Office of Inspector General 

DEPARTMENT OF HOMELAND SECURITY 

Transportation Security Administration 

Continuity of Operations Program 

Redacted

 OIG-06-60 August 2006 

Office of Audits 
Office of Inspector General 

U.S. Department of Homeland Security 

Washington, DC 20528

August 28, 2006 

Preface 

The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 

the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General 

Act of 1978. This is one of a series of audit, inspection, and special reports prepared as part of our 

DHS oversight responsibilities to promote economy, efficiency, and effectiveness within the 

department. 

This report assesses the strengths and weaknesses of the Transportation Security Administration 

(TSA) Continuity of Operations (COOP) Program and its ability to continue mission-essential 

functions during emergency situations. It is based on interviews with employees and officials of 

relevant agencies and institutions, direct observations, and a review of applicable documents. 

The recommendations herein have been developed to the best knowledge available to our office, and 

have been discussed in draft with those responsible for implementation. It is our hope that this 

report will result in more effective, efficient, and economical operations. We express our 

appreciation to all of those who contributed to the preparation of this report. 

 

Richard L. Skinner 

Inspector General 

Audit of TSA Continuity of Operations Program 
Table of Contents/Abbreviations

Audit of TSA Continuity of Operations Program 

 Executive Summary......................................................................................................................... 1 

 Background...................................................................................................................................... 2 

 Results of Audit ............................................................................................................................... 5 

 TSA COOP Plan and Program Elements................................................................................... 7 

 

 TSA COOP Priority and Oversight.......................................................................................... 18 

 Recommendations.............................................................................................................. 20 

 Management Comments and OIG Analysis ......................................................................21 

 

 DHS COOP Oversight ............................................................................................................. 22 

 Recommendations.............................................................................................................. 24 

 Management Comments and OIG Analysis ......................................................................24 

 

 Appendices 

 Appendix A: Purpose, Scope, and Methodology................................................................. 26 

 Appendix B: Management Comments ................................................................................ 27 

 Appendix C: Key Sources of Guidance for Federal COOP Planning.................................35 

 Appendix D: Major Contributors to this Report.................................................................. 36 

 Appendix E: Report Distribution ........................................................................................ 37 
Table of Contents/Abbreviations

Audit of TSA Continuity of Operations Program 

Abbreviations 

AOF Alternate Operating Facility 

COOP Continuity of Operations 

DHS Department of Homeland Security 

FEMA Federal Emergency Management Agency 

FPC Federal Preparedness Circular 

GAO Government Accountability Office 

HQ Headquarters 

IT Information Technology 

OCIO Office of Chief Information Officer 

OIG Office of Inspector General 

OLE Office of Law Enforcement 

ONSC Office of National Security Coordination 

PDD Presidential Decision Directive 

TSA Transportation Security Administration 

TSOC Transportation Security Operations Center 

TT&E Test, Training, and Exercise 
OIG 

Audit of TSA Continuity of Operations Program 

Page 1 

Department of Homeland Security 

Office of Inspector General 

Executive Summary 

The Transportation Security Administration’s (TSA’s) ability to continue its 

mission-essential functions during a variety of emergencies is at risk due to the 

lack of a comprehensive and effective Continuity of Operations (COOP) plan 

and program. The TSA Headquarters (HQ) COOP Plan and Program only 

partially address the 11 required elements that define a viable COOP. 

The TSA COOP plan provides only a minimal COOP capability because TSA 

management has not adequately analyzed or approved the plan to ensure that 

only essential functions and associated emergency staff are included; established 

a viable alternate work site; adequately -------- -- - -------------------------

planning; and taken steps to ensure that staff would have uninterrupted access to 

------------------------------------------------------------------------------- Without a 

complete and viable COOP plan, TSA’s ability to support, coordinate, and direct 

intermodal transportation security during an emergency could be impaired or 

fail. In addition, DHS, through its lead component on COOP matters -- the 

Federal Emergency Management Agency (FEMA) -- has provided only limited 

oversight of TSA COOP activities and has not assessed the extent to which 

TSA, as well as other DHS components, are maintaining a COOP plan and 

program that is current and contains all required information. 

Accordingly, we are making recommendations to TSA and FEMA to take 

appropriate steps to ensure that TSA implements a comprehensive and effective 

COOP plan and program. TSA and FEMA concurred with our 

recommendations. TSA noted progress made in the COOP program since the 

end of our fieldwork. FEMA stated that the agency does not currently have the 

authority to serve as a regulatory agent responsible for ensuring that agencies 

have a viable COOP program in full compliance with Federal Preparedness 

Circular FPC 65. 
Audit of TSA Continuity of Operations Program 

Page 2 

Background

Continuity of Operations (COOP)1 planning is the means by which federal 

departments, agencies, and their subcomponents ensure that their missionessential functions continue under all circumstances. As a baseline of 

preparedness for the full range of potential emergencies, all federal agencies are 

required to establish a viable COOP capability, which ensures the performance 

of their mission-essential functions during any emergency situation that may 

disrupt normal operations. 

While concerns about potential catastrophic attacks and other serious 

emergencies is the catalyst for much of COOP planning, COOP activation can 

also occur in response to routine building renovation or maintenance, 

mechanical failure of building systems, fire, inclement weather, or other acts of 

nature.2

 Federal COOP guidance considers the possibility that threats or attacks 

could render federal government operations unavailable for even the slightest 

period to be unacceptable, as essential functions must continue. 

COOP planning was initially developed during the Cold War to preserve the 

United States government in the event of a nuclear attack. The changing threat 

environment and potential for emergencies with minimal or no warning, such as 

acts of terror, accidents, technological emergency situations, and natural 

disasters, have increased the need for COOP capabilities and plans to enable 

agencies to continue their mission-essential functions across a broad range of 

potential emergencies. COOP planning is a good business practice and part of 

the fundamental mission of agencies as responsible and reliable public 

institutions. 

Federal Guidance on COOP

According to FPC 65,3 an agency’s COOP capability must: 

• Be capable of implementation both with and without warning; 

• Be operational no later than 12 hours after activation; 

• Be capable of maintaining sustained operations for up to 30 days; 

 

1

 Federal Preparedness Circular (FPC) 65, Federal Executive Branch Continuity of Operations, defines the required 

elements for viable federal COOP plans. 

2

 “Continuity of Operations in the Executive Branch: Background and Issues for Congress,” RL31857, Congressional 

Research Service, November 8, 2004. 3

 Originally issued on July 26, 1999, FPC 65 was revised and reissued on June 15, 2004 
Audit of TSA Continuity of Operations Program 

Page 3 

• Include tests, training, and exercises for personnel, equipment, systems, 

processes, and procedures used to support the agency during a COOP 

event;

• Take maximum advantage of existing agency field infrastructures; and

• Include the development, maintenance, and annual review of agency 

COOP capabilities using a multi-year strategy and program management 

plan.

As shown in Table 2, FPC 65 provides definitions and guidance for 11 

elements that agency COOP plans and programs must contain to maintain a 

viable COOP capability. 

TABLE 2: COOP Elements As Defined By FPC 65 

COOP Element Description 

Functions that enable the federal government to provide vital services, exercise 

civil authority, maintain the safety and well being of the general populace, and 

sustain the industrial and economic base in an emergency situation. 

Mission-Essential Functions 

Facilities used to carry out mission-essential functions in a COOP situation if the 

agency’s primary facility is unavailable. Alternate Operating Facilities (AOF) 

Provisions for the assumption of senior agency offices during an emergency in 

the event that any of those officials are unavailable to execute their legal duties. Orders of Succession 

Predetermined statements that specify who is authorized to act on behalf of 

agency leadership for specific purposes. Delegations of Authority 

Capability to transfer statutory authority and responsibility for mission-essential 

functions from an agency's primary operating staff and facilities to other 

employees and facilities, and to sustain operational capability for an extended 

period. 

