I AM SPE IDENTITY ACCESS MANAGEMENT PHASE 1

I AM SPE IDENTITY ACCESS MANAGEMENT – PHASE 1 -2 (GOVERNANCE STRUCTURE, REQUEST PORTAL, DATA GOVERNANCE, ACCESS CERTIFICATIONS) March 2014

Executive Summary Deloitte 11 week study of SPE’s IAM Program (Sept 2012 - Jan 2013) – – – Benchmarked progress against the 2004 Roadmap and Industry practices Assessed and documented Current state and future requirements and objectives Assessed and documented the current environment with respect to infrastructure, policies, procedures, processes, constraints, and risks Key Findings: • Undefined Governance and Ownership of Workforce types – – • Decentralized Onboarding/Offboarding Process – – • Full time employees are owned by P&O and globally managed in Workday (all other workforce types lack centralized ownership and tracking) Recurring audit issues stemming from inconsistent processes and lack of governance (application controls, asset management and reconciliation, physical security controls) Lack of a standard process for onboarding and offboarding for multiple user types and across the regions On average it takes 3 -4 weeks to onboard a new joiner Lack of an authoritative source for identity data – – Inconsistent and inaccurate data Manual entry of identity data across applications leads to audit issues (there is no clear number of identity stores) Detailed Process Work and Program/Project Planning (Jan 2013 - Oct 2013) • • • Designed the approach for future state Identity Life. Cycle Management, including Global Template Comprehensive assessment for all workforce types and scenarios (new hire, change/update, termination, rehire) Recommended a phased project approach – Phase 1 and 2 are ready for greenlight 2

IAM Proposed Solution Service. Now “Launch in Context” with Sail. Point Create in authoritative source P & O & Backlot Admins Default access Automatic create in IDM Workday Notify manager to initiate further requests Create Non-FTE user Onboarding Request Service. Now Access Request Portal Request application access Terminate Access Off-boarding Service. Now Manager Request assets Access Review Tool Generate certification events Terminate in authoritative source P&O Backlot Admins Sail. Point IIQ Manual Provisioning Teams Revoke access Applications Assets Application Admins/ Mangers Default access terminated Workday Terminate Non-FTE user Manager & Badge Systems Automated Request privilege access Certify Access Manager & Badge Request Access Provision Access AD/Outlook Automatic Terminate in IDM AD/Outlook Pinnacle (devices), Provance (desktop access), etc. Notify manager to collect physical assets Manager 3

Financial Summary Year One Project Costs Five-Year Summary and Payback Software: $82, 500 Hardware: $0 Internal Labor: $127, 946 External Labor $1, 717, 834 Inception Funding (FY 14): $190, 000 TOTAL $2, 118, 280 FY 1 Project Benefits Hard $ Benefits (cost reduction, cost avoidance, and operational efficiencies) TOTAL Five-Year Total Cost: Five-Year Total Benefit: $11, 131, 777 Five-Year Net Benefit: $7, 578, 962 Internal Rate of Return: Ongoing Costs: 61. 3% Net Present Value at 10%: $4, 003, 827 Payback in Months: Funding by Fiscal Year 13 $0 FY 15 $1, 928, 280 $1, 083, 089 FY 16 $359, 535 $1, 083, 089 TOTAL Depreciation: $3, 552, 815 $1, 075, 000 $2, 477, 815 ** Five-Year Benefit is a total of the Quantifiable Business and IT Benefits explained in the slides to follow 4

Benefits • Operational Efficiency Ø Eliminated data entry into the multiple systems (i. e. Ariba, Notes, Email, paper forms) Ø Time savings across multiple groups including: GAA, Regional Admins, Desktop Support (i. e. multiple service now tickets that are manually created will be auto-generated) Ø Reduction in turnover costs due to streamlining onboarding process (based on Aberdeen. Group’s 2009 ‘Onboarding Benchmark Report’)¹ Ø Automation of IT Consultant On-Boarding (Lotus Notes Star and IT Facilities & Admin replacement, as well as PPM) Ø Automated Ariba COFA approval will be trigged by IAM solution (closed loop) • Cost Reduction / Avoidance Ø Elimination of Support /Maintenance for end of life solution (throwaway customizations) Ø Cost for additional future assessment • Risk Mitigation Ø Audit findings Ø Consolidation of access requests, approvals /workflow, enabling closed loop for audit ¹ 85% of new hires decide, within the first six months, whether or not they will stay with their new employer. (2% decrease in turnover due to streamlining onboarding, ~400 new Regular employees from ‘ 12 -’ 13, avg. $40, 000 salary, using conservative 1 x salary to replace employee is $1. 4 M) 5

Competitive Analysis • Recent studios implemented the following: Paramount Pictures -Microsoft/ Service. Now • Other Sail. Point customers: RBS, BNP Paribas, Fidelity, Wellpoint, Bank of America, JP Morgan Chase, MGM Resorts, Cardinal Health, Adobe, ING DIRECT, Sallie Mae, Office. Max, Exxon Mobil, UBS, UPS, Travelers, New York Life • Scotia Bank, Exxon and Anadarko Petroleum Foundation use Sail. Point and Service. Now (“Launch in Context”) 6

IAM SPE Timeline Q 4 FY 14 Jan 2014 Feb 2014 Q 1 FY 15 Mar 2014 Q 2 FY 15 Q 3 FY 15 Q 4 FY 15 Q 1 FY 16 Q 2 Apr 2014 May 2014 Jun 2014 Jul 2014 Aug 2014 Sept 2014 Oct 2014 Nov 2014 Dec 2014 Jan 2015 Feb 2015 Mar 2015 Apr 2015 May 2015 June 2015 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 Project Kickoff Planning Design July 2015 Phase 0 Implementation Hypercare Greenlight Project Kickoff Planning Phase I Design Development SIT UAT Cutover Governance/Data Governance Go Live Change Management Design Development Phase II SIT UAT Cutover Go Live Hyper Care

Appendix 8

Security, Risk and Compliance Considerations • Multiple SEHS audit issues resolved by automated provisioning/deprovisioning to On. Guard Ø Ø Active badge accounts that should have been terminated due to termination in IDM Mismatched badge accounts to IDM accounts due to manual errors Badge accounts are active in Onguard but terminated in IDM Accounts are terminated in IDM for users who return as badge-only and the IDM account is never reactivated (out of sync) • Cost /time associated with manual access reviews will decrease due to automated certifications (required per SOX compliance). Historically deficiencies have been reported year to year for inaccurate or incomplete user reviews. Resolves deficiencies FY 13: C 401. 2. 3, C 205. 3. 1, C 401. 2. 3. • Audit issues related to Privileged Account Management will be resolved. Per GISS Monitoring, Section 3 - critical information systems and related events should be monitored. Per SOX, resolves deficiencies: C 404. 1. 1, 404. 1. 2, 404. 1. 3, C 20531. • Audit issues surrounding Access Control will be resolved. Per GISS, Access Control, SPE systems (SOX and non-SOX) should be appropriately restricted. IAM will provide a record of critical sox. vs. non-sox systems to enforce proper access control, including terminations in a timely manner. Relates to findings: SOX C 40131 and C 40133, etc. 9

Scope and Benefits By Phase 10