Department of Homeland Security
 

DHS’ Intelligence Community Members’ 


Continuity of Operations and 


Intelligence Readiness 


OIG-12-87 June 2012
 
Office of Inspector General 

u.s. Department of Homeland Security 

Washington, DC 20528 

Homeland 

Security 

June 19, 2012
 

Preface 

The Department of Homeland Security (DHS) Office ofInspector General (OIG) was 

established by the Homeland Security Act of2002 (Public Law 107-296) by amendment 

to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 

special reports prepared as part of our oversight responsibilities to promote economy, 

efficiency, and effectiveness within the Department. 

This report addresses the strengths and weaknesses ofDHS' Intelligence Community 

members' Continuity of Operations programs. It is based on interviews with employees 

and officials of relevant agencies and institutions, direct observations, and a review of 

applicable documents. 

The recommendations herein have been developed to the best knowledge available to our 

office, and have been discussed in draft with those responsible for implementation. We 

trust this report will result in more effective, efficient, and economical operations. We 

express our appreciation to all of those who contributed to the preparation of this report. 

Acting Inspector General 
Executive Summary.............................................................................................................1
 

Background..........................................................................................................................2
 

Results of Review ................................................................................................................6
 

Office of Intelligence and Analysis .........................................................................7
 

COOP Program Evolution .......................................................................................8
 

Implementing Federal Continuity Directive-1 Requirements................................11
 

Recommendations..................................................................................................20
 

Management Comments and OIG Analysis ..........................................................21
 

United States Coast Guard Intelligence and Criminal Investigations................23
 

COOP Program Evolution .....................................................................................25
 

Implementing Federal Continuity Directive-1 Requirements................................26
 

Recommendations..................................................................................................32
 

Management Comments and OIG Analysis ..........................................................32
 

Appendices 

Appendix A: Purpose, Scope, and Methodology........................................................35
 

Appendix B: Recommendations .................................................................................36
 

Appendix C: Management Comments to the Draft Report ........................................37
 

Appendix D: Major Contributors to This Report........................................................40
 

Appendix E: Report Distribution................................................................................41
 

Abbreviations 

COOP Continuity of Operations
 

CG-2 Intelligence and Criminal Investigations
 

DHS Department of Homeland Security
 

ERG Emergency Relocation Group
 

FCD Federal Continuity Directive
 

FEMA Federal Emergency Management Agency
 

HSPD Homeland Security Presidential Directive
 

I&A Office of Intelligence and Analysis
 

IC Intelligence Community
 

NSPD National Security Presidential Directive
 

OIG Office of Inspector General
 

USCG U.S. Coast Guard
 

Table of Contents/Abbreviations 
OIG
 

Department of Homeland Security 

Office of Inspector General 

Executive Summary 

The Department of Homeland Security’s (DHS) Office of 

Intelligence and Analysis (I&A) and the United States Coast 

Guard’s (USCG) Office of Intelligence and Criminal 

Investigations share the common function of performing as DHS 

departmental elements and Intelligence Community members. 

We assessed the DHS Intelligence Community members’ 

Continuity of Operations programs as part of our Fiscal Year 2011 

Annual Performance Plan. Specifically, we focused on the 

program’s history, evolution, activities, and coordination and 

collaboration efforts. Our objectives were to ensure Continuity of 

Operations definition alignment with the National Continuity 

Policy; to ensure that plans adequately address requirements set 

forth in the National Continuity Policy; to determine whether 

Continuity of Operations training and exercises test capabilities 

and identify potential areas of improvement; and to determine 

whether new planning efforts incorporate lessons learned and 

corrective action resulting from prior exercises or actual events. 

The plans of both I&A and USCG address the required areas that 

define a viable Continuity of Operations plan and are consistent 

with national directives and DHS guidance. Senior leadership for 

both components have effectively assessed their programs and are 

confident that Continuity of Operations functions will be 

performed and sustained during emergency situations. However, 

both the Office of Intelligence and Analysis and USCG 

Intelligence and Criminal Investigations Continuity of Operations 

plans can be strengthened by defining roles and responsibilities 

better, adding more realistic exercise scenarios, and updating plans 

to reflect current operational capabilities. 

We are making eight recommendations to help DHS Intelligence 

Community members strengthen their Continuity of Operations 

plans and programs and to improve oversight. The Department 

concurred with seven recommendations and did not concur with 

one. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 1 
 

Background 

The terrorist attacks of September 11, 2001, and hurricanes Katrina 

and Rita in 2005 are examples of mass destruction and chaos 

caused by manmade and natural disasters. In November 2009, 

shootings at Fort Hood in Killeen, Texas, exemplified the ongoing 

threat of radicalized domestic extremism, further evidenced by the 

December 2009 Christmas Day bombing attempt on board 

Northwest Flight 253. The death of Osama Bin Laden in May 

2011 and other recent events have not curtailed global terrorist 

activities against the United States or its foreign interests. The 

threat of terrorism and natural events beyond our control are two 

primary reasons why the Federal Government relies on Continuity 

of Operations (COOP) plans. COOP plans enable a more rapid 

and effective response to and recovery from an emergency, 

regardless of cause, size, or complexity. 

