1. PURPOSE AND CONTENTS

General

This section outlines the Pandemic Influenza Preparedness Policy formalized by the Board of Directors of BANK on DATE.

Topics covered in this policy are:

Policy Statement Topic 2
Plan Overview Topic 3
Board of Directors and Senior Management Responsibilities Topic 4
Incident Response Team Responsibilities Topic 5
Business Impact Analysis Topic 6
Risk Assessment and Management Topic 7
Travel Impact and Alternatives Topic 8
Staff Training Topic 9
Employee Compensation and Leave of Absence Topic 10
Contact With Public Health Agencies Topic 11
Plan Testing Topic 12

Effective Date

All employees of BANK, herein referenced to as the “Bank”, must comply with the terms of this policy immediately. Managers, employees and technical personnel must modify system configurations and procedures, if necessary, to comply with the terms of this policy within TIME PERIOD.

2. POLICY STATEMENT

General

It is the policy of the Bank to develop, implement and maintain a preparedness strategy with respect to the threat and potential impact of a pandemic influenza event. Pandemics are defined as epidemics or outbreaks of infectious diseases in humans that have the ability to spread rapidly over large areas, possibly worldwide. The United States Government has issued a National Strategy that discusses the threat and potential impact of a pandemic influenza event. The Implementation Plan for the National Strategy identifies roles and responsibilities for the federal government, the private sector, and others.

The adverse economic effects of a pandemic could be significant, both nationally and internationally. Therefore the Bank has implemented a specific plan regarding how it will manage a pandemic event due to its crucial financial and economic role in the community in which it serves.

The main components of the Bank’s strategy address:

1. Establishing an ethic of infection control in the workplace that is reinforced during the annual influenza season, to include, if possible, options for working offsite while ill, systems to reduce infection transmission and worker education;

2. Establishing contingency systems to maintain delivery of essential goods and services during times of significant and sustained worker absenteeism;

3. Where possible, establishing mechanisms to allow workers to provide services from home if public health officials advise against non-essential travel outside the home; and

4. Establishing partnerships with other members of the sector to provide mutual support and maintenance of essential services during a pandemic.

The Bank realizes the importance of playing a key role in the event of pandemic influenza to protect employees' health and safety in addition to limiting the negative impact to the Bank and the economy and society in which it serves. As such, it is the policy of the Bank to adhere to these guidelines by incorporating the following procedures outlined in this policy.

Enforcement

Changes to this policy require approval by the Board of Directors of the Bank. Changes in operating procedures, standards, guidelines and technologies, provided they are consistent with this policy, may be authorized by the OFFICER.

The Board of Directors has the authority to approve this policy, and annually approves the merit thereafter. Senior Management is responsible for ensuring the directives are implemented and administered in compliance with the approved policy.

The primary responsibility for enforcement of this policy and its operating procedures rests with the OFFICER and our employees.

No part of this policy or its supporting operating procedures should be interpreted as contravening or superseding any other legal and regulatory requirements placed upon the Bank. Protective measures should not impede other legally mandated processes such as records retention or subpoenas. Any conflicts should be submitted immediately to the DEPARTMENT for further evaluation and/or subsequent submission to the Bank’s legal counsel.

Exceptions to Policy

Requests for exceptions to this policy must be very specific and may only be granted on specific items, rather than to entire sections. Bank personnel with exceptions are to communicate their requests by submitting an internal memorandum to the OFFICER for consideration by Senior Management.

3. PLAN OVERVIEW

There are distinct differences between the Bank’s Pandemic Plan (PP) and its Business Continuity Plan (BCP). The Bank’s pandemic plan addresses unique challenges presented by such an occurrence to the Bank and to its management and employees. Unlike natural disasters, technical disasters, malicious acts, or terrorist events, the impact of a pandemic event is much more difficult to determine because of the anticipated difference in scale and duration. The nature of the global economy virtually ensures that the effects of a pandemic event will be widespread and threaten not just a limited geographical region or area, but potentially every continent. In addition, while traditional disasters and disruptions normally have limited time durations, pandemics generally occur in multiple waves, each lasting two to three months. Consequently, no individual or organization is safe from the adverse effects that might result from a pandemic event. It is assumed that the most significant and likely challenge from a severe pandemic event will be staffing shortages due to absenteeism. As such, the Bank has taken into consideration these factors in correlation with its normal BCP.

