Continuity of Operations
Selected Agencies Could Improve Planning for Use of Alternate Facilities and Telework during Disruptions Gao ID: GAO-06-713 May 11, 2006To ensure that essential government services are available in emergencies, federal agencies are required to develop continuity of operations (COOP) plans. The Federal Emergency Management Agency (FEMA), within the Department of Homeland Security (DHS), is responsible for overseeing and assessing the status of COOP capabilities of federal executive branch agencies. It has developed guidance stating that agency COOP plans must designate alternate facilities and prepare personnel for unannounced relocation to these facilities. The guidance also states that agencies should consider the use of telework in their continuity plans. GAO was asked to follow up on its previous work on COOP planning and determine, among other things, to what extent (1) 6 selected agencies prepared their alternate facilities and (2) 23 major agencies made preparations necessary to effectively use telework in emergency situations.
All six agencies GAO reviewed took steps to prepare their alternate facilities for use in emergencies. However, none of the agencies followed all of FEMA's guidance. For example, none conducted all the applicable tests and exercises, such as annual exercises that involve moving COOP personnel to alternate facilities. Further, agencies did not fully identify the resources necessary to support their essential functions, which reduces assurance that their facilities are adequately prepared. Although individual agencies are ultimately responsible for preparing their plans and alternate facilities, FEMA's limited efforts to oversee and assess agency COOP capabilities contributed to agencies' incomplete compliance with its guidance. According to an official from the Department of Homeland Security, FEMA recently developed a schedule of oversight activities that includes conducting assessments of agency continuity plans starting in July 2006. However, the assessment's methodology is not yet finalized. If FEMA does not develop an assessment methodology that effectively evaluates agencies' compliance, it will have limited assurance that agencies have taken the steps necessary to ensure that they will be able to perform essential government operations following a disruption. Although agencies are not required to use telework in continuity planning, 9 of the 23 agencies surveyed reported plans for essential team members to telework during a COOP event, compared with 3 in GAO's previous survey. However, few documented that they made the necessary preparations to effectively use telework during such an event. For example, only one agency documented that it had notified its team members of their expectation to telework during a COOP event. The lack of specific guidance on preparations for telework during such an event contributed to the low levels of preparation that agencies reported. If agencies do not make adequate preparations, they may not be able to use telework effectively to ensure the continuity of their essential functions in emergencies.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-06-713, Continuity of Operations: Selected Agencies Could Improve Planning for Use of Alternate Facilities and Telework during Disruptions
This is the accessible text file for GAO report number GAO-06-713
entitled 'Continuity Of Operations: Selected Agencies Could Improve
Planning for Use of Alternate Facilities and Telework during
Disruptions' which was released on May 11, 2006.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
Report to the Chairman, Committee on Government Reform, House of
Representatives:
May 2006:
Continuity Of Operations:
Selected Agencies Could Improve Planning for Use of Alternate
Facilities and Telework during Disruptions:
GAO-06-713:
GAO Highlights:
Highlights of GAO-06-713, a report to the Chairman, Committee on
Government Reform, House of Representatives.
Why GAO Did This Study:
To ensure that essential government services are available in
emergencies, federal agencies are required to develop continuity of
operations (COOP) plans. The Federal Emergency Management Agency
(FEMA), within the Department of Homeland Security (DHS), is
responsible for overseeing and assessing the status of COOP
capabilities of federal executive branch agencies. It has developed
guidance stating that agency COOP plans must designate alternate
facilities and prepare personnel for unannounced relocation to these
facilities. The guidance also states that agencies should consider the
use of telework in their continuity plans.
GAO was asked to follow up on its previous work on COOP planning and
determine, among other things, to what extent (1) 6 selected agencies
prepared their alternate facilities and (2) 23 major agencies made
preparations necessary to effectively use telework in emergency
situations.
What GAO Found:
All six agencies GAO reviewed took steps to prepare their alternate
facilities for use in emergencies. However, none of the agencies
followed all of FEMA‘s guidance. For example, none conducted all the
applicable tests and exercises, such as annual exercises that involve
moving COOP personnel to alternate facilities. Further, agencies did
not fully identify the resources necessary to support their essential
functions, which reduces assurance that their facilities are adequately
prepared.
Although individual agencies are ultimately responsible for preparing
their plans and alternate facilities, FEMA‘s limited efforts to oversee
and assess agency COOP capabilities contributed to agencies‘ incomplete
compliance with its guidance. According to an official from the
Department of Homeland Security, FEMA recently developed a schedule of
oversight activities that includes conducting assessments of agency
continuity plans starting in July 2006. However, the assessment‘s
methodology is not yet finalized. If FEMA does not develop an
assessment methodology that effectively evaluates agencies‘ compliance,
it will have limited assurance that agencies have taken the steps
necessary to ensure that they will be able to perform essential
government operations following a disruption.
Although agencies are not required to use telework in continuity
planning, 9 of the 23 agencies surveyed reported plans for essential
team members to telework during a COOP event, compared with 3 in GAO‘s
previous survey. However, few documented that they made the necessary
preparations to effectively use telework during such an event (see
table). For example, only one agency documented that it had notified
its team members of their expectation to telework during a COOP event.
The lack of specific guidance on preparations for telework during such
an event contributed to the low levels of preparation that agencies
reported. If agencies do not make adequate preparations, they may not
be able to use telework effectively to ensure the continuity of their
essential functions in emergencies.
Figure: Agency Responses to Selected Questions on Telework in COOP
Plans:
[See PDF for Image]
Source: GAO.
[a] Agencies responded positively but did not provide adequate
documentation in support.
[b] In 2004, one agency did not respond, resulting in a total of 22
responses.
[End of table]
What GAO Recommends:
GAO is making recommendations to DHS aimed at improving the assessment
and oversight of agency continuity planning and developing guidance on
including telework in such planning. In commenting on a draft of this
report, DHS partially agreed with GAO‘s recommendations and described
actions to implement them.
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-713]
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Linda Koontz at (202) 512-
6240 or koontzl@gao.gov.
[End of section]
Contents:
Letter:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Unclassified Version of April 13, 2006, Briefing to Staff
of the House Committee on Government Reform:
Appendix II: Comments from the Department of Homeland Security:
Abbreviations:
COOP: continuity of operations:
DHS: Department of Homeland Security:
FEMA: Federal Emergency Management Agency:
FPC: Federal Preparedness Circular:
OPM: Office of Personnel Management:
PDD: Presidential Decision Directive:
United States Government Accountability Office:
Washington, DC 20548:
May 11, 2006:
The Honorable Tom Davis:
Chairman:
Committee on Government Reform:
House of Representatives:
Dear Mr. Chairman:
As you know, essential government services can be interrupted by a
range of events, including terrorist attacks, severe weather, or
building-level emergencies. Federal agencies are required by
Presidential Decision Directive (PDD) 67 to develop plans for ensuring
the continuity of such services in emergency situations. This directive
also designated the Federal Emergency Management Agency (FEMA) as lead
agent for executive branch continuity of operations (COOP) planning,
which includes the responsibility for formulating guidance on such
planning and for assessing the status of executive branch COOP
capabilities.[Footnote 1]
In response, FEMA issued COOP guidance to agencies in July 1999:
Federal Preparedness Circular (FPC) 65. The circular states that, in
order to have a viable COOP capability, agencies should identify their
essential functions, which then provide the basis for subsequent
planning steps. The circular further states that agencies must
designate alternate facilities as part of their continuity plans and
prepare their personnel for the possibility of unannounced relocation
of essential functions to these facilities.
In June 2004, FEMA released an updated version of FPC 65, providing
additional guidance to agencies on each of the topics covered in the
original guidance, including an annex on alternate facilities.
According to the guidance, an agency must identify an alternate
facility that provides sufficient space for relocated personnel to
perform essential agency functions during a COOP event. The guidance
also directs agencies to identify the levels of staff and resources
required at the alternate facility to support the performance of these
functions. The identification of staff and resources--including
equipment, critical information systems and data, and vital records--
establishes the preparation requirements for an alternate facility. For
example, in order for an agency to determine that it has an adequate
number of computers present at the alternate facility, it must first
establish how many are required to support personnel in the performance
of essential functions. Once critical resources are identified, pre-
positioning them is necessary to preparing an alternate facility.
The 2004 version of FPC 65 also states that agencies should consider
telework (also known as work-at-home or flexiplace) as an option in
their COOP planning. Although FPC 65 does not require agency plans to
incorporate telework, using this option can allow employees to
contribute to the performance of agency essential functions without
having to physically relocate to an alternate operating facility. As we
reported in April 2004, telework is an important and viable option for
federal agencies in continuity planning and implementation efforts,
especially as the duration of an emergency event is extended[Footnote
2]. We recommended in that report that the Secretary of Homeland
Security direct the Under Secretary for Emergency Preparedness and
Response to complete efforts to revise federal COOP guidance to more
fully address human capital considerations by incorporating six
organizational actions, the scope of which included telework.
In 2002 and 2004, we reviewed the extent to which agency COOP plans
complied with FEMA's continuity guidance at the request of the
Chairman, House Committee on Government Reform. In both reviews, we
reported that agency plans did not generally comply with FEMA's
guidance. In 2004, we also surveyed agencies to determine how they
planned to use telework during COOP events and reported that, although
agencies were not required to address telework in their continuity
plans, 2 of the 22 responding agencies did so in the plans that were in
place on May 1, 2004.[Footnote 3]
For the current review, as agreed with the committee, our objectives
were to determine to what extent agencies have:
* prepared alternate facilities where they can perform their essential
functions in emergencies and:
* made preparations necessary to effectively use telework in emergency
situations.
To achieve our first objective, we obtained and reviewed headquarters
contingency plans from 23 of the largest civilian departments and
agencies to identify the population of alternate facilities; verified
alternate facilities information with each agency; and selected, from
the population of alternate facilities, six alternate facilities
illustrating variations in several attributes, including agency budget
size, distance from respective primary work facility, and facility
type. For the selected alternate facilities, we evaluated compliance
with FPC 65 criteria by analyzing agency COOP plans and other
documentation and by visiting alternate facilities. Finally, we
obtained and analyzed FEMA's COOP guidance and documents describing its
efforts to provide oversight and assessments of federal planning
efforts, and conducted interviews with FEMA officials to clarify the
activities described in these documents.
