Continuity of Operations
Selected Agencies Tested Various Capabilities during 2006 Governmentwide Exercise Gao ID: GAO-08-185 November 19, 2007To ensure the availability of essential government services in emergencies, federal agencies are required to develop continuity of operations (COOP) plans. The Federal Emergency Management Agency (FEMA), under the Department of Homeland Security (DHS), is responsible for disseminating guidance to federal agencies on developing plans, as well as conducting government-wide exercises every other year to assess federal continuity readiness. In June 2006, FEMA conducted an exercise called Forward Challenge 06, to allow agencies to activate COOP plans, deploy essential personnel to alternate facilities, and perform essential functions. GAO was asked to describe the extent to which agencies tested continuity plans and procedures, personnel, and resources during the June 2006 exercise. To do this, GAO selected the eight civilian agencies with significant responsibilities during national disasters, analyzed agency exercise documentation, and interviewed officials to determine which test and exercise activities each agency included in its participation.
During Forward Challenge 06, the eight agencies GAO reviewed performed various test and exercise activities related to COOP plans and procedures, personnel, and resources. In many cases, agencies provided documentation to substantiate the specific test and exercise activities performed. However, in other cases, agencies reported conducting such activities but did not provide supporting documentation. Finally, agencies also reported not testing or exercising certain capabilities during the exercise. In these cases, participating agencies may have addressed these capabilities in other tests and exercises conducted during the year, which were outside the scope of GAO's review. Agencies' inability to substantiate many of the test and exercise activities that they reported performing during Forward Challenge 06 was due in part to the absence of specific guidance on what should be documented in such exercises. While FEMA directed participating agencies to document issues and requirements for corrective action, significant findings, and important observations during the Forward Challenge 06 exercise, it did not require participating agencies to document the specific activities from their test and exercise programs that they conducted during the exercise. Without adequate records of what has been tested during a major governmentwide exercise, agencies lack assurance that they have adequately tested their continuity capabilities at the frequency outlined in FEMA guidance, which may limit their ability to fully evaluate their readiness to respond to a disruption. In addition, adequate records can reduce the potential negative impact of turnover in key personnel due to attrition or change in administration, and strengthen agency internal control capabilities.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-08-185, Continuity of Operations: Selected Agencies Tested Various Capabilities during 2006 Governmentwide Exercise
This is the accessible text file for GAO report number GAO-08-185
entitled 'Continuity Of Operations: Selected Agencies Tested Various
Capabilities during 2006 Governmentwide Exercise' which was released on
December 19, 2007.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
Report to the Ranking Member, Committee on Oversight and Government
Reform, House of Representatives:
November 2007:
Continuity Of Operations:
Selected Agencies Tested Various Capabilities during 2006
Governmentwide Exercise:
GAO-08-185:
GAO Highlights:
Highlights of GAO-08-185, a report to the Ranking Member, Committee on
Oversight and Government Reform, House of Representatives.
Why GAO Did This Study:
To ensure the availability of essential government services in
emergencies, federal agencies are required to develop continuity of
operations (COOP) plans. The Federal Emergency Management Agency
(FEMA), under the Department of Homeland Security (DHS), is responsible
for disseminating guidance to federal agencies on developing plans, as
well as conducting government-wide exercises every other year to assess
federal continuity readiness. In June 2006, FEMA conducted an exercise
called Forward Challenge 06, to allow agencies to activate COOP plans,
deploy essential personnel to alternate facilities, and perform
essential functions. GAO was asked to describe the extent to which
agencies tested continuity plans and procedures, personnel, and
resources during the June 2006 exercise. To do this, GAO selected the
eight civilian agencies with significant responsibilities during
national disasters, analyzed agency exercise documentation, and
interviewed officials to determine which test and exercise activities
each agency included in its participation.
What GAO Found:
During Forward Challenge 06, the eight agencies GAO reviewed performed
various test and exercise activities related to COOP plans and
procedures, personnel, and resources. In many cases, agencies provided
documentation to substantiate the specific test and exercise activities
performed. However, in other cases, agencies reported conducting such
activities but did not provide supporting documentation. Finally,
agencies also reported not testing or exercising certain capabilities
during the exercise. In these cases, participating agencies may have
addressed these capabilities in other tests and exercises conducted
during the year, which were outside the scope of GAO‘s review. The
table below presents a summary of the extent to which agencies
conducted various test and exercise activities during the
governmentwide exercise.
Agencies‘ inability to substantiate many of the test and exercise
activities that they reported performing during Forward Challenge 06
was due in part to the absence of specific guidance on what should be
documented in such exercises. While FEMA directed participating
agencies to document issues and requirements for corrective action,
significant findings, and important observations during the Forward
Challenge 06 exercise, it did not require participating agencies to
document the specific activities from their test and exercise programs
that they conducted during the exercise. Without adequate records of
what has been tested during a major governmentwide exercise, agencies
lack assurance that they have adequately tested their continuity
capabilities at the frequency outlined in FEMA guidance, which may
limit their ability to fully evaluate their readiness to respond to a
disruption. In addition, adequate records can reduce the potential
negative impact of turnover in key personnel due to attrition or change
in administration, and strengthen agency internal control capabilities.
What GAO Recommends:
GAO recommends that FEMA require agencies participating in future
governmentwide exercises to document the specific test and exercise
activities conducted. In commenting on a draft of this report, DHS
agreed with GAO‘s recommendation and stated that it intends to refine
its assessment program and improve the level of evaluation
documentation.
To view the full product, including the scope and methodology, click on
[hyperlink, http://GAO-08-185]. For more information, contact Linda
Koontz at (202) 512-6240 or koontzl@gao.gov.
[End of section]
Contents:
Letter:
Recommendation for Executive Action:
Agency Comments and Our Evaluation:
Appendixes:
Appendix I: October 4, 2007, Briefing to Staff of the Ranking Member,
House Committee on Oversight and Government Reform:
Appendix II: Comments from the Department of Homeland Security
Abbreviations:
COOP: continuity of operations:
DHS: Department of Homeland Security:
FEMA: Federal Emergency Management Agency:
[End of section]
United States Government Accountability Office: Washington, D.C. 20548:
November 19, 2007:
The Honorable Tom Davis: Ranking Member:
Committee on Oversight and Government Reform: House of Representatives:
Dear Mr. Davis,
As you know, essential government services can be interrupted by a
range of events, including terrorist attacks, severe weather, or
building-level emergencies. To ensure that these services are available
in emergencies, federal agencies are required to develop continuity of
operations (COOP) plans. The Federal Emergency Management Agency
(FEMA), under the Department of Homeland Security (DHS), is responsible
for disseminating guidance to federal agencies on developing COOP plans
as well as conducting governmentwide exercises every other year as an
assessment of federal continuity readiness. In June 2006, FEMA
conducted an exercise, called Forward Challenge 06, designed to allow
agencies to activate their plans, deploy essential personnel to
alternate facilities, and perform essential functions.
We previously reported on COOP test, training, and exercise
requirements at your request,[Footnote 1] and determined that agency
plans did not generally comply with FEMA's guidance. We reported that
although a governmentwide continuity exercise hosted by FEMA in May
2004 helped agencies comply with test, training, and exercise
requirements, few agencies had documented that they conducted internal
tests, training, and exercises at the recommended frequency.
You requested that we evaluate agency participation in Forward
Challenge 06. Specifically, we agreed to describe the extent to which
selected agencies tested their continuity plans and procedures,
personnel, and resources during the governmentwide exercise. For
purposes of our review, we selected eight civilian agencies because of
their significant responsibilities under the National Response Plan,
which outlines the roles of federal agencies in response to national
disasters. Specifically, these eight agencies were designated as
coordinators of emergency support functions and as such, have
responsibilities for coordinating federal interagency support to states
and other federal agencies during emergencies of national significance.
For example, DHS is responsible for coordinating urban search and
rescue efforts.[Footnote 2]
To address our objective, we obtained and reviewed documentation
regarding test and exercise activities during Forward Challenge 06 from
the selected agencies. We analyzed the documentation and interviewed
agency officials to determine which of the test and exercise activities
each agency included in its participation in Forward Challenge 06.
