Boeing Business Continuity Candace Denegal Karen Juhl SCRLC, June 4, 2008

Table of Contents Boeing preparedness history The need for integration: Enterprise Business Continuity Journey to building resiliency Sponsorship from Boeing CEO and Executive Council Business Continuity Council and PRO 6651 Business Preparedness Leaders network Scoping results Building Business Preparedness competency Business Preparedness planning approach and methodology Supplier Management engagement Engage SCRLC in supply chain discussion

Boeing Computer Disaster Preparedness & Recovery Program (CDP&R) Mission: Lead company-wide development and implementation of IT Service Continuity Management policies, standards, tools and processes History: 1995 CDP&R established 1997 Constant Readiness Center 1998 Boeing Supplier Disaster Recovery program with IBM 2007 CDP&R name changed to Information Technology Preparedness (ITP) Accomplishments: 1997 Dialogic Notification enterprise-wide disaster communication tool 2002 Living Disaster Recovery Planning System (LDRPS)

Boeing Emergency and Disaster Preparedness Program Mission: Protect people, products, property and information during large-scale incidents History: 1992 Established enterprise-wide employee and company Emergency and Disaster Preparedness program 2007 Program name changed to Emergency Preparedness (EmP) Accomplishments: 45 Emergency Operation Centers manage incidents in coordination with Enterprise Crisis Management Center Standardized evacuation processes Standardized Volunteer Disaster Response Team

Boeing Business Continuity Program (BC) Business Preparedness Mission: Ensure recovery and restoration of critical processes during any disruptive event History: 2005 Enterprise-wide BC program established to formalize and mature the discipline called “Business Preparedness” (BP) planning and to integrate ITP, EmP, and BP

Business Continuity Program: Oversees integration of EmP, ITP, and BP Boeing will be the strongest, best, and best-integrated aerospace company in the world for today and for tomorrow. ~ Jim McNerney Ensure Boeing’s resilience through integration

The journey to building resiliency Transition- position organization for sustaining model 2009/10 Enterprise “State of Preparedness” Assessment BP Deployment Plan Created for Business Unites and Functions Develop “Initial” BP Plans Launch Business Continuity Integrated Leadership Team Refine Business Continuity Service Offering Conduct Business Impact Analyses Identify Critical Processes by Business Unit and Function 2006 - Launch of SSG BC program 2007: Launch of enterprise BC program, in order to: Establish BP planning as a competency and strengthen current competencies in EP and ITP Define practical, achievable BP plans that minimize the impact of disruptive events on critical processes Integrate the practices of CDP, EDP and BP PRO-6651 CDP and EDP titles changed to ITP and EP, respectively Mandated the integration of ITP, EP, and BP under BC 2008 – BCILT (Business Continuity Leadership Team) Made up of the leadership of ITP, EP, and BP Team reports to BC Leader 2008 SSG pilots business preparedness planning Establish Business Preparedness Leaders Network Integrated Business Continuity PRO 6651 Business Continuity Enterprise Assessment to Boeing Executive Council Staff “Deployment” Team Define Business Continuity service offering 2007 Establish Business Continuity Council Develop Enterprise Pandemic Plans Develop Business Continuity Methodology Design Program Structure 2006

Our success is based on support from Boeing CEO and Executive Council In May 2007 enterprise assessment results were shared with Boeing CEO,Jim McNerney and his Executive Council. Some key comments from McNerney….. Setting Business Continuity goals is a strategic decision Each of you needs to establish a minimum standard for your business Improvements should be targeted Mandate on work with Suppliers

Boeing Business Preparedness Engagement Model Executive Commitment BP Planning and Deliverables Exercise, Test, and Validation Integrated Governance Model Business Units & Functions Establishes new PRO for enterprise business continuity and links to EmP and ITP PROs Enterprise Business Continuity Council Integrates EmP, ITP, and BP as enterprise business continuity Identifies SSG Business Continuity as the provider of business continuity service to the enterprise through a shared delivery model and standard methods and tools Confirms that business units are responsible for creating, testing, validating and sustaining business continuity plans Ensures the sharing of best practices, identification of risks and continuous improvement of enterprise business continuity planning BC PRO Shared Services Group Business Continuity Service Shared Delivery Model Standard Tools and Metrics Training Communication Industry Benchmarking

Business preparedness planning process Plan scoping Documenting dependencies Recovery planning It is not about building the perfect plan. It is focused on building competency about the process, plan, and content A key element of business preparedness is “test and maintain,” which involves regular maintenance and updates to a plan. Focus on your most critical dependencies because every dependency requires the formulation of a recovery procedure If a dependency will not cause the critical process to be halted, it does not need to be included in the plan Test and maintain

BP Planning: limiting the scope Boeing business units and functions determined which processes would cause a “material” impact on The Boeing Company as a whole. “Materiality” applies to anything that could cause a noticeable change in stock price. Examples of likely “material” processes or operations include Anything that could directly halt aircraft production. Managing corporate cash. Meeting external customer commitments, customer support, e.g., “MyBoeingFleet.” Meeting regulatory or significant contractual requirements. This work was already completed. 11/22/2018

What is a business preparedness plan? A single plan (at varying levels of the organization) for recovering a critical business process that is executed after a disruptive event occurs A plan that enables practiced recovery to start earlier and complete sooner than ad-hoc, in-the-moment recovery A plan that details Recovery team names and recovery responsibilities. Critical process or operation. The dependencies of the critical process. Recovery strategies. Recovery resources.

Partnering with Supplier Management Shared BP planning strategy with Supplier Management leadership Emphasized their role and the significance and criticality of supply chain continuity Partner jointly define supply chain planning approach Supplier Management established a leader and a sub-team with enterprise representation to work with BC program Supplier management engagement

Ensuring a standard company-wide approach to Supplier Management Utilize previously identified critical suppliers to limit planning focus Create a standard approach for Supplier Management involvement with business units’ BP planning Identify standard recovery strategies available to business units for use in the recovery of a critical process due to loss of suppliers Supplier management engagement

How can we leverage your experience? What worked? What roadblocks did you encounter? Supplier management engagement

11/22/2018