February 2007

1. Business Continuity Management BCM tools in operation: Tool based Business Continuity and Disaster Recovery Planning London, 1.Feb.2007 Schenker AG Alexander Tsolkas CSO February 2007

2. Agenda • Agenda • Intro • Overview of the market leaders • Tool ranking • Tool list prices • Example of a tool based IT DRP • Advantages and disadvantages of a tool based IT DRP • Discussion Schenker AG; Alexander Tsolkas; Feb.2007, London

3. Intro • 65,5% of the organisations did not update their business continuity • plan for the last 10 years • 26,32 % did update their BCP 1 to 3 times in the last 10 years • Less than half fullfil an appropriate quantity of their BCP targets • 54% of the CIO’s plan to change their BCP strategy • 65% expect a raise in costs for IT BCP • Quelle: Gartner Research a KPMG study 2002 Schenker AG; Alexander Tsolkas; Feb.2007, London

4. Overview of the market leaders • Vendors • Strohl Systems • Binomial International • Coop-Systems • eBRP Solutions Inc. • BRProactive Inc. • Business Protection Systems • EverGreen • Grapevine Software • MIR3 • Sunguard • TAMP Systems • CAPT Schenker AG; Alexander Tsolkas; Feb.2007, London

5. Strohl Systems • LDRPS 10 • License does not expire • Web hosting options • Runs on SQL Server • Small solution for 5 to 30 users • Professional solution for 5 to 50 users • Built-in methodology and guidance based on a long experience • User prompts to enter data • Modules: BCP, Corporate Crisis Management, Business Process Recovery Application Recovery, Site Event Management • Drag and drop functionality • Transparent tree structure • User and group administration • >200 predefined standard reports which describe plans • Customizable plan navigation which guides the user through the plan specifically • Secure data management via encryption • Backup via standby servers • Tool uses a basic Windows format • Tree navigation function • Strong consideration of business processes Schenker AG; Alexander Tsolkas; Feb.2007, London

6. Strohl Systems • Incident Manager 3.0 • Powered by ESI’s WebEOC – web based • Strong influence during development through experience with LDRPS • Scope: • Life Safety • Impact Assessment • Recovery and Restoration • Pinboards offer the possiblity to digitise and electronically organise information and problems collected in an analog way • Transparent tree structure • Incident management on the basis of : • Coordination – via control over the situation with tracking possibility • Communication – Chat client, eMail and Incident Escalation Management • Methodology – Best Practices via ICS (Incident Command System) • Scalable – runs on a Laptop as well as in an IPC • Status reports of the crisis situation • Evaluation of the situation and priorisation of procedures • Enhanced function for monitoring groups, processes and situations • IM 3.0 offers status displays, markers and pinboards • MapTac integrated Schenker AG; Alexander Tsolkas; Feb.2007, London

7. Binomial International • Phoenix • For the development of BCPs on the basis of Windows • Free selection which database to be used • Quick and easy creation of the single components of the BCP • Easy input of information and good information management • Easy updates of the plan • Multi user system • Cooperation of different business departments and units possible • Phoenix modules • Phoenix Corporte Edition • Phoenix for Banks • Phoenix for Credit Unions • Phoenix for Biotechnology • Phoenix for Community Hospitals • Phoenix for Hospitals • Phoenix for ISPs • Phoenix Small Business Edition Schenker AG; Alexander Tsolkas; Feb.2007, London

8. Coop Systems • myCoop 5.3 • Supports 7 phases in a web based system • Easy to use • Low costs • Content can be imported • Easy to learn • Object class technology • Can be customized during the complete life cycle of the system • Languages • Regions • Currencies • Integration into other systems • Modules • Start, Analysis, Creation, Training, Exercise, Maintenance, Execution, Security • Regional parameter settings, Integration, Hosting Schenker AG; Alexander Tsolkas; Feb.2007, London

9. eBRP Solutions • eBRP Toolkit • Offered modules are: • Risk assessment • Physical, personal related, business processes, technological systems • Business impact analysis • Critical resources, recovery time, customers vendors, finance, dependencies • Technology modelling • Hardware inventory, software inventory, network, applications, users • Plan development & maintenance • Unlimited amount of plans, built-in web links, built in data links, check list development, plan linkage, print feature of plans in parts or completely, eMail notification • Features • Web based, unlimited amount of users, role based, access controls, traceability, import of data sheets, Web services, >100 built-in standard reports Schenker AG; Alexander Tsolkas; Feb.2007, London

10. BRProactive Inc. • BRProactive • Tour guide for users • Uses Microsoft Word for planning and editing • Very good help functions • No database know how necessary • Integrated full recovery: Main business area, Voice, IP, LAN, Mid-range systems • 8 predefined recovery team plans, which can be added initially with information • Resource planning and notification sequence integrated • Industry standards are provided consequently and have been considered during development • Action based approach • Password security • Import and export function for files • Predfined forms which can be used Schenker AG; Alexander Tsolkas; Feb.2007, London

11. Business Protection Systems • Business Protector Gateway • Web based with browser interface • Specifically for risk management and BCP • Scalable • Outsourced service or own operation • Fast reaching of the targets • High quantity of plans and reports in documents (on-line formats and *.pdf) • Decentral planning with central control • Automatic notification options • On-line reports, notification trees, emergency procedures • Relational database • Simple document management • Connection to external links, documents and databases Schenker AG; Alexander Tsolkas; Feb.2007, London