We conducted our review from May 2006 through September 2007 in
accordance with generally accepted government auditing standards. The
extended period of time for our analysis was due to a delay in
receiving documentation from DHS. First, 2 days before the exercise, we
were informed by DHS that we would not be able to observe agencies'
participation, despite a previous agreement to do so. Subsequently, we
requested documentation on agencies' participation. As we testified in
April 2007, this documentation was not provided until March of this
year.[Footnote 3] Based on our review of the documentation, we were
able to address the objective.
On October 4, 2007, we provided your office with a briefing on the
results of this review. This report provides the briefing slides to you
and officially transmits our recommendation to the Secretary of
Homeland Security. The slides from the briefing are included as
appendix I.
In summary, we determined that during Forward Challenge 06, the eight
agencies performed various test and exercise activities related to COOP
plans and procedures, personnel, and resources. In many cases, agencies
provided documentation to substantiate the specific test and exercise
activities performed. However, in other cases, agencies reported
conducting such activities but did not provide supporting
documentation. Finally, agencies also reported not testing or
exercising certain capabilities during the exercise. In these cases,
participating agencies may have addressed these capabilities in other
tests and exercises conducted during the year, which were outside the
scope of our review.
Agencies' inability to substantiate many of the test and exercise
activities that they reported performing during Forward Challenge 06
was due in part to the absence of specific guidance on what should be
documented in such exercises. While FEMA directed participating
agencies to document issues and requirements for corrective action,
significant findings, and important observations during the Forward
Challenge 06 exercise, it did not require participating agencies to
document the specific activities from their test and exercise programs
that they conducted during the exercise. Without adequate records of
what has been tested during a major governmentwide exercise, agencies
lack assurance that they have adequately tested their continuity
capabilities at the frequency outlined in FEMA guidance, which may
limit their ability to fully evaluate their readiness to respond to a
disruption. In addition, adequate records can reduce the potential
negative impact of turnover in key personnel due to attrition or change
in administration, and strengthen agency internal control capabilities.
Recommendation for Executive Action:
To better assist agencies in assessing their readiness to respond to
disruptions, we recommend that the Secretary of Homeland Security
direct the FEMA Director to require agencies participating in future
governmentwide exercises to document the specific test and exercise
activities conducted.
Agency Comments and Our Evaluation:
We received written comments on a draft of our report from the Director
of the Department of Homeland Security's GAO/OIG Liaison office. (These
comments are reproduced in app. II) In commenting on the report, the
Director stated that the department agreed with our recommendation. In
addition, the Director stated that the department had already complied
with the recommendation during Forward Challenge 06, citing the general
guidance provided in Federal Preparedness Circular 65[Footnote 4] as
well as evaluations compiled by internal and external evaluators during
the exercise. The Director stated further that the level of
documentation was higher than we reported as demonstrated by external
evaluations that he said did not meet GAO audit standards.
We disagree that FEMA provided adequate guidance on documentation and
that the level of documentation was higher than we reported. While the
guidance provided general direction to agencies to document their test,
training, and exercise programs, it did not specify that agencies were
to document the extent to which each essential function and supporting
capability was tested during this exercise. In addition, we considered
the results of the exercise evaluations in our analysis; but in many
cases, these evaluations did not specify which essential functions and
supporting capabilities were tested during the exercise. The value of
such documentation is not to meet GAO audit standards, as the Director
asserts. Instead, as noted in our briefing, agencies need to fully
document their exercise activities to ensure that they are following
FEMA guidance, to mitigate the effects of potential staff turnover, and
to ensure appropriate internal controls. Nevertheless, the Director
stated that FEMA intends to refine its assessment program, giving
specific attention to improving the level of evaluation documentation.
The Director also included technical comments that we have addressed,
as appropriate.
As agreed with your staff, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days
after its date. At that time, we will send copies of this report to the
Secretary of Homeland Security, and other interested parties. This
report will also be available at no charge on the GAO Web site at
[hyperlink, http://www.gao.gov].
If you or your staff have any questions about this report, please
contact me at (202) 512-6240 or koontzl@gao.gov. Contact points for
our Offices of Congressional Relations and Public Affairs may be found
on the last page of this report. Key contributions to this report were
made by James R. Sweetman, Jr., Assistant Director; Lorne Cammack; Alma
Cole; Barbara Collier; Matthew Grote; Sairah Ijaz; Nick Marinos; Morgan
Walts; and Kim Zelonis.
Sincerely yours,
Signed by:
Linda D. Koontz:
Director, Information Management Issues:
[End of section]
Appendix I (Slides): October 4, 2007, Briefing to Staff of the Ranking
Member, House Committee on Oversight and Government Reform:
Continuity of Operations: Selected Agencies Tested Various
Capabilities During 2006 Governmentwide Exercise:
Briefing for the Staff of the Ranking Member:
Committee on Oversight and Government Reform:
House of Representatives:
October 4, 2007:
Outline of Briefing:
Introduction:
Objective, Scope, and Methodology:
Results in Brief:
Background:
Agencies Tested Various Capabilities:
* Plans and Procedures;
* Personnel;
* Resources.
Conclusions:
Recommendation:
Agency Comments and our Evaluation:
Attachment 1: Agencies Reviewed:
Attachments 2 to 9: Individual Agency Results:
[End of outline]
Introduction:
Events in recent years have underscored the need for federal agencies
to be prepared to respond effectively to a variety of emergency
situations. Specifically, federal operations and facilities have
been disrupted by a range of events, including:
* the terrorist attacks on September 11, 2001, and at Oklahoma City on
April 19, 1995;
* severe weather events, such as hurricanes Katrina, Rita, and Wilma in
2005; and;
* building-level events, such as asbestos contamination at the
Department of the Interior‘s headquarters.
Such disruptions, particularly if prolonged, can lead to interruptions
in essential government services. Prudent management, therefore,
requires that federal agencies develop plans for ensuring the
continuity of such services in emergency situations. These are referred
to as continuity of operations (COOP) plans. These plans lay out an
agency‘s approach to maintaining services, ensuring proper authority
for government actions, and protecting vital assets.
Presidential Decision Directive 67 established the Federal Emergency
Management Agency (FEMA) as the lead agency for COOP planning across
the executive branch. FEMA's Federal Preparedness Circular (FPC) 65
provides guidance to federal agencies on developing COOP plans and
carrying out test, training, and exercise programs to ensure their
effectiveness. The guidance states that agencies are to test and
exercise plans and procedures, personnel, and resources at specific
frequencies during each year. These tests and exercises should include
the following capabilities:
Plans and Procedures: Each agency is to exercise the capability to
continue its essential functions”those functions that enable it to
provide vital services, exercise civil authority, maintain safety, and
sustain the economy during an emergency”on an annual basis. In
addition, each agency should test its continuity plan‘s activation and
notification procedures on a quarterly basis, including notifying COOP
personnel (that is, staff needed to perform essential functions, as
designated by the agency), non-COOP agency employees, the alternate
facility, and the FEMA Operations Center.[Footnote 5] For each exercise
performed, a debriefing should be conducted for participants to
identify weaknesses in plans and procedures and recommend plan
revisions.
Personnel: Each agency should conduct an annual exercise that involves
the movement of COOP personnel to the agency alternate facility
[Footnote 6] to ensure the agency‘s ability to perform essential
functions during an emergency.
Resources: Each agency should conduct tests of resources required to
perform essential functions. These tests should include quarterly tests
of its communications capabilities, such as secure and non-secure
voice, video, fax, and data connectivity, Internet access, and email;
as well as annual exercises of its ability to communicate with internal
and external key contacts. Each agency should also test access to vital
records and critical information systems (electronic and hard-copy
records and information systems needed to support essential functions)
semi-annually, and backup power annually.
