Business Continuity Plan for

<Name of IT-Service>
in the DHL Express Region <Region>

Legend: (please erase when submitting your final BCP)

Written in Black means:

These phrases should not be changed as they are supposed to reflect the same Information through-
out all regions. This template proposes you a structure we would like you to adhere to. It guides you
throug the documentation of single processes and their inherent steps in a comprehensive manner. If
your realities look different, what is likely to be the case, then you will need to add or erase e.g. single
process chapters (1.6 / 1.7 / 1.8 / (1.X)).

Written in Blue means:

These are explanations / examples of what is expected as Information in this place.
Blue writing is not supposed to be contained in your final version of the BCPs.

Content:
The Table of content needs to be updated after you finnished filling in the document. This can be done
using the automized function of MS Word. (right mouse click  Update Field  update entire Table)

Document Name 752367735.docx

Version
Status
Author
Last update

752367735.docx Page 1 of 15

DHL PROPRIETARY AND CONFIDENTIAL

Content

A. Version history...................................................................................................................3
B. Distribution list...................................................................................................................3
C. Document review...............................................................................................................3
D. Supporting documents.......................................................................................................3

1. Scope and objectives of this Business Continuity Plan (BCP)..........................................3

1.1. Location(s)................................................................................................................3
1.2. Local Business Continuity Plan (BCP) Team............................................................3
1.3. Backup procedure/process overview........................................................................3
1.4. Maximum Tolerable Outage (MTO)..........................................................................3
1.5. Dependencies and interfaces....................................................................................3
1.5.1. Dependencies and interfaces to other business processes..............................3
1.5.2. Dependencies on systems or infrastructure......................................................3
1.5.3. Dependencies and interfaces between backup and original process...............3

1.6. Business process 1 affected by the outage: <Process 1>........................................3

1.6.1. Backup steps summary.....................................................................................3
1.6.2. Backup step 1....................................................................................................3
1.6.3. Backup step 2....................................................................................................3
1.6.4. Backup step 3....................................................................................................3
1.6.5. Backup Step n...................................................................................................3

1.7. Business process 2 affected by the outage: <Process 2>........................................3

1.7.1. Backup steps summary.....................................................................................3
1.7.2. Backup step 1....................................................................................................3
1.7.3. Backup step 2....................................................................................................3
1.7.4. Backup step 3....................................................................................................3
1.7.5. Backup step n....................................................................................................3

1.8. Business process n affected by the outage: <Process n>........................................3

1.8.1. Backup steps summary.....................................................................................3
1.8.2. Backup step 1....................................................................................................3
1.8.3. Backup step 2....................................................................................................3
1.8.4. Backup step 3....................................................................................................3
1.8.5. Backup step n....................................................................................................3

2. Disaster Recovery Plan (IT-side).......................................................................................3

3. Exercise.............................................................................................................................3
3.1. Conducting the BCP exercise...................................................................................3
3.2. Documentation of the BCP/DRP exercise.................................................................3
3.3. Exercise schedule for this BCP / DRP......................................................................3
3.4. Documented Exercises.............................................................................................3

4. General Information about the ITSCM-Process................................................................3

4.1. Business Continuity Lifecycle....................................................................................3
4.2. Regional Emergency Management Team (EMT)......................................................3

5. Approval............................................................................................................................3

6. Appendix............................................................................................................................3

752367735.docx Page 2 of 15

DHL PROPRIETARY AND CONFIDENTIAL

 A. Version history

Status/Version Release Date Comments

B. Distribution list

Name Organisation/Location Action/Information

C. Document review

Status/Version Organisation/Location Reviewer’s Name/Date

D. Supporting documents

Reference Document name Version Date

Business Impact Analysis for <Ap-
plication Name>
Continuity Option Decision for
<Application Name>
Service Level Agreement for
<Application Name>

752367735.docx Page 3 of 15

DHL PROPRIETARY AND CONFIDENTIAL

1. Scope and objectives of this Business Continuity Plan (BCP)

This Business Continuity Plan covers the critical service <Name of IT-Service> within the
DHL Express Region <Region>. It is independent from the type of disaster occurring and
presumes a general outage of the IT-Service named above.

