ADNOC Classification: Internal THE CONTENTS OF THIS DOCUMENT ARE [PROPRIETARY AND CONFIDENTIAL] ADNOC GROUP BUSINESS CONTINUITY MANAGEMENT THIRD-PARTY (SUPPLIER) QUESTIONNAIRE VERSION: [3] ADNOC Distribution – BCM Third-Party (Supplier) Questionnaire ADNOC Classification: Internal ADNOC DISTRIBUTION CUSTODIAN SUPPLIER NAME ADNOC Distribution (e.g. Honeywell) REVISION HISTORY PREPARED BY (Designation /Initial) REVIEWED & APPROVED BY (Designation /Initial) DATE REV. NO Jun 2024 3 Senior Analyst, BC - Nov 2021 2 Senior Speccialist, BC VP, ER&CM & A/VP BC Aug 2019 1 Adviser, BCM VP, ER&CM&BC ___________________________________________________________________________________ CONTROLLED INTRANET COPY The Intranet copy of this document is the only controlled document. Copies or extracts of this document, which have been downloaded from the Intranet, are uncontrolled copies and cannot be guaranteed to be the latest version. ADNOC Classification: Internal I. INTRODUCTION ADNOC uses this third-party (supplier) questionnaire to effectively assess and collect information on how they manage business continuity. This is due to the implications of immediate disruption costs and longterm consequences to ADNOC confidence and reputation that may arise from failure to deliver minimum business operations (ADNOC mandate to the Government) during any major disruptions or crisis. This is also part of ADNOC's 2030 growth strategy of ensuring supply chain continuity during any major disruptions and in compliance with NCEMA-7000 requirements. This is also in alignment with the requirement of UAE Federal Decree-Law No. (2) of (Article 19) that makes it mandatory for private sector in UAE to have BCM program in place. This is to ascertain that provision and implementation of basic services in the event of an emergency, a crisis, or a disaster is ensured, according to the standards adopted by the Authority. II. OBJECTIVES The objective of this questionnaire is to provide advice and guidance to all levels of ADNOC management and staff about third-party (supplier) capability to carry out Business Continuity Management (BCM) activities at all levels. The objectives include but are not limited to: III. Assure that third-party service providers are fully committed to ensuring continuity of service; Demonstrate that third-party service providers can meet its client’s contractual requirements for robust BCM; Show ADNOC that the thirdparty service providers are tackling business continuity risks as rigorously as possible; and Underpin the credibility of ADNOC’s own BCM services. SUPPLIER DETAILS Supplier Name Service(s) provided Contact Details Point of Contact ADNOC Classification: Internal IV. QUESTIONNAIRE The questionnaire below aims to assess BCM capability of your organization. # Question 1 Does your organization have an approved Business Continuity Policy setting the objectives and approach to Business Continuity Management (BCM)? Does your organization have a Business Continuity / IT Disaster Recovery Plan? 2 3 4 5 6 7 8 9 If the response selected in (2) is ‘No’, please confirm if your organization has a basic response, restoration and recovery strategy? If selected response is ‘Yes’, please provide high level overview of the steps that would be executed during disaster. If the response selected in (2) is ‘Yes’, please confirm if your organization validates the Business Continuity Plan / IT Disaster Recovery Plan on a regular basis? If the response selected in (2) is ‘Yes’, please confirm if your organization has tested or exercised the Business Continuity Plan/ IT Disaster Recovery Plan in the last 12 months? Has your organization completed any kind of Risk Assessment for the relevant business areas / key projects? Has your organization previously undertaken a Business Impact Analysis (BIA) to establish a prioritization for recovery of your key services/products? Has your organization identified dedicated resources (assigned with roles and responsibilities) to be responsible for Business Continuity Management and Crisis Management? Does your organization provide Business Continuity training for employees? 10 Is your organization confident that services to ADNOC Group could be continued in the event of a major incident / disruption within your organization? 11 Do you have the capability to manage your organization reputation and the ability to operate during disaster? Does your organization contractually document provision of Business Continuity Management (BCM) service? If the response selected is ‘No’, please elaborate. Has your organization identified critical suppliers of services/products, in order to support ADNOC Group during disruption? Is your organisation has any BCM Standard certification or recognition? If “Yes”, attached evidence. 12 13 14 Yes/No? Additional Comments ADNOC Classification: Internal Please share with us any additional relevant information regarding Business Continuity Management which has not been covered. Remarks Please share the most recent approved updated documents listed below for your organization. Please specify date of last review against each document shared: ☐ BCM Policy ☐ Business Continuity Plans ☐ Last BCM Exercise approved report ☐ Last BCM Audit report ☐ Other relevant BCM documents THIRD-PARTY (SUPPLIER) SIGN-OFF Details Name Title Signature Date Completed by Approved by