1© 2023 Everbridge | everbridge.com

Case StudyFinancial Services

CIBC Mellon CIBC Mellon is a leading provider of asset servicing to Canadian institutional investors and global investors into Canada. CIBC Mellon holds more than $2.3 trillion (CAD) in assets under administration on behalf of banks, pension plans, investment funds, insurance companies, foundations, governments, corporations and other institutional investors. Institutional investors from around the world count on CIBC Mellon to settle trades quickly, identify and correct issues promptly and reconcile accounts precisely. The accurate execution of time-sensitive investment strategies is central to the management of any institutional investment portfolio, and in turn to the overall operation of Canada’s capital markets. The organization is 50-50 jointly owned by Canadian Imperial Bank of Commerce (CIBC) and The Bank of New York Mellon Corporation (BNY Mellon).

“Everbridge has supported us by monitoring for potential threats and events and providing immediate, proactive situational awareness, potentially before the direct impact is felt or the first news reports are released.”

Assistant Vice President CIBC Mellon

2© 2023 Everbridge | everbridge.com

Case StudyFinancial Services

Challenges As a key player executing financial transactions, CIBC Mellon has many time-sensitive operations happening on a daily basis. As such, the organization needs to be able to communicate to its team of more than 1,200 geographically-dispersed employees quickly and efficiently, regardless of any business disruptions that may occur. Given the increasing number of threats to business continuity – ranging from natural disasters, to IT outages, to human-driven events – CIBC Mellon needed an effective, user-friendly unified critical communication system to send important messages to key stakeholders during critical events.

Solution CIBC Mellon selected Everbridge’s Unified Critical Communication Platform to support its business continuity initiatives and improve critical communication planning, threat monitoring and response. Using Everbridge, CIBC Mellon can rapidly deliver emergency and operational messages to and from employees, across all devices and office sites. In addition, CIBC Mellon administrators use the system for post-communication analysis and auto-feed capabilities, to help maintain data-integrity to ensure that the right messages get to the right people every time.

3© 2023 Everbridge | everbridge.com

Case StudyFinancial Services

Q&A with Assistant Vice President, Business Continuity Management and Corporate Security, CIBC Mellon

Tell us about your business continuity program and the importance of effective communication.

CIBC Mellon plays a significant role in the Canadian marketplace, and with the scope of activity and external incidents that happen on a daily basis, including many timesensitive actions in support of the smooth operation of the capital markets, it is critical that we are prepared to respond and communicate effectively.

The ability to communicate is essential, and it’s not just the responsibility of business continuity management. Corporate communications is also front and centre. They are essentially the super- users of any communication system that you’d be putting in place, and should be involved from strategy to execution.

Human resources is also a key player, because you’re reaching out to your employee base. From a response perspective, you could be dealing with incidents that are beyond just business disruptions; corporate security, office services and facilities are also central, as well as your corporate functions, from a stakeholder perspective.

We’re conscious of the fact that no matter how much you prepare, invest, plan, train and exercise, you can never prevent every business continuity event. You can control your response, however, which is why it is important to focus on preparing for a wide variety of events, so that you have the

ability to respond to whatever you might be facing as an organization. Communication is such an important part of the process.

How does Everbridge support your critical communication planning efforts?

Everbridge supports these efforts by making sure that we’re prepared to respond to potential events that could impact any of our operations. The system really supports us from a communication planning perspective as we continue to expand our business continuity program.

We approach communication planning in four key categories and scenarios using Everbridge: impacts to our workforce, our sites, our technology and to our supply chain. Typically, any disruption that we encounter will involve one or more of these four types of scenarios. However, all of these scenarios require effective communications. If you can’t respond, you can’t coordinate effectively.

For example, as we were doing assessments on where we wanted to locate our work area recovery sites, we took into consideration where the largest concentrations of our staff live. In the Toronto area, we have two main methods of commuting; public transit into the downtown Toronto area via bus, streetcar and subway network; or GO transit, which services commuter trains that come in from a greater distance away. In addition, there are always employees that walk, bike, drive, or use other means to get to work.