The Objective of this plan is to set the outlined manual backup processes into force after the
case of a service outage was identified and communicated by the EMT and the BCP Team
leader.

1.1. Location(s)

<Please name any location where the critical business processes are taking place and where
you intend to implement this Business Continuity Plan>

<Location/Site-Name >
<Address>

<Specific contacts are documented under point 1.2 for each site>

1.2. Local Business Continuity Plan (BCP) Team

<Please note that in case a business process takes place at several sites/locations the BCP-
Team needs to be set up for any of these sites/locations.>

Name: Function: Contact details:

<Name> Team leader (please fill Address: <details>
in the Name of the same Desk-Nr: <details>
person as within the dia- Home-Nr: <details>
gram under point 1.) Mobile: <details>
Company E-Mail: <details>
Private E-Mail: <details>
<Name> Team member I Address: <details>
Desk-Nr: <details>
1st Substitute for Team Home-Nr: <details>
Leader Mobile: <details>
Company E-Mail: <details>
Private E-Mail: <details>
<Name> Team member II Address: <details>
Desk-Nr: <details>
2nd Substitute for Home-Nr: <details>
Team Leader Mobile: <details>
Company E-Mail: <details>
Private E-Mail: <details>
<Name> Team member n Address: <details>
Desk-Nr: <details>
Home-Nr: <details>
Mobile: <details>
Company E-Mail: <details>
Private E-Mail: <details>

752367735.docx Page 4 of 15

DHL PROPRIETARY AND CONFIDENTIAL

 <Name> 1st substitute for team Address: <details>
member I Desk-Nr: <details>
Home-Nr: <details>
Mobile: <details>
Company E-Mail: <details>
Private E-Mail: <details>
<Name> 2nd substitute for team Address: <details>
member II Desk-Nr: <details>
Home-Nr: <details>
Mobile: <details>
Company E-Mail: <details>
Private E-Mail: <details>
<Name> substitute for team Address: <details>
member n Desk-Nr: <details>
Home-Nr: <details>
Mobile: <details>
Company E-Mail: <details>
Private E-Mail: <details>

1.3. Backup procedure/process overview

<Please briefly outline the manual procedure / the manual process to backup
the critical business processes on an aggregate level.>

<To allow easy understanding on the first glance, BIT proposes to insert a timeline-type
depiction of the entire process on an aggregate level. What happens step per step from the
notion of a service outage, over the communication process with the EMT, the actual execu-
tion of the BCP, to the final return to the normal business process?>

Business Process Owner:

1.4. Maximum Tolerable Outage (MTO)

<Please outline the Maximum Tolerable Outage Period (MTO) for the IT-service>
(MTO = length of time the IT-service can remain unavailable before financial or operational
impacts reach an unacceptable level or cannot be backed up by a manual backup process /
an IT-disaster recovery plan.)

1.5. Dependencies and interfaces

<This chapter was intentionally placed prior to the actual and detailed definition of your
manual backup processes and steps. This is to ensure that the manual backup process(es)
you define, perfectly fit into the existing process landscape. All interfaces between original
process, backup process, and the surrounding processes should shortly be described under
the following points 1.5.1 / 1.5.2 / 1.5.3..)

1.5.1. Dependencies and interfaces to other business processes

<Please name any process directly prior or directly after the affected business process(es).
Briefly outline the interface(s) and consider how these are affected by the IT-Service outage.
Briefly explain how these interfaces will connect to the manual backup process.>

752367735.docx Page 5 of 15

DHL PROPRIETARY AND CONFIDENTIAL

 1.5.2. Dependencies on systems or infrastructure

<Briefly outline any dependencies of the manual backup process to additional systems, infra-
structure or resources needed>

1.5.3. Dependencies and interfaces between backup and original process

<Briefly outline the dependencies and interfaces between the manual backup process and
the original process when you switch back from the backup to the original again.>

<Explanation to points: 1.5.1 / 1.5.2 / 1.5.3>

1.6. Business process 1 affected by the outage: <Process 1>

<Please briefly outline the operative purpose of business process 1>

“<Business Process 1> ensures the following:...”