Devolution 

Electronic and hardcopy records needed to support mission-essential functions 

during a COOP situation. Vital Records 

Alternate communications that provide the capability to perform essential 

functions until normal operations can be resumed. Interoperable Communications 

Measures to ensure that an agency's COOP program can implement the COOP 

plan and support mission-essential functions during an emergency situation. Tests, Training, and Exercises 

Process by which an agency transitions from COOP implementation to 

resumption of normal operations. Reconstitution 

Plans and actions to respond to threats that employees are most likely to face 

during COOP activation, such as dismissal procedures, agency guidelines for 

communicating to employees, and staffing flexibilities, such as telework. 

Human Capital 

Plans and Procedures 

Plans and procedures to be developed and documented so that agency personnel 

will know what to do in an emergency situation. Plans and procedures are 

required for the three phases of COOP implementation: activation and relocation; 

AOF operations; and reconstitution. 
Audit of TSA Continuity of Operations Program 

Page 4 

According to Executive Order 12656 (EO 12656),4 FEMA shall coordinate and 

support the initiation, development, and implementation of national security 

emergency preparedness programs and plans among Federal departments and 

agencies; and provide the President a periodic assessment of Federal, State, and 

local capabilities to respond to national security emergencies. EO 13286 

transferred these responsibilities to the Secretary of Homeland Security.5 In 

March 2004, DHS Delegation Number 9001 assigned the authorities to the 

Under Secretary for Emergency Preparedness and Response. Presidential 

Decision Directive (PDD) 67 establishes FEMA as the lead agency for federal 

Executive Branch COOP. The June 2004 revision of FPC 65 requires FEMA to 

“oversee and assess the status of COOP capabilities” government-wide. A 

detailed discussion of the authorities and guidance for federal COOP planning 

can be found in Appendix C. 

Transportation Security Administration

TSA was created in response to the terrorist attacks of September 11, 2001, as 

part of the Aviation and Transportation Security Act signed into law by 

President George W. Bush on November 19, 2001. TSA was established to 

protect the nation’s transportation system – encompassing aircraft, ships, rail 

and motor vehicles, airports, seaports, trans-shipment facilities, roads, railways, 

bridges, and pipelines – from terrorist attacks and criminal activity. TSA, 

originally a part of the Department of Transportation, became part of DHS in 

March 2003. 

Within TSA, the Office of Emergency Preparedness, and, specifically, the 

Director of Emergency Preparedness and Continuity of Operations,6 is 

responsible for the development and maintenance of the TSA COOP Plan and 

Program. The TSA COOP Program Manager and his staff are primarily 

responsible for the daily operation and execution of the TSA COOP program, 

with the assistance of a network of Office Emergency Coordinators located in 

TSA program offices. According to the TSA HQ COOP Plan, these 

coordinators are responsible for identifying office-level mission-essential 

functions that support the agency’s overall essential functions and developing 

individual office COOP plans. Without a complete and viable COOP plan, 

TSA’s ability to support, coordinate and direct intermodal transportation 

security during an emergency could be impaired or fail. TSA functions that are 

at risk include: ------------------------------------------------ ----------------

-------- --------------------------- -------------- ------------ ---------------------- ---------

 

4

 Executive Order 12656, “Assignment of Emergency Preparedness Responsibilities,” November 11, 1988, Section 1701, as 

amended. 

5

 Executive Order 13286, “Amendment of Executive Orders, and Other Actions, in Connection With the Transfer of 

Certain Functions to the Secretary of Homeland Security,” February 28, 2003, Section 42. 

6

 Referred to as the TSA COOP Program Manager. 
Audit of TSA Continuity of Operations Program 

Page 5 

------- ----------------------------------- -------------------------------------------

------------------------------------------------------------------ ---------------

Prior Audits on Government COOP Programs

Previous government-wide audits have noted substantial weaknesses in 

department and agency COOP plans, programs, and capabilities. In particular, 

the Government Accountability Office (GAO) released two reports that detailed 

weaknesses in compliance with FPC 65 requirements for COOP plans 

government-wide. In a 2004 report,7

 GAO said that the lack of compliance with 

FPC 65 requirements could be attributed, in part, to FEMA’s limited oversight 

of government-wide COOP planning. GAO’s 2005 follow-up report8

 noted 

continued lack of adequate FEMA oversight of COOP activities. 

Results of Audit 

Overall Summary 

Since the agency was created in 2001, TSA designated a COOP Program 

Manager and staff, and developed a plan and program that has established a 

limited COOP capability. The agency has identified mission-essential functions, 

participated in government-wide and internal COOP exercises, and conducted 

periodic informational meetings to identify the agency’s level of COOP 

preparedness. Despite limited resources and the lack of dedicated funding, TSA 

officials indicated they have maintained a level of COOP capability that would 

sustain the performance of agency mission-essential functions. --------------

--------------------- --------------------------------------------- ---------------------------

-------------------------------------------------------------------------------------------------

-----------------------------------------------------------------------------------------------

--------------------- ---------------------------- ---------------------------------------------

-------- ------------------------- ---------------------------------

 

7

 “Continuity of Operations: Improved Planning Needed to Ensure Delivery of Essential Services,” GAO-04-160, February 

2004. 

8

 “Continuity of Operations: Agency Plans Have Improved, but Better Oversight Could Assist Agencies in Preparing for 

Emergencies,” GAO-05-577, April 2005. 
Audit of TSA Continuity of Operations Program 

Page 6 

TSA’s ability to continue its 

mission-essential functions ---------

-----------------------------------------

-----------------------------------------is 

at risk due to the lack of a 

comprehensive and effective COOP 

plan and program. As shown in 

Table 1, the TSA Headquarters 

(HQ) COOP Plan and Program do 

not fully comply with FPC 65. The 

TSA HQ COOP Plan and Program 

only partially address the 11 

required elements that define a 

viable COOP. 

Table 1: Overall Compliance with FPC 65 for TSA HQ 

COOP Plan and Program 

COOP Element Addressed 

Mission-essential Functions --

Alternate Operating Facilities --

Delegations of Authority --

Orders of Succession --

Devolution Planning --

Vital Records --

Interoperable Communications --

Test, Training, and Exercises --

Reconstitution --

Human Capital --

Plans and Procedures --

Y = Element addressed 

N = Element not addressed 

P = Element partially addressed

TSA has developed a cumbersome COOP plan that would require more than 200 

agency personnel to conduct 138 mission-essential functions at two or more 

different locations during the most extreme emergency situations. However, the 

plan provides only a minimal COOP capability because: TSA management has 

not adequately analyzed and approved the plan to ensure that only essential 

functions and associated emergency staff are included in the plan; established a 

viable alternate work site; or ----------- ----------------------- -------------------------

-------------- ----- -------------------------------------------------------------. In 

addition, TSA program offices have not made COOP planning a priority and 

TSA management, until FY 2006, has provided only a fraction of requested 

COOP funding. 

Without a complete and viable COOP plan, TSA’s ability to support, coordinate, 

and direct intermodal transportation security during an emergency could be 

impaired or fail. TSA mission-essential functions that are at risk include: ---

-------------------------------------------- -- ----------------------------------------------

----------------- - ------------ --------------- ------------------------------- -----------

------------------------------------------- ----------------------------------------- - -

-------------------------------------- ---------------
Audit of TSA Continuity of Operations Program 

Page 7 

TSA COOP Plan and Program Elements 

Mission-Essential Functions 

FPC 65 requires agencies to identify, prioritize, and validate their organization’s 

mission-essential functions as a basis for COOP planning, and identify staffing, 

resource requirements, and other supporting activities necessary to perform such 

functions. Resources required to perform mission-essential functions include, 

but are not limited to, trained personnel, equipment, and consumable office 

supplies. The proper identification and prioritization of these functions are 

critical for the creation of a viable continuity plan. If an agency identifies too 

many functions as essential, scarce resources may be allocated to sustain 

nonessential functions, impeding work on tasks that are truly essential. 