For our second objective, we reviewed prior GAO work on telework to
determine key practices for the development of an effective telework
program; developed a series of questions regarding agency plans and
preparations to use telework during a COOP event; surveyed agency
officials responsible for continuity planning at 23 of the largest
civilian departments and agencies to determine to what extent key
telework practices were used in making continuity preparations;
reviewed supporting documentation submitted by agency officials to
support their responses; and created tables that compared this year's
survey responses with those from our previous survey in 2004.
We conducted our review between July 2005 and February 2006 in the
Washington, D.C., area and at several agency alternate facilities in
accordance with generally accepted government auditing standards.
On April 13, we provided your office with a classified briefing on the
results of this review. The purpose of this letter is to provide you
with the unclassified material from our briefing. (See app. I.)
In summary, all six agencies we reviewed had identified alternate
facilities and took steps to prepare their alternate facilities for use
in emergencies. For example, most agencies documented plans and
procedures related to these facilities, including site preparation and
activation plans. However, none of the agencies followed all of FEMA's
guidance. For example, none conducted all of the applicable tests and
exercises outlined in FPC 65, including annual exercises that
incorporate the deliberate and preplanned movement of COOP personnel to
the agencies' alternate facilities. Further, agencies did not fully
identify the levels of resources necessary to support their essential
functions (e.g., the number of computers to support the performance of
essential functions), creating a lack of assurance that the agencies'
facilities are adequately prepared.
Although each agency is responsible for developing a viable COOP plan
and ensuring that its alternate facilities are adequately prepared,
FEMA's limited efforts to oversee and assess agency COOP capabilities
contributed to the agencies' lack of compliance with all of the FPC 65
guidance. For example, FEMA has continued to rely on agency-reported
information as the basis for its assessments. In addition, two planned
oversight efforts--a readiness reporting system operated by FEMA and a
review of agency essential functions by the White House--have been
delayed.
According to an official from the Department of Homeland Security
(DHS)--the parent agency of FEMA--FEMA plans to expand its oversight
activities to include the evaluation and assessment of individual
agency COOP capabilities. As part of the methodology for an upcoming
interagency exercise, known as Forward Challenge 06, FEMA officials
anticipate using independent observers to evaluate agency plans and
their implementation during the exercise. In addition, officials plan
to conduct individual agency COOP assessments starting in July 2006.
However, details regarding the assessment's methodology have yet to be
finalized. If FEMA does not develop an assessment methodology that
evaluates agencies' compliance with FPC 65--including the extent to
which agencies (1) identify essential functions; (2) identify the
levels of staff and resources required at their alternate facilities;
and (3) plan, conduct, and document the necessary tests and exercises
at the appropriate scope and frequency--it will have limited assurance
that agencies have taken the steps necessary to ensure that they will
be able to perform essential government operations following a
disruption.
Finally, more agencies reported plans for essential team members to
telework during a COOP event than in our previous survey, but few
documented that they made the necessary preparations to effectively use
telework during an emergency. Nine of the 23 agencies reported that
some of their essential team members are expected to telework during
such an event. However, only 1 agency documented that it had
communicated this expectation to its emergency team members. In
addition, only 3 of the 23 agencies documented testing the ability of
staff to telework during a COOP event.
The lack of specific guidance on the steps that agencies should take to
ensure that they are fully prepared to use telework during a COOP event
contributed to the low levels of preparation that agencies reported.
FEMA recently disseminated guidance to agencies regarding the
incorporation of pandemic influenza considerations into COOP planning.
However, while the guidance does suggest the use of telework during
such an event, it does not address the steps agencies should take when
preparing to use telework during a COOP event. If agencies do not make
adequate preparations, they may not be able to use telework effectively
to ensure the continuity of their essential functions in emergencies.
Recommendations for Executive Action:
To ensure that agencies are adequately prepared to continue performing
essential functions following an emergency, we recommend that the
Secretary of Homeland Security direct the FEMA Director to improve the
oversight of agency COOP planning by taking the following three actions:
* Before the upcoming interagency exercise, conduct an assessment of
the COOP plans of the six agencies whose alternate facilities were
included in our review and report any deficiencies to the head of the
agency for correction.
* Develop a methodology for individual agency COOP assessments that
independently evaluates executive branch agencies' compliance with FPC
65, including the extent to which agencies (1) identify essential
functions; (2) identify the levels of staff and resources required at
their alternate facilities; and (3) plan, conduct, and document the
necessary tests and exercises at the appropriate scope and frequency.
The methodology should include a mechanism for reporting any
deficiencies to the head of the agency for correction.
* Establish a time line for developing, in consultation with the Office
of Personnel Management (OPM), guidance on the steps that agencies
should take to adequately prepare for the use of telework during a COOP
event.
Agency Comments and Our Evaluation:
We received written comments on a draft of our report from the Director
of the Department of Homeland Security's GAO/OIG Liaison Office. (These
comments are reproduced in app. II.) In commenting on the report, the
Director stated that DHS partially agreed with our recommendations.
In commenting on oversight of COOP planning, the Director wrote that
PDD 67 directed that an interagency advisory group shall provide
coordination, oversight, and management for COOP-related activities of
executive branch agencies. He added that although FEMA is designated as
chair of this group, participating agency coordinators are designated
with the authority to represent and commit their agencies in COOP-
related matters. However, as we point out in our report, according to
FPC 65, the presidential directive also established FEMA as the lead
agency for executive branch continuity planning. Included in this
responsibility is the specific requirement for FEMA to oversee and
assess the status of COOP capabilities of executive branch agencies.
In responding to our first recommendation, the Director stated that DHS
partially agreed and that FEMA will be conducting assessments of the
six agencies in conjunction with its upcoming interagency exercise.
Regarding our recommendation on developing an assessment methodology,
the Director wrote that FEMA currently has an assessment program and a
methodology that includes (1) a self-assessment tool to assist senior
leaders in performing internal assessments, (2) the governmentwide
exercise planned for June 2006, and (3) a plan for an expanded
comprehensive department and agency assessment program. He added that
FEMA plans to continually refine this methodology and expand the
program through additional funding and resources. In addition, the
Director stated that the agency's efforts are constrained by resources.
He stated that to improve the readiness of the federal government's
COOP program, additional resources are required to support the large
number of federal offices and facilities that could benefit from
recurring COOP assessments.
However, while these steps outline an overall approach to assessing
agency plans, they do not constitute a methodology for assessing agency
compliance with FPC 65--including the extent to which agencies (1)
identify essential functions; (2) identify levels of staff and
resources required at their alternate facilities; and (3) plan,
conduct, and document the necessary tests and exercise at the
appropriate scope and frequency, as we have recommended. Without such a
methodology, the agency will have limited assurance that agencies have
taken the necessary steps to prepare for an emergency. While we did not
review the adequacy of FEMA's resources for conducting oversight of
agency planning, DHS should review how FEMA prioritizes its currently
available funding for COOP activities and to the extent it agrees that
additional funding is needed, pursue justifying increases.
In responding to our recommendation on developing guidance on agencies'
use of telework, the Director partially agreed and stated that FEMA
will coordinate with OPM in the development of a timeline for further
telework guidance. In addition, he stated that both FEMA and OPM have
provided guidance on the use of telework. However, as stated in our
report, present guidance does not address the preparations agencies
should make for using telework during emergencies and it is unclear
whether and when FEMA will release such guidance.
The Director also included technical comments that we have addressed,
as appropriate.
We are sending copies of this report to the appropriate congressional
committees, the Secretary of Homeland Security, and the Director of the
Office of Personnel Management, and will make copies available to
others on request. In addition, the report will be available at no
charge on the GAO Web site at [Hyperlink, http://www.gao.gov].
If you or your staff have any questions about this report, please
contact me at (202) 512-6240 or koontzl@gao.gov. Key contributions to
this report were made by James R. Sweetman Jr., Assistant Director;
Barbara Collier; Nick Marinos; and Kim Zelonis.
Sincerely yours,
Signed By:
Linda D. Koontz:
Director:
Information Management Issues:
[End of section]
Appendix I: Unclassified Version of April 13, 2006, Briefing to Staff
of the House Committee on Government Reform:
Continuity of Operations: Selected Agencies Could Improve Planning for
Use of Alternate Facilities and Telework During Disruptions:
Briefing for the Staff of the Committee on Government Reform, House of
Representatives:
April 13, 2006:
Outline of Briefing:
Introduction:
Objectives, Scope, and Methodology:
Results in Brief:
Background:
Results:
* Alternate Facilities Compliance;
* Telework:
Conclusions:
Recommendations:
Agency Comments and Our Evaluation:
Attachment 1: Agencies Participating in Telework Survey:
Introduction:
Federal operations and facilities have been disrupted by a range of
events, including:
* the terrorist attacks on September 11, 2001, and at Oklahoma City;
* severe weather events, such as hurricanes Katrina, Rita, and Wilma in
2005; and:
* building-level events, such as asbestos contamination at the
Department of the Interior's headquarters.
Such disruptions, particularly if prolonged, can lead to interruptions
in essential government services. Prudent management, therefore,
requires that federal agencies develop plans for ensuring the
continuity of such services in emergency situations. These are referred
to as continuity of operations (COOP) plans. These plans lay out an
agency's approach to maintaining services, ensuring proper authority
for government actions, and protecting vital assets.
In October 1998, Presidential Decision Directive (PDD) 67 identified
the Federal Emergency Management Agency (FEMA) as the executive agent
for federal COOP planning across the federal executive branch.
FEMA's responsibilities include:
* formulating guidance for agencies to use in developing viable plans;
* coordinating interagency exercises and facilitating interagency
coordination as appropriate, and:
* overseeing and assessing the status of COOP capabilities across the
executive branch.
In July 1999, FEMA first issued Federal Preparedness Circular (FPC) 65.
FPC 65 is guidance to the federal executive branch for use in
developing viable and executable contingency plans that facilitate the
performance of essential functions during any emergency. Some of the
elements of a viable continuity of operations capability, according to
the guidance, include the identification of essential functions;
provision for alternate facilities; provision of interoperable
communications; availability of vital records; and conduct of regular
tests, training, and exercises.
FEMA released an updated version of FPC 65 in June 2004, providing
additional guidance to agencies on each of the topics covered in the
original guidance, including an annex on alternate facilities. The
annex states that all agencies must designate alternate operating
facilities as part of their COOP plans and prepare their personnel for
the possibility of an unannounced relocation to these facilities. When
agencies identify and prepare their alternate facilities, they should
consider a number of items, including geographical location of the
facility, the availability of necessary logistics and infrastructure,
and the safety and security of relocated personnel, in an effort to
ensure that essential operations can be performed during an emergency.
