Year 2000 Computing Challenge

As of August 1999, the FBI had renovated, tested, and certified as Year 2000 compliant all but one of its 43 mission-critical systems. The FBI had developed system-level contingency plans for all but two of them. Also, the FBI had made some progress in its Year 2000 business continuity planning, but this important effort is running late. Moreover, the FBI lacks many of the management controls and processes needed to effectively guide its continuity planning effort in the short time remaining before the Year 2000 deadline. By not using the management rigor and discipline specified in GAO's Year 2000 business continuity planning guide, the FBI will be unable to ensure that it (1) properly focuses its planning effort on the agency's most critical operations; (2) chooses the best strategies to protect these operations; (3) has enough resources and staff to implement continuity plans; and (4) can efficiently and effectively invoke its continuity plans, if necessary. GAO recommends that the Justice Department clarify its expectations for Year 2000 business continuity planning for all of its bureaus and that the FBI establish and implement (1) a plan for developing and testing business continuity plans and (2) effective controls and structure for managing Year 2000 business continuity planning.

GAO noted that: (1) the FBI reported that it has renovated, tested, and certified as year 2000 compliant all but 1 of its 43 mission-critical systems and has developed system-level contingency plans for all but 2 of the 43; (2) the FBI has made some progress in its year 2000 business continuity planning, but this very important effort is running late; (3) to ensure that there will be sufficient time to develop, test, and finalize plans, GAO recommended in earlier testimony that plans be developed by April 30, 1999, and tested, including addressing problems and retesting by September 30, 1999, in order to allow agencies sufficient time to evaluate whether the plans will provide the level of core business capability needed and whether the plans can be implemented within a specified timeframe; (4) however, the FBI had not yet developed division-level business continuity plans or field office plans, and it did not expect to complete the integration of the division plans until September 1999; (5) further, it had not established a target date for completing field office plans or testing both field-level and division-level plans; (6) these delays left the FBI with little time to complete the many planning tasks that remain and ensure that it is ready to minimize the impact of possible year 2000-induced system failures; (7) the FBI also did not have many of the management controls and processes needed to effectively guide its continuity planning effort through the short time remaining before the year 2000 deadline; (8) according to the year 2000 official, the FBI had not implemented these controls and processes because the Department of Justice's guidance focuses on system-level contingency plans and does not require business continuity planning; (9) further, the official stated that the FBI is inherently capable of ensuring continuity of operations because its agents in both headquarters and the field are well trained and prepared for responding to various emergency circumstances, of which potential year 2000 system failure is just one; and (10) by not employing the management rigor and discipline specified in GAO's year 2000 business continuity planning guide, the FBI will not be able to ensure that it: (a) properly focuses its planning effort on the agency's most critical operations; (b) selects the best strategies to protect these operations; (c) has sufficient resources and staff dedicated to implementing continuity plans; and (d) can efficiently and effectively invoke its continuity plans, if necessary.

Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.

Director: Team: Phone: