/joerobinson amercker@fusionrm.com www.linkedin.com/in/amercker

What is Command & Control? Managing a Comprehensive BCM Program Engaging Everyone in your Organization Managing Incidents & Orchestrating Exercises 4

What is Command & Control? Managing a Comprehensive BCM Program Are you more simply conducting BIA’s, developing plans, and running tabletop exercises? Engaging Everyone in your Organization Are you chasing after plan owners for updates, competing for executive attention, and struggling for awareness? Managing Incidents & Orchestrating Exercises But does this mean simple tabletops, and being in “scramble mode” during actual incidents? 5

? What holds us back? ? ? 6

? What holds us back? Disparate Data Many Sources, Owned By Different Groups, Not Synchronized, Not Consolidated, Various Stages of Currency / Completeness / Accuracy ? Uncoordinated Work Streams of Activities Declare Disaster, Business Recovery, BC & DR Teams, First Responders, Facilities, Risk Agendas ? Lack of a Common Organizing Model Executive Reporting, Consistent Across Programs, Prioritization, Risk Tolerances, Investment Decisions 7

What's changed? Is what we’re doing no longer good enough? Convergence of Major Trends Growing Array of Agendas Increased Expectations for Positive Outcomes Dramatically increasing the pressure to be more effective, efficient, and economical. 8

What's changed? Is what we’re doing no longer good enough? Six Major Trends 1. Ever tightening supply chains and increasing dependencies on critical vendors and outsourced service providers. 2. Increased customer demands to not simply promise but prove you have the ability to deliver. 3. Increased weather events creating greater and more frequent disruptions. 4. Executives’ heightened awareness of responsibilities for operational risk. 5. Greater dependency on IT, and greater IT infrastructure complexity. 6. Ever increasing cyber threats and information security events. 9

What's changed? Is what we’re doing no longer good enough? Growing Array of Agendas 10 Business Continuity Disaster Recovery Crisis Management Incident Management Emergency Management EH&S Security Facility Risk Vendor Risk Cyber Risk Operational Risk Enterprise Risk Audit & Compliance Legal

What's changed? Is what we’re doing no longer good enough? Expectations for Positive Outcomes Expectations for zero downtime Expectations for zero disruptions to the business No deficiencies in your program will cause the organization to miss any of its business objectives. 11

Problem Definition How do we define these challenges? Information Foundation Effective Engagement Activation and Execution 12

Problem Definition How do we define these challenges? Information Foundation Information must be accurate and up to date in order to manage effectively at every point in your program. Information must be consolidated and organized under a “single pane of glass”, so that it’s readily available and presentable in context when you need it. Information must be sustainable, not simply a snapshot, to truly form the foundation of your program -- for your strategies, plans, procedures and activities needed to deliver resilience and recovery. 13

Problem Definition How do we define these challenges? Effective Engagement If you don't have people in your organization who are engaged, accountable and responsible, you don’t have the resources required to run a successful program. If you don't have the attention of your executives, how aware are they of risks and impacts to the business, and how do they determine appropriate levels of investment? Executive buy in and support is necessary to gain resources and tools to deliver an effective program. 14

Problem Definition How do we define these challenges? Activation and Execution If your plans aren't what people turn to during a disruption, then what are they doing and who is leading them? If you lack a common organizing model, then how well can you coordinate people, and prioritize and sequence all of the work streams of activities? If information isn’t readily available as it’s changing, then how can you gain situational awareness to address unplanned scenarios or unexpected events? 15

Solution Definition Information forms the Foundation and is required for all material advances Effective & efficient Engagement drives outcome Establishes confidence in ability to Activate & Execute at time of crisis and/or outage event Command & Control Driving Engagement Strategy & Preparation Information 16 Driving Outcomes

Solution Definition Information forms the Foundation and is required for all material advances Effective & efficient Engagement drives outcome Establishes confidence in ability to Activate & Execute at time of crisis and/or outage event Command & Control Driving Engagement Strategy & Preparation Information 17 Driving Outcomes

Information Baseline Detailed Knowledge of the Business & Business Impacts “Understand how it works so you understand how it breaks” Methodology & System in place to maintain and manage information real-time “Deliver desired outcomes regardless of disruptions” Business Impact Data used in all aspect of Decision making “Decisions based on current data” Ability to use Business Continuity data in Operational Management “Support Change Control & improve efficiency of daily operations” 18 Business Impact Management