Telework can allow employees to contribute to the performance of agency
essential functions without having to physically relocate to an
alternate operating facility. Although the 2004 version of FPC 65 does
not require agencies to use telework (also known as work-at-home or
flexiplace) as an element of their COOP planning, it states that
agencies should consider telework as an option. According to the Office
of Personnel Management's (OPM) guidance on Washington, D.C., area
closures, one of the major benefits of a telework program is the
ability of employees to continue working at their alternative work
sites during a disruption to operations.[Footnote 1] In recognition of
the growing importance of teleworkers to the continuity of agency
operations, OPM states that agencies may require personnel to telework
when the agency is closed.
Objectives, Scope, and Methodology:
Objectives:
In 2002 and 2004, we reviewed agency COOP plan compliance with FEMA's
guidance at the request of the Chairman, House Committee on Government
Reform. In both reviews we reported that agency plans did not generally
comply with FEMA's guidance. In 2004, we also conducted a survey of
agency planned use of telework during COOP events and reported that,
although not required to do so, 2 of the 22 responding agencies
addressed telework in the continuity plans that were in place on May 1,
2004.
For the current review, as agreed with the Committee, our objectives
were to determine to what extent agencies have:
* prepared alternate facilities where they can perform their essential
functions in emergencies and:
* made preparations necessary to effectively use telework in emergency
situations.
To assess the preparation of agency alternate facilities, we:
* obtained and reviewed headquarters contingency plans from 23 of the
largest civilian departments and agencies to identify the population of
alternate facilities;
* verified alternate facilities information with each agency;
* selected, from the population of alternate facilities, six alternate
facilities illustrating variations in several attributes, including
agency budget size, distance from respective primary work facility, and
facility type;[Footnote 2]
* for the selected alternate facilities, evaluated compliance with FPC
65 guidance through analysis of agency COOP plans, other documentation,
and through observation during alternate facility visits; and:
* obtained and analyzed FEMA's COOP guidance and documents describing
its efforts to provide oversight and assessments of federal planning
efforts, and conducted interviews with FEMA officials to clarify the
activities described in these documents.
For each of the six selected agency alternate facilities, we assessed
compliance with FPC 65 guidance using questions based on the guidance.
These questions address topics related to the preparation of an
alternate operating facility:
* site selection;
* facility plans and procedures;
* employee health, safety, security, and emotional well-being;
* space;
* equipment;
* vital records;
* voice and data communications; and:
* tests and exercises.
These eight areas are our categorization of topics covered in the FEMA
guidance on alternate facilities. Each topic area included two to seven
questions.
We used the following steps to evaluate each agency alternate
facility's compliance and assign answers to each of the questions:
* Documents were reviewed and compared independently by two analysts. A
third analyst reviewed documentation where the initial two could not
reach consensus;
* Initial assessments were shared with each agency during structured
interviews;
* Agency officials had the opportunity to provide additional
documentation to demonstrate compliance;
* Analysts then visited alternate facilities to measure compliance with
agency plans and continuity guidance (e.g., identify the pre-
positioning of equipment at the facilities);
* Any supplemental information provided by the agencies was again
reviewed by multiple analysts.
Based on the agency contingency plans, other related documents, and
physical observation during facility visits, we used content analysis
to assign answers to the FPC 65-based questions. Answers were assigned
as follows:
* yes (compliant with all of the guidance related to that question);
* no (not compliant with any of the guidance related to that question);
* partial (compliant with some, but not all of the guidance).
Based on this analysis, we created tables that summarized the results
of the six assessments. In some cases, agencies had not established
clear requirements (for example, they did not fully identify the
necessary equipment, vital records, or number of personnel needed to
perform essential functions from their alternate facilities). In those
cases, we were unable to determine compliance; these are indicated by
footnotes in our summary tables.
To accomplish our objective on the use of telework, we:
* reviewed prior GAO work on telework[Footnote 3] to determine key
practices for the development of an effective telework program;
* developed a series of questions regarding agency plans to use
telework during a COOP event;
* surveyed agency officials responsible for continuity planning at 23
of the largest civilian departments and agencies[Footnote 4] to
determine to what extent telework key practices were used in making
continuity preparations;
* reviewed supporting documentation submitted by agency officials to
support their responses; and:
* created tables that compared this year's survey responses with those
from our previous survey in 2004.[Footnote 5]:
We conducted our review between July 2005 and February 2006 in the
Washington, D.C., area and at several agency alternate facilities, in
accordance with generally accepted government auditing standards.
Results in Brief: Objective 1:
All six agencies we reviewed took steps to prepare their alternate
facilities for use in emergencies. For example, most agencies
documented plans and procedures related to these facilities, including
site preparation and activation plans. However, none of the agencies
followed all of FEMA's guidance. For example, none conducted all the
applicable tests and exercises required by FPC 65, including annual
exercises that incorporate the deliberate and preplanned movement of
COOP personnel to an alternate facility. Further, agencies did not
fully identify the levels of resources necessary to support their
essential functions, creating a lack of assurance that their facilities
are adequately prepared.
While individual agencies are responsible for developing a viable COOP
plan and ensuring that their alternate facilities are adequately
prepared, FEMA's limited efforts to oversee and assess agency COOP
capabilities contributed to agencies' lack of compliance with all of
the FPC 65 guidance. For example, FEMA has continued to rely on agency-
reported information as the basis for its assessments. In addition, two
planned oversight efforts-a readiness reporting system operated by FEMA
and a review of agency essential functions by the White House-have been
delayed.
FEMA recently developed a schedule of COOP oversight activities that
includes conducting individual agency COOP assessments starting in July
2006. However, details regarding the assessment's methodology have yet
to be finalized. If FEMA does not develop an assessment methodology
that evaluates agencies' compliance with FPC 65-including the extent to
which agencies (1) identify essential functions, (2) identify the
levels of staff and resources required at their alternate facilities,
and (3) plan, conduct, and document the necessary tests and exercises
at the appropriate scope and frequency-it will lack assurance that
agencies have taken the steps necessary to ensure that they will be
able to perform essential government operations following a disruption.
Results in Brief: Objective 2:
More agencies reported plans for essential team members to telework
during a COOP event than in our previous survey, but few documented
that they made the necessary preparations to effectively use telework
during an emergency. While FPC 65 does not require agencies to telework
during a COOP event, it does state that they should consider the use of
telework in their continuity plans and procedures. All of the 23
agencies that we surveyed indicated that they considered telework as an
option during COOP planning. In addition:
* 9 of the 23 agencies reported that some of their COOP essential team
members are expected to telework during a COOP event. However, only 1
agency documented that it had notified its team members of their
expectation to telework during a COOP event.
* None of the 23 agencies demonstrated that they can ensure adequate
technological capacity to allow designated personnel to telework during
a COOP event.
* Only 3 of the 23 agencies documented testing the ability of staff to
telework during a COOP event.
The lack of specific guidance from FEMA on the preparations necessary
to ensure an effective telework program contributed to the low levels
of preparation that agencies reported. If agencies do not make adequate
preparations, they may not be able to use telework effectively to
ensure the continuity of their essential functions in emergencies.
Results in Brief:
Recommendations and Agency Comments:
We are making recommendations to the Secretary of Homeland Security
aimed at improving the assessment and oversight of agency continuity
planning and developing guidance on including telework in such planning.
In written comments provided on a draft of this briefing, the Director
of the Department of Homeland Security's GAO/OIG Liaison Office
commented that departments and agencies are responsible for their own
COOP plans. We agree and we clarified the briefing to reflect this
point. The Director also commented on recent actions FEMA has taken to
fulfill its responsibilities for executive branch continuity planning.
The Director's comments, however, did not address FEMA's responsibility
to oversee and assess the status of COOP capability across the federal
executive branch, which is outlined in FPC 65. Finally, the Director
identified recent guidance related to telework. However, none of the
guidance addresses the preparations agencies should take to use
telework effectively during an emergency.
Background Guidance:
In 1988, Executive Order 12656 established policy for preparedness to
address emergencies that affect national security, including
technological emergencies and natural disasters. The order identified
the National Security Council as the agency responsible for developing
and administering a national security emergency preparedness policy,
with the assistance of FEMA.
In October 1998, according to FEMA officials, PDD 67 established a
requirement that agencies have COOP plans in place by October 1999. It
identified FEMA as the executive agent for federal COOP planning across
the federal executive branch, responsible for formulating guidance for
agencies to use in developing viable plans, coordinating interagency
exercises and facilitating interagency coordination as appropriate, and
overseeing and assessing the status of COOP capabilities across the
executive branch. FEMA's Office of National Security Coordination
executes these COOP responsibilities.
In July 1999, FEMA issued FPC 65 to assist agencies in meeting the
deadline established by the directive. The guidance stated that COOP
planning should address any emergency or situation that could disrupt
normal operations, including localized emergencies; thus, it extended
the scope of the required planning beyond the national emergencies
described in the Executive Order. The guidance included topic areas
such as plans and procedures; identification of essential functions;
delegations of authority; orders of succession; alternate facilities;
interoperable communications; vital records and databases; and tests,
training, and exercises. In June 2004, FEMA released an updated version
of FPC 65, providing additional guidance to agencies on each of the
topics covered in the original guidance.
FPC 65 states that agencies must identify essential functions and
develop plans that ensure that these functions will resume within 12
hours of COOP activation and continue for up to 30 days. The guidance
states that the identification and prioritization of essential
functions are prerequisites for continuity planning because these
establish the parameters that drive the agency's efforts in all other
planning areas.
Furthermore, the guidance states that an agency must identify an
alternate facility that provides sufficient space for relocated
personnel to perform agency essential functions. The guidance also
directs agencies to identify the levels of staff and resources required
at the alternate facility to support the performance of these
functions. The identification of staff and resources-including
equipment, critical information systems and data, and vital records-
establishes the preparation requirements for an alternate facility. For
example, in order for an agency to determine that it has an adequate
number of computers present at the alternate facility, it must first
establish how many are required to support personnel in the performance
of essential functions. Once critical resources are identified, pre-
positioning them is necessary to preparing an alternate facility.
The guidance requires agencies to review their alternate facilities for
suitability and functionality. Tests and exercises allow specific
aspects of COOP plans, procedures, and facilities to be assessed,
validated, or identified for subsequent correction. Periodic testing
also ensures that equipment and procedures are maintained in a constant
state of readiness.