FPC 65 further requires FEMA to conduct a governmentwide continuity
exercise every other year as a tool to assess and validate federal
continuity readiness. In June 2006, FEMA conducted Forward Challenge
06, a governmentwide continuity exercise designed to allow agencies to
activate their COOP plans, deploy essential personnel to alternate
facilities, and perform essential functions as a means of assessing
their mission readiness. FEMA guidance for this exercise required
agencies to respond appropriately to the exercise scenarios using their
existing plans. Agencies also had the option to test additional
capabilities or address internal scenarios if they did not interfere
with the overall exercise or the activities of other agencies.
Objective, Scope, and Methodology:
As agreed with your office, our objective was to describe the extent to
which selected agencies tested their continuity plans and procedures,
personnel, and resources during the Forward Challenge 06 governmentwide
exercise.
For purposes of our review, we selected eight civilian agencies because
of their significant responsibilities under the National Response Plan,
which outlines the roles of federal agencies in response to national
disasters.[Footnote 7] Specifically, these eight agencies were
designated as coordinators of emergency support functions and as such,
have responsibilities for coordinating federal interagency support to
states and other federal agencies during emergencies of national
significance. For example, DHS is responsible for coordinating urban
search and rescue efforts. The eight selected agencies and their
respective responsibilities for emergency support functions are listed
in attachment 1.
To address our objective, we obtained and reviewed documentation
regarding test and exercise activities during Forward Challenge 06 from
the agencies. Documentation included internal and external agency after
action reports and results of external evaluations conducted during the
exercise. We analyzed the documentation to determine which of the test
and exercise activities each agency included in its participation in
Forward Challenge 06 and interviewed officials about gaps in their
documentation. We then created summary tables outlining activities that
were supported by documentation (identified as ’tested and
documented“), and activities that agencies reported as having conducted
during the exercise but for which they did not provide documentation
(identified as ’tested but not documented“).
We did not identify and assess other tests and exercises that agencies
may have conducted during the year and thus, did not assess their
compliance with the requirements in FPC 65. As a result, we are
providing only a description of the capabilities tested during Forward
Challenge 06.
We conducted our review from May 2006 through September 2007 in
accordance with generally accepted government auditing standards. The
extended period of time for our analysis is due to a delay in receiving
documentation from DHS. First, we were informed by DHS two days before
the exercise that we would not be able to observe agencies‘
participation, despite a previous agreement to do so. Subsequently, we
requested documentation on agencies‘ participation. As we testified in
April 2007, this documentation was not provided until March of this
year.[Footnote 8] Based on our review of the documentation, we were
able to address the objective.
Results in Brief:
During Forward Challenge 06, the eight agencies performed various test
and exercise activities related to COOP plans and procedures,
personnel, and resources. In many cases, agencies provided
documentation to substantiate the specific test and exercise activities
performed. However, in other cases, agencies reported conducting such
activities but did not provide supporting documentation. Finally,
agencies also reported not testing or exercising certain capabilities
during the exercise. In these cases, participating agencies may have
addressed these capabilities in other tests and exercises conducted
during the year, which were outside the scope of our review. The
following table presents a summary of the extent to which agencies
conducted various test and exercise activities during the
governmentwide exercise.
Agency Testing and Exercising of COOP Plans and Procedures, Personnel,
and Resources:
Category: Plans and Procedures;
Test and exercise activities: Essential Functions;
Tested and documented: 4;
Tested but not documented: 4;
Not tested during exercise[Footnote 9]: 0.
Category: Plans and Procedures;
Test and exercise activities: Activation and Notification: Activation;
Tested and documented: 4;
Tested but not documented: 3;
Not tested during exercise[Footnote 9]: 1.
Category: Plans and Procedures;
Test and exercise activities: Activation and Notification:
Notification”COOP Personnel;
Tested and documented: 3;
Tested but not documented: 4;
Not tested during exercise[Footnote 9]: 1.
Category: Plans and Procedures;
Test and exercise activities: Activation and Notification:
Notification”Non-COOP Personnel;
Tested and documented: 1;
Tested but not documented: 5;
Not tested during exercise[Footnote 9]: 2.
Category: Plans and Procedures;
Test and exercise activities: Activation and Notification:
Notification”Alternate Facility;
Tested and documented: 2;
Tested but not documented: 2;
Not tested during exercise[Footnote 9]: 4.
Category: Plans and Procedures;
Test and exercise activities: Activation and Notification:
Notification”FEMA Operations Center;
Tested and documented: 6;
Tested but not documented: 1;
Not tested during exercise[Footnote 9]: 1.
Category: Plans and Procedures;
Test and exercise activities: Debriefing;
Tested and documented: 8;
Tested but not documented: 0;
Not tested during exercise[Footnote 9]: 0.
Category: Personnel;
Test and exercise activities: COOP Personnel Participation;
Tested and documented: 5;
Tested but not documented: 3;
Not tested during exercise[Footnote 9]: 0.
Category: Resources:
Test and exercise activities: Interoperable Communications:
Communications Capabilities;
Tested and documented: 8;
Tested but not documented: 0;
Not tested during exercise[Footnote 9]: 0.
Category: Resources:
Test and exercise activities: Interoperable Communications:
Communication with Internal Contacts;
Tested and documented: 6;
Tested but not documented: 2;
Not tested during exercise[Footnote 9]: 1;
Category: Resources:
Test and exercise activities: Interoperable Communications:
Communication with External Contacts;
Tested and documented: 4;
Tested but not documented: 4;
Not tested during exercise[Footnote 9]: 0.
Category: Resources:
Test and exercise activities: Vital Records;
Tested and documented: 6;
Tested but not documented: 2;
Not tested during exercise[Footnote 9]: 0.
Category: Resources:
Test and exercise activities: Backup Power;
Tested and documented: 1;
Tested but not documented: 1;
Not tested during exercise[Footnote 9]: 6.
Source: GAO.
[End of table]
While FEMA directed participating agencies to document issues and
requirements for corrective action, significant findings, and important
observations during the Forward Challenge 06 exercise, it did not
require participating agencies to document the specific activities from
their test and exercise programs that they conducted during the
exercise. The absence of specific guidance on what agencies should
document contributed to the lack of documentation to support many of
the test and exercise activities agencies described undertaking during
Forward Challenge 06. Without adequate records of what has been tested
during a major governmentwide exercise, agencies lack assurance that
they have adequately tested their continuity capabilities at the
frequency outlined in FEMA guidance, which may limit their ability to
fully evaluate their readiness to respond to a disruption. In addition,
adequate records can reduce the potential negative impact of turnover
in key personnel due to attrition or change in administration, and
strengthen agency internal control capabilities.
Results in Brief: Recommendation and Agency Comments;
We are making a recommendation to the Secretary of Homeland Security
aimed at improving the ability for agencies to fully assess their
readiness to respond to disruptions by documenting the specific test
and exercise activities they conduct during future governmentwide
exercises.
In written comments on a draft of this briefing, the Director of the
Department of Homeland Security‘s GAO/OIG Liaison office stated that
the Department agreed with our recommendation but has already provided
adequate guidance on documentation requirements. Among other things,
the Director also stated that that the level of documentation was
higher than we reported as demonstrated by external evaluations that
the Director said did not meet GAO audit standards. We disagree that
FEMA provided adequate guidance on documentation and that the level of
documentation was higher than we reported. FEMA‘s guidance did not
specify that agencies were to document the extent to which each
essential function and supporting capability was tested. Similarly, the
results of the evaluations did not document the extent to which
agencies tested these functions and capabilities. The value of such
documentation is not to meet GAO audit standards, as the Director
asserts. Instead, as described in our briefing, agencies need to fully
document their exercise activities to ensure that they are following
FEMA guidance, mitigate the effects of potential staff turnover, and
ensure appropriate internal controls. Nevertheless, the Director stated
that FEMA intends to refine its assessment program, giving specific
attention to improving the level of evaluation documentation. In
addition, the Director provided technical comments, which we
incorporated as appropriate.