DHS has five missions: 

• Preventing terrorism and enhancing security 

• Securing and managing our borders 

• Enforcing and administering our immigration laws 

• Safeguarding and securing cyberspace 

• Ensuring resilience to disasters 

To accomplish its missions, DHS must perform operations 

efficiently and effectively, with minimal disruption of essential 

functions, especially during any type of disaster or emergency. 

The severity and consequences of a disaster or emergency are 

difficult to predict, but effective contingency planning can 

minimize the effect on DHS personnel, resources, and operations. 

National Continuity Policy 

The U.S. Government’s National Continuity Policy, as outlined in 

the May 7, 2007, National Security Presidential Directive 51 

(NSPD-51)/Homeland Security Presidential Directive (HSPD-20), 

establishes as national policy the requirement for each department 

and agency of the executive branch to maintain a comprehensive 

and effective continuity capability composed of Continuity of 

Government and COOP programs. These programs are to ensure 

the preservation of our form of government under the Constitution, 

including the functioning of the three separate branches, and the 

continuing performance of National Essential Functions under all 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 2 
 

conditions. National Essential Functions, as defined in NSPD51/HSPD-20, represent the overarching responsibilities of the 

Federal Government to lead and sustain the Nation during a 

catastrophic emergency and will be the primary focus of the 

Federal Government’s leadership during and in the aftermath of an 

emergency. 

Continuity of Government refers to a coordinated effort within the 

executive branch to ensure that National Essential Functions 

continue to be performed during a catastrophic disaster or 

emergency. COOP refers to an effort within individual executive 

departments and agencies to ensure that Primary Mission-Essential 

Functions continue to be performed during a wide range of 

disasters or emergencies.1 When a disaster, emergency, or 

significant event occurs, COOP procedures may be initiated. Upon 

COOP activation, mission-essential personnel will receive 

information pertaining to the threat condition, whether to report to 

an alternate site, and if so, the reporting time. Once personnel are 

present at the alternate site, they will continue to perform their 

organization’s Primary Mission-Essential Functions. 

National Essential Functions 

National Essential Functions must be maintained at all times, while 

Primary Mission-Essential Functions are unique to each department 

and agency. There are eight National Essential Functions: 

•	 Ensuring the continued functioning of the Federal 

Government under the Constitution, including the 

functioning of the three separate branches of government; 

•	 Providing leadership visible to the Nation and the world 

and maintaining the trust and confidence of the American 

people; 

•	 Defending the Constitution of the United States against all 

enemies, and preventing or interdicting attacks against the 

United States or its people, property, or interests; 

1 Primary Mission-Essential Functions, as defined in NSPD-51/HSPD-20, are those department and agency 

Mission-Essential Functions that must be performed to support or implement the performance of the 

National Essential Functions before, during, and in the aftermath of an emergency. They are required to be 

performed continuously during an event or resumed within 12 hours of an event, and to be maintained for 

up to 30 days after an event or until the resumption of normal operations. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 3 
•	 Maintaining and fostering effective relationships with 

foreign nations; 

•	 Protecting against threats to the homeland and bringing to 

justice perpetrators of crimes or attacks against the United 

States or its people, property, or interests; 

•	 Providing rapid and effective response to and recovery 

from the domestic consequences of an attack or other 

incident; 

•	 Protecting and stabilizing the Nation’s economy and 

ensuring public confidence in its financial systems; and 

•	 Providing for critical Federal Government services that 

address the national health, safety, and welfare needs of the 

United States.2 

Resources required to perform National Essential Functions 

include trained personnel, equipment, and consumable office 

supplies.3 The proper identification and prioritization of these 

functions are critical for creating a viable COOP plan. When 

departments and agencies identify too many functions as essential, 

resources may be allocated to sustain nonessential functions, 

impeding work on essential tasks. 