The Bank’s pandemic plan is designed to be sufficiently flexible to effectively address a wide range of possible effects that could result from a pandemic event. This flexibility is based upon the Bank’s size, complexity, and business activities. The potential impact of a pandemic on the delivery of the Bank’s critical financial services is incorporated into its ongoing business impact analysis and risk assessment processes. From this process, the Bank is then able to appropriately address the following unique challenges posed by a pandemic event, such as a:

1. Preventive program to reduce the likelihood that the Bank’s operations will be significantly affected, including the monitoring of:

A. Potential outbreaks;

B. Educating employees;

C. Communicating and coordinating with critical service providers and suppliers; and

D. Providing appropriate hygiene training and tools to employees.

2. Documented strategy that provides for scaling the Bank’s pandemic efforts so they are consistent with the effects of a particular stage of a pandemic outbreak, such as first cases of humans contracting the disease overseas, within the United States, and within the Bank itself.

The World Health Organization (WHO) tracks the status of virus transmission using a six phase scale. The U.S. Government uses a six stage scale that has a geographic focus. In any event, it is the responsibility of Senior Management and Incident Response Team members to be familiar with and monitor both sources from time to time. In addition, this strategy also outlines plans that state how the Bank will recover from a pandemic wave and make the appropriate preparations for any following wave(s).

3. Comprehensive framework of facilities, systems, or procedures that provide the Bank the capability to continue its critical operations in the event that large numbers of the Bank’s staff are unavailable for prolonged periods, such as procedures designed to:

A. Promote social distancing to minimize staff contact, telecommuting, redirecting customers from branch to electronic banking services, or conducting operations from alternative sites;

B. Take into consideration customer reactions and the potential demand for, and increased reliance on, Internet or telephone banking, Automated Teller Machines (ATMs), and call support services; and

C. Factor possible actions by public health and other government authorities that may affect the Bank’s critical business functions.

NOTE: A planning assumption from The Implementation Plan for the National Strategy for Pandemic Influenza is that rates of absenteeism will depend on the severity of the pandemic. In a severe pandemic event, absenteeism attributable to illness, the need to care for ill family members, and fear of infection may reach 40% during the peak weeks of a community outbreak, with lower rates of absenteeism during the weeks before and after the peak. Certain public health measures (closing schools, quarantining household contacts of infected individuals, “snow days”) are likely to increase rates of absenteeism.

4. Testing program to ensure that the Bank’s pandemic planning practices and capabilities are effective and will allow critical operations to continue; and

5. Monitoring and oversight program to ensure ongoing review and updates to the pandemic plan so that this and other related policies, procedures, and standards include up to date and relevant information provided by governmental sources or by the Bank’s monitoring program.

As such, the Bank has integrated its pandemic plan into its traditional BCP methodologies as outlined in the Bank’s BUSINESS CONTINUITY PLAN POLICY and other related policies, procedures and processes.

4. BOARD OF DIRECTORS AND SENIOR MANAGEMENT RESPONSIBILITIES

The Bank realizes that traditional business continuity planning and pandemic planning require the Board of Directors and Senior Management to follow a cyclical process of planning, preparing, responding, and recovering. However, pandemic planning requires additional actions to identify and prioritize essential functions, employees, and resources within the Bank and across other business sectors.

In general, it is the responsibility of the Board of Directors and Senior Management to:

1. Ensure that effective measures and mitigating controls are effectively developed, implemented and maintained to address the specific challenges and significant risk to the Bank’s entire business operations; and

2. Be directly involved in the planning process and to include key management personnel from all functional, business and product areas, including administrative, human resources, legal, IT support functions, and key product lines.

Specifically, the Board of Directors (or a committee thereof) is responsible for:

1. Overseeing the development of the Bank’s written pandemic plan, including the formal adoption and approval of the plan; and

2. Ensuring that Senior Management is investing sufficient resources into planning, monitoring, and testing the final plan.

