Business Continuity Management

NXP is a safety and security-conscious business, and we take all reasonable precautions to avoid situations that may threaten the safety or welfare of our employees, their families, suppliers, customers and other members of the community or of our business and stakeholders.

In the event of a situation that threatens the safety and security of people or property, NXP managers will make every reasonable effort to minimize damage and to protect people, assets and the company’s corporate reputation and to provide affected audiences with timely and accurate information on the situation. In the event of a major emergency, Crisis Management Teams (CMT) will be activated in accordance with their Group, or Site or regional Crisis Management Plan. In the case of an event affecting multiple NXP operations, where the site or regional Crisis Management Team requests, or as the event mandates, the NXP Corporate Crisis Management Team will be activated.

NXP fabrication operations based in number of our locations are regulated through specific governmental agencies. In this context, certain incidents must be reported to those entities by NXP in compliance with program guidelines. Consistent with those requirements, NXP may be required to keep the existence and details of the incidents confidential.

The Business Continuity Management Office is the global coordinator for the Business Continuity Plan. This Office is responsible for providing guidance and standardization for business continuity plan development, maintenance, testing and maintaining a solution for a centralized plan retention. The BCM office will provide periodic status reports to senior management on the progression of business continuity plan development, maintenance and testing for all locations within the scope of the BCM Program.

Corporate Business Continuity Team (CBCT)

The NXP Corporate Business Continuity and Crisis Management programs are managed and focused via the Corporate Business Continuity Team (CBCT). The CBCT is a cross-functional team of senior leaders. This team has been established to enable the company to develop and implement the BCM Program, to manage incidents and to continue its business-critical activities in crisis situations. The CBCT is comprised of several teams that deal with the various aspects of risk prevention, mitigation and incident management.

The current membership of the CBCT is comprised of members from technology and operations, supply chain, procurement, human resources, finance, legal, communication & public affairs, IT, site services, security, quality, sustainability and environment, health and safety.

Site Business Continuity Team (SBCT)

The Site Business Continuity Teams will consist of a separate team for each factory, focused on the risks associated with that site. The purpose of this team is to identify potential risks in our factory that can have a major impact on product supply to end customer.

This may include physical factory asset risks such as factory tool set availability, facilities systems, utility infrastructure, regional risks or other supply risks. The team will define, execute and measure results of risk mitigation actions to reduce the likelihood and/or impact of the identified risks.

Business Continuity strategies are focused on the risks associated with each site. Each site has identified the potential risks that can have an impact on product supply to the end customer. Risks may include physical factory assets risk, utility infrastructure, regional risks or supply risks. Each site periodically reviews and updates the site business continuity plan. The plans are documented and maintained at the sites and are audited periodically.

NXP conducts its business and operations in approximately 100 sites and in over 30 countries worldwide. While NXP provides utmost care at all our sites, we categorize our sites based on assessed risk, as well as size and magnitude of operations.

• Tier 1 Significant impact if operations are interrupted. Includes manufacturing sites, large design centers or sites with critical operations e.g. IT data centers.
• Tier 2 Moderate impact if operations interrupted, including design or software centers and major regional office centers. Typically, will be non-manufacturing sites >150 employees. Some sites may be classified as Tier 1 based on management discretion.
• Tier 3 All remaining low-risk sites, including sales sites or remote locations with <150 employees.

NXP works with external vendors that provide data in which we use in our annual internal risk assessments. The business impact assessments include a focus on three primary areas of the likelihood of an event, the impact of an event and the recovery time from an incident. Each of these attributes will be given a numerical score and the team will facilitate sharing of learnings and calibration of scores. The review and the update of these plans shall be reviewed at least once a year. A standard document will be created and utilized across all the factories.

The product supply business continuity plan assures product delivery to our customers. It covers the response documentation for internal and external use. Key elements of the product supply continuity plan are as follows:

• Response process documentation for internal and external use
• Assessment and response team initiation for product supply
• Decision-making hub related to product supply
• Product allocation
• Communication protocols for external customers
• Repository for communication and event responses

Information technology business continuity plan addresses the recovery of business critical data systems. Key elements of the IT business continuity are the following.

• Communication procedures for incident management available
• Information on executing restoration procedures
• A Process to initiate service restoration teams into action
• Outline coordination process for restoration of operations

The procurement business continuity plan will assure the delivery of raw materials to the NXP sites. Key elements of the procurement continuity plan are the following:

• Conduct pro-active risk analysis to determine key suppliers and determine alternate options
• Work with key suppliers to ensure an assurance of supply to NXP
• Evaluate dual sourcing options as deemed needed from risk analysis

Alerts are in place to notify us of events of earthquakes, typhoons, floods, explosions or the like. We also have a geographic information system that includes the latitudes and longitudes of the manufacturing locations of our various material suppliers. Teams receive emails whenever events happen, and this immediately triggers a due-diligence assessment and an action-planning process. We reach out to factories and vendors in the proximity of the crisis, and if there might be an impact to our supply continuity, we take mitigation actions. Proactive communication with our customers is also part of this process.