The guidance states that an agency must select an alternate facility
and develop site preparation and activation plans that provide the
agency with the capability to perform its essential functions within 12
hours of COOP activation. The following bullets categorize key areas
identified in FPC 65 that an agency must consider when selecting and
preparing its alternate facility:
* Site selection. Before an agency selects a location for its alternate
facility, it should perform an all-hazard risk assessment for each
facility considered to determine, among other things, any natural
hazards that may affect the facility and the ability to secure the
facility against crime, sabotage, and terrorist attacks. When selecting
a location, an agency should consider access to essential resources-
such as food, water, and fuel-from the alternate facility. Finally, the
agency should be able to run emergency power at the facility.
* Facility plans and procedures. An agency must have detailed site
preparation and activation plans in order to achieve full operational
capability within 12 hours of notification. An agency must have plans
(1) for notifying its alternate facility upon COOP activation of plans
to relocate, (2) for reception and in processing of COOP personnel upon
arrival, and (3) to address housing for the relocated personnel.
* Employee health, safety, security, and emotional well-being. An
agency must provide consideration for the health, safety, and emotional
well- being of its relocating COOP personnel, and ensure that physical
security at the alternate facility meets all requirements established
by annual threat assessments and physical security surveys.
* Space. An agency should ensure that space at its alternate facility
is adequate for supporting the number of relocating COOP personnel
identified in the agency's staffing plans.
* Equipment. An agency should identify the critical resources-including
information technology (IT) and telecommunications equipment-needed to
perform essential functions. An agency must pre-position critical
resources at its alternate facility and have procedures for ordering
equipment not already in place.
* Vital records. Agency personnel must have access to electronic and
hard-copy vital records and databases needed to perform the agency's
essential functions from the alternate facility. In order for an agency
to establish access requirements for vital records and databases at the
alternate facility, it must develop a vital records inventory with
location and access information for each vital record.
* Voice and data communications. An agency must have redundant
communications providing the capability to communicate with key
contacts, including agency staff, critical customers, and the public.
It must also provide access to a local area network, electronic vital
records, critical information systems and data, and internal and
external e-mail and archives.
* Tests and exercises. An agency must conduct and document tests and
exercises of its COOP plans and procedures to ensure that, among other
things, requirements at the alternate facility are adequate for
performing essential functions.
Background Previous GAO Reports:
We previously reported on federal agency headquarters contingency plans
in place in May 2004 at the request of the Chairman, House Committee on
Government Reform.[Footnote 6] At that time, we determined that
agencies had made progress in improving compliance with FPC 65, but
significant weaknesses remained. For example, only 3 out of the 45
agency COOP plans we reviewed documented that their alternate
facilities could provide previously identified equipment and space for
COOP personnel responsible for performing essential functions. In
addition, only 8 out of 45 COOP plans we reviewed adequately documented
that the agencies could provide interoperable communications from their
alternate facilities with internal and external organizations, critical
customers, and the public.
During our previous reviews of agency COOP plans, we reported that
insufficient oversight by FEMA contributed to agencies' lack of
compliance with the continuity guidance. Specifically, we noted that
FEMA had not conducted an assessment of agency contingency plans since
1999. In response, FEMA officials reported that they were developing a
readiness reporting system-a system used to collect data from agencies
on the readiness of their continuity plans that would evaluate
compliance with the guidance-which was to be completed in March 2005.
The system was expected to be operational and certified by October
2005, at which time there would be seven locations (including two FEMA
locations) using the system.
Background Telework:
Telework, also referred to as telecommuting or flexiplace, has gained
widespread attention over the past decade in both the public and
private sectors as a human capital flexibility that offers a variety of
potential benefits to employers, employees, and society. In a 2003
report to Congress on the status of telework in the federal government,
the Director of OPM described telework as "an invaluable management
tool which not only allows employees greater flexibility to balance
their personal and professional duties, but also allows both management
and employees to cope with the uncertainties of potential disruptions
in the workplace, including terrorist threats."[Footnote 7] The 2005
OPM report on telework notes the importance of telework in responding
flexibly to emergency situations, as demonstrated in the wake of the
devastation caused by Hurricane Katrina, when telework served as a tool
to help alleviate the issues caused by steeply rising fuel prices
nationwide.[Footnote 8]:
According to OPM's guidance on Washington, D.C., area closures, one of
the major benefits of a telework program is the ability of employees to
continue working at their alternative work sites during a disruption to
operations.[Footnote 9] In recognition of the growing importance of
teleworkers to the continuity of agency operations, OPM states that
agencies may require personnel to telework when the agency is closed.
According to OPM guidance, telework enabled employees to continue
working after being displaced during events such as the terrorist
attacks and subsequent anthrax problems of 2001.[Footnote 10]:
In November 2005, the White House issued a national strategy to address
the threat of pandemic influenza.[Footnote 11] The strategy states that
social distancing measures may be appropriate public health
interventions for infection control and containment during a pandemic
outbreak. Telework is an example of social distancing. The strategy
requires federal departments and agencies to develop and exercise
preparedness and response plans that take into account the potential
impact of a pandemic on the federal workforce. It also tasks the
Department of Homeland Security (DHS)-the parent department of FEMA-
with developing plans to implement the strategy in regard to domestic
incident management and federal coordination.
As we reported in April 2004, telework is an important and viable
option for federal agencies in COOP planning and implementation
efforts, especially as the duration of an emergency event is
extended.[Footnote 12] In a July 2003 report, we defined 25 key
telework practices for implementation of successful federal telework
programs. [Footnote 13]:
In our April 2005 report on continuity of operations, we reported that
although agencies were not required to use telework in their continuity
plans, 1 of the 21 agency continuity plans in place on May 1, 2004,
documented the agency's intention to address some essential functions
through telework. [Footnote 14] In addition, 10 agencies reported that
they intended to use telework following a COOP event, but those
intentions were not documented in their continuity plans. The plans
reviewed were created before the issuance of FEMA's revised continuity
planning guidance, which includes the recommendation that agencies
consider options such as work-at-home and virtual offices when
establishing continuity plans.
Objective 1: Alternate Facilities Compliance:
All six agencies we reviewed took steps to prepare their alternate
facilities using practices identified in the FPC 65 guidance. Agency
use of these practices, which fall into the eight topic areas presented
earlier, are presented in the following slides.
Among the eight areas, the extent to which agencies performed the
practices varied. For example, most agencies documented plans and
procedures related to their alternate facilities, including site
preparation and activation plans. In contrast, none conducted all the
applicable tests and exercises required by FPC 65, including annual
exercises that incorporate the deliberate and preplanned movement of
COOP personnel to an alternate facility. Furthermore, agencies did not
fully identify the levels of resources necessary to support their
essential functions.
Although individual agencies are responsible for developing a viable
COOP plan and ensuring that their alternate facilities are adequately
prepared, FEMA's limited efforts in overseeing and assessing agency
COOP capabilities contributed to agencies' lack of compliance with all
of the FPC 65 guidance.
Site Selection:
FPC 65 states that agencies must identify and prepare alternate
facilities as part of their COOP plans. The guidance requires that if
the selected facility is not owned or leased by the agency, a signed
memorandum of agreement/understanding (MOA/MOU) must be prepared with
the owner or occupant of the facility and reviewed annually.
Furthermore, agencies should consider access from the alternate
facility to essential resources-such as food, water, fuel, medical
facilities, and municipal services. Agencies should also have the
ability to run emergency power at their alternate facilities. When
selecting their alternate facilities, agencies should perform an all-
hazard risk assessment for any facility considered for COOP use. This
assessment should consist of an analysis that includes identification
of all natural hazards that may affect each facility.
All six agencies identified their alternate facilities, and the one
agency that shares its alternate facility with its owners had a
documented MOA. Most agencies considered access to essential resources
and had the ability to run emergency power. However, only one of the
agencies documented that it had performed the required all-hazard risk
assessments when selecting the identified alternate facilities. If an
agency does not conduct an all-hazard risk assessment before selecting
a facility, it may select a site that is unduly susceptible to:
(1) natural hazards; (2) accidents, such as releases of hazardous
materials; (3) crime, sabotage, and terrorist attacks; or (4)
inadequate capabilities of on-site and/or local first responders to
accommodate the needs of the relocating agency.
Table: Site Selection: Responses by Question:
Question: Does the agency identify an alternate facility as a part of
its COOP plan?
Yes: 6;
Partial: 0;
No: 0;
N/A: 0.
Question: If an alternate facility is not owned or leased by the
agency, does the agency have a signed Memorandum of
Agreement/Understanding (MOA/MOU)?
Yes: 1;
Partial: 0;
No: 0;
N/A: 5.
Question: Did the agency consider access to essential resources such as
food, water, fuel, medical facilities, and municipal services from the
alternate facility?
Yes: 5;
Partial: 1;
No: 0;
N/A: 0.
Question: Does the agency have the ability to run emergency power at
the alternate facility to allow essential functions and operations to
continue?
Yes: 4;
Partial: 1;
No: 0;
N/A: 1[Footnote 15].
Question: Did the agency perform an all-hazard risk assessment for the
alternate facility?
Yes: 1;
Partial: 2;
No: 3;
N/A: 0.
Source: GAO analysis of agency alternate facilities and continuity
planning documents.
[End of table]
Objective 1: Alternate Facilities Compliance Facility Plans and
Procedures:
Facility Plans and Procedures:
FPC 65 states that agencies must have detailed site preparation and
activation plans in order to achieve full operational capability within
12 hours of notification. Additionally, the agency must plan for
notifying the alternate facility upon COOP activation and provide
instructions to COOP personnel for relocating to its alternate
facility. Furthermore, an agency must have plans for in-processing of
COOP personnel upon arrival at the alternate facility and plans to
address the housing of COOP personnel, if applicable.
Most agencies documented site preparation and activation plans and
procedures, documented plans to notify their alternate facilities upon
COOP activation, and provided instructions for relocating to their
alternate facilities. Most agencies also documented plans for reception
and in-processing of COOP personnel. Three agencies reported that
housing plans were not applicable because their alternate facilities
were at a commutable distance for COOP personnel. Of the other three
agencies, two documented plans to address housing for the relocated
employees.
Table: Facility Plans and Procedures: Responses by Question:
Question: Does the agency have a site preparation and activation plan
pre- positioned at the alternate facility?
Yes: 5;
Partial: 1;
No: 0;
N/A: 0.
Question: Does the agency have a plan for notifying alternate
facilities at the time of COOP activation?
Yes: 5;
Partial: 0;
No: 1;
N/A: 0.
Question: Does the agency provide instructions for relocating to
alternate facilities?
Yes: 5;
Partial: 1;
No: 0;
N/A: 0.
