General Emergency Policies It is the responsibility of all CSI employees to be familiar with emergency plans and procedures, and to assume control of their own respective area in the event of an emergency. 1. Procedure Priorities in any Emergency Situation a) Life Saving Efforts b) Employee Family Concerns c) Protection of any Customer Data d) Damage Control/Inventory e) Movement to backup site - to resume processing f) Return to local site and resume normal processing 2. Fire Emergency, Civil Disobedience and Power Failure - all employees (See published emergency procedures - of CSI Policy & Procedures Guide.) 3. Medical Emergency - any employee In case of illness or injury, qualified emergency medical personnel should administer any assistance beyond immediate first aid efforts. An ambulance should be requested by calling 911. Be prepared to report: a) Nature of illness or injury b) Name of individual needing assistance c) Approximate age of individual needing assistance 4. Threatening Phone Calls - (Bomb Threats or Extortion attempts) Any employee receiving such a call should: a) Remain as calm as possible. DO NOT upset the caller. b) Show immediate willingness to cooperate and listen for instructions. c) If possible, write down any instructions given and read back to the caller what you understand instructions to be. d) Notify senior person on duty of the call. Do not discuss among other employees, causing undue panic or alarm. 7/2012 1
e) Take appropriate action to protect lives of all staff including evacuating building if necessary. f) Notify SVP of Operations. If he is not available, notify the General Manager of CSI Document Services. 5. Natural Disasters - (Weather, Tornado, Earthquake, etc.) a) Remain clear of external doors and windows. b) Do not necessarily evacuate building. It may be safer inside. Contact manager on duty for assembly into server room (designated storm and tornado shelter). Seek a protective location with maximum safety from flying glass, falling objects, or debris. Go to the lowest level of the building to the areas that would provide the most protection (inside rooms, areas, bathrooms). If possible, crouch under a sturdy table or desk. Stay away from windows and doors. Occupy inside hallways if there are no inner rooms. For an earthquake, DROP, COVER and HOLD ON. c) Listen for public warning signals or radio broadcasts if available. d) Only after all clear signal is received should damage control assessments be made and evacuation procedures implemented. e) Implement CSI Contingency Plan. 6. Pandemic Preparedness With FDIC regulations requesting all technology service providers to include in their contingency processes a plan to address pandemics, such as avian flu virus, CSI has implemented the following: a) Prevention through Flu Vaccinations CSI offers subsidized flu shots to all employees. CSI covers 100% of flu vaccinations through its insurance plan for covered employees. b) Some employees can work from home. Cross Trained Employees Education of Employees -CSI includes in our annual review of contingency plans, education for all employees on prevention, communication and response to a pandemic. New employees will be given an overview as part of their orientation. c) Contingency for Quarantined Locations CSI anticipates the possibility that its operational sites could be in quarantine should a pandemic occur. CSI will have a kit of basic emergency supplies at the office to be used in the event of a pandemic outbreak, quarantine, or sick employees. The kit will contain basic supplies such as bottled water, hand wash, some type of cleaning wipes, and other items as appropriate. d) Monitoring Employee Health CSI will monitor employee health and follow guidelines as issued by local health agencies. CSI employees will escalate staffing issues because of illness just as they would any other emergency situation. 7. Release of Information to the Media After any emergency situation, be aware that CSI personnel are subject to being questioned by media 7/2012 2
representatives as to what has happened and what the recovery plans are. Because information provided for the public will have a definite impact on the public's perception of our own recovery efforts, all CSI personnel should be aware of the following guidelines. a) It is imperative that CSI personnel recognize the right of the media to ask questions; but, unless you've been specifically authorized to act as spokesperson, simply refer the media representative to the Senior VP of CSI Operations, the General Manager of CSI Document Services or a senior or executive level corporate officer of CSI, Inc. b) Release of any information to the media should be made only with specific authorization of the highest-ranking Senior or Executive corporate officer of, CSI, Inc. c) A written record of information provided to the media should be prepared and kept for reference during the recovery period. The CSI Chief Marketing Officer will be responsible for this documentation. CONTINGENCY PLAN- SUMMARY OF BUSINESS FUNCTIONS: These are the critical business functions performed at the Oklahoma City facility: OPERATIONS 1. Processing Department takes client files from the ftp server (inbound files) and creates statement composition and postal sort. 2. Printing of statements, forms, notices 3. Inserting/Rendering of jobs 4. Exception Processing - examples: more than six page documents, no mails, foreign mail 5. Mail Distribution responsible for outbound mail 6. Business Mail Unit manned by post office staff; ownership of checked in mail CUSTOMER SERVICE sub department of Operations 1. Packet review of each production job and scheduled in Athena 2. Work Order for accounting once the production job is completed attach the billing report and other documentation. 3. Returns of Bill Pay checks scan returns into Digiark system; provide files to Jack Henry through CSIeSafe. 4. Jack Henry IGS Bill Pay Service includes cancelations. Physically pull items. Operations print replacement checks. 5. Answer customer phone calls and emails daily. 6. Maintain spreadsheets for Operations. Tracks and ensures proper USPS billing. QUALITY CONTROL 1. Perform Quality control checks for all print jobs, including mail ready to go out 2. Perform Testing for new jobs 3. Purchasing of all supplies (not IT hardware) 4. Safety Committee Chair WEB PRESS sub department of Quality Control 1. Create Plates for new/changed stock forms 2. Printing of stock forms (actual form creation) 7/2012 3