TSA management has not adequately reviewed, analyzed, prioritized and 

identified interdependencies or associated resources for the 138 missionessential functions that form the basis of its COOP plan. TSA officials indicated 

that a review of mission-essential functions occurred in 2004, and found them to 

be inconsistent and in need of revision. In addition, TSA officials stated that a 

review of mission-essential functions was initiated in 2005, but never 

completed. TSA officials agreed that despite these limited reviews, there were 

some mission-essential functions in the plan that do not need to be continued 

under all circumstances. In addition, the plan does not prioritize missionessential functions based on the criticality or time sensitivity of the functions 

according to likely COOP triggers and scenarios. The plan also does not 

---------------------------------------------------- -------------------------------- ---------- 

----------------------------------------------- --- -----------------------------. Gaps, 

------- ----------------------------------- - ---- ------------------------------in the TSA 

HQ COOP Plan are the result of a lack of careful analysis by TSA. 

Fifteen of the 41 program offices represented in the TSA HQ COOP Plan do not 

have mission-essential functions listed in the TSA HQ COOP Plan, yet are 

assigned space at the AOF.9

 Additionally, interviews with representatives from 

19 of the offices confirmed that TSA has not adequately analyzed and prioritized 

its mission-essential functions: 

• 7 of the 19 program offices acknowledged that not all of their missionessential functions identified in the TSA HQ COOP Plan are, in fact, 

essential and must be continued under all circumstances; 

• 12 of the 19 program offices did not prioritize mission-essential 

functions; and 

 

9

 The AOF is the facility or facilities to be used in the event that an agency’s primary facility is rendered unusable. 
Audit of TSA Continuity of Operations Program 

Page 8 

• 18 of 19 program offices provided the OIG mission-essential functions 

inconsistent with those listed in the TSA HQ COOP Plan. 

The absence of careful management review raises questions about the validity of 

the 138 mission-essential functions included in the TSA HQ COOP Plan. While 

many of the mission-essential functions identified in the TSA HQ COOP Plan 

were of clear importance, the TSA agreed with our observation that many of the 

functions may not be mission-essential during COOP emergencies. The 

following are a few examples of the many mission-essential functions identified 

in the TSA HQ COOP Plan that are vague or questionable in terms of whether 

they need to continue under all circumstances during a COOP emergency: 

• Facilitating paperwork for leadership, 

• Answering and investigating routine complaints, 

• Tracking training activities, and 

• Collecting customer, partner, and stakeholder feedback. 

As a consequence of not properly identifying, prioritizing, and validating 

mission-essential functions, there may be mission-essential functions that are 

overlooked and not included in the TSA HQ COOP Plan. Conversely, the TSA 

HQ COOP Plan may contain nonessential functions, causing the plan to be 

cumbersome, costly, difficult to manage, and more likely to fail during an 

emergency situation. 

Furthermore, TSA or its program offices have not identified and documented the 

resources necessary to continue mission-essential functions under all 

circumstances, ----------- ----------------------------------------------------------------

----------------------------------------------- ------------------ The TSA HQ COOP 

Plan does not identify resource requirements for the 138 mission-essential 

functions listed in the plan. Additionally, 15 of the 19 program offices we 

------------------------- --------------- ------------ ----------------------------------------

---------------- ---------------------------------- -----------------------------------------

-- ------------------------------------------------------------- -------------------

-------------------- ----------------------------------------------------------------- -------

-------------------------------------------------- ---------------------------------------------

------------------------------------------ -----------------------------------------

--- -------------------------------------- ----------------------

Alternate Operating Facilities 

FPC 65 and FEMA guidance require agencies’ COOP plans to identify and 

prepare Alternate Operating Facilities (AOFs) with the capability to perform 

their mission-essential functions within 12 hours of COOP activation and to 

sustain these functions up to 30 days. As such, AOFs must be located far 
Audit of TSA Continuity of Operations Program 

Page 9 

enough from vulnerable areas and provide support, infrastructure systems, and 

security for the relocated employees. 

Since joining DHS in 2003, TSA has secured a number of interim AOFs to 

continue operations; however, the agency has never had permanent AOF 

capabilities to support the TSA HQ COOP Plan. From March 2003 through 

November 2004, TSA collocated the AOF with another TSA installation, which 

was inadequately sized to accommodate the COOP plan. The facility was 

designated for other purposes and TSA leased and occupied another facility, 

despite unsuitable physical security, as a temporary measure until a suitable and 

permanent facility was identified, approved and modified to TSA needs. TSA 

terminated the lease and collocated the current AOF with another TSA 

installation in December 2005, and told the audit team in January 2006 that the 

facility would be modified and ready for COOP activities by May 2006. As of 

March 2006, the AOF was not configured for purposes of TSA COOP activities 

because plans to rearrange the space to accommodate both COOP and current 

TSA occupant needs were still being developed. TSA advised that the AOF was 

------------------------ behind schedule.

The number of staff and leadership requesting a presence at the AOF, and lack 

of resources to procure a larger facility prohibited TSA from obtaining one 

location that could accommodate the entire staff. Consequently, TSA staff and 

leadership would report to different AOFs during some emergency situations. 

Our review concentrated on the emergency staff AOF since senior TSA 

leadership has been designated to report to a location operated by another 

government agency.

The current AOF does not meet FPC 65 requirements and does not provide 

sufficient space and equipment to sustain TSA COOP activities under all 

circumstances. Specifically, we learned: 

• At the time of our site visit in January 2006, the AOF size and 

configuration could only accommodate 16% (30 of the 184) of the 

emergency personnel identified in the HQ COOP Plan. 

• ----------------------------------------------------------------------------

• --------------------------------------------------------------------------------

------------------------------------------------------------------------------------

--------------------------------------------- --------------------------------------

• ----------------------------- -----------------------------

TSA is configuring the new AOF, and planning for associated resources and 

equipment, despite the fact that the agency has yet to validate its missionessential functions. At the time of our audit, TSA was planning for an AOF to 

accommodate 41 program offices and 184 emergency staff to conduct 138 
Audit of TSA Continuity of Operations Program 

Page 10 

separate mission-essential functions. Without a careful analysis of its missionessential functions, TSA cannot effectively or accurately plan for the size, cost 

and associated resources for its AOF. 

Delegations of Authority and Orders of Succession

Under FPC 65, agencies are to pre-delegate authorities for making policy 

determinations and other decisions to ensure rapid response to any emergency 

situation requiring COOP plan activation. Agencies must establish, implement, 

and maintain orders of succession to key positions to ensure an orderly, predefined transition of leadership in the event leadership is debilitated or incapable 

of performing their legally authorized duties, roles, and responsibilities. 

Agencies must ensure that officials who may be expected to assume authorities 

in a COOP situation or be designated successors are trained and briefed annually 

on their potential responsibilities. 

The TSA HQ COOP Plan and the program office COOP plans do not have 

delegations of authority and orders of succession compliant with FPC 65 

requirements. The TSA HQ COOP Plan contained delegations of authority and 

orders of successions that were out of date for more than one year and still did 

not reflect changes in senior TSA leadership and the TSA organizational 

structure that occurred throughout 2005. For example, both the orders of 

succession and delegations of authority refer to the Assistant Administrators for 

Maritime and Land Security and Aviation Operations; however, these positions 

no longer exist in the current TSA organization. 

Delegations of authority and orders of succession were missing or inaccurate ---

-------------- ------------------------------------------ In addition, TSA officials 

acknowledged that the agency has not consistently trained or briefed officials 

that could be delegated authorities under emergency situations or be designated 

successors, and had not conducted briefings since October 2004, despite the fact 

that TSA leadership changed throughout 2005. Without clear and current 

delegations of authority and orders of succession, TSA’s ability to manage and 

direct its mission-essential functions and operations during an emergency 

situation is at risk. 

