Global Information Security Technology
Recovery Program within JLL

Technology Recovery
Program

The JLL Technology Recovery Program is managed by the Global
Technology Recovery Program Manager, reporting to the SVP,Global Risk, Compliance, and Recovery. Plans are in effect forcontinuity of the Regional and Global Technology Teams and theservices they deliver to the firm’s clients and employees, as well as
system recovery plans for all mission-critical technology systems.
The Technology Groups are responsible for recovery of the firm’s
computing environment in the event of a significant incident
affecting critical systems hosted at a regional primary data centerused by JLL; or an incident that disrupts a corporate office ormultiple local offices across a geographic region and displaces
employees at a location. Manual workarounds for critical businessprocesses during the technology restoration period are theresponsibility
Regional IT Group Business Continuity Plans
Plan Description
The Technology Groups’ Crisis Management Plans are detailed guides to crisis response and the rebuildingof the firm’s technology infrastructure systems and business applications. The contents of the plans include
steps the responsible regional Technology Group would take to recover the list below of critical technology
business processes. The regional Technology Crisis Management Plans’ recovery time objectives are thesame day of a major manmade business-interrupting event or natural disaster, while critical businesssystems recovery Time Objective (RTO) is within 72 hours of a disaster declaration which requires all
business-critical production systems to be made available at an identified regional recovery data center(see “Systems Recovery Program”).
• Crisis Communications & Event Management(including liaison with client points of contact)• Technology Operations (all infrastructureservices necessary to support the firm’stechnology delivery)• Vendor Management (third-party vendors
supplying network connectivity, hardware
replacement, managed operations services,
telecommunications, data restoration,telephony)• Procurement (all business controls, including
hardware purchasing)• End-User Support (including replacement PCs
and remote connectivity to ensure JLL staff
ability to function at a recovery location)• Telecommunications (including network
connectivity, telephone access, and voicemail
continuity)• Security Management (secure external andinternal access to the firm’s network and data)• Troubleshooting / Application Management(restoration of systems and data for business –critical applications)• Restoration of business–critical technology
systems and data at an alternate data center
location if necessaryTechnology Recovery Program2|

System Recovery Program
Assessing Systems Recovery Priorities and Requirements
For the determination of technology disaster recovery requirements, the Information Technology Group
conducts business impact analysis (BIA) sessions with senior-level representatives from all business units.
During these sessions critical business processes are documented, as well as the impact of disruption tothese processes, and the tools used to support them. Business processes and systems are evaluated interms of criticality, recovery tolerance, and financial impact to the firm. This information is compiled andevaluated, and the technology systems grouped into two categories: Tier 1 and Tier 2. Detailed System
Recovery Plans are then developed for each Tier 1 application.
On an annual or as-needed basis, the listing of Tier 1 systems in each region is reviewed to ensurealignment with the criteria for remaining on the critical systems list. During the implementation of newsystems, a business impact analysis of the system’s criticality is performed for consideration of it being
added to the Tier 1 suite of applications.
The recovery classifications for systems are outlined below.

Tier 1

Tier 2

Systems will be operational within 72 hoursof an outage with no more than 24 hours ofdata loss.

Systems will be operational within two
weeks of an outage with no more than 24hours of data loss.

Systems critical to the service of our clients andemployees because there is little or no manual
process available to duplicate the tasks
performed by these systems. The loss of theseapplications would cause significant financial
or non-financial impact to the firm’s employees
and clients.

Systems important to the service of our clientsand employees, but the tasks performed bythese systems can be manually performed
during an interim period.

Based on the above assessment process, this is a representative list of Tier 1 critical business applications
that are client-facing across multiple service regions around the globe.

Tier 1 Systems
Analytics

BudgetExtranet

Foundational
Report

MaintainPortfolio

Project

Property HubSpaceSpendTechnology Recovery Program3|

Program Maintenance and Testing
System recovery plans are reviewed and updated on an annualbasis; with out-of-cycle reviews occurring as new systems arebought, developed, or acquired. Program testing documentation
includes test objectives and formal verification scripts, as well as arecovery test results report which is issued as part of the testingprocedure.
Testing occurs throughout the calendar year, with at least one
annual exercise for Technology crisis management and businessresumption, and all Tier 1 applications are subject to live recovery
testing on a minimum three-year testing cycle to validate
technology recovery resumption and timeline (some applications
are tested more frequently based on business criticality or clientagreement). A combination of written plan updates, tabletop crisis
response scenario exercises, and live system recovery tests is used
to verify and maintain plan currency. Gaps noted during tests andexercises are worked to conclusion through a mitigation project.

For more information
For additional informationon the JLL Global Technology
Recovery Program, pleasecontact the Technology
Recovery Team at
TechnologyRecovery@am.jll.com