4© 2023 Everbridge | everbridge.com

Case StudyFinancial Services

We utilized Everbridge’s polling capabilities to quickly survey our employees on how they commute to work so we could have a better idea of where they were coming from, how they got here – and use that information to better inform where our recovery sites should be located.

In addition to helping us with site location, this information was important for other critical communications, for example dealing with weather events, transit strikes or even public transportation outages.

Speaking of planning, do you regularly conduct tests of your critical communication system and analyze results of all activities?

It’s very valuable for us to run tests and see how people are responding. We have a program of regularly-scheduled tests and exercises conducted outside of normal business hours. They provide a training opportunity for users and validate that the system is functioning as intended. They also provide training and awareness for employees receiving the communications, establishing a baseline for our response rate, and serving as a reminder to employees to keep their contact information up to date with human resources.

Our analysis actually altered the way we conduct our planning. Originally, when we implemented the program, we only had access to available work cell phone numbers, as well as home numbers and work contact information available in the system.

After a few rounds of tests, we realized our typical baseline response was approximately 60 percent. We knew we needed to do better.

When we started following up with employees, we learned that they weren’t home at the times of the tests. They’re not at work, they’re not at home – and we weren’t reaching them. Working with our human resources partners, we established a process where, if the employees were interested, they could provide a personal cell phone number to have on file with their employee file as well. That information flowed into the Everbridge system through our auto-feed.

By making the personal cell phone option available to employees, we saw an improvement to better than 80 percent response rate on communications. The lesson here is that it’s important when running tests to not only analyze the results – but to understand the method of the response. All

Q&A with Assistant Vice President, Business Continuity Management and Corporate Security, CIBC Mellon

5© 2023 Everbridge | everbridge.com

Case StudyFinancial Services

communications need to be exercised and tested to be effective. A robust system and accurate data are requirements, but you also need to ensure that you have a team of trained users who know how to leverage the system as well as taking the time to familiarize the full employee base with the messages. By taking the time to do all employee tests, you will be in much better shape when the time comes to reach out to employees for a real situation.

How do you proactively identify the types of incidents that could impact your operations and trigger critical communications?

Planning your response is critical, but it’s also important to take steps where possible to get ahead of incidents, for example, looking into how you might find out about an event that could potentially impact your operations. Everbridge helps us with that through threat monitoring. When I say threat monitoring, I’m talking about helping us to identify and become aware of actual incidents or potential threats that might be occurring or escalating.

Traditionally, business continuity professionals, incident management teams and on-call individuals are tasked with having to keep an eye out for these types of events. This process usually involved actively and personally monitoring and seeking out information about current events – whether or not an incident is occurring. This would include

refreshing and reviewing internet news sites, television news feeds, radio broadcasts, social media, and even waiting for calls from employees letting you know that something has happened.

Typically, all of these options are reactive, and identify threats after they have occurred. Everbridge has supported us by monitoring for potential threats and events and providing immediate, proactive situational awareness, potentially before the direct impact is felt or the first news reports are released.

We now have information that we obtain through alerts, and it works through the system where we identify site addresses that we’re concerned with for our organization. We define a proximity from each of the sites of interest, and we identify who needs to receive alerts for each of those sites. Everbridge partnering with NC4 (Threat Intelligence) really allows us to establish criteria and push out alerts via e-mail, text or phone on threat thresholds.

How does this improve your ability to keep your employees safe?

In the news, we all typically hear when there’s a problem at either an address or an intersection. Everbridge allows us to go in and actually assess what the potential impact is in proximity to those events; and if we need targeted communications, we can push them out on a city-wide or regional level. If we did have employees that resided in proximity to this incident, we can immediately,

Q&A with Assistant Vice President, Business Continuity Management and Corporate Security, CIBC Mellon

6© 2023 Everbridge | everbridge.com

Case StudyFinancial Services

if required, establish a communication to those employees using the Everbridge system.