Senior Management is responsible for:

1. Developing the pandemic plan and translating the plan into this and other related policies, procedures and processes;

2. Communicating the plan throughout the Bank to ensure consistent understanding of the key elements of the plan and to ensure that employees understand their role and responsibilities in responding to a pandemic event; and

3. Ensuring that the plan is regularly tested and remains relevant to the scope and complexity of the Bank’s operations.

5. INCIDENT RESPONSE TEAM RESPONSIBILITIES

The following Bank personnel are members of the Bank’s Incident Response Team which is responsible for conducting all operationally related pandemic event duties for their respective areas of responsibility:

1. LIST HERE TITLES AND RESPONSIBILITIES.

Specifically, the Bank’s Incident Response Team is responsible for activating and terminating the Bank’s pandemic event preparedness and response plan, altering business operations as necessary or required (e.g. shutting down operations in affected areas), and transferring business knowledge to key employees.

6. BUSINESS IMPACT ANALYSIS

The potential effects of a pandemic event are incorporated into the Bank’s overall BCP business impact analysis (BIA), which includes:

1. Assessing and prioritizing essential business functions and processes that may be affected by a pandemic event, which include the following in order of priority;

LIST HERE ESSENTIAL BUSINESS FUNCTIONS.

2. Identifying the potential impact of a pandemic event on the Bank's essential business functions and processes, and supporting resources;

DESCRIBE HERE IN DETAIL.

3. Identifying the potential impact of a pandemic event on customers, including those that could be most affected and those that could have the greatest impact on the (local) economy;

DESCRIBE HERE IN DETAIL.

4. Identifying the legal and regulatory requirements for the Bank’s business functions and processes;

DESCRIBE HERE IN DETAIL.

5. Estimating the maximum downtime associated with the Bank’s business functions and processes that may occur during a pandemic;

DESCRIBE HERE IN DETAIL.

6. Assessing cross training conducted for key business positions and processes; and

DESCRIBE HERE IN DETAIL.

7. Evaluating the plans of critical service providers for operating during a pandemic event, including monitoring the servicers to ensure critical services are available. In addition, the Bank has made backup arrangements to mitigate any risk, with special attention directed at the Bank’s ability to access leased premises and whether sufficient internet access capacity is available if telecommuting is determined to be a key risk mitigation strategy.

DESCRIBE HERE IN DETAIL.

The Bank realizes that incorporating the impact of pandemic risk into the Bank’s BCP involves additional complexity since typical disaster or emergency response mechanisms and methods may not be feasible. For example, moving employees to an alternate facility that is typically used during a natural disaster or other emergency may not be an appropriate or a feasible way to continue operations in a pandemic event. As such, there may be a shortage of available staff to relocate and it is possible that the alternate site might be affected by the pandemic event. In this respect, the Bank has taken into consideration the following planning assumptions recommended by the Department of Homeland Security into its impact analysis:

1. Susceptibility to the pandemic influenza virus will be universal.

2. Efficient and sustained person to person transmission signals an imminent pandemic.

3. The clinical disease attack rate will likely be 30% or higher in the overall population during the pandemic event. Illness rates will be highest among school aged children (about 40%) and decline with age. Among working adults, an average of 20% will become ill during a community outbreak.

Some persons will become infected but not develop clinically significant symptoms. Asymptomatic or minimally symptomatic individuals can transmit infection and develop immunity to subsequent infection.

4. Of those who become ill with influenza, 50% will seek outpatient medical care. With the availability of effective antiviral drugs for treatment, this proportion may be higher in the next pandemic event.

5. The number of hospitalizations and deaths will depend on the virulence of the pandemic virus. Estimates differ about 10 fold between more and less severe scenarios. Two scenarios are presented based on extrapolation of past pandemic experience. Planning should include the more severe scenario.

Risk groups for severe and fatal infection cannot be predicted with certainty but are likely to include infants, the elderly, pregnant women, and persons with chronic medical conditions.

6. Rates of absenteeism will depend on the severity of the pandemic. In a severe pandemic, absenteeism attributable to illness, the need to care for ill family members, and fear of infection may reach 40% during the peak weeks of a community outbreak, with lower rates of absenteeism during the weeks before and after the peak.

