Suffolk BC forum Willis BC/DR Experience 6 th December, 2013

1 Risk Appetite - BC Need to set own risk appetite to give clear indication on scope eg :  We plan for the loss of Ipswich office  We plan for the loss of London office  We don’t plan for the loss of both at the same time  Mumbai operation have gone from single office to : ‒ three offices in different parts of the city ‒ contracted third party recovery site ‒ improved home working capability  We don’t plan for the long term loss of all three office and recovery site at the same time

2 Risk Appetite – IT DR Critical IT systems centralised  Operational efficiencies – maintenance, support, upgrades etc  Data resilience – infrastructure, management, etc  Recovery – backup systems, data replication etc. Recovery plans  Applications have published recovery objectives  Three tier approach for recovery – High/Med/Low  increasingly seen as needing faster recovery given global nature of our business

3 Willis BC/DR experience Have well developed and tested BC/DR plans for major global offices Contracted or designated recovery sites for all offices Major offices have annual recovery site exercises Automated messaging system (SMS, voice, ) with annual testing Annual IT DR recovery site exercise Large scale remote working capability  Sized for 2000 concurrent remote users  Largest test (for London Olympics) 1009 concurrent remote users  Daily average in UK  Over 500 concurrent users on Mon 28 Oct for storm – had sent emergency message out on Sunday night to all UK Associates.

4 Willis BC/DR experience Requirement to update BIAs to reaffirm our recovery plans/capability Previous BIAs indicated hrs recovery – no financial trading systems like banks or call centres for High St insurance companies BIAs confirmed recovery sizing  No. of seats at recovery site  Remote working capacity  Reaffirmed overall recovery period  BIAs confirmed desire for faster recovery Fitted with other IT projects for data centre and upgrades  Fully fault tolerant – no SPoF systems, infrastructure, building/ environment  Resilient - system capacity, fail over, hot swap etc  Data replication to provide full recovery within hours.

We are looking to avoid this……

Business Continuity in Action?