R EGION B ANK R EGION B ANK $15B in Assets – 105 Branches Footprint: NYC & NJ BCP Exercise Program BACKGROUND Business Continuity & Corporate Resilience Rick Wilson

R EGION B ANK Table Top Exercise Objectives Learning Experience Evaluate Readiness Freedom – No Consequences Validate Processes & Inventories Better Prepared for a Real Event

R EGION B ANK You Can Be Sure of – Death, Taxes and Disasters

R EGION B ANK Insured Catastrophe Losses

R EGION B ANK BCP Scenario Exercise Card 1 Time Event Occurred / Reported to BCP Coordinator: 9:15 am DAY BEFORE NEW CORE GO-LIVE Event Description There is a mandatory NEW CORE meeting for all Managers at Bank Headquarters. This meeting will brief the managers as to what WILL and WILL NOT be operational after the cutover. NEW CORE has been given the go ahead to start preparatory steps. The meeting is being held in the Training Room A on the 10 th floor of Bank Headquarters. NEW CORE is mostly ready and the agreement is to Go-Live. Some things will not be available Day 1, but the decision has been made to move forward. Announcements have been made and there is some pressure to get this behind us. Included in this meeting at Bank Headquarters are Sr. VP Fred Gartner and CIO Alex Mendez Impact Facility Report Security Report: Casualty Report: IT Services Report: Damage Estimate: Business Continuity – Situation Event: Earthquake

R EGION B ANK Earthquakes

R EGION B ANK Earthquakes New Jersey New Jersey - M New Jersey - Delaware border New Jersey - M New Jersey - M 3.0 New York New York City, New York - M Between Massena, New York and Cornwall, Ontario, Canada - M Blue Mountain Lake, New York - M Au Sable Forks, New York - M Redford, New York - M 3.3 On December 18, 1737, a damaging earthquake near New York City was felt throughout most of New Jersey. The strong earthquakes off Cape Ann, Massachusetts, in 1755, the New Madrid, Missouri, area in , at Riviere-Ouelle, Canada, in 1860, Wilmington, Delaware, in 1871, New York City, New York, in 1884, and Charleston, South Carolina, in 1886, all affected New Jersey. The highest intensity earthquake ever observed in New Jersey occurred on June 1, 1927, in the Asbury Park area. Three shocks were felt along the coast from Sandy Hook to Toms River. Maximum intensities of VII were observed at Asbury Park and Long Branch. Several chimneys fell, plaster cracked, and articles were thrown from shelves. The felt area extended over approximately 7,800 square kilometers.

R EGION B ANK Insured Catastrophe Losses This severe earthquake affected an area roughly extending along the Atlantic Coast from southern Maine to central Virginia and westward to Cleveland, Ohio. Chimneys were knocked down and walls were cracked in several States, including Connecticut, New Jersey, New York, and Pennsylvania. Many towns from Hartford, Connecticut, to West Chester, Pennsylvania. Property damage was severe at Amityville and Jamaica, New York, where several chimneys were "overturned" and large cracks formed in walls. Two chimneys were thrown down and bricks were shaken from other chimneys at Stratford (Fairfield County), Conn.; water in the Housatonic River was agitated violently. At Bloomfield, N.J., and Chester, Pa., several chimneys were downed and crockery was broken. Chimneys also were damaged at Mount Vernon, N.Y., and Allentown, Easton, and Philadelphia, Pa. Three shocks occurred, the second of which was most violent. This earthquake also was reported felt in Vermont, Virginia, and Washington, D.C. Several slight aftershocks were reported on August 11. Near New York City, New York :07 UTC Magnitude Intensity VII

R EGION B ANK Earthquake Force Lines

R EGION B ANK Earthquakes This severe earthquake was felt from Canada south to Maryland and from Maine west to Indiana. It caused property damage estimated at $2 million at Massena and Cornwall. Many chimneys in that area required rebuilding, and several structures were unsafe for occupancy until repaired. Residents of St. Lawrence County reported that many water wells went dry. At Massena, in northern St. Lawrence County, 90 percent of the chimneys were destroyed or damaged and house foundations, plumbing, and masonry were damaged severely. Similar effects were reported at Cornwall. Cracks formed in the ground at Hogansburg, and brick-masonry and concrete structures were damaged. Chimneys were downed in several towns in New York, including Fort Covington, Keeseville, Malone, Norfolk, Ogdensburg, and Waddington. Between Massena, New York and Cornwall, Ontario, Canada :38:45.7 UTC (Local 09/04) Magnitude Intensity VIII