7. Certain public health measures (closing schools, quarantining household contacts of infected individuals, “snow days”) are likely to increase rates of absenteeism.

8. The typical incubation period (interval between infection and onset of symptoms) for influenza is approximately two days.

9. Persons who become ill may shed virus and can transmit infection for up to one day before the onset of illness. Viral shedding and the risk of transmission will be greatest during the first two days of illness. Children usually shed the greatest amount of virus and therefore are likely to post the greatest risk for transmission.

10. On average, infected persons will transmit infection to approximately two other people.

11. In an affected community, a pandemic outbreak will last about six to eight weeks.

12. Multiple waves (periods during which community outbreaks occur across the country) of illness could occur with each wave lasting two to three months. Historically, the largest waves have occurred in the fall and winter, but the seasonality of a pandemic cannot be predicted with certainty.

The pandemic issues considered in the Bank’s BIA also involve forecasting employee absenteeism and considering family care issues that may affect business operations. In addition, a key element of the Bank’s BIA examines how a pandemic event addresses external factors. For example, the Bank has assessed the impact of critical interdependencies that involve making planning assumptions regarding the availability of external services and prioritizing the effect of possible disruptions. In addition, potential travel restrictions imposed by health and emergency management officials may limit access to those services, even if they are still operating.

Senior Management has determined the minimum workforce and necessary cross training that will properly sustain the Bank’s mission critical operations in the event of employee absences during a disaster, such as a pandemic event, within the various resumption team topics in this policy. This determination includes such factors as personal illness, family member illness, community containment measures and quarantines, school and/or business closures, and public transportation closures.

7. RISK ASSESSMENT AND MANAGEMENT

The following risk management and assessment procedures were developed and implemented by the Bank using the findings and evaluations of the Bank’s BIA risk assessment process to ensure effective pandemic event planning scenarios are attained. In summary, the Bank has:

1. Prioritized the severity of potential business disruptions resulting from a pandemic event, based on the Bank’s estimate of impact and probability of occurrence on operations;

DESCRIBE HERE IN DETAIL.

2. Performed a “gap analysis” that compares existing business processes and procedures with what is needed to mitigate the severity of potential business disruptions resulting from a pandemic event;

DESCRIBE HERE IN DETAIL.

3. Developed this policy in addition to other related policies, procedures, processes and written pandemic plans for Bank personnel to follow during a possible pandemic event;

4. Reviewed and approved the Bank’s pandemic plan by the Board of Directors (or a committee thereof) and Senior Management (and subsequently at least annually thereafter); and

5. Communicated and disseminated the plan and the current status of pandemic phases to all Bank personnel.

In addition, the Bank has identified specific risk assessment and risk management actions arising from a pandemic event which include the following:

1. Coordination with Outside Parties. Open communication and coordination with outside groups, including critical service providers (and key backup service providers), is an important aspect of the Bank’s pandemic planning. As such, the Bank has initiated coordinated information sharing efforts through participation in business and community working groups and has developed coalitions with outside parties to provide support and maintenance for vital services during a pandemic event. These efforts include consideration of cooperative arrangements with other financial institutions within the Bank’s geographical trade area. In addition, the Bank has coordinated its pandemic planning efforts with local public health and emergency management teams, identified authorities that can take specific actions (e.g., who has the ability to close a building or alter transportation), and planned to alert local and state agencies regarding significant employee absenteeism that may be caused by a sudden pandemic outbreak. Communication with customers and the media is also critical to ensure that accurate information is disseminated about the Bank’s business operations. As such, these critical interdependency challenges require the Bank to ensure that an adequate reserve of essential supplies is maintained in addition to proactively managing the maintenance of equipment to ensure sustainability during service disruptions. It is the responsibility of Senior Management to monitor the Bank’s service providers, identify potential weaknesses in the service and supply chains, and develop potential alternatives for obtaining critical services and supplies.

