EXECUTIVE SUMMARY PURPOSE Herndon Capital Management’s (HCM) Business Continuity Plan provides a structure for managing large‐
scale emergencies or disasters, and interruption of network services. The Plan consists of information and procedures required to enable rapid recovery from an occurrence which would disable HCM’s normal business operations for a period exceeding 24 hours. The goal of the Plan is to minimize the impact of a disaster to our business and clients. OVERVIEW HCM’s Business Continuity Plan is comprised of the following documents: 1. The Business Continuity Flow Chart – a pictorial representation of the detailed information contained in the ‘Procedures’ document and is meant to aid in understanding the Plan. 2. The Procedures – outlines the steps to be taken in order to activate the business continuity plan. 3. The Disaster Recovery Plan – steps that will be taken to facilitate a rapid recovery of HCM’s network infrastructure in the event of a disaster. 4. The Backup, Replication & Data Recovery Procedures – procedures for backing up, restoring and replicating of HCM’s data to our disaster recovery site in Dallas, Texas. 5. The Emergency Evacuation Procedures – procedures for evacuating the building before or during a disaster. 6. The Plan Maintenance Form – a method for documenting approved changes to the Plan after annual testing is performed. 7. The Business Continuity Team – a list of employees who will be responsible for disaster recovery activities as well as a list of their respective duties. 8. The Vendor Contact List – a list containing important vendor information that may be needed in the event of a disaster. 9. The Call Forwarding Matrix – a list of critical HCM phone numbers that will be forwarded to a cell phone or external landline in the event of a disaster at our corporate office. 10. The Breakthrough Technology Group’s Disaster Recovery Guide – outlines the steps our virtual infrastructure provider will take to bring HCM’s Cloud infrastructure online at our disaster recovery location in Dallas, Texas. OBJECTIVES Herndon Capital Management’s objectives for Business Continuity/Disaster Recovery are: 1. To protect life, health and safety of staff and customers. 2. To protect property and assets. 1 | P a g e 3. To resume business operations as quickly as possible to minimize risk exposure and financial loss. 4. Establish appropriate internal and external communication protocols 5. Clearly communicate roles and responsibilities during a disaster. RECOVERY GOALS Herndon Capital Management’s Recovery goals are: 1. HCM will be able to resume operations of all critical business functions within 24 hours after a disaster is declared at our Cloud infrastructure in Piscataway, New Jersey or our corporate office in Atlanta, Georgia. 2. HCM employees will be able to work from a remote location in the event of a disaster at our corporate office in Atlanta, Georgia. 3. Designated telephone numbers will be forwarded to external telephone numbers within 24 hours after a disaster is declared at our corporate office in Atlanta, Georgia. Recovery goals are contingent upon the following conditions being met: 1. HCM’s disaster recovery site in Dallas, Texas has survived a disaster that has occurred at our primary site in Piscataway, New Jersey. 2. HCM’s primary site or disaster recovery site has survived a disaster that has occurred at our corporate office in Atlanta, Georgia. 3. IT staff is available to bring our disaster recovery site online. 4. HCM’s telephone provider is available to initiate emergency call forwarding of HCM’s phone numbers defined in this Plan. 5. Staff is available to perform critical functions defined within the Plan. 6. Staff is notified and is able to access primary or secondary Cloud infrastructure. 7. Staff is able to work from a remote location or one of Regus workplace recovery location. 8. The Business Continuity Plan and Disaster Recovery Plan are current and have been tested. STRUCTURE OF THE PLAN HCM’s Business Continuity Plan is made up of several sections. Each section provides detail instructions, information and procedures that should be followed before, during and after a disaster in order to resume business operations as quickly as possible. ALTERNATE PROCESSING SITE HCM has signed a contract with Regus (www.regus.com), a workplace recovery provider. In the event of a disaster at HCM’s corporate office we will utilize one of Regus’ recovery locations in Georgia to continue our business operations. Regus recovery solution provides us with: same day move in, office space to accommodate our entire staff, high‐speed Internet access, computer equipment, telephones, 2 | P a g e printers, copiers, fax machines and supplies. Included in our subscription is the ability to perform disaster recovery testing. If our corporate office is inaccessible for an extended period of time due to a disaster, we will transfer specific services to our Regus location (e.g. mail and package delivery). Specifications considered when choosing the alternate site included: 1. Alternate site is at a sufficient distance from the main facility to reduce the likelihood of destruction under the same disaster circumstances. 2. Alternate site has adequate space for designated employees. 3. Alternate site has office services (e.g. mail forwarding, fax services, print and copy services, meeting rooms, video conferencing and telephone services). 4. Alternate site has high speed Internet connectivity. DISTRIBUTION OF THE PLAN The Plan is distributed electronically to all employees. Approved changes to the Plan will be communicated to all employees via email. Employees with older copies of the Plan will be required to destroy them and print the latest version for use. The master copy of the Plan will be kept electronically and will be coded with a revision number and date. Older copies of the Plan will be archived as historical references. To ensure availability of the Plan to any person or organization element that may become involved in its implementation, a current copy is filed and maintained as listed: 1.
2.
3.
4.
5.
6.
7.
President Director of Administrative Services Chief Compliance Officer Network Manager Breakthrough Technology Group Electronically on HCM’s file server (Offsite) Electronically on disaster recovery file server (Offsite) MAINTENANCE OF THE PLAN Changes and modifications to the Plan are organized in the following manner: 1. HCM’s Business Continuity Plan will be reviewed annually or if a substantial change has been made that would affect the effectiveness of the current plan. The Business Continuity Team will be responsible for reviewing the Plan and documenting changes on the Plan Maintenance Form. 2. Approved changes documented on the Plan Maintenance Form will be included in the Plan after an archived copy is made. 3 | P a g e 3. The Network Manager or designate will distribute the updated Plan to individuals assigned a copy of the Plan and also inform all employees of the changes to the electronic copy. 4. A copy of each Plan Maintenance Form will be archived. CONTROL PROCEDURES To properly control the Plan, the Network Manager or designate is the only person that can update the Plan once the Plan Maintenance Form is approved by the Business Continuity Team. TESTING THE PLAN HCM’s Business Continuity Plan will be tested annually. Testing of the Plan will include: 1.
2.
3.
4.
5.
6.
Determining the feasibility of the business recovery process. Verifying the feasibility of the alternate processing site. Identifying deficiencies in the current procedures. Identifying areas in the Plan that need modification or enhancement. Providing training to the Business Continuity Team members. Ensuring the adequacy of procedures relating to the various teams involved in the recovery process. 7. Demonstrating the ability of HCM to recover from a disaster. 8. Providing a mechanism for maintaining and updating the Plan. 4 | P a g e