12. Evergreen Data Continuity Inc. • Mitigator • Overall business continuity management • Complete company inventory • Business impact analysis • IT Risk Assessment • Application recovery points based on lost data • Recovery analysis based on business requirements versus IT capabilities • Impact analysis based on a malfunction, application failure or general failure • Recovery strategies including cost calculation based in inventory data • Overall business and operative continuity and disaster recovery plans for all company locations • Creation of recovery teams and task assignment to team members • Test and maintenance of the BCP or DRP • Assists for SOX 404 compliance • Financial and operative risks can be drawn from operative failures • Tons of reports • After installation Mitigator provides loaded potential risks, recovery team tasks and 1000 best practice proposals Schenker AG; Alexander Tsolkas; Feb.2007, London

13. Grapevine • Full Command • Transform existing plans in living documents • The process of finding, insertion, registration, evaluation, approval und supporting of personnel, of resources and documentation is simplified. • Distribution and standardisation of the content of plans over many organisations • Plans can be edited directly by the means of a browser • Maitenance of accurate plan data • Testing of plans • Analysis of vulnerabilities and risks • Reporting • Secure authentication and accesses Schenker AG; Alexander Tsolkas; Feb.2007, London

14. MIR3 • Enterprise • Company wide communication for the major Business, Disaster Recovery, Business Continuity • Role based access control • Intelligent messaging system • Works with Oracle DBs, Peoplesoft applications, MS-Active Directory, SunGard, Paragon/ePlanner/Revolution, Strohl’s LDRPS and LDAP Implementations • Support for MS-Outlook for Telefone, GSM, Email, Pagers, SMS, Fax and Satellite telefone systems • Maintenance of Remote- and international business locations, IPCs and WANs Schenker AG; Alexander Tsolkas; Feb.2007, London

15. Sungard • Business Continuity Solutions • Business and Technology Profile Solution • Business Impact Analysis Solution • End-User Recovery Solution • Information Availability Assessment Solution • Managed Tape Backup Solution • System Recovery Solution • Vaulting and Business Continuity Solution • Paragon • BCP development • “What if” scenario development (simulation) • Messaging, Eskalation • Maintainance of plans • Database oriented Schenker AG; Alexander Tsolkas; Feb.2007, London

16. TAMP Systems • Disaster Recovery System DRS • Scalable • Customizable reporting • Decentral planning possibilities • Role based access control • Automatic plan updates (via external interfaces) • Pratical approach for application functionality to maintain plans without complications • Simple user guidance Schenker AG; Alexander Tsolkas; Feb.2007, London

17. Heine & Partner – Info AG • Continuity Action Planning Tool • MS-Access based • Registration and maintenance of resources • Organisational units, persons emergency teams, business functions, technology, software, data inventory, connections, other aids, dangerous goods • Development of action plans • Emergency scenarios and recovery strategies, activities and action plans (graphical user interface) • Output document manager • Print lists ( report generator for multiple formats) • Free textpages • Emegency handbooks and table of content • Administration • Logging of user activities • User access control and authentication • Special functions • Layout of the print output • Customization of data and field names • Data import and export Schenker AG; Alexander Tsolkas; Feb.2007, London

18. Tool ranking • Vendors (personal ranking list) • 1 eBRP Solutions Inc. – eBRP Toolkit • 2 Strohl Systems, LDRPS • 3 Sunguard – Business Continuity Solutions • 4 MIR3 – Enterprise • 5 EverGreen – Mitigator • 6 Heine & Partner – Continuity Action Planning Tool • 7 Grapevine Software – Full Command • 8 Coop-Systems – myCoop • 9 Strohl Systems , Incident Manager • 10 BRProactive Inc. – BRProcative • 11 Business Protection Systems - Business Protector Gateway • 12 Binomial International – Phoenix • 13 TAMP Systems – Disaster Recovery System Schenker AG; Alexander Tsolkas; Feb.2007, London

19. Tool list prices • Hersteller • Strohl Systems, LDRPS 115.000 €, Incident Manager 3.0 38.000 €. • Binomial International – Phoenix ca. 80.000 € • Coop-Systems – myCoop ca. 7000 Euro • eBRP Solutions Inc. – eBRP Toolkit ca. 350.000 € • BRProactive Inc. – BRProcative 26.000 € • Business Protection Systems - Business Protector Gateway 150.000 € • EverGreen – Mitigator 120.000 € • Grapevine Software – Full Command 27.000 € • MIR3 – Enterprise from ca. 140.000 € • Sunguard – Business Continuity Solutions – varies from module to module • TAMP Systems – Disaster Recovery System - no price provided • Heine & Partner – Continuity Action Planning Tool 10.000 € SU, 80k Enterprise Schenker AG; Alexander Tsolkas; Feb.2007, London

20. Example of a tool based IT DRP • Heine & Partner CAPT – Continuity Action Planning Tool Schenker AG; Alexander Tsolkas; Feb.2007, London

21. Advantages and disadvantages of a tool based IT DRP • Pros • Standardized and customized format of all plans • Simple maintenance and update of plans (via integrity of the software) • Cental policy of the tool and decentral maintenance • Web based access from all over • Access to plans is simple and availability is higher • Customizable layout of lists/reports and plans • Printout of plans in parts which are required • Partly plans for dedicated groups can be printed out • Cons • Expensive first time investment • Costs for training • Requirement of a handbook • Interfaces most often do not provide what is wished in terms of applications and data • General limitations due to the fact that is is a tool • Additional costs for administration, hosting and maintenance, backup, etc. Schenker AG; Alexander Tsolkas; Feb.2007, London

22. Discussion • Questions • Alexander Tsolkas • CSO • Schenker AG • Alexander.Tsolkas@schenker.com • www.schenker.com • Opinions Schenker AG; Alexander Tsolkas; Feb.2007, London