Business continuity management program

We are committed to protecting our clients’ and the company’s information and assets without disruption.

We invest in significant resources, including dedicated staff, systems, and processes, to create and maintain plans and recovery strategies within our business and services. Our firm-wide program framework, supported by senior management, provides an integrated approach in addressing the needs of our business and operations; our staff, facilities, technology, and data - incorporating continuity into the way we work.

Business continuity plans

We create, document, and maintain business continuity plans (BCPs) based upon a proactive “all hazards” approach in preparing for disruptions of varying severity and scope – from a destructive severe weather event to a global pandemic or outage, our plans and strategies address the potential for both short-term and long-term disruptions.

• BCPs are reviewed and updated annually at a minimum or in the event of a material change, through a series of plan enhancement workshops facilitated by a business continuity subject matter expert with participation from the business area and management.

• As part of the planning process, we conduct a business impact analysis with each business area, which helps determine the criticality of business processes. We conduct exercises to validate our plans and recovery strategies. Plans are approved and certified annually by business leadership.

• Ameriprise maintains multiple recovery solution strategies that enable us to activate the appropriate strategy based upon the severity and duration of the event or business disruption. Key components include alternate workplace recovery facilities, remote access workplace strategies and geo-dispersed operations. Our flexible, multi-faceted approach allows us to respond appropriately and effectively based on the type of event.

• Regular exercises and testing are conducted to validate the plans are effective, and that critical applications and recovery procedures are in place.

Disaster recovery

We maintain established policies, standards and operational measures designed to back-up and protect our data. Disaster Recovery Plans (DRPs) are designed and tested by our technology teams to address the specific needs and risks of technology systems and applications.

• Plans are updated to reflect changes and the most current information, and are approved annually as part of our formal plan certification.

• Regular exercises and testing are conducted to validate the plans are effective, and that critical applications and recovery procedures are in place.

• Dedicated technology teams ensure that critical applications and data have appropriate redundancy and are replicated offsite.

• Testing and validation of backup frequency is based upon the critical nature of the data. Our recovery approach is designed to guard against the loss of critical data.