Question: Does the agency have procedures for the reception and in-
processing of personnel at the alternate facility?
Yes: 4;
Partial: 2;
No: 0;
N/A: 0.
Question: Does the agency have a plan to address housing for COOP
personnel, if applicable?
Yes: 2;
Partial: 1;
No: 0;
N/A: 3.
Source: GAO analysis of agency alternate facilities and continuity
planning documents.
[End of table]
Objective 1: Alternate Facilities Compliance Employee Health, Safety,
Emotional Well-being, and Security:
Employee Health, Safety, Emotional Well-being, and Security:
FPC 65 states that alternate facilities must provide consideration for
the health, safety, emotional well-being, and security of relocated
employees. The guidance calls for agencies to have sufficient personnel
and technology to provide perimeter and access control, internal
security functions, and surveillance of the facility. Physical security
at the alternate facility must meet the requirements established by
annual threat assessments and physical security surveys by the agency's
security office, the Federal Protective Service, or a qualified
contractor.
All six agencies provided consideration for the health and safety of
relocated COOP personnel. For example, one agency's alternate facility
provided medical support on site while another was equipped with first
aid supplies. In addition, the six agencies provided consideration for
the emotional well-being of relocated COOP personnel. For example, one
agency's facility included an employee assistance program office
staffed with counselors, while another provided a recreation area for
off-shift relaxation.
At all six agency alternate facilities that we visited, physical access
to the facilities was controlled through the use of guards,
identification badges, or entry devices such as key cards. Three
agencies documented that they had conducted all of the required
physical security surveys and threat assessments. If an agency does not
conduct the necessary physical security assessments and surveys, it may
be unaware of vulnerabilities at its alternate facility and, therefore,
unable to address them.
Objective 1: Alternate Facilities Compliance Employee Health, Safety,
Emotional Well-being, and Security:
Table: Employee Health, Safety, Emotional Well-being, and Security:
Responses by Question:
Question: Does the agency provide consideration for the health and
safety of relocated COOP personnel?
Yes: 6;
Partial: 0;
No: 0;
N/A: 0.
Question: Does the agency provide consideration for the emotional well-
being of relocated COOP personnel?
Yes: 6;
Partial: 0;
No: 0;
N/A: 0.
Question: Is access to facilities controlled through the use of guards,
identification badges, or entry devices such as key cards or
biometrics?
Yes: 3;
Partial: 3;
No: 0;
N/A: 0.
Question: Does the agency provide physical security that meets all
requirements established by annual threat assessments and physical
security surveys?
Yes: 6;
Partial: 0;
No: 0;
N/A: 0.
Source: GAO analysis of agency alternate facilities and continuity
planning documents.
[End of table]
Alternate Facility Space:
FPC 65 requires agencies to establish staffing requirements needed to
perform essential functions within 12 hours of COOP activation and for
up to 30 days. In addition, the guidance states that agencies must
ensure that alternate facilities have enough space to accommodate the
maximum number of relocating personnel they require.
All six agencies identified the maximum number of COOP personnel that
could relocate to their alternate facilities. Four of those agencies
provided adequate space to accommodate the maximum number of staff
indicated in their staffing plans. The other two agencies did not
provide enough space at their alternate facilities to accommodate all
of the relocating COOP personnel. Officials from those two agencies
stated that the number of COOP personnel simultaneously relocating to
their facilities would be less than the maximum number of personnel
identified, although they were unable to provide documentation to
support this.
If agencies do not establish clear staffing requirements for their
alternate facilities, the allocated space at the facilities may be
insufficient to accommodate COOP personnel needed to perform agency
essential functions.
Table: Alternate Facility Space: Responses by Question:
Question: Does the agency identify the maximum number of personnel that
could relocate to the alternate facility?
Yes: 6;
Partial: 0;
No: 0;
N/A: 0.
Question: Does the agency identify sufficient space at the alternate
facility to accommodate the number of personnel4200 identified to
relocate there?
Yes: 4;
Partial: 2;
No: 0;
N/A: 0.
Source: GAO analysis of agency alternate facilities and continuity
planning documents.
[End of table]
Equipment:
FPC 65 requires that agencies identify the critical resources-including
IT and telecommunications equipment-needed to perform essential
functions. Agencies must pre-position critical resources at the
alternate facility to ensure the availability of services. In addition,
agencies should (1) have procedures for ordering equipment and supplies
not already in place at the alternate facility and (2) annually review
their lists of resources required to perform essential functions and
update them as necessary.
All six agencies identified types of equipment they would need to
perform essential functions at their alternate facilities, but four
agencies did not identify both types and quantities. For example, one
agency required computers at its facility but did not specify how many.
Because of the unclear requirements for the four agencies, we were
unable to determine whether all necessary resources were pre-positioned
at their facilities. In addition, four agencies had procedures for
ordering equipment and supplies, and one agency demonstrated that it
annually reviewed its lists of equipment. If an agency does not
identify equipment requirements for the alternate facility, it cannot
be assured that the current level of resources present at its alternate
facility is adequate for performing the essential functions.
Table: Equipment: Responses by Question:
Question: Does the agency establish requirements for equipment
(including IT and telecommunications hardware) needed to perform
essential functions?
Yes: 2;
Partial: 4;
No: 0;
N/A: 0.
Question: Has the agency pre-positioned equipment, as identified, at
the alternate facility[Footnote 16]?
Yes: 2;
Partial: N/A;
No: N/A;
N/A: N/A.
Question: Does the agency identify the office supplies needed to
perform essential functions?
Yes: 2;
Partial: 3;
No: 1;
N/A: 0.
Question: Does the agency have procedures for ordering equipment and
supplies not already in place at the alternate facility?
Yes: 4;
Partial: 2;
No: 0;
N/A: 0.
Question: Does the agency annually review its lists of equipment
required to perform essential functions and update them as necessary?
Yes: 1;
Partial: 0;
No: 5;
N/A: 0.
Source: GAO analysis of agency alternate facilities and continuity
planning documents.
[End of table]
Vital Records:
FPC 65 states that agency personnel must have access to electronic and
hard-copy vital records and databases needed to perform their essential
functions from the agency alternate facility. In order for an agency to
establish access requirements for vital records and databases at the
alternate facility, it must develop a vital records inventory with
location and access information for each vital record. The guidance
also states that an agency must develop and maintain a vital records
plan packet that includes-among other items-agency contact information,
lists of records recovery experts and vendors, and its vital records
inventory.
One of the six agencies maintained an inventory that included location
and access information for each vital record and database required to
perform essential functions at the alternate facility. For the
remaining five agencies, which lacked complete inventories, we could
not fully assess whether the necessary electronic and hard copy vital
records would be available at the facilities. Furthermore, only one out
of the six agencies had a complete vital records plan packet at its
alternate facility. If an agency does not maintain a complete inventory
of the vital records and databases needed to perform essential
functions, it will be unable to determine whether the records necessary
for performing agency essential functions will be available at the
alternate facility.
Objective 1: Alternate Facilities Compliance Vital Records:
Vital Records: Responses by Question:
Question: Does the agency establish requirements for vital records and
databases needed to support its essential functions in an inventory
that includes location and access information?
Yes: 1;
Partial: 5;
No: 0;
N/A: 0.
Question: Does the agency provide the capability to access its
classified and unclassified vital records and databases from the
alternate facility?[Footnote 17]:
Yes: 1;
Partial: N/A;
No: N/A;
N/A: N/A.
Question: Does the agency have a vital records plan packet?
Yes: 1;
Partial: 4;
No: 1;
N/A: 0.
Question: Does the agency provide the procedures for moving non-pre-
positioned vital records from the primary to the alternate facility in
event of COOP activation?
Yes: 2;
Partial: 1;
No: 3;
N/A: 0.
Question: Does the agency outline procedures for updating vital records
to ensure that they always contain the most current information?
Yes: 2;
Partial: 3;
No: 1;
N/A: 0.
Question: Did the agency conduct a risk assessment for its vital
records?
Yes: 1;
Partial: 0;
No: 5;
N/A: 0.
Question: Does the agency identify individuals that can assist with
recovery from potential records damage?
Yes: 3;
Partial: 0;
No: 3;
N/A: 0.
Source: GAO analysis of agency alternate facilities and continuity
planning documents.
[End of table]
Voice and Data Communications:
The success of agency operations at an alternate facility depends on
the availability of voice and data communication methods. FPC 65 states
that an agency must have redundant communications systems at its
alternate facility. Furthermore, an agency must have the ability to
communicate with key contacts, including (1) agency staff-such as COOP
personnel, agency leadership, and other employees operating from
different locations-and (2) external entities, such as the FEMA
Operations Center, the Homeland Security Operations Center, critical
customers, and the public. The guidance also states that an agency must
be able to access from its alternate facility its critical information
systems and data, a local area network, and internal and external e-
mail and archives.
Although most agencies provided redundant emergency communications
methods at their alternate facilities, four agencies did not fully
document procedures for how they would communicate with key internal
and external entities using these methods. For example, two agencies
provided information on how to contact others but did not have clear
procedures demonstrating how they would receive incoming communications
at their alternate facilities.
In addition, three out of the six agencies did not specifically
document the data and critical information systems needed for essential
functions. For example, one agency identified a general need for access
to file servers, but did not identify the specific critical information
systems and data within the servers. As a result, we were unable to
determine whether all necessary systems and data would be accessible
from the alternate facilities. Most agencies provided access to a local
area network, and two provided access to internal and external e-mail
and archives.
If the ability to communicate with internal and external entities is
limited, essential agency operations may also be limited. Furthermore,
if agencies do not identify the critical information systems and data
needed to perform essential functions, they cannot ensure that
personnel will be able to access the information resources necessary to
perform these functions at the alternate facility.
Table: Voice and Data Communications: Responses by Question:
Question: Does the agency provide communications capabilities at the
alternate facility of sufficient quantity and mode/media to effectively
interface with key contacts?
Yes: 2;
Partial: 4;
No: 0;
N/A: 0.
Question: Does the agency provide redundant communications systems for
use in COOP implementation within 12 hours of COOP activation and
sustained for up to 30 days?
Yes: 5;
Partial: 1;
No: 0;
N/A: 0.
Question: Does the agency establish requirements for data and critical
information systems needed to conduct essential functions and support
activities?
Yes: 3;
Partial: 2;
No: 1;
N/A: 0.
Question: Does the agency provide access to critical information
systems and data within 12 hours of COOP activation?[Footnote 18]:
Yes: N/A;
Partial: 1;
No: 2;
N/A: N/A.