Background: Guidance;
Testing and exercising continuity capabilities are essential to
demonstrating, assessing, and improving the ability of agencies to
execute their COOP plans. Tests and exercises serve to assess,
validate, or identify for subsequent correction specific aspects of
COOP plans, procedures, and resources. FPC 65 outlines various tests
and exercises of continuity capabilities (including plans and
procedures, personnel, and resources) that agencies are to conduct
throughout the year; they are not required to perform these activities
during a governmentwide exercise. These activities include the
following:
Plans and Procedures:
* Essential functions. On an annual basis, agency personnel must
exercise the agency‘s capability to continue its essential functions.
* Activation and notification. In order to ensure proper activation of
COOP plans, agencies must have a decision-making process for activating
their plans, as well as procedures for notifying personnel designated
as being on the COOP team (COOP personnel), non-COOP agency employees,
the alternate facility, and the FEMA Operations Center. The guidance
calls for each agency to test such procedures on a quarterly basis.
* Debriefing. For each exercise performed by an agency, a comprehensive
debriefing for participants should be conducted to identify systemic
weaknesses in plans and procedures and recommend COOP plan revisions.
Personnel:
* COOP personnel participation. Each agency should conduct an annual
exercise that involves the movement of COOP personnel to the agency
alternate facility to ensure the agency‘s ability to perform essential
functions during an emergency.
Resources:
* Interoperable communications. Each agency should conduct quarterly
tests of its communications capabilities and annually exercise its
ability to communicate with internal and external key contacts.
* Vital records and critical information systems.[Footnote 10] Each
agency should perform semi-annual tests of plans for the recovery of
vital records and critical information systems at alternate facilities.
* Backup power. Each agency should ensure that its alternate facility
has the ability to run emergency power to allow essential functions to
continue in any environment. The guidance states that such
infrastructure systems are to be tested on an annual basis.
Background: Forward Challenge 06;
FPC 65 requires FEMA to conduct a governmentwide exercise every other
year as a tool to assess and validate federal continuity readiness.
From June 19 to 22, 2006, FEMA conducted Forward Challenge 06, a
governmentwide continuity exercise designed to allow agencies to
activate their COOP plans, deploy essential personnel to alternate
facilities, and perform essential functions as a means of assessing
their mission readiness. FEMA guidance for this exercise required
agencies to respond appropriately to the exercise scenarios using their
existing plans. Agencies also had the option to test additional
capabilities or address internal scenarios if they did not interfere
with the overall exercise or the activities of other agencies.
The scenario for the exercise involved the simulation of agency
continuity response to heightened alert conditions involving weapons of
mass destruction within the United States. During the exercise, each
participating agency‘s activities were observed by an official from
another agency. These external evaluators provided the agency they
observed with a checklist indicating which activities it included
during its participation in the exercise. Forward Challenge 06 was
conducted as a component of TOPOFF 4, a national homeland security
preparedness exercise sponsored by DHS designed to, among other things,
exercise the national ability to prevent, respond to, and recover from
a weapon of mass destruction incident.
Background: Previous GAO Reports;
We previously reported on COOP test, training, and exercise
requirements at the request of the Chairman, House Committee on
Government Reform,[Footnote 11] and determined that agency plans did not
generally comply with FEMA‘s guidance regarding tests, training, and
exercises. We reported that although a governmentwide COOP exercise
hosted by FEMA in May 2004 helped agencies comply with test, training,
and exercise requirements, few agencies had documented that they
conducted internal tests, training, and exercises at the recommended
frequency. We recommended that FEMA develop a methodology for
individual COOP assessments that independently evaluates executive
branch agencies‘ compliance with FPC 65, including the extent to which
agencies plan, conduct, and document the necessary tests and exercises
at the appropriate scope and frequency.
In response to this recommendation, before Forward Challenge 06 FEMA
coordinated independent evaluations of participating agency COOP plans
in an effort to review the extent to which elements of a viable COOP
capability were addressed. These assessments included a review of
whether agency plans called for test, training, and exercise activities
at the frequencies outlined in FEMA‘s guidance. FEMA included the
results of these assessments in the individual agency after-action
reports it prepared following the governmentwide exercise.
Background: 2008 Continuity Exercise;
FEMA is currently planning for a governmentwide continuity exercise for
2008. According to FEMA officials, the continuity exercise will take
place over 3 days in late April 2008 and will include objectives
similar to those of Forward Challenge 06.
Agencies Tested Various Capabilities:
During Forward Challenge 06, the eight agencies performed various test
and exercise activities related to COOP plans and procedures,
personnel, and resources. In many cases, agencies provided
documentation to substantiate the specific test and exercise activities
performed. However, in other cases, agencies reported conducting such
activities but did not provide supporting documentation. Finally,
agencies also reported not testing or exercising certain capabilities
during the exercise. In these cases, participating agencies may have
addressed these capabilities in other test and exercises conducted
during the year, which were outside the scope of our review. The
following slides summarize the test and exercise activities agencies
conducted during the governmentwide exercise.
Agencies Tested Various Capabilities: Plans and Procedures;
Essential Functions:
Essential functions are those functions that enable agencies to provide
vital services, exercise civil authority, maintain the safety and well
being of the general populace, and sustain the industrial/economic base
in an emergency.
* Four of the agencies performed at least one essential function during
the exercise. Some of the essential functions performed included
ensuring command and control of the organization and providing
information to the public.
* The remaining four agencies reported exercising their essential
functions but did not provide documentation substantiating which
essential functions were exercised.
Agencies Tested Various Capabilities: Plans and Procedures;
Activation and Notification Procedures:
Each agency develops a decision process for determining when to
activate its COOP plans and procedures and, following activation, must
notify appropriate points of contact: COOP and non-COOP employees, its
alternate facility, and the FEMA Operations Center.
Activation:
* Four agencies exercised activation procedures. For example, three
agencies activated their plans as result of a change in exercise threat
level conditions.
* Of the remaining four agencies, three reported exercising their
activation procedures, but did not provide documentation substantiating
the reported activity.
Notification”COOP Personnel:
* Three agencies exercised notification procedures for COOP personnel.
For example, one agency used an automated notification system to
contact personnel by phone and email upon COOP activation.
* Of the remaining five agencies, four reported exercising the
notification of their COOP personnel, but did not provide documentation
substantiating the reported activity.
Notification”Non-COOP Personnel:
* One agency exercised notification procedures for non-COOP personnel
by sending a mass e-mail notifying nonessential personnel of the
exercise and activation of its COOP plan.
* Of the remaining seven agencies, five reported exercising the
notification of their non-COOP personnel, but did not provide
documentation substantiating the reported activity.
Notification”Alternate Facility:
* Two agencies exercised notification procedures for their alternate
facilities by notifying personnel present at the alternate facility of
COOP activation, triggering preparations.
* Of the remaining six agencies, two reported exercising the
notification of their alternate facility, but did not provide
documentation substantiating the reported activity.
Notification”FEMA Operations Center:
* Six agencies exercised notification procedures for the FEMA
Operations Center. For example, one agency notified FEMA of COOP
activation by e-mail one morning during the exercise.
* Of the remaining two agencies, one reported exercising the
notification of the FEMA Operations Center, but did not provide
documentation substantiating the reported activity.
Comprehensive Debriefing:
A comprehensive debriefing after agency COOP exercises allows
participants to identify systemic weaknesses in plans and procedures
and recommend plan revisions.
* All eight agencies identified strengths in their continuity
capabilities and areas for improvement using questionnaires completed
by participants or meetings with participants following the exercise.
Each of the agencies outlined their results in bullets identifying the
top three strengths and top three areas for improvement. For example,
strengths identified by the agencies included conducting essential
functions and the performance of alternate facility support staff;
areas for improvement included notification procedures and communication
with external contacts.
Agencies Tested Various Capabilities: Personnel;
COOP Personnel Participation:
COOP personnel are agency officials assigned responsibility to report
to an alternate site, as required, to perform agency essential
functions.
* Five agencies moved COOP personnel to alternate facilities to
participate in the exercise. For example, one agency participated with
13 percent of its COOP personnel, while another agency participated
with 89 percent.
* The remaining three agencies reported exercising with their COOP
personnel, but did not provide documentation substantiating the extent
of COOP personnel participating in the exercise.