1.6.1. Backup steps summary

 Step No. Description of the single steps

Step 1 <Please name step 1> “Contact BCP team members...”
Step 2 <Please name step 2> “Assess the situation...”
... ...
... ...
Step n <Please name step n>

1.6.2. Backup step 1

<Please briefly outline backup Step 1>

Responsibility for backup step 1:

<Please enter the function of the person in charge for backup step 1 in each site (refer to the
BCP Team under point 1.2>

752367735.docx Page 6 of 15

DHL PROPRIETARY AND CONFIDENTIAL

 1.6.3. Backup step 2

<Please briefly outline backup step 2>

Responsibility for backup step 2:

<Please enter the function of the person in charge for backup step 2 in each site (refer to the
BCP Team under point 1.2>

1.6.4. Backup step 3

<Please briefly outline backup step 3>

Responsibility for backup step 3:

<Please enter the function of the person in charge for backup step 3 in each site (refer to the
BCP Team under point 1.2>

1.6.5. Backup Step n

<Please briefly outline backup step n>

Responsibility for backup step n:

<Please enter the Function of the person in charge for backup step n in each site (refer to the
BCP Team under point 1.2>

1.7. Business process 2 affected by the outage: <Process 2>

<Please briefly outline the operative purpose of business process 2>

“<Business process 2> ensures the following:...”

1.7.1. Backup steps summary

 Step No. Description of the single steps

Step 1 <Please name step 1> “Contact BCP team members...”
Step 2 <Please name step 2> “Assess the situation...”
... ...
... ...
Step n <Please name step n>

1.7.2. Backup step 1

<Please briefly outline backup step 1>

Responsibility for backup step 1:

<Please enter the function of the person in charge for backup step 1 in each site (refer to the
BCP Team under point 1.2>

1.7.3. Backup step 2

<Please briefly outline backup step 2>

752367735.docx Page 7 of 15

DHL PROPRIETARY AND CONFIDENTIAL

Responsibility for backup step 2:
<Please enter the function of the person in charge for backup step 2 in each site (refer to the
BCP Team under point 1.2>

1.7.4. Backup step 3

<Please briefly outline backup step 3>

Responsibility for backup step 3:

<Please enter the function of the person in charge for backup step 3 in each site (refer to the
BCP Team under point 1.2>

1.7.5. Backup step n

<Please briefly outline backup step n>

Responsibility for backup step n:

<Please enter the function of the person in charge for backup step n in each site (refer to the
BCP Team under point 1.2>

1.8. Business process n affected by the outage: <Process n>

<Please briefly outline the operative purpose of business process n>

“<Business process n> ensures the following:...”

1.8.1. Backup steps summary

 Step No. Description of the single steps

Step 1 <Please name step 1> “Contact BCP team members...”
Step 2 <Please name step 2> “Assess the situation...”
... ...
... ...
Step n <Please name step n>

1.8.2. Backup step 1

<Please briefly outline backup step 1>

Responsibility for backup step 1:

<Please enter the function of the person in charge for backup step 1 in each site (refer to the
BCP Team under point 1.2>

1.8.3. Backup step 2

<Please briefly outline backup step 2>

Responsibility for backup step 2:

<Please enter the function of the person in charge for backup step 2 in each site (refer to the
BCP Team under point 1.2>

752367735.docx Page 8 of 15

DHL PROPRIETARY AND CONFIDENTIAL

 1.8.4. Backup step 3

<Please briefly outline backup step 3>

Responsibility for backup step 3:

<Please enter the function of the person in charge for backup step 3 in each site (refer to the
BCP Team under point 1.2>

1.8.5. Backup step n

<Please briefly outline backup step n>

Responsibility for backup step n:

