Critical Continuity

Federal guidelines push government agencies to prepare for the worst

Last month, this column addressed HSPD-20, which mandates government agencies to appoint a senior official at the assistant secretary level as continuity of government coordinator to prepare plans, budgets and exercises to test continuity planning, preparation and capability.

This month’s column highlights key points, requirements and timelines associated with the mandates set for continuity of operations (COOP) and continuity of government (COG) programs. HSPD-20 is designed to ensure that government agencies can initiate plans with little or no notice in order to remain open and ready to deal with terrorist, manmade or natural threats and disasters. This led to the development and release of a new national continuity policy implementation plan (NCPIP) on Sept. 27.

NCPIP builds on guidance provided by HSPD-20 for identifying and executing primary mission-essential functions. It also calls for the integration of COOP and COG programs into routine government operations. These objectives require an active, deliberate response from all departments and agencies.

Federal Preparedness Circular 65 (FPC-65) provides guidance for developing COOP programs within the executive branch, while NCPIP implements the policies in HSPD-20 and transitions the COOP planning concepts of FPC-65 into mandated actions.

NCPIP is designed to initiate a framework of integrated continuity. It seeks to integrate the COOP planning efforts within all departments, branches and levels of government, also encompassing the private sector. NCPIP integrates COOP within organizations, COG within each branch and enduring constitutional government among all branches. It asserts that continuity planning must be part of, and be developed concurrently with, all existing and future programs.

The capability to provide continuity of operations is built upon a foundation of ongoing continuity planning or program management. Once established, that foundation will support the leadership, staff, facilities and communications needed to perform essential functions.

NEAR-TERM REQUIREMENTS FOR NCPIP COMPLIANCE

A revised federal continuity directive lists requirements for determining MEFs and PMEFs. Feb. 29, 2008, submit MEFs and potential PMEFs to the interagency board for validation. June 30, 2008, expect a listing of approved PMEFs from the national continuity coordinator. July 31, 2008, orient and train all key COOP personnel. Jan. 30, 2009, coordinate PMEFs and MEFs internally and externally and with key partners within the private sector.

Under NCPIP, the president designates a national continuity coordinator. An NCC is a federal official reporting directly to the president who establishes a continuity policy coordination committee to develop policies, a continuity advisory group to implement programs and an interagency board to validate primary mission-essential functions. In addition, the NCPIP requires the establishment of new leadership roles. A continuity coordinator, a senior accountable official at a level equivalent to an assistant secretary, must report to the NCC on all continuity matters. A continuity manager is a lead official who must provide daily management of the COOP programs and represent the department on the NCC’s continuity advisory group as appropriate.

Another requirement of the plan calls for federal departments to identify mission- essential functions. To qualify as a MEF, a function must be required by law or executive order, and a business process analysis must determine that the function must be performed uninterrupted, with minimal interruption or requiring immediate execution during an emergency. In addition to MEFs, departments must identify primary mission-essential functions.

To qualify as a PMEF, a function must directly support national essential functions and continue uninterrupted or within 12 hours in all circumstances. There are eight national essential functions that must be sustained under all circumstances:

• Ensure the continued function of government under the constitution and include the function of the three separate branches of government.

• Provide leadership visible to the nation and the world, and maintain the trust and confidence of the American people.

• Defend the constitution against all foreign and domestic enemies, and prevent or interdict attacks against the United States or its people, property or interests.

• Maintain and foster effective relationships with foreign nations.

• Protect against threats to the homeland, and bring to justice perpetrators of crimes or attacks against the United States or its people, property or interests.

• Provide rapid and effective response to and recovery from the domestic consequences of an attack or other incident.

• Protect and stabilize the nation’s economy, and ensure public confidence in its financial systems.

• Provide for critical federal government services that address the health, safety and welfare needs of the United States. In the long run, there are several ongoing requirements for NCPIP compliance. First, each government branch must incorporate continuity requirements into daily operations and planning. This includes focusing all planning efforts on the continuance of PMEFs under all circumstances.

FPC-65
NCPIP
Reflects a model that regards COOP, COG and ECG as independent entities
Mandates integration of COOP, COG and ECG planning efforts across all levels of government and encompasses the private sector
Defines COOP planning as efforts dedicated towards the continued performance of essential functions
Requires integral and concurrent COOP development with all existing and future projects
Provides guidance for developing plans and procedures within a COOP program
Provides official definitions and criteria for required components and mandates immediate initiation of COOP planning
Outlines essential elements of an effective COOP program
Establishes deadlines for completing essential COOP program activities

Also, lawful orders of succession must be pre-planned and documented to grant a successor the authority, autonomy and responsibility to replace delayed or unavailable COOP personnel. Records, equipment, systems, storage, buildings, supplies and data must be safeguarded. Pre-arranged access to these must be granted to continuity staff, and procedures must exist to acquire expended or missing supplies during COOP procedures.

To prepare for emergencies, departments and agencies must have internal and external communications capabilities that are redundant at primary sites, duplicated at alternate sites and immediately available during emergencies. They also must provide resources that enable recovery from a catastrophic event to normal operating status within a primary or alternate site. And personnel must be designated, trained, prepared and capable of relocating to an alternate facility in support of continuing PMEF performance.

Next, each branch must develop and maintain a corrective action program, a listing of procedures to address deficiencies, funding and personnel requirements, and resource acquisition tasks within the COOP program. They’re required to participate in national exercises sponsored by DHS and include COOP program development within all budgetary requests.

Today’s changing threat environment and recent natural and manmade emergencies demonstrate the need for COOP/COG capabilities and plans at the local, state and federal levels.

Featured

  • Gaining a Competitive Edge

    Ask most companies about their future technology plans and the answers will most likely include AI. Then ask how they plan to deploy it, and that is where the responses may start to vary. Every company has unique surveillance requirements that are based on market focus, scale, scope, risk tolerance, geographic area and, of course, budget. Those factors all play a role in deciding how to configure a surveillance system, and how to effectively implement technologies like AI. Read Now

  • 6 Ways Security Awareness Training Empowers Human Risk Management

    Organizations are realizing that their greatest vulnerability often comes from within – their own people. Human error remains a significant factor in cybersecurity breaches, making it imperative for organizations to address human risk effectively. As a result, security awareness training (SAT) has emerged as a cornerstone in this endeavor because it offers a multifaceted approach to managing human risk. Read Now

  • The Stage is Set

    The security industry spans the entire globe, with manufacturers, developers and suppliers on every continent (well, almost—sorry, Antarctica). That means when regulations pop up in one area, they often have a ripple effect that impacts the entire supply chain. Recent data privacy regulations like GDPR in Europe and CPRA in California made waves when they first went into effect, forcing businesses to change the way they approach data collection and storage to continue operating in those markets. Even highly specific regulations like the U.S.’s National Defense Authorization Act (NDAA) can have international reverberations – and this growing volume of legislation has continued to affect global supply chains in a variety of different ways. Read Now

  • Access Control Technology

    As we move swiftly toward the end of 2024, the security industry is looking at the trends in play, what might be on the horizon, and how they will impact business opportunities and projections. Read Now

Featured Cybersecurity

Webinars

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3