Agencies Tested Various Capabilities: Resources;
Interoperable Communications:
The success of agency operations at an alternate facility depends on
available and redundant communications with internal organizations,
other agencies, critical customers, and the public.
Communications Capabilities:
* All eight agencies tested communications capabilities during the
exercise. Equipment tested by the agencies included secure video
teleconference, phone, e-mail, and an online emergency collaboration
system.
Communication with Internal Contacts:
* Six agencies exercised communication with internal contacts, such as
field offices, during the exercise.
* The remaining two agencies reported exercising communication with
internal contacts, but did not provide documentation substantiating the
reported contacts.
Communication with External Contacts:
* In addition, four agencies exercised communication with external
contacts, such as the White House.
* The remaining four agencies reported exercising communication with
external contacts, but did not provide documentation substantiating the
reported contacts.
Vital Records and Critical Information Systems:
Vital records are electronic and hardcopy documents, references,
records and information systems needed to support essential functions
during an emergency.
* Six agencies tested access to vital records during the exercise.
* The remaining two agencies reported testing access to vital records
but neither provided documentation substantiating the reported
activities.
Emergency Backup Power:
Emergency backup power ensures that an agency‘s alternate facility can
allow essential functions to continue in any environment.
* One agency‘s primary power source unintentionally went out during the
exercise, triggering the use of backup power for several hours.
* Of the remaining seven agencies, one agency reported testing its
backup power, but did not provide documentation substantiating the
reported test.
Agencies Tested Various Capabilities: FEMA Provided Limited Guidance on
Documentation;
FEMA published and disseminated an exercise plan prior to the start of
Forward Challenge 06, outlining information regarding the scope and
methodology of the exercise as well as the responsibilities of
officials from participating agencies. Within the plan, FEMA stated
that participating agency officials were to document issues and
requirements for corrective action, significant findings and important
observations during the Forward Challenge 06 exercise. In response,
each agency we reviewed documented the main strengths and weaknesses of
its exercise participation.
In contrast, FEMA did not direct participating agencies to document the
specific activities from their test and exercise programs that they
conducted during Forward Challenge 06. The absence of guidance in this
area contributed to the lack of documentation to support many of the
test and exercise activities agencies described undertaking during
Forward Challenge 06. Without adequate records of what has been tested
during a major governmentwide exercise, agencies lack assurance that
they have adequately tested their continuity capabilities at the
frequency outlined in FEMA guidance, which, in turn, can limit the
agencies‘ assurance that the procedures, people, and resources they
need to respond to a disruption will be available when needed.
Developing and maintaining such documentation can also reduce the
potential negative impact of turnover in key personnel”for example,
turnover caused by attrition or a change in administration”by providing
new staff with information regarding the status of their agency‘s test
and exercise program and overall continuity capability. Finally, such
documentation can strengthen an agency‘s internal control capability,
by ensuring that relevant, reliable, and timely information is
available for management decision-making and for external reporting
purposes such as congressional oversight.
Conclusions:
Agencies took advantage of the opportunity to test a number of their
continuity capabilities during FEMA‘s Forward Challenge 06
governmentwide exercise. The strengths and weaknesses each agency
identified as a result of its participation can provide the basis for
improvements in their continuity programs. However, in many cases,
agencies reported conducting test and exercise activities but had not
documented their efforts, due in part to FEMA‘s guidance not requiring
them to do so. Without adequate records of what has been tested during
a major governmentwide exercise, agencies may lack assurance that they
have adequately tested their continuity capabilities at the frequency
outlined in FEMA guidance, which may limit their ability to fully
evaluate their readiness to respond to a disruption.
Recommendation:
To better assist agencies in assessing their readiness to respond to
disruptions, we recommend that the Secretary of Homeland Security
direct the FEMA Director to require agencies participating in future
governmentwide exercises to document the specific test and exercise
activities conducted.
Agency Comments and Our Evaluation:
In written comments on a draft of this briefing, the Director of the
Department of Homeland Security‘s GAO/OIG Liaison office stated that
the Department agreed with our recommendation. In addition, the
Director stated that the Department had already complied with the
recommendation during Forward Challenge 06, citing the general guidance
provided in FPC 65 as well as evaluations compiled by internal and
external evaluators during the exercise. The Director stated further
that the level of documentation was higher than we reported as
demonstrated by external evaluations that he said did not meet GAO
audit standards. Finally, the Director stated, with respect to our
assertion that FEMA did not specify which aspect of an agency‘s test
and exercise program should be included in the exercise, that FEMA
provided guidance to departments and agencies for the overarching
objectives of the exercise.
We disagree that FEMA provided adequate guidance on documentation and
that the level of documentation was higher than we reported. While the
guidance provided general direction to agencies to document their test,
training, and exercise programs, it did not specify that agencies were
to document the extent to which each essential function and supporting
capability was tested. In addition, we considered the results of the
exercise evaluations in our analysis, but in many cases these
evaluations did not specify which essential functions and supporting
capabilities were tested during the exercise. The value of such
documentation is not to meet GAO audit standards, as the Director
asserts. Instead, as noted in our briefing, agencies need to fully
document their exercise activities to ensure that they are following
FEMA guidance, to mitigate the effects of potential staff turnover, and
to ensure appropriate internal controls. Nevertheless, the Director
stated that FEMA intends to refine its assessment program, giving
specific attention to improving the level of evaluation documentation.
Regarding the Director‘s statement that FEMA provided guidance to
departments and agencies through the exercise objectives and FPC 65, we
agree that FEMA provided guidance that required agencies to respond to
exercise scenarios using their continuity plans. As a result, we have
revised the introduction and background sections of the briefing to
clarify the scope of FEMA‘s guidance.
The Director also provided technical comments, which we incorporated as
appropriate. [The Director‘s comments are reproduced as appendix II].
Attachment 1: Agencies Reviewed;
The National Response Plan designates the following eight civilian
agencies as coordinators of emergency support functions identified to
provide support to states and other federal entities during
national disasters.
Agency/Coordinator: Department of Agriculture;
Emergency Support Function Responsibilities: Firefighting; Agriculture
and Natural Resources.
Agency/Coordinator: Department of Energy;
Emergency Support Function Responsibilities: Energy.
Agency/Coordinator: Department of Health and Human Services;
Emergency Support Function Responsibilities: Public Health and Medical
Services.
Agency/Coordinator: Department of Homeland Security;
Emergency Support Function Responsibilities: Communications; Emergency
Management; Mass Care, Housing, and Human Services; Urban Search and
Rescue; Public Safety and Security; Long-Term Community Recovery and
Mitigation; and External Affairs.
Agency/Coordinator: Department of Justice;
Emergency Support Function Responsibilities: Public Safety and
Security.
Agency/Coordinator: Department of Transportation;
Emergency Support Function Responsibilities: Transportation.
Agency/Coordinator: Environmental Protection Agency;
Emergency Support Function Responsibilities: Oil and Hazardous
Materials Response.
Agency/Coordinator: General Services Administration;
Emergency Support Function Responsibilities: Resource Support.
Source: DHS, National Response Plan (Washington, D.C.: December 2004).
[End of table]
[End of attachment]
Attachment 2: U. S. Department of Agriculture;
U.S. Department of Agriculture (USDA): Forward Challenge 06 Test and
Exercise Activities;
Test and Exercise Activity: Plans and Procedures:
1. Essential Functions;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
USDA Action: Exercised all 43 of its essential functions during the
exercise.
Test and Exercise Activity: Plans and Procedures:
2. Activation and Notification Procedures;
a. Activation Procedures;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
USDA Action: Exercised its COOP activation procedures one morning during
the exercise.
Test and Exercise Activity: Plans and Procedures:
2. Activation and Notification Procedures;
b. COOP Personnel Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
USDA Action: Reported exercising the notification of its COOP personnel
but did not provide documentation substantiating this activity.
Test and Exercise Activity: Plans and Procedures:
2. Activation and Notification Procedures;
c. Non-COOP Personnel Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
USDA Action: Reported exercising the notification of its non-COOP
personnel, but did not provide documentation substantiating
this activity.