Devolution Planning

TSA has not identified a devolution site or developed a devolution plan to 

ensure continuation of the agency’s mission-essential functions if TSA HQ or its 

AOFs were rendered unavailable. Devolution planning refers to preparation 

necessary to transfer mission-essential functions of a department or agency to 

another organizational element, such as a field office, should an organization’s 

AOF or emergency relocation personnel be rendered unavailable or 
Audit of TSA Continuity of Operations Program 

Page 11 

incapacitated. FPC 65 requires that agencies conduct devolution planning to 

identify how the agency will continue its mission-essential functions during 

increased threat situations or in the aftermath of a catastrophic emergency 

situation. Although TSA has an existing field structure in place at 5 Mission 

Support Centers and over 400 airports located across the United States, TSA has 

not performed required devolution planning. Without a devolution site or plan, 

there is no assurance that TSA would be able to continue operations if an 

emergency situation rendered TSA’s HQ or the AOFs unavailable or 

incapacitated. 

Vital Records Program

FPC 65 requires agencies to identify, protect, and make readily available vital 

records and databases to support mission-essential functions during COOP 

emergencies. The protection and availability of electronic and hardcopy 

documents, references, records, and information systems are needed to support 

mission-essential functions under a variety of emergency situations. To the 

extent possible, agencies should pre-position and regularly update duplicate 

records or backup electronic files. There are two types of vital records: 

 

• Emergency Operating Records: Emergency plans and directives; orders 

of succession; delegations of authority; staffing assignments; and related 

records of a policy or procedural nature that provide agency staff with 

guidance and information resources necessary for conducting operations 

during an emergency situation, and for resuming formal operations at its 

conclusion. 

• Legal and Financial Records: Records that are critical to carrying out an 

organization’s essential legal and financial functions and activities, and 

protect the legal and financial rights of individuals directly affected by 

its activities. 

By issuing Management Directive 200.9, Vital Records Program, TSA 

established policy and procedures for the identification, preparation, and 

inventory of vital records to ensure that needed records are available during 

COOP emergencies. However, the directive was not issued until August 29, 

2005. Under this directive, TSA program offices are charged with identifying, 

safeguarding, and updating office vital records; and ensuring that these records 

are easily retrievable to support the continuity of their mission-essential 

functions during COOP emergencies. 

The TSA HQ COOP Plan does not address an agency-wide vital records 

program to support COOP operations, although officials indicated that specific 

instructions for the storage of electronic and paper emergency operating records 
Audit of TSA Continuity of Operations Program 

Page 12 

were issued separately. Despite this, TSA officials were unaware of the extent 

to which TSA program offices have complied with TSA policy for its vital 

records program. Interviews with Office Emergency Coordinators from 19 

TSA organizational elements indicated that ------------------------------------ a 

formal vital records program in accordance with FPC 65 and TSA Management 

Directive 200.9. These Emergency Coordinators do not maintain complete 

documentation for their emergency operating vital records and procedures for 

implementing, safeguarding and updating the records. 

Interoperable Communications

Under FPC 65, agencies are required to establish interoperable communications 

that provide the capability to perform mission-essential functions until normal 

operations can be resumed. Specifically, agencies are required to ensure the 

availability of redundant and interoperable communication systems that support 

the ability to communicate with employees, agency leadership, and other 

elements and locations during an emergency situation. Also, agencies must 

ensure the backup of critical applications are available to provide access to data, 

systems, and services necessary to support mission-essential functions. 

The Office of Management and Budget Circular A-130, Management of Federal 

Information Resources and the National Institute of Standards and Technology

Special Publication 800-34, Contingency Planning Guide for Information 

Technology Systems, discuss the need for disaster recovery plans in the event an 

emergency situation leads to information technology (IT) system failure. The 

TSA COOP Program Manager explained that COOP IT readiness is his 

responsibility with support from the TSA Office of Chief Information Officer 

(OCIO). 

TSA has only partially established interoperable and redundant communications 

and systems available to support communication with employees, agency 

leadership, and other elements and locations during an emergency. TSA 

officials advised that TSA provides multiple modes of communication at its 

AOFs including: 

• Dedicated TSA data connectivity to all critical applications housed at the 

TSA hosting center;10

• Dedicated land-line voice communication based at different locations on 

the Public Switched Telephone Network (PSTN);11 and 

 

10 This facility is located outside the Washington, D.C. area. 

11 The PSTN (public switched telephone network) is the world's collection of interconnected voice-oriented public 

telephone networks, both commercial and government-owned. The PSTN also furnishes much of the Internet's longdistance infrastructure. 
Audit of TSA Continuity of Operations Program 

Page 13 

• Commercial systems such as the Internet, cellular telephones, and 

dedicated voice lines to communicate with its non-emergency workforce. 

Although emergency planning assumes that the PSTN will be available during 

an emergency, TSA officials agreed that -------------------------------------- -----

-------------------------------------------------------------------------------------------

------------------------------------------------ ------------------------------------------

-------------------------------------------- -------------- --------------------------------

----------------------------------------------------------------------------------------------

------------------------------------------------ -------------------------------------------

-- ------------------------------------------ ------------------------------------------

----------------------------------------------------------------------

--------------------------------------------------------------- ---------------

-------------- -------------------------------------------------------------------------------

----------------------------- ------------ If a disaster rendered the data centers 

inoperable, TSA would use its IT contractor facility in suburban Virginia to 

provide a limited backup capability to recover systems. The OCIO may not be 

-------------------------------------------------- ---------------------- ----------------------

-----------------------------------------------------------------------------------------------

------------------------------------------------------------- -------------------------------

-------------------------------------------------------------------------- - -

--------------------------------------------------

------------------------------------------------- ----------------------------------- ---------

---------------------------------------------- ---------- ------------ -----------------------

-------------------------------------------------------------- ----------------------

---------- -------------------------------- ---------------------------------------

------------------------------------------------------------------------ --------------

------ --------------------------------------------------------------------------------------

------- ----------------------------------------------------------------------------------

---------- ----------------------------------------------------- ---------------- -

--------------------------------------------------------------------------------------

----------------------------------------------------------------- ----------- --------

----------------------------- -------------- ------------------------------ ----- ------

---------------------------------------------------------------------------------------

------------------------------------------- -----------------------------------------

----------------------------------------

 

12 The OCIO provided a list of 18 mission critical systems that are housed at either an off-site data center or an on-site data 

center. Some examples of the mission critical systems are the Alert Notification System, Law Enforcement Messaging 

Switch, and TSANet. 
Audit of TSA Continuity of Operations Program 

Page 14 

TSA officials agreed that COOP planning has not been a TSA priority, as 

evidenced by the --------------------------------------------------------------------

---------------------------- ----------------------- -------------------------------------------

------- They said that funding for these items has been repeatedly requested but 

not approved, because funding has generally been directed towards other, more 

current problems such as connectivity issues, ------------------------ capabilities. 

Without redundant and interoperable communications systems, backup of 

critical applications, and disaster recovery plans, there may be a loss of access to 

many critical applications, and TSA may not be able to continue its missionessential functions. 

Test, Training, and Exercise Program

FPC 65 requires that agencies assess, demonstrate, and improve the ability to 

execute COOP plans and programs through a testing, training, and exercise 

(TT&E) program. Agencies must plan, conduct, and document periodic tests, 

training, and exercises to demonstrate COOP plan viability, identify 

deficiencies, and ensure personnel are able to implement COOP plans to carry 

out mission-essential functions. The circular also instructs agencies to develop a 

multi-year plan that addresses TT&E requirements and resources to support 

these activities. 

While TSA participated in several internal and government-wide COOP 

exercises, the TSA has not fully developed a test, training and exercise program 

to validate, or identify for subsequent correction, specific aspects of COOP 

capabilities, procedures, systems and facilities used in response to emergency 

situations. 