ACCOUNT MANAGEMENT 1. Responsible for new customer implementations 2. Responsible for existing customer changes 3. Assigned Customers 30-50 each DEVELOPMENT 1. Maintenance of Software productions and services 2. New application software development 3. Tier 3 (Technical) customer support CSI DATA CENTER OPERATIONS DOCUMENT SERVICES 1. Purchase, installation and maintenance of servers and desktops 2. Backup and Restoration of Oklahoma City facility Servers 3. Maintenance of Networking Equipment 4. Oversees physical security, alarm system and access control 5. Maintenance of Generators and UPS ACCOUNTING -Sub Department of Director of Corporate Accounting CSI Accounting is utilizing the Great Plains Accounting Software that resides on a server in Paducah. However they access the internal Oklahoma City systems for billing information. 1. Responsible for billing of work orders including postage 2. Gathering support documentation from Operations WAREHOUSE INVENTORY -Sub-Department of Director of Corporate Accounting CSI 1. Inventory for all printed material from WEB PRESS 2. Inventory and ordering for all external provided forms and envelopes 3. Coordinates DPS Third Party Print Jobs that Oklahoma City can t handle 4. Building Maintenance/Fork Lift Operation SALES AND MARKETING 1. Responsible for all new sales 2. Product Demonstrations 3. Product Enhancements CONTINGENCY PROCESSES: The following outlines the contingency processes that the Oklahoma City facility has in place to mitigate risk in its daily operations: 1. Server Data Backups - Daily Backups are completed for all servers from CommVault to disc. Disc backups are then put on tapes and taken offsite to Iron Mountain in Oklahoma City. Tapes are kept offsite for 4 weeks and rotated back to the Oklahoma City Facility. a. Daily Backups Tapes are retained for one month offsite b. Monthly Tapes are retained onsite for one year in fire proof safes c. Yearly Tapes are retained onsite for seven years in fire proof safes This process has been in place since December of 2010. A separate list of servers is provided in this plan. 2. Offsite Storage of Forms- CSI has signed a lease for warehouse space in Dallas and plans 7/2012 4
to have a 30 days supply of forms on-site in Dallas by the end of October 2012. Also, the ability to reproduce forms has been established with an Indiana company, VoluForms. To ensure this capability, all production forms used in the Indianapolis print facility are currently produced in the VoluForms plant today. 3. Backup Sites for Processing of data on the Servers- All critical services have backup servers in Paducah, KY. Actual print and delivery will take place in other locations. Staff will access the servers in Paducah to initiate the jobs. 4. Backup Sites for Print and Delivery a. Dallas (Mesquite), TX Rendering site is the primary backup site for print and insert for check processing. b. The Indianapolis, IN and St. Louis, MO rendering sites are primary and secondary sites for statement / notice print and delivery. Indianapolis currently prints and renders for a select group of Oklahoma City FIs and will continue to increase the volume and number of FIs. c. There is no one site at CSI that can handle the volume of print and rendering as an individual backup site for Oklahoma City. Should we need to move work away from Oklahoma Cite, we will utilize all three print and rendering sites to handle the volume. 5. Generator Backup- There are two generators that backup the Oklahoma city facility a. The primary generator powers the building except Web Press and has approximately 7 days of fuel b. The second generator powers only the Server room and has approximately 2 days of fuel UPS (Uninterrupted Power Supply) 6. Physical Security The Oklahoma City facility has limited access through a card access system. Each employee has an assigned security card that allows them access into the facility. All Visitors must enter through the front door and are signed into the facility and given a visitor badge. The visitor badges are numbered. The Visitor log is maintained and visitors must sign out when they leave the facility. The building has an ADT access alarm system that operates from Friday night at 12:30 p.m. through Sunday night 10:00 p.m. and when there is no staff not working in the facility. The perimeter gate is open from 8:00 a.m. to 5:00 p.m. It is on an automatic timer with pin code access by employees after hours. 7. Cyber Security controls are in place to require minimum 8 character passwords. Training is conducted for social engineering. Complies with CSI standards. 8. Fire Prevention Fire extinguishers are available throughout the building. The entire facility has a water sprinkler system that is heat activated for putting out fires. Inventory storage is adequate distance from the ceiling. 9. Safety Eye wash stations are available in the WebPress area and print area where chemicals are used. Exit lights are available and Exits are marked. There is a Safety Committee by Department and Helen Short heads the committee. 7/2012 5
ESCALATION The loss of resources at the Oklahoma City facility that inhibits the delivery of services is considered a situation requiring immediate escalation. Any employee on duty in the Oklahoma City Facility, when encountering an issue is to report it immediately to the Operations Manager or Shift Supervisor. As necessary, the Supervisor or Manager will escalate to the Vice President of Operations. If the situation is not Operational, then any employee should escalate to their immediate onsite supervisor or senior company officer and further escalation until the VP of Operations has been notified. The VP of Operations will contact the President and General Manager of Document Services when a situation is not resolved within 2 hours. The Oklahoma City Disaster Management Team will be contacted and formulate the plan of action. If at any time any level of supervisor or manager is not available, escalate to the next level. When the situation warrants, the President and General Manager of Document Services will declare a disaster and a plan will be formulated for processing as required by the situation. Typically the decision to declare a disaster is made after discussion with CSI Senior Executive staff. Once there is a declaration of a disaster, Oklahoma City business does not operate as usual. Efforts will be led by the Oklahoma City Disaster Management Team to direct employees to respond to the situation, take steps to recover and then return to normal operations. Each situation is unique and this process could take from hours to months. 7/2012 6