Business Continuity

Policy

Framework

Business Continuity Management System (BCMS)

Main Activities and Results (Fiscal 2012)

Monitoring and Improvement

Objectives and Achievements

Policy

NEC provides numerous information and communications systems that support social infrastructure. Accordingly, NEC has a social responsibility to maintain those systems in the event of a natural disaster, as well as fulfill its responsibility to help maintain supply chains that have become increasingly complex and technically advanced. To this end, the NEC Group as a whole is actively and systematically formulating business continuity plans (BCPs) and conducting business continuity management (BCM) to maintain and improve BCPs.

The NEC Group has three common policies governing BCP formulation:

1. Protect the lives and safety of employees and other people (including onsite contract workers and visitors)
2. Fulfill the social duties expected of NEC:
   Maintain and rebuild critical systems in areas such as communications, public infrastructure, traffic, defense and finance
3. Minimize any economic damage caused by business disruptions

Framework

The NEC Group has clarified its framework for promoting BCP formulation by assigning "BCP Promoters" and "BCP Developing Members," as follows.

• BCP Promoter: Assigned to each business division, namely business units, subsidiaries and affiliates, and responsible for obtaining expertise on BCP formulation and for guiding the preparation of a BCP and overseeing progress at the entire assigned business division.
• BCP Developing Member: Assigned to each business subject to BCP formulation, and responsible for performing a business impact analysis (BIA) and preparing a BCP for the business.

The General Affairs Division of NEC Corporation provides expertise on BCP formulation to assist business divisions with BCP formulation. By cooperating with other corporate staff, the Division provides assistance with any issues that cannot be solved at the business division level.

Internal BCP formulation guidelines for NEC were developed, covering know-how related to plan development along with disaster scenarios. The guidelines were distributed and communicated to all BCP formulation personnel, including BCP Promoters and BCP Developing Members. An internal website was also created to enable the teams to access sample BIA/BCP documents and other templates for use during each phase of formulation. Through these and other measures, NEC worked to share information on the BCP formulation process. The number of BCP formulation personnel with whom know-how and information have been shared in this manner has surpassed 2,000 individuals among the NEC Group.

Business Continuity Management System (BCMS)

From fiscal 2008, NEC has phased in the creation of BCPs for earthquakes by all business divisions at NEC Group consolidated subsidiaries in Japan. By March 31, 2009, NEC had created BCPs for approximately 400 businesses. In addition, in fiscal 2009, we began working to obtain third-party certification via the BSI (British Standards Institution) standard BS25999-2, primarily in businesses where BCP creation is required by customers worldwide as a precondition for doing business. This UK standard has become the de facto global standard in the BCMS field until the transition to an ISO standard is complete.

Since fiscal 2009, in accordance with the BCMS (Business Continuity Management System) stipulated in BS25999-2, NEC has been implementing a management system based on a continuous PDCA cycle to govern all BCP-related activities from plan formulation, document management and education to training drills, internal audit, management review and system upgrades.

Main Activities and Results (Fiscal 2012)

Activities in Japan

Company-wide Review of BCPs After the Great East Japan Earthquake

Inspection of BCPs in the wake of the Great East Japan Earthquake has highlighted discrepancies with disaster scenarios and the need to reassess vulnerabilities. In response, NEC has reestablished disaster scenarios as a first step, while working to identify vulnerabilities in each business division. Issues that are difficult to solve at the divisional level have been identified as company-wide issues.

Among these company-wide issues, those related to internal infrastructure, such as buildings and facilities, IT systems, and logistics, are fundamental to business continuity. To address these vulnerabilities related to internal infrastructure, the relevant corporate staff divisions have explored measures to reduce damage from disasters, such as seismic reinforcement and spreading out infrastructure, based on the scenario of a disaster that causes damage over an extensive area.

In fiscal 2013, each business division will work to improve BCPs by reviewing action plans and measures for restoring businesses, based on the aforementioned measures to address internal infrastructure.

Training drills

From fiscal 2009, NEC has conducted joint group training drills to determine the effectiveness of businesses that have completed the BCP formulation process. In fiscal 2012, NEC conducted one group training drills, as shown in the following table. In the morning, first-response training drills were conducted all at once, including assembling key personnel, establishing a response headquarters and escalating information. In the afternoon, each business division implemented business restoration simulation drills based on scenarios prepared by each individual division.