• TSA officials indicated that tests of COOP procedures and systems have 

occurred during nationwide COOP exercises and associated with events 

such as the 2005 Presidential Inauguration and the 2006 State of the 

Union Address. However, officials also acknowledged that the system 

has not been tested at least quarterly, as required by FPC 65. The TSA 

COOP Program Manager explained that TSA planned to use an 

automated alert and notification system,13 but the contact information in 

the system is extremely outdated, thereby reducing the utility of the tests. 

• TSA has not implemented action plans to correct deficiencies identified 

during previous COOP exercises and updated the TSA HQ COOP Plan. 

While program office personnel reported numerous problems 

experienced during a June 2005 COOP exercise, ----------------------

 

13 The alert and notification system automatically calls and e-mails TSA senior management and emergency coordinators 

during an emergency. A recorded message would provide details on the COOP situation including whether to deploy to the 

AOF. 
Audit of TSA Continuity of Operations Program 

Page 15 

----------- ------- ---------- ---------- ------------- -----------------------

------------------------------------------------------------------ ------------------

TSA has not developed or implemented plans to correct those 

deficiencies. TSA officials advised that, despite the lack of a written 

corrective action plan, many COOP deficiencies noted during COOP 

exercises in 2004 and 2005 have been addressed by the agency. 

• TSA has not ensured that agency personnel are trained to implement 

COOP plans and carry out mission-essential functions in a COOP 

situation. Sixteen of the 19 Office Emergency Coordinators we 

interviewed said that they did not receive formal COOP training for their 

position, despite the fact that FEMA provides numerous no-cost COOP 

training opportunities both in a classroom setting and on-line. 

Additionally, TSA does not have adequate assurance that COOP 

awareness training, orientation or briefings are provided to its entire 

workforce, as required by FPC 65. The TSA officials said that COOP 

training was left up to each program office because the TSA COOP staff 

does not have the resources to train personnel. TSA officials indicated 

that the agency has established a TSA-intranet website on emergency 

preparedness available to all employees, as well as a COOP information 

pamphlet provided to all OECs for distribution to the workforce. 

However, TSA officials also indicated they do not know whether COOP 

training or orientations are actually being provided, or to what extent 

employees have accessed the intranet site or received the COOP 

pamphlet. 

• TSA has not prepared a multi-year TT&E plan that addresses COOP 

TT&E requirements, resources to support TT&E activities, and a TT&E 

planning calendar. 

An effective TT&E program is important to improve the ability of agencies to 

effectively manage and execute their COOP program. Without an effective 

TT&E program in place, TSA has no assurance that its COOP program is 

capable of supporting the continued execution of the agency’s mission-essential 

functions during a COOP situation. 

Reconstitution

FPC 65 requires agencies to provide an executable reconstitution plan to 

transition from COOP status to an efficient normal operations status once the 

threat or disruption has passed. Agencies must coordinate and pre-plan options 

for reconstitution from all levels of disruption and outline procedures for a 

smooth transition from a relocation site to the new or restored HQ facility. As 

reconstitution is implemented, agencies must inform and instruct all personnel 
Audit of TSA Continuity of Operations Program 

Page 16 

for resumption of normal operations and supervise the orderly return to the 

primary location. Agencies are required to verify that all systems, 

communications, and other required capabilities are available and operational 

and the agency is fully capable of accomplishing all mission-essential functions 

at the new facility. The agency must conduct an after-action review to identify 

areas for correction and develop a remedial action plan. 

The TSA HQ COOP Plan does not provide options for reconstitution from all 

levels of disruptions and the movement from the COOP AOF or devolution site 

to the original facility or new operating site. Instead, the plan identifies limited 

actions that the Facilities Recovery Team would take that would result in 

recommendations for recovery and reconstitution strategy. The plan mentions 

that a separate Reconstitution Team will be established when TSA facilities 

have sustained severe damage or TSA staff has suffered substantial casualties. 

The TSA COOP Program Manager explained that during a national security 

emergency, TSA would rely on direction from the White House for all other 

reconstitution planning. We understand that a catastrophe of significant 

magnitude would require special guidance and attention; however, TSA has not 

provided emergency personnel with sufficient information to ensure a smooth 

transition from a COOP situation to resume normal operations. Based on the 

limited information in the TSA HQ COOP Plan, reconstitution may pose 

significant challenges during a COOP event and delay the return to normal 

operations. 

Human Capital

The TSA HQ COOP Plan does not include the required procedures and guidance 

on human resource issues related to continued operations. FPC 65 requires each 

agency to design, update, and carry out comprehensive plans to respond to the 

threats that its employees are most likely to face during an emergency situation. 

Agencies should be familiar with the many human capital resources and 

flexibilities that exist to assist managers and employees in an emergency 

situation. Agencies need to address human capital topics in their COOP plans 

such as: 

• Dismissal and closing procedures; 

• Plans and methods for communicating with employees; 

• Pay and staffing flexibilities; 

• Employee recall procedures; and 

• Employee roles and responsibilities.

FPC 65 also requires that agencies ensure COOP capabilities take maximum 

advantage of existing agency field infrastructures and give consideration to other 

options, such as telecommuting locations, work-at-home, virtual offices, and 
Audit of TSA Continuity of Operations Program 

Page 17 

joint or shared facilities. DHS Management Directive 3070.2, Telework 

Directive,14 states that telework can be used as an integral part of DHS COOP 

plans to ensure that DHS operates smoothly in times of emergency situations, 

disasters, or inclement weather. According to the Office of Personnel 

Management, telework is “an invaluable management tool which not only 

allows employees greater flexibility to balance their personal and professional 

duties, but also allows both management and employees to cope with the 

uncertainties of potential disruptions in the workplace, including terrorist 

threats.” GAO and the Congress have also indicated that the ability to telework 

has been, and will continue to be, very important in times of emergency 

situations. 

The TSA HQ COOP Plan does not include the human factors that need to be 

considered during a crisis, such as expected roles and responsibilities, staffing, 

pay, and notification protocols. Instead, the plan indicates that detailed 

administrative and personnel services support procedures for deployed TSA 

staff during an emergency situation will be provided at an unspecified “later 

date.” 

Similarly, TSA has not addressed telework as an emergency strategy in its 

COOP plan and program. TSA advised that the agency did not have a telework 

policy in place prior to February 2006. In addition, TSA indicated that the 

agency conducted a pilot project for using telework as a COOP strategy, but 

found that ---------------- ---------------------------------------------------------

---------------------------------------------------------------------------- 

Without human capital information in its COOP plan and program, TSA staff 

may not receive the information necessary to know what to do under many 

emergency situations. Additionally, without implementing a telework program 

to support its COOP program, TSA is missing an opportunity to extend the 

survivability of its mission-essential operations if TSA HQ and AOF locations 

are rendered inoperable or inaccessible during a catastrophic event. 

Plans and Procedures

As previously discussed, FPC 65 requires that agencies develop a 

comprehensive COOP plan to ensure the continued performance of an 

organization’s mission-essential functions under all circumstances and include 

elements that define a viable COOP. In addition, agencies are required to 

develop plans and procedures for three phases of COOP implementation: 

activation and relocation; AOF operations; and reconstitution. The TSA HQ 

COOP Plan includes: 

 

14 Dated August 17, 2005 
Audit of TSA Continuity of Operations Program 

Page 18 

 

• Plans for activation, such as check-in procedures for emergency 

personnel; 

• Plans for fly-away kits15 for emergency personnel; and 

• Alert and notification procedures. 

However, the TSA HQ COOP Plan, as described in the previous sections, is not 

comprehensive and does not adequately address all 11 elements of a viable 

COOP. The COOP plan has not been reviewed annually or approved by senior 

TSA officials, as required by FPC 65. 

