Self Service Access for Guests Visitor Management Paul

Self Service Access for Guests (Visitor Management) Paul Doris August 19, 2014

Business Problem No capability for self service guest registration; currently a high volume, manual process Culver City SPE lot processes nearly 250, 000 guests per year; 2 million guests since VMS was implemented 8 years ago Upcoming Lot Expansion - Additional 1, 000 occupants, increased number of guests during 18 -24 month construction period Vulnerabilities exist with current VMS and not compliant with SPE Windows standard(e. g. end of life). End of Life for patching or updates, support costs increase significantly or support is non-existent Sony Pictures has guests on premises around the world, guests are received via multiple Visitor Management System (VMS) methods at each office location; causing process and information inconsistencies. Global Information Security Standards (GISS) for managing guests are not implemented and accepted as required. Responsibility of Security Ops include: Provide a safe and secure work environment for SPE staff. Process Guests quickly, efficiently, and accurately in a professional manner. 2

Proposed Solution - Access Control Enterprise System (ACES) Program Objectives q Policy: Access management with Global Information Security Standards (GISS) q Duty of Care: Provide a safe and secure work environment q Customer Service: Professionally process client requests efficiently and accurately Program Solution – Implement enterprise wide Sure. Site application § Program Phase 1 - ACCESS Project - Greenlight request for FY 15 § § § Self Service guest access management system Integration with On. Guard Badge System Scalable across all SPE offices Comprehensive Monitoring Alerts Effective Security Data Management: Watch List (e. g. VIP and Keep Out) Reliable Operation Control Notification shared with designated Security Center Locations § Program Phase 2 - INTEGRATION Project - Greenlight request in future § Integration with Radiant Logic (VDS), with Sail. Point/Service Now (IGA/IAM) § Sure. Site Dashboard for real-time parking statistics § Program Phase 3 - GOVERNANCE Project - Greenlight request in future § Creation of physical security portal based on an automated workflow with appropriate decentralized approvals and task queues § SEHS will make enhancements to SPE physical security (separately funded): § New SPE Badge Design and Turnstiles 3

Financial Summary 4

Benefits Category $ Benefit Description Cost Reduction $0 (1 st year) $908, 500 (5 years) • Reduction of officer staff as a result of automation Cost Avoidance $379, 218 (1 st year) $515, 026 (5 years) • Upgrade to Passage. Point Global • Support for London VMS beyond FY 14 Operational Efficiency Risk Mitigation (Improved Control) (1 st $0 year) $812, 500 (5 years) • Support of 10 International offices greater than 100 headcount for Guest pre-registration and check in process • Support of 40 International offices less than 100 headcount for Guest pre-registration and check in process • Safe secure environment with better controls: • Self Service Guest Registration Workflow • Pre-registration/check-in guest capabilities with audit trail for security authorization • Escorts/Host management and notification via email and/or text message SEHS Physical Security Enhancements (separately funded): • Enhance premise security at entry points by changing design and visual appearance of badge ID and distribute to all SPE holders • Enhance control of pedestrian access by adding turnstiles to Culver City lot 5

Timeline FY 14 S O N D J FY 15 F M A M J S O N D J F M A M J J A S O August – Sept 2015 April 2015 Contract Legal Approval Wave 1 A Greenlight Prepare Implementation Plan & GL docs (e. g. Project Charter, RFP, CBA, Workplan and Greenlight Deck) J FY 16 FY 17 N D J F M A M J J A S O N D October 2015 – May 2016 Los Angeles Campuses Inception Elaboration Construction Transition Global Offices with headcount > 100 employees (~10 offices) Wave 2 Inception Elaboration Construction Transition Global Offices with headcount < 100 employees (~40 offices) Wave 3 Inception Elaboration Construction Transition Phase Go-Live Milestone 6

Appendix 7

Resource Information ** Right. Crowd hourly rate ($187. 50) is representative of daily rate of $1500/day, which has been discounted by 25% as a result of RFP negotiation. 8

Benefit Calculations Category Cost Reduction Cost Avoidance Operational Efficiency $ Benefit Description $0 (1 st year) $908, 500 (5 years) • Reduction of officer staff as a result of automation. 3 contractor resources at 2000 hours annually * 28 (labor rate). • Labor rate/hour increases incrementally by 3% annually. $379, 218 (1 st year) $515, 026 (5 years) • Upgrade to Passage. Point Global • License Fee: $143, 303 • Hardware: $112, 664 • Implementation fee: $80, 500 • Training: $8800 • Annual Software Maintenance: $31, 952 • Maintenance/license support for London VMS (Visitor. Net) beyond FY 14: $10, 000 $0 (1 st year) $812, 500 (5 years) • Support of 10 International offices greater than 100 headcount. Avoidance of 2. 5 hours per day and there are 250 business days in the year at a rate of $10 an hour for 10 offices. ((2. 5*250)*10 = $62, 500 • Support of 40 International offices less than 100 headcount. Avoidance of 1 hour per day and there are 250 business days in the year at a rate of $10 an hour for 40 offices. ((1*250)*10)*40 = $100, 000 9

Resource Plan – Project Team 10

Guest Management Usage by Sony Entertainment and Benchmarked Companies 11

Governance Steering Committee Operating Committee Stevan Bernard Marcelo Rodriguez Mike Taylor Manny Rodriguez Jr. Steve Andujar David Buckholtz Mark Quinto Karen Dedo Paul Doris Ken Lee Burt Germain 12

Security, Risk, and Compliance Considerations GISS #3. 2. 1 Visitor Control When implementing for premise (building) or room entry control, the following controls must be implemented for visitors to each business premise: When receiving visitors, reception or security guards room must be notified in advance whenever possible, and details of the appointment (visitor name, organizational affiliation, receiving employee's name and contact number) must be recorded. Reception or on-site security personnel at each business premises must prepare a visitor book or utilize an electronic log to record the following items for all visitors, where practical to do so: - Visitor's name, organizational affiliation, receiving employee's name, visit date and time, visitor departure time All visitors are required to wear visitor passes or identifications at all times. (Visitors are advised to wear their visitor passes or identifications at easily visible places. ) All visitors must be accompanied at all times (i. e. , a receiving employee must meet the visitors at reception area, accompany them while they are in the premise, and must escort them back to the reception area for their signing out and departure from the premises. ). When visitors leave the location, ensure that their visitor passes or identifications are returned to reception or security guard room. 13