Question: Does the agency provide access to a local area network within
12 hours of COOP activation?
Yes: 4;
Partial: 2;
No: 0;
N/A: 0.
Question: Does the agency provide access to internal and external e-
mail and archives within 12 hours of COOP activation?
Yes: 2;
Partial: 2;
No: 2;
N/A: 0.
Source: GAO analysis of agency alternate facilities and continuity
planning documents.
[End of table]
Tests and Exercises:
Tests and exercises of continuity of operations capabilities are
essential to demonstrate and improve an agency's ability to execute its
COOP plans and procedures. FPC 65 provides for multiple test and
exercise requirements that directly impact the preparedness of agency
alternate facilities, including (1) annual exercises that incorporate
the deliberate and preplanned movement of the COOP personnel to an
alternate facility; (2) quarterly validation of internal and external
communications capabilities at an alternate facility; and (3) tests to
ensure that vital records and data to support essential functions are
sufficient, complete, current, and available at an alternate facility.
None of the agencies documented that they conducted all of the required
tests and exercises related to the preparation of alternate facilities
that are required by FPC 65, including annually testing primary backup
infrastructure systems and services at the alternate facilities. If an
agency does not plan, conduct, and document the necessary tests and
exercises of its COOP plans and procedures, it will be unable to ensure
that (1) agency personnel are familiar with alert, notification, and
deployment procedures; (2) resource requirements at the alternate
facility are adequate for performing essential functions; and (3) any
deficiencies in their plans and procedures are identified and corrected.
Table: Tests and Exercises: Responses by Question:
Question: Does the agency test annually its primary and backup
infrastructure systems and services at its alternate facility (e.g.,
power, water, fuel)?
Yes: 0;
Partial: 2;
No: 4;
N/A: 0.
Question: Does the agency conduct annual exercises that incorporate the
deliberate and preplanned movement of the COOP personnel to an
alternate facility?
Yes: 0;
Partial: 5;
No: 1;
N/A: 0.
Question: Does the agency annually test/exercise its required physical
security capabilities?
Yes: 3;
Partial: 0;
No: 3;
N/A: 0.
Question: Does the agency test to ensure that vital records and data
are sufficient, complete, current, and available?
Yes: 0;
Partial: 2;
No: 4;
N/A: 0.
Question: Has the agency documented the quarterly validation of its
internal and external communications capabilities at its alternate
facility?
Yes: 0;
Partial: 4;
No: 2;
N/A: 0.
Source: GAO analysis of agency alternate facilities and continuity
planning documents.
[End of table]
Readiness Reporting System:
Although individual agencies are responsible for developing a viable
COOP plan and ensuring that their alternate facilities are adequately
prepared, FEMA's limited efforts in overseeing and assessing agency
COOP capabilities contributed to agencies' lack of compliance with all
of the FPC 65 guidance. For example, FEMA has continued to rely on
agency-reported information as the basis for its assessments. According
to DHS comments on a draft of this briefing, FEMA uses its Forward
Challenge series of interagency COOP exercises, which occur every 2
years, as its external assessment for all executive branch agencies.
However, participating agencies completed assessments of their own COOP
capabilities during the most recent exercise. In addition, FEMA
collects COOP readiness status reports from agencies and provides
consolidated reports to White House and DHS officials.
During our previous reviews of agency COOP plans in 2002 and 2004, we
raised similar concerns. In response, FEMA officials reported that the
agency was developing a readiness reporting system to assist it in
assessing agency plans. FEMA officials reported that the online system
was to be completed in March 2005 and to be operational and certified
by October 2005.
However, FEMA recently terminated testing and development of its
readiness reporting system, citing design issues and stating that the
system could not be implemented at the required scale. According to
Office of National Security Coordination officials, an internal working
group was established to develop system requirements and a new
statement of work, although no time line has been established for
development of a new system.
Interagency Tests and Exercises:
FEMA officials previously identified the agency's coordination of
interagency COOP exercises as an effort that helps in ensuring the COOP
readiness and capabilities of executive branch agencies. According to
officials from the Office of National Security Coordination, the agency
coordinated Determined Challenge, an interagency table-top exercise
conducted in November 2005 that included participants from 46
departments and agencies. FEMA also continues its planning efforts for
Forward Challenge 06, its upcoming interagency exercise in June 2006.
Officials stated that about 60 departments and agencies will
participate in the exercise from their alternate facilities. Officials
anticipate using independent observers to evaluate agency plans and
their implementation during the exercise.
Although participation in FEMA's interagency exercises can help
agencies to assess and validate their COOP plans and procedures, it
does not ensure that agencies meet all FPC 65 requirements for tests
and exercises. For example, the guidance calls for agency exercises to
incorporate the movement of COOP personnel to their alternate operating
facilities, and for these exercises to be conducted annually. However,
FEMA coordinates such exercises only every 2 years.[Footnote 19]:
Essential Function Review:
We previously reported that the White House initiated an effort-in
coordination with FEMA-to identify and validate the mission essential
functions of executive branch agencies. In a memorandum issued on
January 10, 2005, the Assistant to the President for Homeland Security
initiated the process, stating that once identified, mission essential
functions would serve as key continuity planning factors for agencies'
determination of the appropriate level of staffing, communications, and
facilities. Initial plans were to use the validated functions to
support, among other things, the development of new continuity policy
and to develop and implement improved requirements.
However, officials from FEMA's Office of National Security Coordination
stated that oversight efforts to review agency essential functions were
postponed until the council develops and releases further continuity
policy. One official stated that the council informally reviewed
essential functions for four agencies before the postponement, but did
not provide formal written comments or revisions of essential functions
to the agencies. No time line has been set for resuming the essential
function review.
Identification of essential functions is crucial to the development of
continuity plans and preparation of alternate facilities. Thus, until
essential functions are reviewed and validated against consistent
criteria, FEMA and the Homeland Security Council will lack assurance
that agencies have made adequate preparations for alternate facilities,
including provisions for necessary resources and staffing levels.
FEMA COOP Oversight Plan:
In his comments on a draft of this briefing, the Director of the
Department of Homeland Security's GAO/OIG Liaison Office stated that
FEMA has plans to expand its COOP oversight activities to include the
evaluation and assessment of individual agency COOP capabilities. He
added that, as part of the methodology for the upcoming interagency
exercise, Forward Challenge 06, agency COOP plans will be externally
evaluated before the exercise. In addition, officials plan to conduct
individual agency COOP assessments starting in July 2006. These
assessments will include the evaluation of, among other things, agency
COOP plans and procedures; essential functions; alternate facilities;
and tests, training, and exercises. FEMA officials plan to conduct two
agency assessments per month, with assessment reports to be provided
beginning in late August 2006. However, according to an Office of
National Security Coordination official, details regarding the
assessment's methodology have yet to be finalized.
Conducting assessments of agency COOP capabilities can help agencies
validate their plans and procedures and identify any deficiencies for
correction. However, if FEMA does not develop a methodology for
individual agency COOP assessments that evaluates agencies' compliance
with FPC 65-including the extent to which they (1) identify essential
functions, (2) identify the levels of staff and resources required at
their alternate facilities, and (3) plan, conduct, and document the
necessary tests and exercises at the appropriate scope and frequency-it
will lack assurance that agencies have taken the steps necessary to
ensure that they will be able to perform essential government
operations following a disruption.
Objective 2: Telework:
More agencies reported plans for essential team members to telework
during a COOP event than in our previous survey, but few documented
that they had made the necessary preparations to effectively use
telework during an emergency. Although FPC 65 does not require agencies
to use telework during a COOP event, it does state that they should
consider the use of telework in their continuity plans and procedures.
All of the 23 agencies that we surveyed indicated that they considered
telework as an option during COOP planning. In addition:
* Nine of the 23 agencies reported that some of their COOP essential
team members are expected to telework during a COOP event. However,
only one agency documented that it had notified its team members of
their expectation to telework during a COOP event.
* None of the 23 agencies demonstrated that they can ensure adequate
technological capacity to allow designated personnel to telework during
a COOP event.
* Only 3 of the 23 agencies documented testing the ability of staff to
telework during a COOP event.
Reasons cited for not planning to use telework during a COOP event
included (1) the need to access classified information-which is not
permitted outside of secured areas-in order to perform agency essential
functions and (2) a lack of funding for the necessary equipment
acquisition and network modifications.
Telework Practices:
Telework: Responses by Question:
The following tables summarize the most recent agency responses to
questions on the use of telework in responding to disruptions to
operations. For comparison, we also provide responses from the survey
we conducted in 2004.
Question: Does the agency have a telework policy?;
Year: 2005;
Yes: 22;
Yes[Footnote 20](no doc): 1;
No: 0.
Question: Does the agency have a telework policy?;
Year: 2004[Footnote 21];
Yes: 19;
Yes[Footnote 20](no doc): 3;
No: 0:
Question: If yes, does the policy specifically address COOP events?;
Year: 2005;
Yes: 2;
Yes[Footnote 20](no doc): 6;
No: 15.
Question: If yes, does the policy specifically address COOP events?;
Year: 2004;
Yes: 1;
Yes[Footnote 20](no doc): 2;
No: 19.
Question: Does the COOP plan specifically address telework?;
Year: 2005;
Yes: 12;
Yes[Footnote 20](no doc): 3;
No: 8.
Question: Does the COOP plan specifically address telework?;
Year: 2004;
Yes: 2;
Yes[Footnote 20](no doc): 1;
No: 19.
Question: Does the agency coordinate its COOP and telework planning
processes?;
Year: 2005;
Yes: 4;
Yes[Footnote 20](no doc): 13;
No: 6.
Question: Does the agency coordinate its COOP and telework planning
processes?;
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 5;
No: 17.
Question: Was the agency's telework coordinator involved in COOP
planning?;
Year: 2005;
Yes: 1;
Yes[Footnote 20](no doc): 14;
No: 8.
Question: Was the agency's telework coordinator involved in COOP
planning?;
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 6;
No: 16.
Question: Are any of the COOP essential team members expected to
telework in a COOP event?
Year: 2005;
Yes: 3;
Yes[Footnote 20](no doc): 6;
No: 14.
Question: Are any of the COOP essential team members expected to
telework in a COOP event?
Year: 2004;
Yes: 1;
Yes[Footnote 20](no doc): 2;
No: 19.
Question: Were staff informed of their responsibility to telework
during a COOP event?
Year: 2005;
Yes: 1;
Yes[Footnote 20](no doc): 10;
No: 12.