TSA COOP Priority and Oversight 

According to FPC 65, each federal executive branch agency is responsible for 

appointing a senior federal government executive to serve as program manager 

and agency point of contact for agency COOP activities, and to ensure that there 

is adequate planning, programming, and budgeting for a viable and executable 

COOP program that adheres to FPC 65. The TSA HQ COOP Plan designates 

the TSA COOP Program Manager responsible for the coordination, 

development, execution, and maintenance of the COOP plan and program. 

Additionally, FPC 65 requires that each agency’s COOP plan must include the 

development, maintenance, and annual review of the COOP capabilities using a 

multi-year strategy and program management plan. The multi-year strategy and 

program management plan should outline the process an agency will follow to 

designate and review mission-essential functions and resources; define short and 

long-term COOP goals and objectives; forecast COOP budgetary requirements; 

and identify COOP program issues, concerns, potential obstacles, and the 

strategy for addressing these obstacles. 

COOP planning has not been a priority for TSA nor have adequate resources 

been available for COOP planning. Both have contributed to the numerous 

deficiencies discussed in this report. TSA officials stated that the main reason 

for COOP deficiencies was the lack of funding and personnel resources 

provided to the program. As we were concluding our audit fieldwork in 

February 2006, approximately $4.2 million was reprogrammed to the TSA 

COOP program, primarily to cover costs associated with modifying and 

outfitting the agency’s AOFs used to support COOP activation. However, from 

15 Fly-away kits are kits prepared by, and for, an individual who expects to deploy to an alternate location during an 

emergency. They contain work-related and personal items needed to minimally satisfy personal and professional needs 

during deployment. 
Audit of TSA Continuity of Operations Program 

Page 19 

FY 2003 through FY 2005, TSA had provided only $830,000 total in reallocated 

funds,16 although TSA COOP management requested $6 million to $8.75 

million annually for the COOP program. Funds were requested for additional 

staff, telecommunications and IT equipment, emergency office supplies, and 

AOF renovation. In addition, OCIO officials said that approximately $40 

million was requested to address deficiencies in information technology disaster 

recovery planning and has not been approved by TSA. 

As stated in a TSA draft acquisition plan prepared in 2005, “... the (TSA 

COOP) program remains unfunded, and, therefore, has been slow to progress 

beyond the initial stage. Through the reprogramming of operational funds, a 

minimum level of capability has been achieved, but is not sustainable. ...[and 

consequently] TSA would be out of compliance with White House and DHS 

directives concerning COOP requirements. TSA would be vulnerable to 

disruption of its missions-essential functions.” 

Additionally, the TSA COOP Program Manager explained he also had many 

staffing challenges since assuming this role in July 2002. The COOP Program 

Manager worked on the program by himself for over a year, and during that 

time, he indicated that only 30 to 50 percent of his time was allocated to the 

TSA COOP program because he was assigned to other duties. Furthermore, the 

COOP Program Manager said that TSA was unable to maintain a trained COOP 

staff until September 2004. Since then, the COOP Program Manager has 

maintained a staff of four trained employees with assistance from between one 

and four additional staff members over time. 

We concluded that TSA has not provided effective oversight of the TSA COOP 

Program. As previously discussed, TSA has not adequately reviewed and 

confirmed the program office mission-essential functions, reviewed office-level 

COOP plans, or prepared a multi-year strategy and program management plan to 

guide the COOP program. Additionally, major sections of the TSA HQ COOP 

Plan are incomplete or missing and/or not in compliance with FPC 65 

requirements. The HQ COOP Plan has not been updated to reflect 

organizational and mission-essential function changes and lists incorrect contact 

information for --------------------- we interviewed. In addition, TSA has not 

------------------------------------------------ ---------------------------- . For example: 

• ----------------------------------------------------------------------------------

-----------------------------------------------------------------------------------------

 

16 The following funds were reprogrammed to the COOP program from FY 2003 through FY 2005: FY 2003-$230,000; 

FY 2004-$350,000; and FY 2005-$250,000. 

17 TSA classifies commercial airports in the United States into one of five security risk categories (X, I, II, III, and IV) 

based on various factors, such as the total number of takeoffs and landings annually, and other security considerations. In 

general, category X airports have the largest number of passenger boarding and category IV have the smallest. 
Audit of TSA Continuity of Operations Program 

Page 20 

------------------------------------------------------------------------------------

---------------------------------------------- ---------------------------------------

------------ ---------------- ------------

• -----------------------------------------------------------------------------------

-------------------------------- -----------------------------

• ---------------------------------------------------------------------------------------

--------------------------------------------- -----------------------------------------

------------- -------------

Recommendations 

We recommend that the Assistant Secretary of the TSA take appropriate steps 

to: 

1. Ensure that the TSA Office of Emergency Preparedness provides 

sufficient direction and oversight that will enable the agency to develop 

and maintain a comprehensive and effective COOP plan and program, 

compliant with all FPC 65 requirements; 

2. Ensure that TSA program offices fulfill their assigned responsibilities 

under the TSA HQ COOP plan and provide the support necessary for 

TSA to implement a viable COOP plan and program. 

3. Provide the resources necessary to implement a viable COOP program, 

in order to continue operations under any emergency situation. 

 

Management Comments and OIG Analysis: 

Management Comments to Recommendation #1 

TSA concurred with our recommendation and stated that making COOP 

planning a priority for its leadership is central to a viable COOP capability. 

TSA noted that the Assistant Secretary’s personal interest in the COOP program 

demonstrates the highest level of oversight. TSA indicated that the COOP 

program is now being managed by the Office of Law Enforcement (OLE), 

Emergency Preparedness Division, and that their leadership is reaching out 

across TSA management to build COOP awareness and support. With this 

reorganization, TSA believes that it has improved the accountability, oversight 

and visibility of the COOP program. TSA also provided examples of how the 

agency has made significant progress in addressing the deficiencies in the 

required elements of a viable COOP since the end of our fieldwork. TSA also 
Audit of TSA Continuity of Operations Program 

Page 21 

intends to use the eleven program elements as a benchmark to measure progress 

and evaluate COOP capacity and performance. 

Management Comments to Recommendation #2 

TSA concurred with our recommendation. In response to our draft report, TSA 

stated that the agency recently completed an internal reorganization and 

reassignments of responsibility aligning senior management officials for each 

program office. TSA indicated that new Office Emergency Coordinators have 

been assigned and COOP program management is developing a comprehensive 

strategy for ensuring office compliance and readiness. This strategy will include 

self-audits, unannounced audits by COOP program officers, readiness 

checklists, and ongoing awareness initiatives. Finally, OLE management will 

engage with program office senior management officials to ensure that officelevel and field planning efforts are complete, accurate and viable. 

Management Comments to Recommendation #3

TSA concurred with our recommendation. The agency, in its response to the 

draft report, stated that $10 million in FY 2006 funds were allocated to the 

COOP program to support the design and build-out of two AOFs and procure 

emergency equipment. TSA also indicated that funding will also be used to 

obtain contractor support for developing COOP documentation. 

OIG Comments and Analysis

We consider Recommendations #1, #2, and #3 resolved but will remain open 

until implementation is complete. We agree that TSA has been responsive to 

our draft report and has taken significant steps to building a strong, viable 

COOP capability. TSA provided additional resources and reorganized the 

COOP management structure to raise the visibility and priority of the program. 

TSA noted that the agency recently reexamined its mission-essential functions 

and a task force would be formed to identify a strategy to analyze, validate and 

prioritize the results. TSA is also in the process of developing a five-year TT&E 

plan. However, TSA still needs to make progress in addressing other 

deficiencies in its COOP plan and program that we identified during our audit, 

many of which were ------------------------ --------- ----------------------------------

---------------------------- ------------------------------------------------------------

--------- ------------------- ------------------------------------------------

-------------------------------------------------------------- ----------------------------

---------------------------------------------------------- ----- Although TSA has made 

additional resources available to the COOP program, TSA did not specifically 

state its plans to provide adequate resources to address deficiencies ------------

------------------------------------------ -------------- -
Audit of TSA Continuity of Operations Program 

Page 22 

 

We will consider the recommendations closed when TSA reports back to us on 

the completion of its planned actions to address all deficiencies identified in this 

report. 