2. Identification of Triggering Events. A triggering event occurs when an environmental change takes place that requires the Bank to implement its response plans based on the pandemic alert status. Alerts may be issued by various organizations that have developed surveillance systems to monitor the progression of viral outbreaks. Depending on the severity of the alert, it is the responsibility of Senior Management to:

A. Act quickly to implement elements of the Bank’s pandemic response plans;

B. Monitor national and international pandemic news sources in order to be aware of potential outbreaks;

C. Monitor websites devoted to national health care issues, identify key points of contact for emergency and health care organizations, and assess potential implications for the Bank if a pandemic event occurs; and

D. Communicate to employees and key service providers the actions the Bank plans to take at specific triggering points.

3. Employee Protection Strategies. Employee protection strategies are crucial to sustain an adequate workforce during a pandemic event. As such, the Bank actively promotes employee awareness by communicating the risks of a pandemic outbreak and discussing the steps employees can take to reduce the likelihood of contracting a pandemic virus, such as:

A. Promoting preventative medicine and access to healthcare and social service providers. The Bank routinely encourages its employees to take advantage of any potential influenza vaccines to mitigate the risk of infection and to promote an employee’s well being. To this extent, the Bank makes every effort to offer and track such vaccination programs for its employees on a periodic basis or during a pandemic event through its health care provider or other health care organization or agency.

In addition, it is the responsibility of Senior Management and the Bank’s Incident Response Team to monitor and evaluate employee access to and availability of healthcare services (medical, mental, social services, faith-based resources, etc.) during a pandemic event and improve services as needed.

B. Publicizing the Centers for Disease Control and Prevention “Cover Your Cough” and “Clean Your Hands” programs or other general hygiene programs.

C. Encouraging employees to avoid crowded places and public transportation systems.

D. Implementing “social distancing” techniques to minimize typical face to face contact through the use of teleconference calls, video conferencing, flexible work hours, telecommuting, encouraging customers to use Internet or telephone banking services, ATMs, and drive up windows.

In addition, the Bank has implemented the following minimum basic guidelines recommended by the Center for Disease Control (CDC) in an effort to mitigate the risk of Bank personnel or customers contracting or spreading the disease via face to face contact (e.g. hand shaking, attending meetings, office layout, air filtration systems, etc.). Specifically, Bank personnel will be required to:

• Pay careful attention to hand hygiene (washing hands frequently) before and after all employee or customer contact or contact with items potentially contaminated with respiratory secretions. Cleaning your hands often with soap and water removes potentially infectious material from your skin and helps prevent disease transmission. Waterless alcohol based hand gels may be used when soap is not available and hands are not visibly soiled;

• Use medical protection gloves supplied by the Bank at all times;

• Use proper cough or sneeze etiquette techniques; and

• Wear medical eye protection supplied by the Bank at all times. Managers are responsible for ensuring the prompt exclusion and medical dismissal of any employee thought to exhibit influenza symptoms for medical evaluation and treatment. In addition, the Bank provides at all of its facilities sufficient and accessible infection control supplies (e.g. hand hygiene products, tissues and receptacles for proper disposal) and has installed a high efficiency particulate air (HEPA) filter in its heating and cooling air circulation systems.

E. Reviewing and considering the use of other non-pharmaceutical interventions developed by the Centers for Disease Control and Prevention, such as:

• Isolation of all persons with confirmed or probable pandemic influenza and treatment (as appropriate) with influenza antiviral medications. Isolation may occur in the home or healthcare setting, depending on the severity of the individual’s illness and/or the current capacity of the healthcare infrastructure.

• Voluntary home quarantine of members of households with confirmed or probable influenza case(s) and consideration of combining this intervention with the prophylactic use of antiviral medications, providing sufficient quantities of effective medications exist and that a feasible means of distributing them is in place.

• Dismissal of students from schools (including public and private schools as well as colleges and universities) and school based activities and closure of childcare programs, coupled with protecting children and teenagers through social distancing in the community to achieve reductions of out of school social contacts and community mixing.

• Use of social distancing measures to reduce contact between adults in the community and workplace, including, for example, cancellation of large public gatherings and alteration of workplace environments and schedules to decrease social density and preserve a healthy workplace to the greatest extent possible without disrupting essential services. Enable institution of workplace leave policies that align incentives and facilitate adherence with the non-pharmaceutical interventions (NPIs) outlined above.

