CONTINUITY

RECOVERY PLANNING

What Is Business Continuity Management?Business Continuity Management (BCM) is the complete

set of activities and processes divided into various stagesnecessary to manage the continuation of business followingan adverse event. We must anticipate incidents which mayaffect critical business functions and identify processes toensure that the organization is capable of responding to suchincidents in a planned and rehearsed manner.

The importance of Business Continuity Management not onlyis beneficial to the company, but these plans are audited by theOffice of Comptroller of Currency (OCC) using the FederalFinancial Institution Examination Council (FFIEC) guidelines.Thefollowing are a few of the objectives used in our BCM program:

Objective 1: Business Impact Analysis (BIA).The BIAestablishes the requirements for evaluating the workflowand determining the criticality of our operations and anyassociated information system within Colonial BancGroup,Inc. and Colonial Bank N.A. The BIA is an essential systematicprocess that is used to gather and analyze information onour functional and operational business units and processes.

Objective 2: Business Continuity Management. BCM is theprocess whereby we ensure the maintenance or recovery ofoperations, including services to customers, when confrontedwith adverse events such as natural disasters, technologicalfailures, human error, or terrorist activity. Changing businessprocesses (internally and externally among interdependentfinancial service vendors) and new threat scenarios requiresus to maintain and update the Business Continuity, andDisaster Recovery plan.

Objective 3: Crisis Management Plan (CMP).The CMP de-fines the process developed to recover Colonial BancGroup'sand Colonial Bank's lines of businesses, service units, retailand commercial facilities,etc. The plan components detailour procedures for responding to an emergency situationwhich affects Colonial's ability to provide services to the cus-tomers, or its ability to meet legal or regulatory requirements.

Objective 4: Colonial Storm Matrix Plan (CSMP).The C5MPprovides guidelines for preparing and recovering from ahurricane, which could affect Colonial Bank's ability to pro-

vide services to our customers, or our ability to meet legal orregulatory requirements.

Objective 5: Disaster Recovery Plan (DR).The BusinessContinuity Plan is augmented by the Colonial Bank's DRprocesses.The Information Technology (IT) recovery processis an effort designed to recover the Colonial's back officeoperations and service customers.The ability to recover anenvironment that is suitable to resume functionality withbusiness partners and vendors is a key component. Thebank's ability to recover the IT and related functions aretested on a semi-annual basis.The tests results are summa-rized and submitted for Board review. The test results areutilized by IT personnel for recovery process enhancements.

Objectives: Alabama Inclement Weather Plan (AIWP).The AIWP is the guideline used to ensure that the essentialfunctions of Colonial Bank's Business Applications, Infrastruc-ture, Risk Management, Corporate Security, Loan Operations,Treasury Management, and Deposit Operations continueduring inclement weather situations.

Managers and employees under the IT direction of TomBurge, EVP-CIO, should be familiar with the procedures andhave an understanding of how they will execute the plan asit is described in the IT Master Safety and Security Manual.Semi-annually, Colonial IT managers are responsible forconducting a security training meeting for all employeesunder their supervision. Employee training is essential for themaintenance of a good security prog ram.This training mustinclude all areas covered by the Colonial Master Security Planin order to ensure the protection of bank assets and thesafety and welfare of all employees.

Objective 7: Pandemic Influenza Planning. The pandemicpreparedness document (located on EaglePort/Divisions/Business Continuity/Highlight/Pandemic PreparenessDocument) relates to the internal processes and proceduresof Colonial BancGroup and Colonial Bank.The informationcontained in the document is provided for informationalpurposes only and is not an obligation on the part ofColonial BancGroup or Colonial Bank.

What Is Business Continuity Management? Pagel