Business Continuity Disclosure
In keeping with ING IM’s commitment to provide the highest quality of service to its customers, the Company has developed a comprehensive approach to planning for possible disruptions to its critical business operations. ING IM has developed a Business Resumption Plan that includes the following five components:
The Crisis Management Plan addresses various crisis situations (i.e. electrical power outage, fire, bomb threat, inclement weather etc.). The plan includes a crisis committee to respond and implement an appropriate course of action in the event of a business disruption and off-site location identification for employees following building evacuations as well as an employee crisis hotline number for updates. Additionally, the plan outlines restoration procedures following an event.
The departmental Business Continuity Plans address business unit actions to be undertaken in a disaster scenario. A risk assessment of each core business process was performed to identify failure scenarios with risk of occurrence in order to determine recovery tolerance for each core process. Documentation of how, by whom, and where critical processes will be resumed are included. Employees have a variety of options, as agreed with their management, for off-site work locations including other ING IM sites, third party service recovery sites and residential locations.
The Crisis Communication Plan addresses the communication roles across ING IM business units and the types of messages communicated to ING IM employees, customers and media in the event of a significant business disruption.
The Disaster Recovery Plan is the Information Technology plan addressing the recovery of systems and data. ING IM has an extensive approach to safeguarding system files and documents. The Company’s systems and data are protected through a combination of data replication, journaling, vaulting, mirroring and tape backup stored off-site. Based on system criticality, applications and data are stored on Storage Area Networks replicating data to alternative data centers. ING IM also maintains documented Disaster Recovery Plans for all critical systems and utilizes a third-party vendor for off-site document storage. Improving technology has also allowed for greater work from home capability through the use of laptop computers for essential ING IM employees and job functions. The Company continues to enhance our IT continuity and recovery strategies through engaged partnerships with our world-class vendors.
The final component of ING IM’s Business Resumption Plan is the Test Plan, describing ING IM’s test strategy over the long term. The strategy consists of scalable and incremental tests of the Crisis Management Organization, Crisis Communication Plan, Business Continuity Plans and Disaster Recovery Plans. Annual tests include communication exercises, desktop/walkthrough testing of Business Continuity Plans and various disaster recovery tests of critical applications.
ING IM continually refines its Business Resumption Plan through ongoing evaluation of the risk management aspects related to business conditions, local and regional events, the national security level and other factors influencing the safety of employees and the ability to conduct business as required by customers and regulatory agencies.