4. Mitigating Controls. Despite the unique challenges posed by a pandemic event, there are control processes that the Bank can implement to mitigate risk and the effects of a pandemic. For example, to overcome some of the personnel challenges, Senior Management would ensure that employees are cross trained and that succession plans have been developed by the Bank for all areas. As such, the Bank may be able to leverage these plans to further mitigate the risk of a minimal or unskilled workforce.

5. Remote Access. During a pandemic event there may be a high reliance on employee telecommuting, which could put a strain on the Bank’s remote access capabilities such as capacity, bandwidth, and authentication mechanisms. Moreover, employees who typically work onsite may not have remote access authority or the necessary technology infrastructure to work at home. Therefore, the Bank has performed an analysis of its remote access capabilities to properly:

A. Map related technology infrastructure to employee needs during a pandemic event;

B. Assess the infrastructure at the neighborhood level; and

C. Take into consideration internal and external capacity that are necessary to help ensure telecommuting strategies will work during a pandemic event.

It is the responsibility of Senior Management and the Incident Response Team to ensure communications and information technology resources are available as needed to support employee telecommuting and remote customer access requirements. In addition, the Bank has identified alternate worksites and hours of operation necessary to sustain all mission critical functions in other topics of this policy (such as the business resumption team topics) that are applicable to a pandemic event or other such emergency or disaster recovery instance.

8. TRAVEL IMPACT AND ALTERNATIVES

The Bank has identified the following personnel and/or business operations or functions that may be impacted by a restriction in domestic and international travel (e.g. quarantines, border closures):

1. LIST HERE TITLES OR FUNCTIONS.

Employee travel to affected geographic areas (consider both domestic and international sites) will be limited, and only in the event as an absolute business necessity. In addition, Senior Management will properly evaluate and consider evacuating employees working in or near an affected area when an outbreak begins and implement its contingency plan, including the events surrounding employees returning to and from affected areas. Specifically, Bank personnel are to use the following CDC travel recommendations:

1. Avoid all direct contact with poultry, including touching well appearing, sick, or dead chickens and ducks;

2. Avoid places such as poultry farms and bird markets where live poultry are raised or kept, and avoid handling surfaces contaminated with poultry feces or secretions;

3. Wash your hands carefully and frequently. Cleaning your hands often with soap and water removes potentially infectious material from your skin and helps prevent disease transmission. Waterless alcohol-based hand gels may be used when soap is not available and hands are not visibly soiled;

4. Ensure all foods from poultry, including eggs and poultry blood are cooked thoroughly. Egg yolks should not be runny or liquid. Influenza viruses are destroyed by heat, thus the cooking temperature for poultry meat should be 74°C (165°F); and

5. Immediately seek medical treatment if you become sick with symptoms such as a fever accompanied by a cough, sore throat, or difficulty breathing or if you develop any illness that requires prompt medical attention. If traveling abroad, a U.S. consular officer can assist you in locating medical services and informing your family or friends.

After your return:

1. Monitor your health for 10 days;

2. If you become ill with a fever plus a cough, sore throat, or trouble breathing during this 10-day period, consult a health care provider. Before you visit a health care setting, tell the provider the following:

A. Your symptoms;

B. Where you traveled; and

C. If you have had direct contact with poultry or close contact with a severely ill person.

This will ensure the physician can be aware that you have traveled to an area reporting avian influenza.

3. Do not travel again if you become ill (unless you are seeking medical care). Limiting contact with others as much as possible can help prevent the spread of an infectious illness.

9. STAFF TRAINING

The following Bank personnel are responsible for staff training and preparing an ancillary workforce (e.g. contractors, alternate employees, retirees, etc.) in the event of a pandemic event:

1. LIST HERE TITLES AND RESPONSIBILITIES. IN ADDITION, LIST ALL KEY EMPLOYEES OR CUSTOMERS WITH SPECIAL NEEDS AND RELATED REQUIREMENTS AS APPLICABLE.

