CPI Qualified Plan Consultants, Inc.

CPI has developed its Business Continuity Plan with the goal of continuing the timely service to which our clients are accustomed. Here are some of the highlights and significant features of our business continuity plan, as well as some general technology information:

CPI has developed a Disaster Recovery Team to aid in facilitation of every employee at CPI in the event of a disaster. Team members are drawn from every department and meet on a regular basis to enhance and update procedures. Employees participate in periodic drills to ensure that every employee is accounted for and moved quickly and safely to the shelter.

CPI has sophisticated battery backup and power generation equipment to ensure that our systems have a constant power source. Generator power is supplied to the Network Operations Center as well as several critical departments within the main facility.

The Network Operations Center is housed in a specially constructed building that can withstand direct winds of 350 mph. The building also serves as a storm shelter for our employees and guests, and can protect over 600 people. Portions of this building would also serve as an auxiliary work area in the event our main building is damaged due to a storm. Below are a few snapshots of this structure from beginning to end.



Systems have been implemented that automatically notify the Information Technology staff of potential system problems by a variety of methods including text messaging, cell phone, and email. This monitoring also measures system health, confirms successful completion of backup processes, and monitors system capacity. CPI relies on internet connectivity for communications, as well as to provide web site access to our clients. For these reasons we have made reliability and redundancy a priority. CPI's internet connection is provided by a trio of T-1 lines, communicating with our internet service provider via a SONET ring, which provides multiple data paths to guard against outages. CPI uses Hewlett Packard servers for all critical server systems, and uses Microsoft Windows and Microsoft SQL Server for the server operating system and database server functions. Data housed on these servers is stored on redundant disk arrays to avoid data loss from drive failures. CPI employs failover and load balancing technology in its web servers, ensuring that processing power will always be in excess of demand, and protecting against individual server failure. CPI utilizes similar failover technology for the database servers that support our recordkeeping systems. Laptop and notebook computers are secured in several ways. First, no participant-level data is ever transferred to or stored on a laptop or notebook computer. Second, all laptop and notebook hard drives are encrypted using the TrueCrypt encryption system. This system employs AES-256, Serpent, and Twofish encryption algorithms, ensuring that no information will be compromised in the event of a lost or stolen computer. Third, antivirus and endpoint security software programs are installed on all laptop and notebook computers. All software is kept current through automatic updates. Fourth, all access to the corporate network is accomplished though secure telecommuting software from Citrix and Logmein that isolates the network from the remote computer. For those clients and investment professionals who are concerned about sending data via email, CPI offers a web-based secure file transfer service. Clients and investment professionals can upload sensitive data to a secure mailbox via an industry standard https connection, which is then retrieved by CPI personnel using the same method. Data can be sent in a similar fashion. CPI personnel upload data to the web site, then send an email with a link to the specific file to the recipient for use in downloading the file. An optional password can also be employed for additional security. The integrity of client and participant data is crucial, and to insure that data, CPI has made an investment in a Storage Area Network (SAN) from EMC Corp. The SAN allows for periodic "snapshots" of participant data and other critical information to be taken at intervals more frequent than with conventional tape backup technology. It also provides a higher level of fault tolerance and reliability than RAID-based storage alone, due to redundancy in every component of the system. Our Disaster Relocation site is in a former grade school building in the community of Albert, KS, approximately 15 miles from our Great Bend office. It provides facilities for over 300 people to continue servicing our clients. CPI maintains and monitors a secure private network connection from the Albert facility to our network operations center. Over 300 workstations are in place and ready to be used within hours of an event that deems all or part of our Great Bend facility unusable. Investments in both power and network infrastructure have been made to ensure that CPI can operate at this facility for an extended period of time.