A copy of TSA’s entire response is included as Appendix B.

DHS COOP Oversight 

DHS has provided only limited oversight of TSA COOP activities. Specifically, 

DHS has not assessed the extent to which TSA, as well as other DHS 

components, are maintaining a COOP plan and program that is current, contains 

all required information as outlined in FPC 65, and ensures the continuation of 

TSA mission-essential functions under a variety of emergencies. While FEMA 

acknowledges that it is the “lead agent” for COOP activities across the federal 

executive branch, and has primary responsibility within DHS for the 

development and execution of the Department’s COOP program, the agency 

does not believe that it has been formally assigned the authority, nor does it have 

the resources to assess DHS component COOP programs, plans, and 

capabilities. 

FEMA was established as the “lead agent” for federal executive branch COOP 

under Presidential Decision Directive 67 (PDD 67).18 This effort is led by 

FEMA’s Office of National Security Coordination (ONSC). Under PDD 67, 

FEMA is designated as the chair of an Interagency Advisory Group charged 

with providing coordination, oversight, and management for COOP activities. 

According to Executive Order 12656 (EO 12656),19 FEMA shall coordinate and 

support the initiation, development, and implementation of national security 

emergency preparedness programs and plans among Federal departments and 

agencies; and provide the President a periodic assessment of Federal, State, and 

local capabilities to respond to national security emergencies. EO 13286 

transferred these responsibilities to the Secretary of Homeland Security.20 In 

March 2004, DHS Delegation Number 9001 assigned the authorities to the 

Under Secretary for Emergency Preparedness and Response. The June 2004 

18 PDD 67, “Enduring Constitutional Government and Continuity of Government Operations,” October 21, 1998. FEMA 

provided the OIG team only with unclassified excerpts of the document relevant to federal agency COOP responsibilities 

and FEMA’s role government-wide. PDD 67 is a national security classified document under the control of the National 

Security Council. 

19 Executive Order 12656, “Assignment of Emergency Preparedness Responsibilities,” November 11, 1988, Section 1701, 

as amended. 

20 Executive Order 13286, “Amendment of Executive Orders, and Other Actions, in Connection With the Transfer of 

Certain Functions to the Secretary of Homeland Security,” February 28, 2003, Section 42. 
Audit of TSA Continuity of Operations Program 

Page 23 

 

revision of FPC 65 requires FEMA to “oversee and assess the status of COOP 

capabilities” government-wide. 

ONSC also serves as DHS’ lead agent for COOP activities with the Department. 

Under authority established by DHS Management Directive 9300.1,21 a DHS 

COOP Working Group was formed “to provide oversight and direction to the 

DHS COOP program.” FEMA co-chairs this working group with the Office of 

the Chief of Staff. We noted that this Directive does not reflect the recent 

reorganization of DHS. When the Directive was issued in 2004, FEMA reported 

to the Under Secretary for Emergency Preparedness and Response, which was 

given overall responsibility for the development and execution of the DHS-wide 

COOP program. According to FEMA officials, this responsibility was delegated 

to FEMA’s ONSC. As a result of a recent reorganization, FEMA now reports 

directly to the DHS Deputy Secretary. Nevertheless, FEMA indicated that DHS 

COOP responsibilities currently remain with ONSC and that they would be 

proposing changes to the now out-of-date Directive. 

GAO also attributes a significant COOP oversight responsibility to FEMA. In 

consecutive reports issued in 2004 and 2005, GAO reported that the lack of 

compliance with FPC 65 requirements by federal executive branch departments 

and agencies could be attributed, in part, to FEMA’s limited oversight of COOP 

planning government-wide.22 GAO noted that FEMA had not conducted 

oversight that is “sufficiently regular and extensive to ensure that agencies 

correct deficiencies” in COOP plans and programs. GAO noted that improved 

FEMA oversight of COOP activities could be instrumental in ensuring that 

agencies prepare adequate COOP plans. 

ONSC, however, does not believe that guidance provides them with the 

authority and responsibility to ensure that agencies, both within DHS and 

government-wide, are maintaining viable COOP plans, programs and 

capabilities. ONSC officials contend that their role is limited to providing 

coordination, guidance, advice, and support, but that they do not have the 

regulatory authority to conduct in-depth assessments of individual agency 

COOPs, nor the authority to direct agencies to establish and maintain a viable 

COOP capability. 

Within DHS, FEMA officials pointed out that oversight responsibilities for 

COOP activities are vested in the DHS COOP Working Group, which they cochair. However, they agreed that the Working Group has not, nor does it intend 

21 DHS Management Directive 9300.1, “Continuity of Operations Programs and Continuity of Government Functions,” 

July 12, 2004. 

22 “Continuity of Operations: Improved Planning Needed to Ensure Delivery of Essential Services,” GAO-04-160, 

February 2004. “Continuity of Operations: Agency Plans Have Improved, But Better Oversight Could Assist Agencies in 

Preparing for Emergencies,” GAO-05-577, April 2005. 
Audit of TSA Continuity of Operations Program 

Page 24 

to, conduct in-depth assessments of DHS component COOP plans and programs. 

FEMA officials further stated that ONSC may be the most appropriate office to 

provide additional oversight and to conduct assessments of COOP plans and 

programs. However, FEMA contends that currently they do not have the 

authority or resources to fulfill such a role. 

While FEMA officials agreed with us that DHS COOP oversight was inadequate 

and required improvements, the agency believes that limited oversight is 

provided through annual FEMA-coordinated government-wide COOP exercises, 

such as Forward Challenge 2004 and Pinnacle 2005. FEMA stated that they 

assumed that agencies, including TSA, have viable COOP capabilities due to 

their successful participation in these government-wide COOP exercises. 

Additionally, FEMA is working on a COOP reporting and oversight tool, the 

Readiness Reporting System,23 which will require departments and agencies 

government-wide to answer a series of questions to determine and report their 

readiness posture. However, FEMA acknowledged that it has not yet addressed 

GAO concerns on how the agency plans to validate agencies’ self-reported 

information on COOP capabilities. 

Recommendations 

We recommend the Under Secretary for Federal Emergency Management 

ensure that DHS Management Directive 9300.1 is revised to reflect the current 

DHS organization. The Directive should clearly assign and delineate COOP 

oversight responsibilities and authority to ensure that all DHS components have 

a viable COOP program in full compliance with FPC 65 that is capable of 

ensuring continuation of all essential functions under all COOP situations. 

 

Management Comments and OIG Analysis: 

Management Comments to Recommendation

FEMA generally agreed with the overall finding that DHS has provided only 

limited oversight of TSA COOP activities, and concurred with our 

recommendation to revise MD 9300.1 to clearly assign and delineate COOP 

oversight responsibilities and authority to ensure that all DHS components have 

a viable COOP program in full compliance with FPC 65. The agency stated that 

they believe that revisions to MD 9300.1 need to include some form of 

accountability which FEMA can enforce, and where agencies can ensure their 

national security commitments. While FEMA generally agreed that they 

 

23 The Readiness Reporting System was initially scheduled to be operational by October 2005; however, FEMA officials 

advised that the system would now be ready by October 2006. 
Audit of TSA Continuity of Operations Program 

Page 25 

provide only limited oversight of TSA (and other agency) COOP activities, the 

agency stated that they do not have the authority to serve as a regulatory agent 

responsible for ensuring that departments and agencies are prepared for COOP. 

FEMA contends they have provided significant oversight to many agencies 

including the TSA, by collecting agency COOP readiness status reports. 