Question: Were staff informed of their responsibility to telework
during a COOP event?
Year: 2004;
Yes: 1;
Yes[Footnote 20](no doc): 3;
No: 18.
Question: Has the agency ensured that it has adequate technological
capacity for staff to telework during a COOP event?
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 14;
No: 9.
Question: Has the agency ensured that it has adequate technological
capacity for staff to telework during a COOP event?
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 5;
No: 17.
Question: Will the agency provide technological assistance to staff
during a COOP event?
Year: 2005;
Yes: 3;
Yes[Footnote 20](no doc): 11;
No: 9.
Question: Will the agency provide technological assistance to staff
during a COOP event?
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 5;
No: 17.
Question: Did the agency train staff how to telework during a COOP
event?
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 13;
No: 10.
Question: Did the agency train staff how to telework during a COOP
event?
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 3;
No: 19.
Question: Has the agency tested the ability of staff to telework during
a COOP event?
Year: 2005;
Yes: 3;
Yes[Footnote 20](no doc): 7;
No: 13.
Question: Has the agency tested the ability of staff to telework during
a COOP event?
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 2;
No: 20.
Question: Are any personnel not designated essential for COOP purposes
expected to telework during an emergency?
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 11;
No: 12.
Question: Are any personnel not designated essential for COOP purposes
expected to telework during an emergency?
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 7;
No: 15.
Question: Were staff informed of their responsibility to telework
during a COOP event?
Year: 2005;
Yes: 1;
Yes[Footnote 20](no doc): 5;
No: 17.
Question: Were staff informed of their responsibility to telework
during a COOP event?
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 3;
No: 19.
Question: Has the agency ensured that it has adequate technological
capacity for staff to telework during a COOP event?
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 8;
No: 15.
Question: Has the agency ensured that it has adequate technological
capacity for staff to telework during a COOP event?
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 7;
No: 15.
Question: Will the agency provide technological assistance to staff
during a COOP event?
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 7;
No: 16.
Question: Will the agency provide technological assistance to staff
during a COOP event?
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 5;
No: 17.
Question: Did the agency train staff how to telework during a COOP
event?
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 4;
No: 19.
Question: Did the agency train staff how to telework during a COOP
event?
Year: 2004;
Yes: 0;
Yes[Footnote 20](no doc): 1;
No: 21.
Question: Has the agency tested the ability of staff to telework during
a COOP event?
Year: 2005;
Yes: 0;
Yes[Footnote 20](no doc): 4;
No: 19.
Question: Has the agency tested the ability of staff to telework during
a COOP event?
Year: 2004
Yes: 0;
Yes[Footnote 20](no doc): 3;
No: 19.
Source: Analysis of agency responses to GAO questions.
[End of table]
Telework Telework Guidance:
No guidance addresses the steps that agencies should take to ensure
that they are fully prepared to use telework during a COOP event. When
we reported the results of our 2004 survey, we recommended that the
Secretary of Homeland Security direct the Under Secretary for Emergency
Preparedness and Response to develop, in consultation with OPM,
guidance on the steps that agencies should take to adequately prepare
for the use of telework during a COOP event. However, to date, no such
guidance has been created nor has a time line been established for its
creation.
FEMA recently disseminated guidance to agencies regarding the
incorporation of pandemic influenza considerations into COOP planning.
While the guidance does suggest the use of telework during such an
event, it does not address the steps agencies should take when
preparing to use telework during an emergency.
Without guidance on what constitutes adequate preparation, including
tests and training, agencies are unlikely to take all the steps
necessary to ensure that employees will be able to effectively use
telework to perform essential functions during any COOP event,
including an influenza pandemic.
Conclusions:
All six agencies we reviewed took steps to prepare their alternate
facilities for use in emergencies. However, none of the agencies
followed all of FEMA's guidance. For example, none conducted all the
applicable tests and exercises required by FPC 65, including annual
exercises that incorporate the deliberate and preplanned movement of
COOP personnel to an alternate facility. Furthermore, agencies did not
fully identify the levels of resources necessary to support their
essential functions, creating a lack of assurance that their facilities
are adequately prepared to support agency essential functions.
Although individual agencies are responsible for developing viable COOP
capabilities, FEMA's limited oversight contributed to the lack of
agency compliance with all of the FPC 65 guidance for alternate
facilities. FEMA recently announced plans to expand its assessments of
individual agency COOP plans, but has not yet determined how these new
assessments will take place. If FEMA does not conduct timely
assessments of the plans developed by the six agencies included in our
review, it will lack assurance that those agencies are fully prepared
to use the upcoming interagency exercise to demonstrate their
readiness. Also, until FEMA conducts independent assessments of all
agencies' compliance with FPC 65-including the extent to which agencies
(1) identify essential functions, (2) identify the levels of staff and
resources required at their alternate facilities, and (3) plan,
conduct, and document the necessary tests and exercises at the
appropriate scope and frequency-it will lack assurance that agencies
have taken the steps necessary to ensure that they will be able to
perform essential government operations following a disruption.
After the 2004 version of FPC 65 was issued, which included a
requirement to consider the use of telework, more agencies than in our
previous survey reported plans to use telework to some extent during
COOP events. However, although some of these agencies reported making
related preparations, the general lack of documentation to support
their responses indicates that few are likely to have fully implemented
the telework preparations that we have previously found to be
effective. Although FEMA recently provided additional guidance on the
use of telework, it did not address the steps agencies should take to
prepare to use telework during an emergency event, nor has a time line
been established for when such guidance may be written. Without
guidance on what constitutes adequate preparation for using telework
during an emergency situation, it will be difficult for agencies to
identify and perform the necessary steps to ensure that their
teleworking staff will be able to perform essential functions during a
COOP event.
Recommendations for Executive Action:
To ensure that agencies are adequately prepared to continue performing
essential functions following an emergency, we recommend that the
Secretary of Homeland Security direct the FEMA Director to improve the
oversight of agency COOP planning by taking the following actions:
* Before the upcoming interagency exercise, conduct an assessment of
the COOP plans of the six agencies whose alternate facilities were
included in our review and report any deficiencies found to the head of
the agency for correction.
* Develop a methodology for individual agency COOP assessments that
independently evaluates executive branch agencies' compliance with FPC
65, including the extent to which agencies (1) identify essential
functions; (2) identify the levels of staff and resources required at
their alternate facilities; and (3) plan, conduct, and document the
necessary tests and exercises at the appropriate scope and frequency.
The methodology should include a mechanism for reporting any
deficiencies found to the head of the agency for correction.
* Establish a time line for developing, in consultation with OPM,
guidance on the steps that agencies should take to adequately prepare
for the use of telework during a COOP event.
Agency Comments and Our Evaluation:
In written comments provided on a draft of this briefing, the Director
of the Department of Homeland Security's GAO/OIG Liaison Office stated
that continuity planning is the responsibility of individual
departments and agencies. We agree and we clarified our draft to more
clearly identify the responsibility of agencies for their own
continuity planning. The Director also identified actions that FEMA had
taken to fulfill its responsibilities for coordination, guidance and
advice, support, and periodic assessment of agency continuity planning.
However, the list of responsibilities provided by the Director excludes
the responsibility to oversee and assess the status of COOP capability
across the federal executive branch, which is outlined in FPC 65. We
revised our briefing to emphasize our conclusion that FEMA's ongoing
reliance on self-reported information from the departments and agencies
constitutes a limited level of oversight that contributes to the lack
of full compliance with FEMA's continuity planning guidance.
The Director also identified recently published guidance on telework,
as well as FEMA's guidance to agencies regarding continuity
considerations for pandemic influenza. We updated our briefing to
include these recent developments. However, neither the guidance issued
by FEMA nor the additional telework guidance addresses the preparations
necessary for agencies to ensure that they are prepared to use telework
following a COOP event.
Attachment 1: Agencies Participating in Telework Survey:
Department of Agriculture:
Department of Commerce:
Department of Education:
Department of Energy:
Department of Health and Human Services:
Department of Homeland Security:
Department of Housing and Urban Development:
Department of Justice:
Department of Labor:
Department of State:
Department of the Interior:
Department of the Treasury:
Department of Transportation:
Department of Veterans Affairs:
Agency for International Development:
Environmental Protection Agency:
General Services Administration:
National Aeronautics and Space Administration:
National Science Foundation:
Nuclear Regulatory Commission:
Office of Personnel Management:
Small Business Administration:
Social Security Administration:
Footnotes:
[1] OPM, Washington, DC, Area Dismissal or Closure Procedures
(Washington, D.C.: November 2005).
[2] Because of the method of selection for the six alternate facilities
we reviewed, we cannot conclude that our results represent any larger
group of alternate facilities. However, the six facilities we reviewed
illustrate some of the ways in which agencies comply with FPC 65
guidance related to alternate facility identification and preparation.
[3] GAO, Human Capital: Further Guidance, Assistance, and Coordination
Can Improve Federal Telework Efforts, GAO-03-679 (Washington, D.C.:
July 18, 2003).
[4] The 23 agencies that participated in the survey are listed in
attachment 1.
[5] GAO, Continuity of Operations: Agency Plans Have Improved, but
Better Oversight Could Assist Agencies in Preparing for Emergencies,
GAO-05-577 (Washington, D.C.: Apr. 28, 2005).
[6] GAO, Continuity of Operations: Agency Plans Have Improved, but
Better Oversight Could Assist Agencies in Preparing for Emergencies,
GAO-05- 577 (Washington, D.C.: Apr. 28, 2005) and Continuity of
Operations: Agency Plans Have Improved, but Better Oversight Could
Assist Agencies in Preparing for Emergencies, GAO-05-619T (Washington,
D.C.: Apr. 28, 2005).
[7] OPM, Report to the Congress: The Status of Telework in the Federal
Government (Washington, D.C.: January 2003).
[8] OPM, Report to the Congress: The Status of Telework in the Federal
Government (Washington, D.C.: 2005).
[9] OPM, Washington, DC, Area Dismissal or Closure Procedures
(Washington, D.C.: November 2005).
[10] OPM, Telework: A Management Priority, A Guide for Managers,
Supervisors, and Telework Coordinators (Washington, D.C.: May 2003).
[11] Homeland Security Council, National Strategy for Pandemic
Influenza (Washington, D.C.: Nov. 1, 2005).
[12] GAO, Human Capital: Opportunities to Improve Federal Continuity
Planning Guidance, GAO-04-384 (Washington, D.C.: Apr. 20, 2004).