Test and Exercise Activity: Plans and Procedures:
2. Activation and Notification Procedures;
d. Alternate Facility Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Empty];
Not Tested: [Check];
USDA Action: Did not exercise the notification of its alternate
facility during the exercise. According to USDA officials, personnel
deployed to the alternate facility prior to the exercise.
Test and Exercise Activity: Plans and Procedures:
2. Activation and Notification Procedures;
e. FEMA Operations Center Notification;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
USDA Action: Exercised the notification of the FEMA Operations Center
one morning during the exercise.
Test and Exercise Activity: Plans and Procedures:
3. Debriefing;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
USDA Action: Conducted a debriefing identifying strengths and areas of
improvement from the exercise.
Test and Exercise Activity: Personnel;
4. COOP Personnel Participation;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
USDA Action: Exercised with 67 of its 75 COOP personnel. This is an 89
percent participation rate.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
a. Communications Capabilities;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
USDA Action: Tested multiple forms of communication capabilities,
including telephone, fax, and e-mail.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
b. Communication with Internal Contacts;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
USDA Action: Exercised communication with internal entities, including
the Animal and Plant Health Inspection Service.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
c. Communication with External Contacts;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
USDA Action: Exercised communication with external contacts, including
the White House.
Test and Exercise Activity: Resources;
6. Vital Records;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
USDA Action: Tested access to vital records pre-positioned at the
alternate facility.
Test and Exercise Activity: Resources;
7. Backup Power;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
USDA Action: Reported that the backup power at its alternate facility
was tested during the exercise by the facility‘s host, but did not
provide documentation substantiating this testing.
[End of attachment]
Attachment 3: Department of Energy;
Department of Energy (DOE):
Forward Challenge 06 Test and Exercise Activities:
Test and Exercise Activity: Plans and Procedures;
1. Essential Functions;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOE Action: Reported exercising its essential functions but did not
provide documentation substantiating which essential functions were
performed during the exercise.
Test and Exercise Activity: Plans and Procedures;
2. Activation and Notification Procedures;
a. Activation Procedures;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOE Action: Exercised its COOP activation procedures one morning during
the exercise.
Test and Exercise Activity: Plans and Procedures;
2. Activation and Notification Procedures;
b. COOP Personnel Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOE Action: Reported exercising the notification of its COOP personnel
but did not provide documentation substantiating this activity.
Test and Exercise Activity: Plans and Procedures;
2. Activation and Notification Procedures;
c. Non-COOP Personnel Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOE Action: Reported exercising the notification of its non-COOP
personnel but did not provide documentation substantiating this
activity.
Test and Exercise Activity: Plans and Procedures;
2. Activation and Notification Procedures;
d. Alternate Facility Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Empty];
Not Tested: [Check];
DOE Action: Did not exercise the notification of its alternate
facility.
Test and Exercise Activity: Plans and Procedures;
2. Activation and Notification Procedures;
e. FEMA Operations Center Notification;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOE Action: Exercised notification of the FEMA Operations Center one
morning during the exercise.
Test and Exercise Activity: Plans and Procedures;
3. Debriefing;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOE Action: Used questionnaires completed by exercise participants that
identified main strengths and areas for improvement.
Test and Exercise Activity: Personnel;
4. COOP Personnel Participation;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOE Action: Reported exercising with over 220 personnel during the
course of the exercise, but did not provide documentation
substantiating a level of participation by COOP personnel.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
a. Communications Capabilities;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOE Action: Tested communications capabilities, including satellite
phones and secure video teleconferencing.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
b. Communication with Internal Contacts;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOE Action: Exercised communication with internal contacts, including
agency personnel using a web-based communication tool.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
c. Communication with External Contacts;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOE Action: Exercised communication with external contacts, including
other agencies such as the Nuclear Regulatory Commission.
Test and Exercise Activity: Resources;
6. Vital Records;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOE Action: Tested access to vital records during the exercise.
Test and Exercise Activity: Resources;
7. Backup Power;
Tested and Documented: [Empty];
Tested but Not Documented: [Empty];
Not Tested: [Check];
DOE Action: Did not test backup power during the exercise.
[End of attachment]
Attachment 4: Department of Health and Human Services:
Department of Health and Human Services (HHS):
Forward Challenge 06 Test and Exercise Activities:
Test and Exercise Activity: Plans and Procedures;
1. Essential Functions;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
HHS Action: Exercised one of its essential functions during the
exercise.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
a. Activation Procedures;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
HHS Action: Reported exercising activation procedures but did not
provide documentation substantiating this activity.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
b. COOP Personnel Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
HHS Action: Reported exercising notification procedures for COOP
personnel but did not provide documentation substantiating this
activity.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
c. Non-COOP Personnel Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
HHS Action: Reported exercising non-COOP personnel notification
procedures, but did not provide documentation substantiating
this activity.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
d. Alternate Facility Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
HHS Action: Reported exercising notification procedures for the
alternate facility but did not provide documentation substantiating this
activity.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
e. FEMA Operations Center;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
HHS Action: Exercised the notification of the FEMA Operations Center
during the exercise.
Test and Exercise Activity: Plans and Procedures;
3. Debriefing;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
HHS Action: Conducted a debriefing and provided a summary list of
strengths and areas for improvement.
Test and Exercise Activity: Personnel;
4. COOP Personnel Participation;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
HHS Action: Deployed 105 COOP personnel for the exercise.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
a. Communications Capabilities;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
HHS Action: Tested several communications capabilities, including
telephone and fax.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
b. Communication with Internal Contacts;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
HHS Action: Exercised communication with internal entities, such as the
Centers for Disease Control and Prevention.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
c. Communication with External Contacts;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
HHS Action: Exercised communication with external contacts, such as the
Homeland Security Operations Center.
Test and Exercise Activity: Resources;
6. Vital Records;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
HHS Action: Tested access to vital records during the exercise.
Test and Exercise Activity: Resources;
7. Backup Power;
Tested and Documented: [Empty];
Tested but Not Documented: [Empty];
Not Tested: [Check];
HHS Action: Did not test backup power during the exercise. HHS reported
that backup power is tested on a monthly basis at the alternate
facility.
[End of attachment]
Attachment 5: Department of Homeland Security;
Department of Homeland Security (DHS);
Forward Challenge 06 Test and Exercise Activities;
Test and Exercise Activity: Plans and Procedures;
1. Essential Functions;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DHS Action: Reported exercising its essential functions, but did not
provide documentation substantiating this activity.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
a. Activation Procedures;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DHS Action: Reported exercising its activation procedures, but did not
provide documentation substantiating this activity.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
b. COOP Personnel Notification;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DHS Action: Exercised the notification of its COOP personnel.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
c. Non-COOP Personnel Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DHS Action: Reported that DHS headquarters COOP team personnel
provided notification and individual instructions to non-COOP
personnel within their respective organizations. DHS did not
provide documentation substantiating this activity.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
d. Alternate Facility Notification;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DHS Action: Exercised the notification of its alternate facility.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
e. FEMA Operations Center;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DHS Action: Reported exercising the notification of the FEMA Operations
Center, but did not provide documentation substantiating this
activity.
Test and Exercise Activity: Plans and Procedures;
3. Debriefing;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DHS Action: Conducted a debriefing identifying strengths and areas of
improvement from the exercise.
Test and Exercise Activity: Personnel;
4. COOP Personnel Participation;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DHS Action: Exercised with 24 of its 184 COOP personnel. This is a 13
percent participation rate. DHS officials stated that additional
COOP personnel participated in the exercise, but did not sign in.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
a. Communications Capabilities;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DHS Action: Tested its communications capabilities, including secure
video teleconferencing.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
b. Communication with Internal Contacts;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DHS Action: Reported exercising communication with internal contacts as
it exercised essential functions, but did not provide documentation
substantiating the communication.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
c. Communication with External Contacts;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DHS Action: Reported exercising communication with external contacts as
it exercised essential functions, but did not provide documentation
substantiating the communication.
