Critical Continuity

Federal guidelines push government agencies to prepare for the worst

Last month, this column addressed HSPD-20, which mandates government agencies to appoint a senior official at the assistant secretary level as continuity of government coordinator to prepare plans, budgets and exercises to test continuity planning, preparation and capability.

This month’s column highlights key points, requirements and timelines associated with the mandates set for continuity of operations (COOP) and continuity of government (COG) programs. HSPD-20 is designed to ensure that government agencies can initiate plans with little or no notice in order to remain open and ready to deal with terrorist, manmade or natural threats and disasters. This led to the development and release of a new national continuity policy implementation plan (NCPIP) on Sept. 27.

NCPIP builds on guidance provided by HSPD-20 for identifying and executing primary mission-essential functions. It also calls for the integration of COOP and COG programs into routine government operations. These objectives require an active, deliberate response from all departments and agencies.

Federal Preparedness Circular 65 (FPC-65) provides guidance for developing COOP programs within the executive branch, while NCPIP implements the policies in HSPD-20 and transitions the COOP planning concepts of FPC-65 into mandated actions.

NCPIP is designed to initiate a framework of integrated continuity. It seeks to integrate the COOP planning efforts within all departments, branches and levels of government, also encompassing the private sector. NCPIP integrates COOP within organizations, COG within each branch and enduring constitutional government among all branches. It asserts that continuity planning must be part of, and be developed concurrently with, all existing and future programs.

The capability to provide continuity of operations is built upon a foundation of ongoing continuity planning or program management. Once established, that foundation will support the leadership, staff, facilities and communications needed to perform essential functions.

NEAR-TERM REQUIREMENTS FOR NCPIP COMPLIANCE

A revised federal continuity directive lists requirements for determining MEFs and PMEFs. Feb. 29, 2008, submit MEFs and potential PMEFs to the interagency board for validation. June 30, 2008, expect a listing of approved PMEFs from the national continuity coordinator. July 31, 2008, orient and train all key COOP personnel. Jan. 30, 2009, coordinate PMEFs and MEFs internally and externally and with key partners within the private sector.

Under NCPIP, the president designates a national continuity coordinator. An NCC is a federal official reporting directly to the president who establishes a continuity policy coordination committee to develop policies, a continuity advisory group to implement programs and an interagency board to validate primary mission-essential functions. In addition, the NCPIP requires the establishment of new leadership roles. A continuity coordinator, a senior accountable official at a level equivalent to an assistant secretary, must report to the NCC on all continuity matters. A continuity manager is a lead official who must provide daily management of the COOP programs and represent the department on the NCC’s continuity advisory group as appropriate.

Another requirement of the plan calls for federal departments to identify mission- essential functions. To qualify as a MEF, a function must be required by law or executive order, and a business process analysis must determine that the function must be performed uninterrupted, with minimal interruption or requiring immediate execution during an emergency. In addition to MEFs, departments must identify primary mission-essential functions.

To qualify as a PMEF, a function must directly support national essential functions and continue uninterrupted or within 12 hours in all circumstances. There are eight national essential functions that must be sustained under all circumstances:

• Ensure the continued function of government under the constitution and include the function of the three separate branches of government.

• Provide leadership visible to the nation and the world, and maintain the trust and confidence of the American people.

• Defend the constitution against all foreign and domestic enemies, and prevent or interdict attacks against the United States or its people, property or interests.

• Maintain and foster effective relationships with foreign nations.

• Protect against threats to the homeland, and bring to justice perpetrators of crimes or attacks against the United States or its people, property or interests.

• Provide rapid and effective response to and recovery from the domestic consequences of an attack or other incident.

• Protect and stabilize the nation’s economy, and ensure public confidence in its financial systems.

• Provide for critical federal government services that address the health, safety and welfare needs of the United States. In the long run, there are several ongoing requirements for NCPIP compliance. First, each government branch must incorporate continuity requirements into daily operations and planning. This includes focusing all planning efforts on the continuance of PMEFs under all circumstances.

FPC-65
NCPIP
Reflects a model that regards COOP, COG and ECG as independent entities
Mandates integration of COOP, COG and ECG planning efforts across all levels of government and encompasses the private sector
Defines COOP planning as efforts dedicated towards the continued performance of essential functions
Requires integral and concurrent COOP development with all existing and future projects
Provides guidance for developing plans and procedures within a COOP program
Provides official definitions and criteria for required components and mandates immediate initiation of COOP planning
Outlines essential elements of an effective COOP program
Establishes deadlines for completing essential COOP program activities

Also, lawful orders of succession must be pre-planned and documented to grant a successor the authority, autonomy and responsibility to replace delayed or unavailable COOP personnel. Records, equipment, systems, storage, buildings, supplies and data must be safeguarded. Pre-arranged access to these must be granted to continuity staff, and procedures must exist to acquire expended or missing supplies during COOP procedures.

To prepare for emergencies, departments and agencies must have internal and external communications capabilities that are redundant at primary sites, duplicated at alternate sites and immediately available during emergencies. They also must provide resources that enable recovery from a catastrophic event to normal operating status within a primary or alternate site. And personnel must be designated, trained, prepared and capable of relocating to an alternate facility in support of continuing PMEF performance.

Next, each branch must develop and maintain a corrective action program, a listing of procedures to address deficiencies, funding and personnel requirements, and resource acquisition tasks within the COOP program. They’re required to participate in national exercises sponsored by DHS and include COOP program development within all budgetary requests.

Today’s changing threat environment and recent natural and manmade emergencies demonstrate the need for COOP/COG capabilities and plans at the local, state and federal levels.

Featured

  • New Report Reveals Top Trends Transforming Access Controller Technology

    Mercury Security, a provider in access control hardware and open platform solutions, has published its Trends in Access Controllers Report, based on a survey of over 450 security professionals across North America and Europe. The findings highlight the controller’s vital role in a physical access control system (PACS), where the device not only enforces access policies but also connects with readers to verify user credentials—ranging from ID badges to biometrics and mobile identities. With 72% of respondents identifying the controller as a critical or important factor in PACS design, the report underscores how the choice of controller platform has become a strategic decision for today’s security leaders. Read Now

  • Overwhelming Majority of CISOs Anticipate Surge in Cyber Attacks Over the Next Three Years

    An overwhelming 98% of chief information security officers (CISOs) expect a surge in cyber attacks over the next three years as organizations face an increasingly complex and artificial intelligence (AI)-driven digital threat landscape. This is according to new research conducted among 300 CISOs, chief information officers (CIOs), and senior IT professionals by CSC1, the leading provider of enterprise-class domain and domain name system (DNS) security. Read Now

  • ASIS International Introduces New ANSI-Approved Investigations Standard

    • Guard Services
  • Cloud Security Alliance Brings AI-Assisted Auditing to Cloud Computing

    The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today introduced an innovative addition to its suite of Security, Trust, Assurance and Risk (STAR) Registry assessments with the launch of Valid-AI-ted, an AI-powered, automated validation system. The new tool provides an automated quality check of assurance information of STAR Level 1 self-assessments using state-of-the-art LLM technology. Read Now

  • Report: Nearly 1 in 5 Healthcare Leaders Say Cyberattacks Have Impacted Patient Care

    Omega Systems, a provider of managed IT and security services, today released new research that reveals the growing impact of cybersecurity challenges on leading healthcare organizations and patient safety. According to the 2025 Healthcare IT Landscape Report, 19% of healthcare leaders say a cyberattack has already disrupted patient care, and more than half (52%) believe a fatal cyber-related incident is inevitable within the next five years. Read Now

New Products

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.