<Please enter the function of the person in charge for backup step n in each site (refer to the
BCP Team under point 1.2>

2. Disaster Recovery Plan (IT-side)

<Please insert your documentation of the disaster recovery solution.>
<This chapter is to cover the rather technical IT-side of ITSCM if the business decided this to
be needed in addition to the manual backup processes within this BCP and the Disaster Re-
covery Plans which are in place in your regional ITSCs. Therefore your DRP-Document (e.g.
a region or country-specific SLA for disaster recovery) needs to cover a disaster recovery
solution on the IT-side, which needs to be negotiated separately and in addition to the exist-
ing agreements with IT-Services. (This does not include any disaster recovery service taking
place within one ITSC. E. g. a service specific SLA provides 98% availability of a service in
question and the business decides that regardless of that it needs an additional fallback solu-
tion on the IT-side to cover the remaining risk by an additional fallback solution / hot standby
of another ITSC.)>

<Please be aware that a Disaster Recovery Plan/Document needs to contain a Recovery

Time Objective (RTO) especially for the IT-service you are regarding.>
(The RTO is the desired time frame within which the original business process should be
restored in order to avoid unacceptable consequences which are associated with a break in
continuity.)

3. Exercise

Exercising the content of this BCP on a regular Basis is of paramount importance. DHL Ex-
press will exercise this plan in all its steps once a year and document the outcome. This doc-
umentation has to be provided to the regional EMT for review and evaluation no later than
<XXX> business days after the test was conducted. The EMT will derive appropriate meas-
ures (improvements, changes) that need to be implemented in order to keep the BCP up to
date. The exercise documentation has to be imbedded in this BCP. (Please refer to Point
3.4)

 The responsibility to set up the test schedule is with the Emergency Function Man-
ager who is part of the EMT. He or she needs to include the BCP Team Leader into
his decision of when to conduct the exercise.

 The responsibility to conduct and document the test is with the BCP Team Leaders.
They need to communicate and plan the exercise and inform all relevant parties. The
752367735.docx Page 9 of 15

DHL PROPRIETARY AND CONFIDENTIAL

 BCP Team Leader may assign designated team members to support planning, test
supervision and documentation.

 The responsibility to review the test documentation and derive appropriate measures
(improvements, changes) is with the Emergency Function Manager just as well as
keeping the document up to date. The Emergency Function Manager may assign
personnel to assist in this process.

3.1. Conducting the BCP exercise

<Please outline your regional approach of how to conduct a BCP exercise. Include the single
steps from setting the date of the test, communicating the test to all participants and other
relevant parties, preparing the sequences, assign responsibilities, prepare appropriate docu-
mentation...>

3.2. Documentation of the BCP/DRP exercise

<The Template for Test/Exercise Documentation will be released on August 29th according to
the project plan and has to be added in this place. Furthermore any documented exercise
needs to be added in the matrix below.>

3.3. Exercise schedule for this BCP / DRP

Date Area of the test (entire BCP / process x-y / all Loca- Comments
tions / selected Locations)

3.4. Documented Exercises

Documented exercises are to be added to the appendix of this BCP.

752367735.docx Page 10 of 15

DHL PROPRIETARY AND CONFIDENTIAL

4. General Information about the ITSCM-Process

4.1. Business Continuity Lifecycle

Business Continuity Management is a process which follows the 5 steps depicted below:

Identify:
This first step identifies services in scope for Business Continuity Management. This period
was initially defined by the Corporate IT-Audit on 15th June 2006. The Audit Report and its
derived overall action plan assigned specific tasks to DHL Express and other business units
to be finalized by December 2007. For the running period, the action plan assigned DHL Ex-
press to cover 3-5 critical services per Express region.

After the subsequent Corporate Audit in December 2007, the next period for Business Con-
tinuity Management will be set off.

Analyze:
Within the analysis, DHL Express Business IT conducts its Business Impact Analysis (BIA)
on the services identified in step 1. The findings of the BIA serve as an indicator for the Con-
tinuity Option Decision which has to be met by the regional business. Furthermore the BIA
already contains information about the underlying business processes which are supported
by the IT-service in question. This information serves as a first basis to meet the Continuity
Option Decision first and to create an according business continuity plan afterwards.