R EGION B ANK Bank HQ Real Life – AND – Our Scenario

R EGION B ANK Scenario Update BCP Scenario Exercise Card 2 Time Event Occurred / Reported to BCP Coordinator: 9:47:09 am Event Description A major earthquake begins. Cindy Russell, of Accounting, is in the NEW CORE meeting, sitting in the front row, directly beneath the projector. Suddenly there is a jolt and a cracking sound in the ceiling. At the sound above her she turns her head only to see the projector falling from its mounting. The sharp corner of the projector strikes her directly in the temple. Cindy is killed instantly. The same jolt that loosened the projector has also fractured several glass windows. Arnold Samson (VP, Marketing) was standing by one of the broken windows and glass shards have raked his face. People in the room start to push toward the door and in the rush shoving occurs and one of the tables is pushed over and hits the NEW CORE project lead in the knee, breaking his leg. There is a now lot of commotion and the building continues to sway. The NEW CORE conversion work is progressing off-site, unaware of the situation. Impact Facility ReportUnknown at this time Security Report: Casualty Report:See above IT Services Report:Unknown at this time Damage Estimate:Unknown at this time

R EGION B ANK BCP Table Top Exercise Considerations Surrounding - CARD # 2 Who is In-Charge? How did you notify the Crisis Management Team? Did you establish an Emergency Operations Center? Who coordinates with 911 and First Responders?

R EGION B ANK Scenario Update BCP Scenario Exercise Card 3 Time Event Occurred / Reported to BCP Coordinator: 9:50 am Event DescriptionLocation of Crisis Management Team members: CEO Cliff Harris is overseas on Business COO Stan Hampton is in his office in Menlo Park – but feels the quake and is immediately alert SVP, Operations Fred Gartner is in the Headquarters meeting Gene Statler, Director of Facilities, is off-site inspecting another building for an acquisition CIO Alex Mendez is in the Headquarter meeting Anthony Pasquale, Chief Risk Officer, is in his office in Menlo Park Impact Facility Report Security Report: Casualty Report: IT Services Report: Damage Estimate:

R EGION B ANK Considerations Surrounding - CARD # 3 Who notifies Cindys family? Arnolds family? Who are their Emergency Contacts? Where are those Emergency Contact numbers stored? Who notifies NEW CORE about injury to their staff? Does the conversion to NEW CORE move forward? Who notifies Regulators? Customers? How notified? Who formulates the Message with Arnold not available? Who deals with the PRESS? BCP Table Top Exercise

R EGION B ANK Scenario Update BCP Scenario Exercise Card 4 Time Event Occurred / Reported to BCP Coordinator: 10:30 am Event DescriptionDamage reports begin to flow in: see below Impact Facility Report Headquarters: Potentially major damage – many broken windows – full extent unknown Menlo Park: minimal cosmetic damage Four local branches are CLOSED due to lack of power and some damage. Sanders site: (36 miles from HQ) no damage Midland site: (22 miles from HQ) no damage Janesbury site: (38 miles from HQ) no damage Littlefield site: (17 miles from HQ) no damage All other branches and locations are not affected and are able to reopen by noon. Security Report: Casualty Report:Beyond deaths and injuries at Headquarters, there were no other causalities. IT Services Report:No network connectivity at Headquarters (Data Center) All other facilities are online and operating normally Damage Estimate:

R EGION B ANK BCP Table Top Exercise Considerations Surrounding - CARD # 4 How do people report damage? How do people report department functions that are: Working and Not Working? When and How do departments move to ALTERNATE locations? Who do they notify when they get there? What processes do the execute? Which do they drop? How do you communicate company status to all employees? Who drafts the message? What medium? / Web / Phone / Conference / Social Media? How often do you update? What do you tell customers about reduced services?

R EGION B ANK Scenario Update BCP Scenario Exercise Card 5 Time Event Occurred / Reported to BCP Coordinator: 3:00pm Event DescriptionThe landlord and building inspectors will not clear the Headquarters for occupancy until it has been fully inspected and certified. Other nearby buildings have also been damaged and it will take several days before Headquarters can be fully inspected. The return to Headquarters is forecasted to be at least four days. Impact Facility Report Security Report: Casualty Report: IT Services Report: Damage Estimate:

R EGION B ANK BCP Table Top Exercise Considerations Surrounding - CARD # 5 Now that it is longer than a day – What other departments need to move? What other processes need to be enabled? What additional staff need to report to Alternate sites? Who needs to Move out and Stay home to make room for Time-Critical staff in these Alternate sites? What IT issues need to be reviewed? Do 2 nd and 3 rd level Alternate sites need to be activated? Are accommodations (Hotel Rooms) needed for staff at Alternate sites? Do we Bus people to Alternate sites?

R EGION B ANK BCP Table Top Exercise BCP Post Exercise Observations Self-Review of – What worked well? What needs to be strengthened? What inventories / lists need to be updated? What actions would allow us to be better prepared?