Test and Exercise Activity: Resources;
6. Vital Records;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DHS Action: Reported testing access to its vital records, but did not
provide documentation substantiating this testing.
Test and Exercise Activity: Resources;
7. Backup Power;
Tested and Documented: [Empty];
Tested but Not Documented: [Empty];
Not Tested: [Check];
DHS Action: Did not test its backup power during the exercise. DHS
reported that the host of the alternate facility conducts regular
tests of the backup power.
[End of attachment]
Attachment 6: Department of Justice;
Department of Justice (DOJ);
Forward Challenge 06 Test and Exercise Activities;
Test and Exercise Activity: Plans and Procedures;
1. Essential Functions;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOJ Action: Reported exercising its essential functions as if
conducting a usual work day but did not provide documentation
substantiating which essential functions were performed.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
a. Activation Procedures;
Tested and Documented: [Empty];
Tested but Not Documented: [Empty];
Not Tested: [Check];
DOJ Action: Reported that exercising activation procedures was not part
of the agency‘s exercise plan.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
b. COOP Personnel Notification;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOJ Action: Reported that exercising activation procedures was not part
of the agency‘s exercise plan.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
c. Non-COOP Personnel Notification;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOJ Action: Reported that exercising activation procedures was not part
of the agency‘s exercise plan.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
d. Alternate Facility Notification;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOJ Action: Reported that exercising activation procedures was not part
of the agency‘s exercise plan.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
e. FEMA Operations Center;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOJ Action: Reported that exercising activation procedures was not part
of the agency‘s exercise plan.
Test and Exercise Activity: Plans and Procedures;
3. Debriefing;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOJ Action: Conducted a debriefing and provided a summary list of
strengths and areas for improvement.
Test and Exercise Activity: Personnel;
4. COOP Personnel Participation;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOJ Action: Reported exercising with COOP personnel but did not provide
documentation substantiating this activity.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
a. Communications Capabilities;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOJ Action: Tested multiple communication capabilities including cell
phones, and a secure radio system.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
b. Communication with Internal Contacts;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOJ Action: Exercised communication with internal entities, including
the U.S. Marshals Service.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
c. Communication with External Contacts;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOJ Action: Reported exercising communication with external contacts as
it exercised essential functions, but did not provide documentation
substantiating the communication.
Test and Exercise Activity: Resources;
6. Vital Records;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOJ Action: Tested access to vital records during the exercise.
Test and Exercise Activity: Resources;
7. Backup Power;
Tested and Documented: [Empty];
Tested but Not Documented: [Empty];
Not Tested: [Check];
DOJ Action: Did not test its backup power capabilities during the
exercise. DOJ stated that the alternate facility‘s backup power is
tested regularly by the site host.
[End of attachment]
Attachment 7: Department of Transportation;
Department of Transportation (DOT);
Forward Challenge 06 Test and Exercise Activities;
Test and Exercise Activity: Plans and Procedures;
1. Essential Functions;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOT Action: Reported exercising its essential functions, but did not
provide documentation substantiating which functions were performed
during the exercise.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
a. Activation Procedures;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOT Action: Reported exercising its activation procedures, but did not
provide documentation substantiating this activity.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
b. COOP Personnel Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOT Action: Reported notifying 90 percent of its COOP personnel through
its alert system, but did not provide documentation substantiating the
notification.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
c. Non-COOP Personnel Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Empty];
Not Tested: [Check];
DOT Action: Did not test the notification of its non-COOP personnel
during the exercise.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
d. Alternate Facility Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Empty];
Not Tested: [Check];
DOT Action: Did not exercise the notification of its alternate
facility. DOT officials reported that the notification of the alternate
facility was not applicable to the exercise because the facility
managers were the leaders of the exercise.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
e. FEMA Operations Center;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOT Action: Exercised the notification of the FEMA Operations Center
during the exercise.
Test and Exercise Activity: Plans and Procedures;
3. Debriefing;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOT Action: Conducted a debriefing identifying strengths and areas of
improvement from the exercise.
Test and Exercise Activity: Personnel;
4. COOP Personnel Participation;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOT Action: Reported that it exercised with 90 percent of its COOP
personnel, but did not provide documentation substantiating this level
of participation.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
a. Communications Capabilities;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
DOT Action: Tested its communications capabilities.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
b. Communication with Internal Contacts;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOT Action: Reported exercising communication with internal contacts but
did not provide documentation substantiating this communication.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
c. Communication with External Contacts;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOT Action: Reported exercising communication with external contacts but
did not provide documentation substantiating this communication.
Test and Exercise Activity: Resources;
6. Vital Records;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
DOT Action: Reported testing access to its vital records, but did not
provide documentation substantiating the testing.
Test and Exercise Activity: Resources;
7. Backup Power;
Tested and Documented: [Empty];
Tested but Not Documented: [Empty];
Not Tested: [Check];
DOT Action: Did not test its backup power during the exercise.
According to DOT officials, testing backup power is the responsibility
of the host of the alternate facility.
[End of attachment]
Attachment 8: Environmental Protection Agency;
Environmental Protection Agency (EPA);
Forward Challenge 06 Test and Exercise Activities;
Test and Exercise Activity: Plans and Procedures;
1. Essential Functions;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
EPA Action: Exercised seven of its eight essential functions during the
exercise.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
a. Activation Procedures;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
EPA Action: Exercised its COOP activation procedures.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
b. COOP Personnel Notification;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
EPA Action: Exercised the notification of its COOP personnel by
telephone and e-mail.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
c. Non-COOP Personnel Notification;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
EPA Action: Exercised notification of its non-COOP personnel by sending
an e-mail out to all EPA employees during the exercise.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
d. Alternate Facility Notification;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
EPA Action: Exercised the notification of its alternate facility by
notifying personnel at the facility prior to COOP personnel deployment.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
e. FEMA Operations Center;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
EPA Action: Exercised the notification of the FEMA Operations Center.
Test and Exercise Activity: Plans and Procedures;
3. Debriefing;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
EPA Action: Used questionnaires completed by exercise participants to
identify main strengths and areas for improvement.
Test and Exercise Activity: Personnel;
4. COOP Personnel Participation;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
EPA Action: Exercised with 77 of its 109 COOP personnel. This is a 71
percent participation rate.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
a. Communications Capabilities;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
EPA Action: Tested its communications capabilities, including secure
fax.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
b. Communication with Internal Contacts;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
EPA Action: Exercised communication with internal contacts, including
agency field offices.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
c. Communication with External Contacts;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
EPA Action: Exercised communication with external contacts, including
the Nuclear Regulatory Commission.
Test and Exercise Activity: Resources;
6. Vital Records;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
EPA Action: Tested access to vital records during the exercise.
Test and Exercise Activity: Resources;
7. Backup Power;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
EPA Action: Tested its backup power capabilities when its primary power
source unintentionally went out, triggering the use of backup
power for several hours.
[End of attachment]
Attachment 9: General Services Administration;
General Services Administration (GSA);
Forward Challenge 06 Test and Exercise Activities;
Test and Exercise Activity: Plans and Procedures;
1. Essential Functions;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
GSA Action: Exercised all six of its essential functions.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
a. Activation Procedures;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
GSA Action: Exercised its activation procedures on one morning of the
exercise.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
b. COOP Personnel Notification;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
GSA Action: Exercised the notification of its COOP personnel through an
email sent on one morning of the exercise.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
c. Non-COOP Personnel Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
GSA Action: Reported exercising the notification of its non-COOP
personnel but did not provide documentation substantiating this
activity.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
d. Alternate Facility Notification;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
GSA Action: Reported exercising the notification of its alternate
facility personnel but did not provide documentation substantiating this
activity.
Test and Exercise Activity: Plans and Procedures;
2. Notification Procedures;
e. FEMA Operations Center;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
GSA Action: Exercised the notification of the FEMA Operations Center on
one morning of the exercise.
Test and Exercise Activity: Plans and Procedures;
3. Debriefing;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
GSA Action: Used questionnaires completed by exercise participants to
identify main strengths and areas for improvement.