Through their co-chairing of the DHS COOP Working Group, the agency 

promotes the development, coordination, and integration of COOP planning and 

programs throughout DHS. FEMA also stated that the agency has provided 

extensive and comprehensive COOP training to various departments and 

agencies during the past two years on revisions to FPC 65. 

OIG Comments and Analysis 

Our draft report noted that FEMA does not believe that it has been formally 

assigned the authority, nor does it have the resources, to assess DHS component 

COOP programs, plans, and capabilities. We agree that FEMA is an active 

member of the DHS Working Group, has provided numerous COOP training 

opportunities, and has coordinated government-wide COOP exercises. 

However, we still contend that DHS has not provided the depth of oversight 

necessary to determine the extent to which TSA, as well as other DHS 

components, are maintaining a COOP plan and program that is current and 

contains all required information as outlined in FPC 65. FEMA generally 

agreed with our recommendation that MD 9300.1 needs to be revised to clearly 

provide the authority necessary to fulfill a more robust COOP oversight role in 

the Department. 

 

While FEMA concurred with Recommendation #4, the agency did not tell us 

specifically what actions it intends to take to resolve the recommendation. 

Therefore, we consider the recommendation unresolved and open. We will 

consider the recommendation closed and resolved when DHS Management 

Directive 9300.1 is revised to reflect the current DHS organization and clearly 

assigns and delineates COOP oversight responsibilities and authority to ensure 

that all DHS components have a viable COOP program in full compliance with 

FPC 65 that is capable of ensuring continuation of all essential functions under 

all COOP situations. 

A copy of FEMA’s entire response is included as Appendix B.
Appendix A 

Purpose, Scope and Methodology

Audit of TSA Continuity of Operations Program 

Page 26 

The objective of this audit was to determine whether TSA has a viable COOP 

capability, which ensures the performance of its mission-essential functions 

during any emergency situation that may disrupt normal operations. 

Specifically, the audit determined whether: 

• TSA has a viable COOP capability and a COOP plan that meets 

government-wide requirements and guidance that define a viable 

COOP capability. 

• TSA and DHS provide effective guidance and oversight over TSA’s 

COOP Plan and Program. 

To determine whether the TSA has a viable HQ COOP plan that meets 

government-wide requirements, we obtained and reviewed applicable federal 

laws, directives, and regulations; the TSA HQ COOP Plan (dated August 

2005); TSA COOP budget documentation; exercise reports; and associated 

supporting documentation provided by the TSA COOP Program Manager, 19 

Office Emergency Coordinators; and 4 airport COOP coordinators. We 

compared the TSA HQ COOP Plan against the requirements of FPC 65 and 

other TSA, DHS, and government-wide COOP guidance. Additionally, we 

physically inspected two TSA AOFs in the Washington metropolitan area 

established for COOP activation. 

To obtain a thorough understanding of the TSA COOP program and oversight 

provided by TSA and DHS, we interviewed the TSA COOP Program 

Manager and his staff, 19 TSA Office Emergency Coordinators, COOP 

coordinators from 4 ------------- airports, and FEMA officials responsible for 

overseeing DHS COOP programs. 

Our audit was conducted at TSA HQ between November 2005 and March 

2006, in accordance with generally accepted government auditing standards 

and in compliance with the laws and regulations to the extent necessary to 

satisfy the audit objectives. 
Appendix B 

Management Comments to Draft Report

Audit of TSA Continuity of Operations Program 

Page 27 
Appendix B 

Management Comments to Draft Report

Audit of TSA Continuity of Operations Program 

Page 28 
Appendix B 

Management Comments to Draft Report

Audit of TSA Continuity of Operations Program 

Page 29 
Appendix B 

Management Comments to Draft Report

Audit of TSA Continuity of Operations Program 

Page 30 
Appendix B 

Management Comments to Draft Report

Audit of TSA Continuity of Operations Program 

Page 31 
Appendix B 

Management Comments to Draft Report

Audit of TSA Continuity of Operations Program 

Page 32 
Appendix B 

Management Comments to Draft Report

Audit of TSA Continuity of Operations Program 

Page 33 
Appendix B 

Management Comments to Draft Report

Audit of TSA Continuity of Operations Program 

Page 34 
Appendix C 

Key Sources of Guidance for Federal COOP Planning

Audit of TSA Continuity of Operations Program 

Page 35 

1. Executive Order 12148, Federal Emergency Management, July 20, 

1979, as amended: Created the Federal Emergency Management Agency 

(FEMA) and vested in it authorities and responsibilities related to civil 

defense and emergency preparedness government-wide. 

2. Executive Order 12656, Assignment of Emergency Preparedness 

Responsibilities, November 18, 1988, as amended: Developed to ensure 

that the United States would have sufficient capabilities at all levels of 

government to meet essential defense and civilian needs during any 

national security emergency. Under this Order, national security 

preparedness responsibilities were assigned to the individual federal 

departments and agencies. E.O. 12656 requires that the Director of FEMA 

and the heads of departments and agencies must ensure that their 

preparedness plans and activities are consistent with current presidential 

guidelines and policies.

3. Executive Order 13286, Amendment of Executive Orders, and Other 

Actions, in Connection With the Transfer of Certain Functions to the 

Secretary of Homeland Security, February 28, 2003: The order 

transfers authorities to the Secretary of Homeland Security in a variety of 

policy areas, including those preparedness responsibilities assigned to the 

Director of FEMA in E.O. 12656. 

4. Presidential Decision Directive 67, Enduring Constitutional 

Government and Continuity of Government Operations, October 21, 

1998: Addresses the survival of United States government processes and 

continuity of essential federal civilian functions in the event of a nuclear 

attack or other disaster. This directive requires all federal departments and 

agencies to develop formal COOP plans to ensure continuity of their 

essential operations. 

5. FPC 65, Federal Executive Branch Continuity of Operations, June 15, 

2004: The primary document that provides the requirements that define a 

viable COOP plan and program. FPC 65 was revised and reissued on June 

15, 2004, superseding three previous continuity preparedness circulars: 

FPC 65, Federal Executive Continuity of Operations (1999); FPC 66, Test, 

Training, and Exercise (TT&E) Program for COOP (2001); and FPC 67, 

Acquisition of Alternative Facilities for COOP (2001). 
Appendix D 

Major Contributors to this Report

Audit of TSA Continuity of Operations Program 

Page 36 

 Philadelphia Audit Office

 Timothy J. Crowe, Director 

 Mark S. Phillips, Auditor-in-Charge 

 Patrick O’Malley, Program Analyst 

 Christine Haynes, Auditor 

 Michael A. Talevi, Referencer 

 
Appendix E 

Report Distribution 

Audit of TSA Continuity of Operations Program 

Page 37 

Department of Homeland Security

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretary 

Chief Privacy Officer 

Assistant Secretary, Transportation Security Administration 

Director, Federal Emergency Management Agency 

Assistant Secretary for Policy 

Assistant Secretary for Public Affairs 

Assistant Secretary for Legislative and Intergovernmental Affairs 

 Director, GAO/OIG Audit Liaison Office 

DHS OIG Liaison, TSA 

Office of Management and Budget

Chief, Homeland Security Branch 

DHS OIG Budget Examiner

Congress

Congressional Oversight and Appropriations Committees, as appropriate
Additional Information and Copies 

To obtain additional copies of this report, call the Office of Inspector General (OIG) at 

(202) 254-4100, fax your request to (202) 254-4285, or visit the OIG web site at 

Hwww.dhs.gov/oigH. 

OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal 

or noncriminal misconduct relative to department programs or operations, call the 

OIG Hotline at 1-800-323-8603; write to DHS Office of Inspector General/MAIL 

STOP 2600, Attention: Office of Investigations - Hotline, 245 Murray Drive, SW, 

Building 410, Washington, DC 20528, fax the complaint to (202) 254-4292; or email 

DHSOIGHOTLINE@dhs.gov. The OIG seeks to protect the identity of each writer 

and caller.