GSA's Effort to Develop Year 2000 Business Continuity and Contingency Plans for Telecommunications Systems

GAO provided information on the General Services Administration's (GSA) efforts to ensure that the telecommunications systems it manages for the federal government are year 2000 compliant.

GAO noted that: (1) in addition to managing contracts with service providers for long-distance communications, local communications, wireless communications, and paging services, GSA is responsible for 423 telecommunications systems--156 of these are directly managed by GSA and 267 are vendor-owned and controlled; (2) all of these systems are vulnerable to year 2000 problems that could result in network disruptions or even a complete loss of communications links; (3) GSA reported that year 2000 fixes had been completed on 153 of the 156 systems (98 percent) directly managed by GSA; (4) GSA is in the process of verifying vendor certified systems either by observing vendor tests or by observing independent tests carried out at other government agencies; (5) GSA also included requirements in recently awarded Federal Telecommunications System 2001 contracts that obligate the contractor to provide year 2000 compliant hardware, software, and equipment; (6) according to GSA Year 2000 Program officials, GSA has been following GAO's Business Continuity and Contingency Planning guide, which provides a conceptual framework for managing the risk of potential year 2000-induced disruptions to operations and incorporates best practices in contingency planning and disaster recovery; (7) in developing its business continuity and contingency plan, GSA did not work with its customers to ensure that customers' business continuity and planning tasks and activities are fully coordinated with GSA's plans; (8) GSA should make sure that its customer agencies are fully aware of its strategy and priorities and that they know what their own responsibilities are during network disruptions; (9) while GSA's plan anticipated a total loss of federal telecommunications services, it did not anticipate the possibility of partial losses in service, which is more likely to occur; considering partial losses in service is important because it may require different recovery priorities and timing; (10) GSA did not incorporate the contingency plans of its regional offices; (11) the regional role would be particularly important in the event of geographically confined outages, which were not anticipated in the overall plans; (12) at the time of GAO's review, the regions were still in the process of developing their continuity and contingency plans and were not expected to be done until June 1999; and (13) GSA officials stated that although regional contingency plans were not yet available, regions were provided the opportunity to contribute to the overall plan during the drafting phase.