[13] GAO, Human Capital: Further Guidance, Assistance, and Coordination
Can Improve Federal Telework Efforts, GAO-03-679 (Washington, D.C.:
July 18, 2003).
[14] GAO, Continuity of Operations: Agency Plans Have Improved, but
Better Oversight Could Assist Agencies in Preparing for Emergencies,
GAO-05-577 (Washington, D.C.: Apr. 28, 2005).
[15] One agency documented that it would relocate to its alternate
facility selected for this assessment only if the building is
operational; otherwise it would relocate to one of its other alternate
facilities.
[16] 4 of the 6 agencies did not document specific requirements for
pre- positioned equipment, so we could not assess their compliance for
this question.
[17] 5 of the 6 agencies did not adequately document requirements for
vital records and databases, so we could not assess their compliance
for this question.
[18] 3 of the 6 agencies did not adequately document requirements for
critical information systems and data, so we could not assess their
compliance for this question.
[19] Forward Challenge 06 and its predecessor, Forward Challenge 04,
are examples of exercises that can incorporate the movement of COOP
personnel to agency alternate facilities.
[20] Agencies provided a positive response but did not provide adequate
documentation to support their response.
[21] In 2004, one agency did not respond, resulting in a total of 22
responses for that year versus 23 responses for 2005.
[End of section]
Appendix II: Comments from the Department of Homeland Security:
U.S. Department of Homeland Security:
Washington, D.C. 20472:
May 5, 2006:
Ms. Linda D. Koontz:
Director:
Information Management Issues:
U.S. Government Accountability Office:
441 G Street, NW:
Washington, D.C. 20548:
Dear Ms. Koontz:
Thank you for the opportunity to review and comment on the Government
Accountability Office's (GAO's) draft report GAO-06-713 entitled
Continuity of Operations (COOP): Selected Agencies Could Improve
Planning for Use of Alternate Facilities and Telework During
Disruptions. The Department of Homeland Security (DHS) recommends the
following changes be made to the report's recommendations and findings:
Comments on GAO Recommendations:
GAO Introduction: To ensure that agencies are adequately prepared to
continue performing essential functions following an emergency, we
recommend that the Secretary of Homeland Security direct the Federal
Emergency Management Agency (FEMA) Director to improve the oversight of
agency COOP planning by taking the following actions:
DHS Comment: Presidential Decision Directive 67 (PDD 67) directs that
an Interagency Advisory Group (IAG) shall provide coordination,
oversight, and management for COOP related activities of executive
branch civil departments and agencies. Although FEMA is designated as
chair of this group, principal members' departments and agency
emergency coordinators are designated with the authority to represent
and commit their departments and agencies in matters relating to COOP.
Since departments and agencies have the ultimate authority to commit
their organizations to the coordination, oversight, and management
recommendations of the IAG, recommend the GAO recommendation be changed
to read, ".FEMA Director to improve the readiness of agency COOP
programs by taking the following actions:"
GAO Recommendation One: Before the upcoming interagency exercise,
conduct an assessment of the COOP plans of the six different agencies
whose alternate facilities were included in our review and report any
deficiencies found to the head of the agency for correction.
DHS Comment: We partially concur with this recommendation. FEMA will
conduct the assessment of the six agencies in conjunction with the
upcoming Top Officials/Forward Challenge 06 Exercise.
GAO Recommendation Two: Develop a methodology for individual agency
COOP assessments that independently evaluates executive branch
agencies' compliance with Federal Preparedness Circular 65 (FPC 65),
including the extent to which agencies (1) identify essential
functions; (2) identify the levels of staff and resources required at
their alternate functions; and (3) plan, conduct, and document the
necessary tests and exercises at the appropriate scope and frequency.
The methodology should include a mechanism for reporting any
deficiencies found to the head of the agency for correction.
DHS Comment: We partially concur with this recommendation. FEMA
currently has an assessment program and plans to continually refine its
assessment methodology and expand the program through additional
funding and resources. We believe the recommendation should reflect
this reality by beginning, "Refine the methodology for individual
agency COOP assessments.."
GAO Recommendation Three: Establish a timeline for developing, in
consultation with the Office of Personnel Management (OPM), guidance on
the steps that agencies should take to adequately prepare for the use
of telework during a COOP event.
DHS Comment: We partially concur with this recommendation. FEMA will
continue to work with the government lead agent for telework, OPM, to
provide further guidance on telework, recognizing that this is a
valuable tool for improving continuity preparedness. FEMA will
coordinate with OPM in the development of the timeline for telework
guidance. In FPC 65, FEMA provides guidance to departments and agencies
to consider when identifying and preparing alternate operating
facilities for continuity operations. Options include giving
consideration to telecommuting locations, work at home agreements,
virtual offices, and joint or shared facilities (FPC 65, page E-1).
FEMA and OPM provided further guidance and instruction on the potential
use of telework during a COOP event, along with other personnel
management options, during several Interagency COOP Working Group
meetings during the past two years. These meetings were well attended
by the COOP community and the presentation material received high
praise for its usefulness. Minutes and presentation material from all
meetings were distributed to all Interagency COOP Working Group
members, even if not in attendance at a particular meeting. This
includes guidance and consideration for telework during this and other
continuity events.
Comments on GAO Findings:
In addition to the Department's comments on the recommendations, we
believe that a number of findings should be changed to more accurately
reflect FEMA's actions in support of COOP preparedness, as well as our
assigned responsibilities.
* Where GAO refers to 'FEMA'S limited efforts..." DHS believes this
verbiage should be changed to "FEMA's limited resources..."
FEMA's efforts are constrained by resources. Notwithstanding this
limitation, FEMA has provided extensive guidance and assistance and
conducted numerous training and exercise activities across the country
to assist the Federal executive branch in its COOP preparedness (see
DHS's April 10, 2006 reply to the GAO's draft briefing entitled
Continuity of Operations: Selected Agencies Could Improve Planning for
Use of Alternate Facilities and Telework During Disruption). To improve
the readiness of the Federal government's COOP program, additional FEMA
resources are required to support the large number of Federal offices
and facilities that could benefit from recurring COOP assessments
throughout the nation.
* References to FEMA as "executive agent" should be changed to FEMA as
"lead agent."
Presidential Decision Directive 67 identifies FEMA as the lead agent
for COOP. Although previous indications have been made referencing FEMA
as executive agent, Presidential direction specifies FEMA as lead
coordinating agency for COOP activities.
* References to tests and exercises "required" by FPC 65 should be
reworded to indicate that such efforts are "recommended" by FPC 65.
Federal Preparedness Circulars are guidance and coordination documents
and not directives per guidance in FPC IA, Federal Preparedness
Circular.
* DHS suggests that references to FEMA's assessment methodology utilize
the following language: "If FEMA does not refine its current assessment
methodology...it will diminish the capability to assure agencies have
taken the steps..."
FEMA currently has an assessment methodology, which includes:
FEMA Assessment Methodology:
* FEMA developed a COOP Self-Assessment Tool in 2004 (updated in 2005)
to assist senior leaders and their COOP coordinators in performing
internal reviews/audits of their COOP plans and programs.
* FEMA will continue to use the Forward Challenge series of exercises
as its biennial COOP external assessment for executive branch
departments and agencies. Planning is well along on completing this
during the June 2006 Top Official 4/Forward Challenge 06 (T4/FC06)
exercise. In March 2006, FEMA completed development of its plan for an
expanded comprehensive department and agency COOP assessment program.
FEMA will provide further COOP assessment guidance to departments and
agencies in addition to the requirements associated with the biennial
full-scale COOP exercises. The table below outlines the major
components of this program.
Table:
Compile Department and Agency COOP Plans (Part of T4/FC06 exercise
evaluation methodology); May 1, 2006.
Complete External COOP Plan Evaluation for each Department and Agency
(T4/FC06 Assessments); May 31, 2006.
Schedule published for the expanded Department and Agency External
Assessment Program (New External Assessment Program); June 15, 2006.
Conduct external COOP evaluations for Departments and Agencies during
T4/FC06 Exercise; June 20 - 21, 2006.
Conduct Department and Agency COOP Assessments to include: Plans and
Procedures; Essential Functions; Delegations of Authority; Orders of
Succession; Alternate Operating Facilities; Interoperable
Communications; Vital Records and Databases; Human Capital; Test,
Training, and Exercises; Devolution of Control and Direction;
Reconstitution; and Telework; July 30, 2006. Assess 2 Departments and
Agencies per month.
Provide Assessment Reports; Beginning August 31, 2006.
[End of table]
Through this program, FEMA will continue to refine upon its assessment
program that was initiated during the Forward Challenge 2004 exercise.
Thank you again for the opportunity to comment on this draft report and
we look forward to working with you on future homeland security issues.
Sincerely,
Signed By:
Steven J. Pecinovsky:
Director:
Departmental GAO/OIG Liaison Office:
(310759):
[End of section]
Contacts:
Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 U.S.
Government Accountability Office, 441 G Street NW, Room 7125
Washington, D.C. 20548:
Public Affairs:
Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548:
[End of section]
FOOTNOTES:
[1] Although the 2004 version of FPC 65 refers to FEMA as the "lead
agent" for federal executive branch continuity efforts, the 1999
version used the term "executive agent."
[2] GAO, Human Capital: Opportunities to Improve Federal Continuity
Planning Guidance, GAO-04-384 (Washington, D.C.: Apr. 20, 2004).
[3] GAO, Continuity of Operations: Agency Plans Have Improved, but
Better Oversight Could Assist Agencies in Preparing for Emergencies,
GAO-05-577 (Washington, D.C.: Apr. 28, 2005); and Continuity of
Operations: Agency Plans Have Improved, but Better Oversight Could
Assist Agencies in Preparing for Emergencies, GAO-05-619T (Washington,
D.C.: Apr. 28, 2005).
GAO's Mission:
The Government Accountability Office, the investigative arm of
Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability
of the federal government for the American people. GAO examines the use
of public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's commitment to
good government is reflected in its core values of accountability,
integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains
abstracts and full-text files of current reports and testimony and an
expanding archive of older products. The Web site features a search
engine to help you locate documents using key words and phrases. You
can print these documents in their entirety, including charts and other
graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document
files. To have GAO e-mail this list to you every afternoon, go to
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order
GAO Products" heading.
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office
441 G Street NW, Room LM
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm
E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Public Affairs:
Jeff Nelligan, managing director,
NelliganJ@gao.gov
(202) 512-4800
U.S. Government Accountability Office,
441 G Street NW, Room 7149
Washington, D.C. 20548:
