GovernmentExecutive.com

By Gautham Nagesh

What Is It?

Continuity of operations are guidelines that ensure that the government can carry on all essential functions in case of a natural or manmade disaster. Recent disasters (the Sept. 11, 2001, terrorist attacks and Hurricane Katrina) highlighted the necessity of agencies having a continuity plan. The idea of preserving key government functions during times of crises, however, dates back to the beginning of the Cold War.

A continuity of operations plan, or COOP, outlines steps that an agency will take in the event a disaster interrupts business. Continuity plans require agencies to designate functions as essential or nonessential. Essential functions are those jobs that personnel must perform regardless of circumstances. Examples of essential functions are health care, law enforcement, border patrol, communications and environmental containment. The government also must ensure that resources or personnel associated with a critical function are geographically disbursed and not concentrated in one area, which raises the risk that those employees could not perform their duties if a disaster strikes.

Presidential Decision Directive 67, issued in October 1998, required agencies to develop plans by October 1999 to ensure government services were not interrupted in case of emergencies. The Federal Emergency Management Agency is responsible for issuing guidance for and reviewing agencies' continuity plans. FEMA released Federal Preparedness Circular 65 in July 1999, which provided initial advice for how agencies' should develop their COOP plans.

The circular recommended that agencies identify essential functions that provide vital services, maintain safety and stability, and sustain the economy. Agencies should then document plans and procedures for how to continue those functions during emergencies. They then should delineate the order of succession for the head of the agency and other top management positions to make it clear who would be responsible. In addition, agencies should set up alternate locations where employees can continue work for up to 30 days. Finally, agencies should ensure they could continue communications both internally and with other agencies and the public if necessary.

Safeguarding electronic assets and data is another critical aspect of COOP. Agencies must ensure that electronic records and resources are backed up and mirrored at a second location in case data and systems are damaged at the primary work site. They also must conduct tests and training exercises to ensure that the backup operations can support their workload if networks fail for any reason.

Why Should I Care?

After the Sept. 11 attacks, continuing operations during times of disaster became a top priority for government. But three years later, in March 2004, 23 of the 34 largest civilian agencies still lacked an adequate continuity plan as outlined by FEMA, according to the Government Accountability Office. One of the more serious problems with COOP was agencies failed to properly identify critical functions they performed. Some agencies identified many nonessential functions, including speechwriting, as a critical job. FEMA revised Federal Preparedness Circular in June 2004, which required agencies to put in place continuity of operations plans regardless of circumstances.

Continuity planning returned to prominence following FEMA's failed response to Hurricane Katrina in August 2005, one of the worst natural disasters in U.S. history. The storm killed more than 1,800 people and caused more than $82 billion in damage. Looting and violence were reported and thousands of residents were trapped on top of their homes or within the Superdome waiting for relief. New Orleans and surrounding areas did not have critical services for weeks. Critics claimed the federal government's poor response to help citizens was driven by race and neglect.

What's the Latest Thinking?

President Bush issued Homeland Security Presidential Directive 20 in May 2007, which mandates agencies to develop continuity plans to ensure that mission-critical functions continue during emergencies -- including technological emergencies. HSPD-20 is more explicit than previous directives and the White House issued it in response to the political fallout from its poor management in the aftermath of Hurricane Katrina. The directive called for increased interagency cooperation, with FEMA remaining in charge of coordinating emergency activities under the National Response Framework. The framework tasks agencies with disaster response functions, and they are responsible to FEMA for performing them.

Agencies also are responsible for developing contingency plans that outline how they would continue operating if any kind of emergency occurred, including a loss of electricity to a large-scale disaster. Part of agencies' plans must include having access to alternate facilities and making sure critical personnel are not concentrated in one location. In addition, they must safeguard and duplicate all critical technological resources and databases. FEMA and GAO advocate testing continuity plans.

In August 2007, Bush approved the national Continuity Policy Implementation Plan to help agencies identify those functions that are necessary to continue operating the government. In February 2008, the FEMA issued Federal Continuity Directive 1, which, among other things, sets criteria for what a continuity facility should provide, establishes minimum communications requirements, and emphasizes management of vital records as an essential part of continuity planning.

FEMA also released the same month Federal Continuity Directive 2, which provided agencies guidance on how to identify mission essential functions (those federal jobs that must not stop operating during a disaster) and primary mission essential functions (jobs that must be resumed within 12 hours of a catastrophic event). The directive also required agencies to conduct a risk management process to identify those functions and a method to file those functions to the Homeland Security Department.

Telework, working remotely from home or another location, is another important aspect of COOP. Because a critical element of a continuity of operations plan is providing an alternate location from which to perform critical job tasks, allowing employees to telework often fulfills that requirement.

The General Services Administration and Congress have encouraged agencies to expand telework programs. GSA has set a goal to have 50 percent of eligible employees teleworking by 2010. Currently, about 20 percent telework at least one day a week. That's about twice the rate at large agencies, where less than 10 percent telework at least one day a week.

How Do I Get Started?

Most large agencies have some form of a COOP in place. But it is likely that many of the plans do not yet fulfill all requirements issued by FEMA and HSPD-20. Some of the steps that agencies can take to make sure there continuity plans are complete are:

-- Designate a primary crisis manager who knows the steps that need to be taken when disaster strikes. Assign a backup crisis manager in case the primary manager is unavailable.
-- Find an alternate sight where employees can work during an emergency.
-- Determine what kinds of disasters pose a risk and how they should be managed. Agencies located in flood plains or on the coast have different threats than those in earthquake-prone areas. But electricity, of course, can go out anywhere.

-- Consider the feasibility of dispersing employees to different work sites so they are not concentrated in one geographic area.

-- Make sure all critical databases and computer resources are backed up and duplicated at an alternate location. Run periodic tests on the backup systems to make sure they work properly.

-- Decide how critical staff would coordinate if communications are lost. Establishing redundant communications systems and methods are essential.

-- Make sure you have ways to acquire the products and services necessary to continue operations.

-- Train employees to handle crisis situations.

-- Test plan under simulated emergency conditions.