GLOBAL CRISIS MANAGEMENT UPDATE SONY PICTURES ENTERTAINMENT

SCA Policy The crises events of 2011 resulted in the creation of the “Sony Group Business Continuity & Crisis Management Planning Policy” - Issued by SCA in May 2012 Policy mandates creating, maintaining, and testing of Business Continuity, Crisis Management, and Crisis Communication Plans for each Sony Group. “In these tough times, Sony cannot afford to not be prepared….” October 2012 – Nicole Seligman 3

Crisis Management The process by which an organization deals with a major event or crisis that threatens to harm the organization, its stakeholders, or the general public.

SPE – “Global Crisis Management” Key Program Components Business Continuity Plan (aka “General Plan”) Executive Crisis Team Plan Global Crisis Management Team Action Plan Region Crisis Response Plan Local Crisis Response Plan Global Recovery Management Team Action Plan Department Business Recovery Plan SPE Emergency Standard / Procedures Business Occupancy Resumption Program (BORP) IT Disaster Recovery (DR) Plan 5

CRISIS RESPONSE FLOW

Initial Actions For Any Crisis Incident reported into the GSOC GSOC alerts the Incident Assessment Team (IAT) IAT classifies incident per SCA Alert Levels IAT Assigns IC IAT determines escalation & follows CM Process Flow

Incident Assessment Team (IAT) Every crisis/incident affecting SPE reviewed by IAT Subset of SPE’s Global Crisis Management Team (GCMT) Members include CM & BCP Leads, GSOC, Travel, and Corp Comm Responsible for initial analysis and triage of incident Incident Commander (IC) assigned and determined by type of incident (safety, security, environmental, IT, investigations)

IAT Roster

SCA Alert Level Classifications

Pre Determined IC’s

Global Crisis Management Team (GCMT) Activated by the IAT Activates GCMT plan and assembles at the EOC Activates appropriate Regional Crisis Team if needed Notifies and updates the Executive Crisis Team (ECT) Manages and supports the crisis response

Regional Crisis Team (RCT) Regional Crisis Team (RCT) Activated by the GCMT or any member of the RCT Teams are LATAM, EMEA, and APAC Any incident in North America is managed by the GCMT Core membership includes regional leads in SEHS, Facilities, P&O, IT, Legal, Finance Liaise with the business during crisis with support from GCMT Assist with supporting local business continuity plans

Site Crisis Team (SCT) Site Crisis Team (SCT) Activated at time of incident – usually first responders Determines accountability of staff and impact of an event Provides stability at local level (shutoffs, secure bldg, etc…) Communicating and updating the GCMT Local office contacts responsible for crisis management and activating local business continuity plans

Executive Crisis Team (EXCT) Activated by GCMT Provide overall guidance, support, and funding of proposed response Determines business-related response and recovery priorities Advised and updated by the GCMT

Phases of Crisis Management Prevention & Mitigation Emergency Preparedness Emergency Response Recovery (Business Continuity) EVENT

CM Hierarchy SEVERITYSEVERITY SEVERITYSEVERITY

What We Plan For….. We Do Not Develop Plans for a Specific Crisis We Develop Plans to Account For:  Loss of People  Loss of Facility  Loss of Connectivity  Loss of Power  Loss of Key Interdependency/Vendor 18

Department Business Recovery Plans Initial actions Staff contacts, call-out lists, and emergency communications Summary of critical functions Critical Function Procedures External contacts and resources Vital records and assets Emergency contact information 19

Emergency Procedures Template

Questions / Comments? 21 Tom Roepke Director, Business Continuity x48372 Kyle Momii Manager, Emergency Preparedness x41247 Scot Falkenstien Exec Director, Fire/Life Safety x45501 Mark Wachter Director, Global Threat Mgmt x48584