Starting Point - Impact Assessments A Business Continuity Management process that is used to determine and manage the outage impacts and exposures of mission-critical processes, applications or facilities over time is used to support & establish priorities for resilience, availability and/or recovery can be used to determine the “value” of a missioncritical process can also be used to support the business case for investments in IT, Facility and process resilience 19

Types of Impact Assessments Business Impact Assessment (BIA) (Process, Function, Department, Functional Area) System/Technology Impact Assessment (SIA/TIA) (Application, IT System, IT Service) Facility/Site Impact Assessment Vendor Risk Assessment Supply Chain Risk Assessment 20

Impact Management Best Practices 1. Focus on information that extends beyond a typical BIA. 2. Use a data model that reflects a. b. c. d. How your organization works, How it might break, How you can prevent breaks, and How you can put it back together again. 3. Assume information is constantly changing 4. Methodology and approach promotes Ownership & Engagement 21

Engagement - what do we mean ? Effective & efficient Engagement drives outcome & supports successful Command & Control Engagement is: Individual ownership Information updated regularly as part of operational process Program information is used to support operational decisions & viewed as a value to the enterprise 22 is NOT: Annual testing and plan reviews is only time the extended program team is involved Business Impact Data only updated during traditional 2-3 year update cycle Maintaining program data and information baseline is viewed as a governance / regulatory requirement

Executive Engagement Starts on the foundation of facts and generates value to the Enterprise Program Status Dashboards – promotes program confidence & maintain visibility Collect & report information by areas of Relevance (VP, Department, Organizational Unit, etc.) – often generates a healthy competition Focus on factors that communicates your level of confidence in ability to execute 23

Executive Engagement Starts on the foundation of facts and generates value to the Enterprise Program Status Dashboards – promotes program confidence & maintain visibility Collect & report information by areas of Relevance (VP, Department, Organizational Unit, etc.) – often generates a healthy competition Focus on factors that communicates your level of confidence in ability to execute 24

Activation & Execution Actual crisis events rarely reflect the tabletop test or a ‘planned’ exercise Integrating multiple plans, coordinating multiple teams and staying on track is challenging even for the most experienced practitioners. Recovery orchestration techniques deliver better simulations and more predictable outcomes during actual crisis events. 25

Effective Recovery Orchestration Focus on your Milestones Understand Dependencies Maintain Awareness (Situation and Progress) Distribute Responsibilities Communicate/Inform Be Adaptive Leverage Tools 26

Solution Definition Information forms the foundation for all material advances Effectiveness, Efficiency & Economic value can be delivered with new thinking and new approaches Command & Control can become your brand to advance your program 27 Command & Control Driving Engagement Strategy & Preparation Information Driving Outcomes

Micron Technology Global Risk & Resilience Joe Robinson Sr. Director, Global Risk & Resilience 2016 Micron Technology, Inc. All rights reserved. Information, products, and/or specifications are subject to change without notice. All information is provided on an “AS IS” basis without warranties of any kind. Statements regarding products, including regarding their features, availability, functionality, or compatibility, are provided for informational purposes only and do not modify the warranty, if any, applicable to any product. Drawings may not be to scale. Micron, the Micron logo, and all other Micron trademarks are the property of Micron Technology, Inc. All other trademarks are the property of their respective owners.

Micron by the Numbers 38 Years strong in 18 Countries with 13 Manufacturing and R&D sites, 3O,OOO Team Members and Net Sales in Fiscal 2016 of 12,39O,OOO,OOO 29 June 27, 2017

Corporate Headquarters and R&D Facilities BOISE, ID 30 June 27, 2017

Global Manufacturing Scale 1 2 3 Boise, Idaho USA Lehi, Utah USA 1 4 Manassas, VA USA 5 Muar, Malaysia Singapore 8 3 6 4 2 7 5 6 7 Taiwan (Inotera) 31 8 Taiwan June 27, 2017 9 Xian, China 10 Hiroshima, Japan Akita, Japan 10 9

Serving a broad set of customer applications 32 June 27, 2017