Design:
The “design-step” refers to the Continuity Option Decision (COD), where one defines the
overall nature and content of a subsequent business continuity documentation (Business
Continuity Plan / Disaster Recovery Plan). This is the actual step where the business decides

752367735.docx Page 11 of 15

DHL PROPRIETARY AND CONFIDENTIAL

on the measures it wants to take with regards to mitigating the impacts outlined within the
previously conducted Business Impact Analysis (BIA). Therefore the COD bridges the gap
between impact- and mitigation-documentation. Here the business consciously decides what
it wants to do, why and how much the targeted solution may cost.

Execute:
This step refers to the creation of the Business Continuity Plans. What measures, processes,
steps will be implemented on the operative business side in order to mitigate the risks
caused by a potential IT-service outage. The business continuity plan furthermore may con-
tain a so called disaster recovery plan to cover and describe a possible IT-backup solution
that exceeds the existing Disaster Recovery Plans that are in place within the ITSCs.

Measure:
This last step of the Business Continuity Lifecycle contains the testing and training of the
BCP / DRP. Within this test the Emergency Management Team (EMT) needs to ensure that
the planned measures are appropriate and working in order to keep up business functionalit-
ies for the necessary time defined by the Maximum Tolerable Outage (MTO) / Recovery
Time Objective (RTO). The test needs to be recorded and reviewed in order to derive appro-
priate adaptations.

752367735.docx Page 12 of 15

DHL PROPRIETARY AND CONFIDENTIAL

4.2. Regional Emergency Management Team (EMT)

In case a major incident/disaster is presumed or obviously occurs, the regional Emergency

Management Team will meet physically or supported by telecommunications to assess the
situation. The EMT jointly identifies the emergency and sets the appropriate Business Con-
tinuity Plan/Disaster Recovery Plan into force.

The regional EMT has the following format:

Regional
Sr. Management
EMERGENCY
MANAGEMENT TEAM (EMT)

Mr. / Mrs. XYZ

EMT Team Leader

e.g. regional SM-Head

Emergency Emergency Emergency Emergency

Function I Manager Function II Manager Function III Manager Function IV Manager
e.g. regional Domain Head e.g. regional Domain Head e.g. regional Domain Head e.g. regional Domain Head
Operations Marketing Finance (...)

<Name> <Name> <Name> <Name>

(BCP (BCP (BCP (BCP
Team Leader) Team Leader) Team Leader) Team Leader)
BCP Teams BCP Teams BCP Teams BCP Teams
Refer to point Refer to point Refer to point Refer to point
1.2 1.2 1.2 1.2

Any Business Continuity Plan (BCP) will be activated by the BCP Team Leader after receiv-
ing the according instruction from the Emergency Function Manager in the EMT.

For the time of the emergency, the BCP Team Leader reports directly to the EMT Function
Manager. Any instructions, decisions, requests between the EMT and the BCP Team are to
be exchanged over the Emergency Function Manager and the BCP Team Leader.

The BCP Team Leader is responsible for the communication with his team and to ensure
that all steps and measures are being executed as defined within this Business Continuity
Plan.

752367735.docx Page 13 of 15

DHL PROPRIETARY AND CONFIDENTIAL

5. Approval

The following signatories, by signing this Business Continuity Plan, confirm that the details of this BCP
document are understood and accepted. The according responsibilities are assigned and communi-
cated.

Emergency Management Team Leader ________________________________

Date and Signature

Business Service Owner _______________________________

Date and Signature

Business Process Owner

_______________________________

Date and Signature

752367735.docx Page 14 of 15

DHL PROPRIETARY AND CONFIDENTIAL

6. Appendix
Please insert you exercise documentations here.

Date Embedded document(s) Comment

752367735.docx Page 15 of 15

DHL PROPRIETARY AND CONFIDENTIAL