Specifically the Bank’s pandemic training program includes the following elements:

1. A review covering pandemic fundamentals (e.g. signs and symptoms of influenza, modes of transmission), personal and family protection and response strategies (e.g. hand hygiene, coughing/sneezing etiquette, contingency plans);

2. Attempt to ease employee fears and anxiety from rumors and misinformation by providing facts, information, and support resources;

3. Ensure employee communications are culturally and linguistically appropriate;

4. Disseminate information to employees about the Bank’s pandemic preparedness and response plan;

5. Provide information for the at home care of ill employees and family members;

6. Provide employees with alternative methods for communicating pandemic status and actions (e.g. hotlines, dedicated websites) to employees, vendors, suppliers and customers inside and outside the workplace in a consistent and timely way, including redundancies in the emergency contact system; and

7. Identifying community sources for timely and accurate pandemic information (domestic and international) and resources for obtaining counter measures (e.g. vaccines and antivirals).

10. EMPLOYEE COMPENSATION AND LEAVE OF ABSENCE

As outlined in the Bank’s HUMAN RESOURCES GENERAL POLICY and HUMAN RESOURCES SALARY ADMINISTRATION POLICY, the Bank will make every effort to ensure for employee compensation and sick leave absences, including special considerations on a case by case basis that are unique to a pandemic event (e.g. non-punitive, liberal leave, etc.). In addition, a previously ill employee who is no longer infectious may return to work after such an illness provided the employee has obtained a medical release signed by a physician.

11. CONTACT WITH PUBLIC HEALTH AGENCIES

It is the responsibility of Senior Management and members of the Incident Response Team to maintain a line of communication with various community, state and federal agencies outlined below in an effort to:

1. Review the Bank’s pandemic incident preparedness plan with insurers, health plans, and major local healthcare facilities and understand their capabilities and plans;

2. Collaborate with federal, state, and local public health agencies and/or emergency responders to participate in their planning processes, share the Bank’s pandemic plans, and understand their capabilities and plans;

3. Communicate with local and/or state public health agencies and/or emergency responders about the assets and/or services the Bank could contribute to the community; and

4. Share best practices with other businesses in communities the Bank serves, chambers of commerce, and associations to improve community response efforts.

The Bank has identified the following public health agencies that Bank personnel may contact in the event of a pandemic event to obtain assistance, emergency management support and other important information:

• Centers for Disease Control (CDC) http://www.cdc.gov • Department of Agriculture (USDA) http://www.usda.gov • Department of Health and Human Services (DHHS) http://www.dhhs.gov • Department of Labor Occupational Safety and Health Administration (OSHA) http://www.osha.gov • Department of State http://travel.state.gov • Pandemic Flu Website http://www.pandemicflu.gov • The Financial Services Sector Coordinating Committee https://www.fsscc.org • U.S. Department of Veterans Affairs (VA) http://www.publichealth.va.gov • U.S. Chamber of Commerce http://www.uschamber.com/issues/index/defense/pandemic_influenza.htm • World Health Organization (WHO) http://www.who.int • LIST LOCAL COMMUNITY HEALTH ORGANIZATIONS HERE

12. PLAN TESTING

As information from medical and governmental experts about the causes and effects of a pandemic continues to evolve, the Bank’s pandemic plan is designed to be sufficiently flexible to incorporate new information and risk mitigation approaches. As a result, risk monitoring and testing of the pandemic plan is important to the Bank’s overall planning process.

Periodic testing of the Bank’s pandemic plan provides a high degree of assurance that critical business processes, including supporting infrastructure, systems, and applications, will function even during a severe pandemic event. In general, the Bank’s pandemic testing program outlines:

1. Roles and responsibilities of management, employees, key suppliers, and customers;

2. Key pandemic planning assumptions;

3. Increased reliance on Internet or telephone banking, and call center services; and

4. Remote access and telecommuting capabilities.

Testing for a pandemic event may require variations to the scope of traditional disaster recovery and business continuity testing, as potential test scenarios will most likely be different. Alternatives for pandemic testing can include:

1. Well orchestrated “work at home” days for critical and essential employees to test remote access capabilities and infrastructure;

2. Crisis management team communication exercises;

3. Table top exercises that test various scenarios related to escalated absenteeism rates;

4. Additional or modified call tree exercises; and

5. Community, regional or industry wide exercises with members of the financial services sector to test the financial sector’s ability to respond to a simulated pandemic crisis.

The results of these tests are to be properly documented and reported to Senior Management and the Board of Directors, with subsequent appropriate updates made to the Bank’s pandemic plan and testing program.