Test and Exercise Activity: Personnel;
4. COOP Personnel Participation;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
GSA Action: Exercised with 92 of its 153 COOP personnel. This is a 60
percent participation rate.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
a. Communications Capabilities;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
GSA Action: Tested multiple forms of communication capabilities,
including cell phones and email.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
b. Communication with Internal Contacts;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
GSA Action: Exercised communication with internal contacts, including
non-COOP personnel.
Test and Exercise Activity: Resources;
5. Interoperable Communications;
c. Communication with External Contacts;
Tested and Documented: [Empty];
Tested but Not Documented: [Check];
Not Tested: [Empty];
GSA Action: Reported exercising communication with external contacts,
but did not provide documentation substantiating this communication.
Test and Exercise Activity: Resources;
6. Vital Records;
Tested and Documented: [Check];
Tested but Not Documented: [Empty];
Not Tested: [Empty];
GSA Action: Tested access to vital records during the exercise.
Test and Exercise Activity: Resources;
7. Backup Power;
Tested and Documented: [Empty];
Tested but Not Documented: [Empty];
Not Tested: [Check];
GSA Action: Did not test its backup power during the exercise.
[End of attachment]
[End of Appendix I]
Appendix II: Comments from the Department of Homeland Security:
U.S. Department of Homeland Security:
Washington, DC 20528:
[hyperlink, http://www.dhs.gov]:
November 2, 2007:
Ms. Linda D. Koontz:
Director:
Information Management Issues:
U.S. Government Accountability Office:
441 G Street, NW:
Washington, D.C. 20548:
Dear Ms. Koontz:
Thank you for the opportunity to review and comment on the Government
Accountability Office's (GAO's) draft report GAO 08-185SU entitled
Continuity of Operations: Selected Agencies Tested Various Capabilities
During 2006 Governmentwide Exercise. Technical comments have been
provided under separate cover. We appreciate GAO's review of our
previous comments on GAO's briefing slides and the changes made in this
draft report in response to our comments.
The Department of Homeland Security agrees with GAO's one
recommendation "to require agencies participating in future government
wide exercises to document the specific test and exercise activities
conducted." Further, the Department believes that the Federal Emergency
Management Agency (FEMA) has complied with this recommendation with
respect to Forward Challenge 2006 (FC 06) and will continue to do so in
future exercises.
Federal Preparedness Circular 65 (FPC-65), dated June 15, 2004, is very
specific on Federal Executive Branch Test, Training, and Exercise
(TT&E) requirements. The FC 06 exercise was specifically designed to
allow Departments and Agencies (D/As) to conduct their continuity of
operations tests, training, and exercise activities in this internally
and externally evaluated exercise. FPC 65 states on page 8 that, "All
agencies must plan, conduct, and document periodic tests, training, and
exercises to demonstrate the plan 's viability and identify
deficiencies. Deficiencies and actions taken to correct them must be
documented. " FPC 65 states on page I-1 that, "Agencies must develop
and maintain a COOP test, training and exercise program for conducting
and documenting TT&E." FPC 65 provides an entire annex (Annex I)
directing comprehensive components of an agency Test, Training and
Exercise programs. All agencies were provided FPC 65 prior to the
exercise. The Evaluation Plan (EVALPLAN) provided guidance to
organizations to test and evaluate FC 06 in accordance with the
standardized published Exercise Evaluation Guides (EEG) and the self-
assessment checklist. The Exercise Evaluation Guide/self-assessment
checklist, included specific requirements for a department and agency's
COOP program. This Guide/checklist is very specific and included Green,
Yellow, and Red evaluation ratings for performance of these
requirements. Exercise guidance was very clear that the checklist was
to be used to assist the departments and agencies in their exercise
planning/development to meet the continuity requirements, and that the
assessment would document to the President their ability to conduct
these requirements. FPC 65 further requires all departments and
agencies to document performance of continuity of operations exercise
activities and include corrective actions in their Corrective Action
Program (CAP). The FC 06 exercise was designed with the departments and
agencies to facilitate the performance of their required essential
functions and other supporting continuity of operations requirements.
The eight departments/agencies reviewed by GAO for this exercise are
all Level 1 and 2 organizations and all were required to participate in
the exercise, participate in the required assessments, with reports on
their capabilities to be submitted to the President. Again, FPC 65
requires all organizations that participate in COOP exercises to
document their performance of exercise objectives in a Corrective
Action Plan (CAP) and to develop and document corrective actions.
Each agency evaluation team was made up of external and internal
evaluators. The external evaluators were responsible for providing
feedback to FEMA's National Continuity Programs (NCP) to develop the
external After Action Reports (AARs); and the internal evaluators were
provided the same forms/training to conduct their internal portion of
the evaluation to include self-assessments on Primary Mission Essential
Functions and internally developed Master Scenario Events Lists. They
were also directed to prepare an internal AAR, which was to be provided
to NCP.
GAO indicated that D/As tested, but did not document, many components
of their continuity exercises. GAO however, also acknowledged during
their exit conference that many components were documented by external
evaluators but not to GAO auditing standards. Thus, the level of
documentation for Forward Challenge 06 was higher than reported by GAO,
sufficient to evaluate performance and general lessons learned, but
perhaps not uniformly at the level sufficient to meet GAO standards.
FEMA intends to continue to refine upon its assessment program that was
initiated during the Forward Challenge 2004 exercise, giving specific
attention to improving the level of evaluation documentation.
DHS welcomes the opportunity to provide GAO with appropriate and
meaningful access so that GAO may effectively assess emergency
preparedness and response activities. As an example, GAO observers were
provided access to the recent TOPOFF 4 exercises which were held
October 15-20, 2007.
Thank you again for the opportunity to comment on this draft report and
we look forward to working with you on future homeland security issues.
Sincerely,
Signed by:
Steven J. Pecinovsky:
Director:
Departmental GAO/OIG Liaison Office:
[End of Appendix II]
Footnotes:
[1] GAO, Continuity of Operations: Agency Plans Have Improved, but
Better Oversight Could Assist Agencies in Preparing for Emergencies,
GAO-05-577 (Washington, D.C.: Apr. 28, 2005), and Continuity of
Operations: Selected Agencies Could Improve Planning for Use of
Alternate Facilities and Telework during Disruptions, GAO-06-713
(Washington, D.C.: May 11, 2006).
[2] DHS, National Response Plan (Washington, D.C.: December 2004).
[3] GAO, Department of Homeland Security: Observations on GAO Access to
Information on Programs and Activities, GAO-07-700T (Washington, D.C.:
Apr. 25, 2007).
[4] Federal Preparedness Circular 65 is guidance to the federal
executive branch for use in developing viable and executable
contingency plans that facilitate the performance of essential
functions during any emergency.
[5] The FEMA Operations Center is responsible for, among other things,
facilitating information sharing between FEMA and non-FEMA
entities, and providing a status of on-going incidents, responses or
potential events, during an emergency.
[6] An alternate facility provides a physical location from which to
conduct essential functions if the agency‘s usual facilities are
unavailable.
[7] DHS, National Response Plan (Washington, D.C.: December 2004).
[8] GAO, Department of Homeland Security: Observations on GAO Access to
Information on Programs and Activities, GAO-07-700T (Washington, D.C.:
Apr. 25, 2007).
[9] Participating agencies may have addressed these capabilities in
other tests and exercises conducted during the year, which were outside
the scope of our review.
[10] FPC 65 states that agency personnel must have access to and be
able to use electronic and hard-copy records and information systems
needed to perform their essential functions.
[11] GAO, Continuity of Operations: Agency Plans Have Improved, but
Better Oversight Could Assist Agencies in Preparing for Emergencies,
GAO-05-577 (Washington, D.C.: Apr. 28, 2005), and Continuity of
Operations: Selected Agencies Could Improve Planning for Use of
Alternate Facilities and Telework during Disruptions, GAO-06-713
(Washington, D.C.: May 11, 2006).
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "Subscribe to Updates."
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office:
441 G Street NW, Room LM:
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Gloria Jarmon, Managing Director, JarmonG@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
