B3 S A Brasil Bolsa Balcão : Business continuity and Crisis Management Policy

BUSINESS CONTINUITY AND CRISIS MANAGEMENT POLICY

17/08/2020

PUBLIC INFORMATION

BUSINESS CONTINUITY AND CRISIS MANAGEMENT POLICY

TABLE OF CONTENTS
1	PURPOSE ....................................................................................................	3
2	SCOPE .........................................................................................................	3
3	REFERENCES .............................................................................................	3
4	CONCEPTS ..................................................................................................	3
5	GUIDELINES ................................................................................................	4
6	RESPONSIBILITIES.....................................................................................	5
7	FINAL PROVISIONS ....................................................................................	7
8	CONTROL INFORMATION ..........................................................................	7

2	INFORMAÇÃO PÚBLICA

BUSINESS CONTINUITY AND CRISIS MANAGEMENT POLICY

1 PURPOSE

The purpose of this Policy is to set out guidelines and responsibilities to be included in the Business Continuity Management System of B3 S.A. - Brasil, Bolsa, Balcão with the aim of minimizing the financial, operational, legal and regulatory impacts deriving from the unavailability of the human, material and technological resources essential to the regular functioning of B3's operations.

2 SCOPE

This Policy applies to all administrators, employees, interns, trainees, suppliers, service providers and partners of B3 S.A. - Brasil, Bolsa, Balcão, its subsidiaries and affiliates abroad, B3 Bank, BSM Market Supervision, Cetip Info Tecnologia S.A., B3 Social, and other associations (Company).

1. REFERENCES
2. • Brazilian Association of Technical Standards (ABNT) Standard NBR ISO 22301:2012 - Business Continuity Management Systems: Requirements;
   • ABNT Standard NBR ISO 22313:2012 - Business Continuity Management Systems: Guidance; and
   • The Company's Corporate Risk Management Policy.
3. CONCEPTS
4. • Business Impact Analysis (BIA): Review of business processes which identify the qualitative and quantitative impacts of interruptions, providing an executive overview of the Company's mission-critical processes;
   • Business Continuity Management (BCM): An overarching management process responsible for providing a structure that enables the Company to develop organizational resilience and respond to unforeseen events, safeguarding the interests of all stakeholders and the Company's reputation and image;

3	INFORMAÇÃO PÚBLICA

BUSINESS CONTINUITY AND CRISIS MANAGEMENT POLICY

• Business Managers: Managing directors, associate directors or managers responsible for mission-critical business processes or functions;
• Recovery Objectives: Requirements for recovery of a mission-critical process or function, depending on the impact caused by the interruption;
• Business Continuity Plans (BCP): A set of structured documents listing the activities required for the recovery of a mission-critical process, in order to reduce the impacts caused by an interruption and assure an adequate level of communication during the recovery process; and
• Business Continuity Management System (BCMS): A set of management and governance processes which the Company's top management supports by allocating the resources required to identify risks, maintain recovery strategies and plans, and respond to crisis so as to guarantee continuity of the Company's business.

5 GUIDELINES

The Company's Business Continuity Management System shall provide for mechanisms to:

• Identify the internal and external threats that may impair the continuity of the Company's operations;
• Identify the potential impact on operations if such threats materialize;
• Identify all the legal, regulatory and further requirements relating to business continuity;
• Define roles and responsibilities for parties internal and external to the Company;
• Develop a crisis management and response framework, supported by adequate levels of authority and competence, so as to assure effective communication with stakeholders;

4	INFORMAÇÃO PÚBLICA