In December 2013, here in the Toronto area, we had a major ice storm. It was problematic because it lasted a number of days during the holiday season. Despite being a regional event, it was quite devastating to the area, impacting most organizations throughout the region. The electrical company in our area estimated that 600,000 power outages were encountered at the height of the ice storm. The first wave of freezing rain for the ice storm began on December 20, coating the city in a significant but manageable quantity of ice. However, it was closely followed by a second wave that hit on December 22.

We went into the weekend, and as things started to get worse, we realized we may have a problem. We used the Everbridge tool to send out a broadcast communication using text, e-mail, and phone, asking one basic question to all our employees. We wanted to see where our staff were, from a preparedness perspective, to get into work.

By broadcasting a message we confirmed to our employees that our office was not impacted and would be business as usual, and also asked them to indicate what their status was for work the next day. It was a holiday period, heading into the December holiday break, so we simply asked employees to select their status as their response. They were either on scheduled vacation, would be

at work, or may be unable to work due to storm- related challenges. We knew within 90 minutes of sending out these communications, that we would be well positioned to carry on business as usual for the day. Eighty per cent of our staff were confident that they weren’t going to be impacted by the storm.

We had further developments with the storm the next day and continued to utilize the tool to get a pulse check and see how our employees were holding up, to ensure we were ready and prepared to meet our client commitments on the Monday.

How else does CIBC Mellon use Everbridge to communicate during these types of incidents?

We use Everbridge to communicate to employees using the full suite of available methods: texts, e-mails and phone calls. It is very important to have this multi-layered communication approach because, depending upon the disruption you’re dealing with, it’s impossible to be sure which services will be available to you – or your employees. Ultimately, you just want to make sure you reach them; you don’t want to be worried about how to do it.

With Everbridge, we can broadcast information to employees using any Internet-enabled computer, any Internet-enabled mobile device, or simply call an Everbridge operator if the user is in transit or if our own technology were impacted. We also have

Q&A with Assistant Vice President, Business Continuity Management and Corporate Security, CIBC Mellon

7© 2023 Everbridge | everbridge.com

Case StudyFinancial Services

Get in touch to learn about Everbridge, empowering resilience.

BO-CS-EN-CIBC Mellon-Letter_02.10.23

two-way communications capabilities; we can receive immediate feedback from our employee base, and communicate back out to them. We also have live monitoring and reporting capabilities to see how effective it is while we’re in the middle of an incident.

We need this type of flexibility, so that when we’re broadcasting messages, we can tailor it to whatever we’re dealing with; company- wide communications, business unit-level communications, maybe to specific devices, to sites, or to a regional response team. Everbridge is very flexible and has worked well for us by providing these different options.

That said, a communication system is only as good as the data you feed into it. We take that very seriously at CIBC Mellon, and by working with our human resources and technology groups, we’ve actually established and taken advantage of Everbridge’s auto-feed capabilities. Our human resources system now feeds the Everbridge

system with updated employee information. This also helps improve data integrity across the board, with our human resources system being the book of record. Should there be missing information, or if there are any errors on the employee records that are uploaded to the Everbridge system on a daily basis, our human resources administrator receives an e-mail and then follows up immediately.

Overall, Everbridge has been highly effective for CIBC Mellon. Through training exercises, business- as-usual survey activity, and even through real world situations such as the ice storm event, Everbridge has helped us coordinate a rapid, effective response.

Effective communication is critical to coordinating a corporate response to any type of event or business disruption. You need to be flexible and consider response, threat monitoring and planning as part of your program, and Everbridge helps us to do all of this at once.

Q&A with Assistant Vice President, Business Continuity Management and Corporate Security, CIBC Mellon

About Everbridge

Everbridge, Inc. (NASDAQ: EVBG) is a global software company that provides enterprise software applications that automate and accelerate organizations’ operational response to critical events in order to Keep People Safe and Organizations Running™.

Everbridge serves 8 of the 10 largest U.S. cities, 9 of the 10 largest U.S.-based investment banks, 47 of the 50 busiest North American airports, and 9 of the 10 largest U.S.-based health care providers. Everbridge is based in Boston with additional offices in 25 cities around the globe.

For more insights visit Everbridge.com, read the company blog, and follow us on LinkedIn and Twitter.

8© 2023 Everbridge | everbridge.com