Both programs are routinely reviewed by the Economy & Diplomacy internal audit team and external regulators. The results of these reviews and metrics are communicated to the relevant governing bodies as needed.

The programs have several key elements, including:

Risk Assessment and Monitoring

BC/DR Planning

Crisis management

Training and awareness

Exercises and tests

Third-party supervision

Risk Assessment and Monitoring

Economy & Diplomacy conducts annual site risk assessments for offices around the world. The assessment results are used to drive risk mitigation activities, including improving site resilience, business continuity planning, and deploying additional recovery strategies where appropriate.

In addition, a comprehensive weekly risk outlook is created that identifies potential threats to Economics & Diplomacy staff and/or offices worldwide. Threats are reviewed, escalated, and managed by senior staff, and widely disseminated for awareness and appropriate action.

BC/DR Planning



There are three main areas of focus that comprise the BC/DR planning undertaken by Economy & Diplomacy:

1. Business Continuity Plans:

Economy & Diplomacy maintains Business Continuity Plans (BCPs) for the commercial functions in each Economy & Diplomacy office worldwide. The BCPs have the following key components:

Business Impact Analysis (BIA): Evaluates the financial and non-financial impacts of the loss of a critical process. Each department reviews and updates the information for each critical process they perform annually. The results of this process are used to drive planning and recovery strategies to minimize potential risks.

Business Recovery Plans:

Procedures designed to recover critical processes to provide business continuity in the event of a business interruption. These include recovery strategies for personnel, data, communications, information processing, and facilities. Recovery strategies are validated through annual exercises.

2. Disaster recovery plans: Disaster recovery plans (DRPs) incorporate failover strategies and are broadly designed to recover from a disruptive event affecting a data center facility, while also accommodating a more limited recovery from the loss of a single server. Key elements of DRPs include:

MONITORED RESILIENCE

Communication plan that identifies how staff will be involved when an event occurs, as well as the frequency and method of communicating information and status throughout the event.

Incident management plan that includes information for establishing and maintaining an incident response team, management team responsibilities, as well as a methodology for decision-making and escalation

Recovery plans that include requirements, configuration, and execution procedures to fail over each application to a secondary data center

3. Emerging and pandemic health problems:

BCPs capture and identify potential risks related to staff absenteeism associated with pandemics or other health issues.

This global program is managed by the Economy & Diplomacy Health and Security team and implemented at the local/regional level to take into account national and cultural considerations when responding. The framework addresses supplies, cleaning, social distancing strategies, and crisis management response triggers.

Crisis management

The Economy & Diplomacy Crisis Management Program provides a comprehensive framework for responding to disruptive events, including:

Crisis management call lists including key global and regional business heads

Command and control structure, including identification of primary and alternate team members to fill key roles

An automated crisis notification system that can relay messages to designated personnel in the event of a crisis. Notifications are sent via email, personal and work phones, and text messages.

Employee support hotline and emergency websites to provide updates and assistance to staff

Training and awareness

Economics & Diplomacy uses several methods to keep employees aware of the critical role they play in preparing for and responding to potential business disruptions.

Methods used include:

Mandatory annual online emergency preparedness training for all staff

Business recovery exercises

Data Center Recovery Testing



Crisis management training and exercises Regular awareness/learning sessions on specific threats

Exercises and tests

Economy & Diplomacy exercises its BCPs to verify that procedures for restoring business operations are appropriate and that key personnel are familiar with documented procedures. Several exercises are conducted each year:

Remote access (i.e., from home or other off-site location)

Alternative location (i.e., a dedicated recovery site or an alternative Economics & Diplomacy office)

Work transfer (i.e., transferring the workload to an unaffected office and team)

System failover testing, including third-party vendors where applicable

Evacuation drills, notification system testing, and periodic generator testing

The results of the business continuity exercise are documented, reviewed, and distributed as appropriate after each exercise. Recommendations for improving the recovery process are identified, risks are classified, and corrective actions are clearly defined and assigned to the appropriate personnel.

Economy & Diplomacy conducts an annual disaster recovery test for each of its production data centers. During the test, the data center is isolated from the Economy & Diplomacy network to simulate a total loss of the facility. Applications are failed over to secondary data centers within the established recovery time objective (RTO), and functionality is validated by qualified testers.

Disaster recovery test results are documented, reviewed, and distributed to key executives after each test. The documentation includes an overview of recovery times, a pass/fail assessment of all applications, and a plan to resolve any issues discovered during the testing lifecycle.

Third-party supervision



One of the key components of the business resilience planning process is our vendor management framework, which includes periodic reviews of business continuity and disaster recovery programs for key service providers. Risk assessments are used to determine the criticality of each service provider. For the most critical service providers, Economy & Diplomacy conducts targeted reviews and assessments of BCM and DR plans and, where appropriate, on-site visits.

ENS/ENI.