Each participating division compiled the points of improvement from the training drills into reports, and held follow-up meetings to make improvements.

Internal audit

In fiscal 2012, NEC conducted internal audits of all BCPs that have already been completed and put into operation. The internal audits were conducted from the viewpoint of verifying the proper implementation of business continuity management (BCM).
When implementing internal audits, NEC selected a total of roughly 200 internal auditors for each business unit and subsidiary, and provided training for these individuals through internal audit seminars. The internal auditors performed the internal audits by reviewing related documents and interviewing relevant personnel using implementation guidelines and check sheets prepared by the General Affairs Division.

BS25999-2 certification gained

Activities Outside Japan

In various overseas regions, there have been frequent occurrences of natural disasters, accidents, infectious disease outbreaks and other such events, along with burgeoning geopolitical risk due to complex international affairs. Meanwhile, the NEC Group’s supply chains have become increasingly complex and technically advanced as the Group has promoted the globalization of its business operations. This has led to concerns about the possible impact of global risk factors on the NEC Group’s business operations.
Under these circumstances, the NEC Group’s overseas subsidiaries first created BCPs for the possible outbreak of a highly pathogenic new strain of influenza in fiscal 2010. In fiscal 2011, overseas subsidiaries continued to formulate other BCPs for natural disasters and similar events. In 2011, overseas subsidiaries continued to formulate these BCPs.

During the Thai floods that occurred in 2011, some of NEC subsidiaries’ plants were flooded. Countermeasures were discussed after launching BCPs, gathering information on damage at an alternate office, and escalating information about the situation to the response headquarters in Japan. Although plant operations were suspended for several months, these operations have been resumed following the restoration of plant sites or relocation of plants.
Based on the lessons learned from this event, various overseas subsidiaries will closely reexamine disaster scenarios, measures to reduce damage and other details, with the view to revising and raising the effectiveness of BCPs.

BCP formulation

Overseas subsidiaries subject to BCP formulation* developed BCP formulation frameworks by appointing BCM Practitioners, who are responsible for formulating BCPs and promoting BCM. The General Affairs Division and business divisions presiding over overseas subsidiaries provided guidelines and training materials to BCM Practitioners to assist with BCP formulation.
Each overseas subsidiary formulates BCPs by identifying threat factors specific to the host country’s circumstances, including natural disasters, political unrest, and terrorism, while establishing disaster scenarios.

(*)Based on the NEC Group’s common policies governing BCP formulation, each business division presiding over overseas subsidiaries identifies subsidiaries subject to BCP formulation, focusing mainly on systems operation service, maintenance, manufacturing and logistics companies, while giving due consideration to the necessity for BCPs.

Establishing a System for the Escalation of Information

To ensure that information about the status of damage can be grasped and shared promptly after a disaster occurs, NEC has clarified rules and channels for the escalation of information, as well as the personnel responsible for reporting and points of contact, among other details. In March 2012, in order to verify and familiarize personnel with the actual procedures, almost all overseas subsidiaries conducted training drills on the escalation of information about the status of damage envisaged in their disaster scenarios to their respective response headquarters in Japan.

Monitoring and Improvement

Divisions formulating BCPs upload formulated or updated BCPs to the management site of a dedicated website. The General Affairs Division confirms the uploaded plan, and provides feedback to the division that formulated the plan when improvements are necessary.
Furthermore, the divisions formulating BCPs prepare implementation reports after conducting training drills and internal audits, and upload these reports in the same manner. The General Affairs Division has confirmed the implementation status of training drills and internal audits in fiscal 2012, and has identified company-wide points of improvement based on these reports.
In fiscal 2012 (2nd half), a Coordination Meeting will be held to report and share information about company-wide BCM implementation and points of improvement among BCP Promoters in every division, while encouraging improvements in each division.

Objectives and Achievements

Objectives for the Medium Term (From Fiscal 2011 to Fiscal 2013) and Fiscal 2012, Achievements and Progress, and Degree of Completion

(Degree of completion: achieved/mostly achieved/some progress/no progress)

Fiscal 2013 Objectives

Internal Control (Compliance and Risk Management)

Information security

For Shareholders and Investors

Top of this page