RESILIENCYSchneider Electric Business andOperations Resiliency Framework
Resiliency allows Schneider Electric to provide
reliable products and services

se.comOur commitment: keep our services and operations running smoothly, so that
we can provide our customers with the best service possible and a peace ofmind to their customers and business.
Our priorities: identify and manage the technological, environmental, process,geo-political, and health risks that could disrupt business.
Schneider Electric is the most local of global companies. As such, decisions
are made at the very beginning of a crisis to triage an incident to the rightleadership team for maximum efficiency.
22

SE business & operations resiliency framework

Schneider Electric business & operations
resiliency framework overview
Here is the risk-centric framework that lays out our approach for a reduced risk exposure
and preparedness for any hazards.

Identify &Assess

Protect

Detect /Monitor

Respond

Recover

Risk register definition & update
Risk owner identification & animation
Intelligence

Mitigation actions (policies, training, capabilities, tools)
Coverage (insurance, hedging, provisions)Influencing
Action prioritizations & resource allocation

Reality check (audit, controls, simulation)
Automatic & manual systematic controls

Crisis management plan

Business Continuity Plan
Disaster recovery plan

LegendReduced risk exposure

3SE business & operations resiliency framework

Preparedness

Get ready: Plan development
Crisis management preparedness plans, disaster recovery plans and business continuity
plans prepare us to respond and recover efficiently when our operations are affected.
They all serve a different purpose.

We take an “All Hazards” approach to our resiliency planning; ready to respond to alltypes of challenges.

4

Natural disasters
E.g. hurricanes, floods, fires,
earthquakes

Terrorist/man-made disasters
E.g. Active shooter, protests

Technology crisis
E.g. Software failure, industrial
accidents, cyber attacks

Organizational misdeeds
E.g. Management misconducts,
product misinformation and recalls

SE business & operations resiliency framework

Crisis management preparedness plan
The purpose of preparedness planning at Schneider
Electric is to protect employees and business
operations by providing actionable guidance and tools
to effectively manage a crisis.
Schneider Electric prescribes the tools, responsibilities
and roles to ensure immediate and effective
management of a crisis.
It includes the definition of triggers for escalation of anincident to a crisis, the composition of the crisis teamand communications/media handling.
2021

This preparedness planning ensures Schneider
Electric is ready to:ensure safety and security,
assess the situation and damages quickly,
provide internal & external communication for full transparency.

5SE business & operations resiliency framework

Business continuity plan
Based on our risk assessment and business
impact analysis, Schneider Electricbusiness continuity plans areadminist
Plandeveloped to sustain or restore ouradministration
critical operations after a crisis.
When there is an unplanned event that
affects Schneider Electric, our continuity
plan kicks in to provide a quick response
and recovery.

Planactivation& escalation
triggers

Key
products& services
to prioritize

To withstand and thrive during challenging times,
we developed holistic business continuity plansthat can keep our business up and running,protect data, safeguard the brand, retain
customers – and ultimately help reduceRec
total operating costs over the long term.
strat
Recovery
Having a business continuity plan instrategies
place can minimize downtime andachieve sustainable improvements inbusiness continuity, IT disaster recovery,
corporate crisis management capabilities andregulatory compliance.

Communication
planMinimum
recovery
configurations

7

SE business & operations resiliency frameworkKeycompetencies& skills
to maintain

Schneider ElectricBusiness continuity
plan components

IT Disaster Recovery Plan
IT Resilience requires proper planning to be ready in the face of disaster.
Schneider Electric policies require Disaster Recovery planning for key assets, routinemaintenance of plans, and regular testing frequency to ensure readiness.
Plans are standardized and centrally available, globally.
Team and leadership involvement is critical, roles and responsibilities are identified.
Infrastructure and application configurations are documented and standards in place.
Our digital suppliers are monitored for DR Readiness.

1. Assemble Plan
8. Testing and Maintainance2. Identify Scope

Disaster
Recovery Plan
7. Restore Technology
Functionality

6. Data & Back Ups
Location

6

SE business & operations resiliency framework

3. Appoint EmergencyContacts

5. Assign Roles &Responsibilities

4. Designate Disaster
Recovery Team (DRT)Continuous improvement: Testingand validation
Continuous improvement is at the core of our business resiliency framework. We test ourplans and draw conclusions from simulations and the real crises.
administ

Incorporationof revisions
into plans
Communicationof changes

Revise

Review

Exerciseor Real Crisis
Rec

Test plans
strat
Simulation exercise
Scenario planning
Tabletop exercise
Lessons learnt

8SE business & operations resiliency framework

Periodic review ofSchneider Electricplans by variousstakeholders

Respond & recover
Our framework is designed for flexibility so we can answer to a crisis of any type, scope,or complexity.
Our local leaders are empowered to handle any type of hazard for rapid and effective
administ
response.
When experiencing a crisis, there are 3 key steps to take quickly:
Ensure safety and security of people
Assess situation and damages
Communicate
We refer to the crisis preparedness plan known by the leadership team and readily
accessible.
Once the above is taken care of, we enter a business continuity phase. There are 2 key
aspects:
Customer experience continuity: Customer interaction lifecycle (e.g. selecting offers,get quotations, get delivered, get technical support)
Key internal processes continuity: Managing payroll and cash, paying suppliers,
invoicing customers
To allow our employees to perform, we must ensure the digital continuity of our business.
It includes our communication infrastructure; Schneider Electric IT team has policies anddisaster recovery plans in place.
Even in a crisis, our values guide us:
People culture and values: we do the right thing
Compliance with our policies: we always abide by local rules and regulations10SE business & operations resiliency framework

We have a specific approach for Cyber Defense
How do we identify, detect and respond to and recover from aCyber incident?

Our process and procedures support the prompt and consistent management ofsecurity incidents to minimize any harm to Schneider Electric’s customer and theiroperations, employees, partners, physical and digital assets and to reduce the risk offuture breaches of security.
administ

Our Cyber Incident Response process follows 5 stages summarized below:
Identify

DetectAnalyze

RespondRecoverWe identify Cyber risks, vulnerabilities and threats throughout the company,
by robust risk assessment, threat intelligence, detection & hunting
capabilities and focusing on high value (crown-jewel) assets. Also, we protect
the company through initiatives implementing cyber capabilities and digitallocks.
Our extended ecosystem is connected to efficiently detect anomalies andprevent cyber events, via people and technology sensors. Lawful andproportionate measures complemented with a modern technology stack isin place to protect the information in monitored networks and systems.
We are leveraging our correlation technology & tools and Security
Operations Center to assess and triage incident types, define severity andassign adequate escalation paths.
With a risk-based approach we define clear incident ownership enforcedby our internal policies and procedures, among which is a strong Incident
Response Plan and Privacy Breach Response Procedure. We respond toincidents through an organization of Security Officers across regions.
As a learning organization, we systematically conduct root cause analysis
and mitigation actions are implemented. Business continuity plans aredeveloped, as well as IT Disaster Recovery Plans, with regular testing andexercises.

29SE business & operations resiliency framework

For more information visit
se.comSchneider Electric35 rue Joseph Monier
92500 Rueil-Malmaison, France
Tel : +33 (0)1 41 29 70 00© 2018 Schneider Electric. All Rights Reser ved. Life Is On Schneider Electric is a trademark and the998-20319763_GMA-US