National Continuity Policy Implementation Plan and Federal 

Continuity Directive 

In August 2007, the President approved the National Continuity 

Policy Implementation Plan. This plan augments the National 

Continuity Policy and provides guidance to executive branch 

departments and agencies on identifying and executing their 

Primary Mission-Essential Functions. To provide operational 

guidance in implementing this policy, the Federal Emergency 

Management Agency (FEMA) within DHS coordinated with its 

interagency partners and developed the Federal Continuity 

Directive-1 (FCD-1), Federal Executive Branch National 

Continuity Program Requirements (February 2008). FCD-1 

provides direction to executive branch departments and agencies 

2 NSPD-51/HSPD-20 § (5)(a)-(h).
 

3 Essential Functions include all activities and resources necessary to support and maintain National 


Essential Functions and department- and agency-specific Primary Mission-Essential Functions and
 

Mission-Essential Functions.
 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 4 
 

 

on identifying and implementing the requirements to maintain a 

COOP capability.4 

FCD-1 states that a viable COOP program will include the 

following 10 elements: 

• Essential functions 

• Alternate operating facilities 

• Delegations of authority 

• Orders of succession 

• Devolution planning 

• Vital records management 

• Interoperable communications 

• Test, training, exercise, and evaluation program 

• Human resources and capital 

• Reconstitution 

At the request of the Assistant Inspectors General for Inspections 

Working Group of the Intelligence Community (IC) Inspectors 

General Forum, all IC Offices of Inspectors General (OIGs) agreed 

to conduct evaluations of COOP and Intelligence Readiness 

programs for their respective departments and agencies. These 

evaluations were to assess COOP programs and capabilities for 

elements in each organization that are funded by the National 

Intelligence Program.5 

The IC members represent 16 different Federal Government 

departments and agencies. DHS has two IC members: the I&A 

and the U.S. Coast Guard Intelligence and Criminal Investigations 

(USCG CG-2). DHS IC members are the conduit between the IC 

and other DHS components. I&A and USCG CG-2 are 

responsible for ensuring the integration and continuity of 

intelligence to and from the IC during regular operational periods 

and national disasters and emergencies. I&A and USCG CG-2 

have the unique ability to function as both departmental 

components and IC members in times of national disasters and 

emergencies. 

4 FCD-1’s provisions apply to the executive departments listed in 5 U.S.C. § 101, including DHS;
 

independent establishments as defined by 5 U.S.C. § 104(1); government corporations as defined in
 

5 U.S.C. § 103(1); and the U.S. Postal Service. Throughout this report, we refer to these entities as 


“departments and agencies.”


5 The National Intelligence Program funds intelligence activities in several Federal departments and
 

agencies. Detailed funding requests for intelligence activities are classified.
 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 5 
We reviewed COOP and Intelligence Readiness programs for I&A 

and USCG CG-2 to determine the following: 

•	 Whether the COOP definitions used align with the National 

Continuity Policy; 

•	 The extent to which the IA and USCG CG-2 COOP plans 

address the requirements set forth in the National 

Continuity Policy; 

•	 Whether COOP training and exercises test capabilities and 

identify potential areas of improvement; and 

•	 Whether new planning efforts incorporate lessons learned 

and corrective action resulting from prior exercises or 

actual events. 

Our report addresses DHS IC member efforts and capabilities, not 

the Department’s overall COOP plan and program. However, we 

reviewed DHS’ and USCG’s plans to ensure that I&A and USCG 

CG-2 plans are included in the Department and USCG plans. 

Results of Review 

I&A and USCG CG-2 have provided effective oversight of their respective COOP 

programs. Both have reviewed and confirmed component-specific Essential 

Functions, reviewed office-level COOP plans, and prepared multiyear strategies 

and management plans to guide each program. Neither I&A nor USCG CG-2 

distinguishes between Primary Mission-Essential Functions and Mission-Essential 

Functions; they consider all critical mission functions to be Essential Functions. 

Senior leadership of both components is engaged in building viable COOP plans. 

I&A and USCG CG-2 COOP program officials say that their COOP plans allow 

both components to maintain a successful COOP posture and execute their 

Essential Functions during a significant national event. Continuity planning is 

consistent because both components’ policies define authorities and responsibilities 

to reflect current national directives and guidance. I&A and USCG CG-2 COOP 

training and exercises are sufficient to prepare and assess component abilities to 

provide essential services during a significant emergency. However, improvements 

can be made to better define roles and responsibilities, enhance exercises to 

simulate real-world events, and update plans to reflect current operational 

capabilities. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 6 
Both plans are centric to operations and sustainment of the Department and not 

the IC. There are no interagency or IC-level Mission-Essential Functions in 

I&A’s plan, but USCG CG-2 has one plan that supports all essential requirements 

tasked to USCG. Both I&A and USCG CG-2 receive and transmit information to 

other IC departments and agencies that assist in ensuring that DHS MissionEssential Functions are met. Figure 1 lists the national, DHS, I&A, and USCG 

CG-2 Essential Functions. 

Figure 1: Essential Functions: National, DHS, I&A, and USCG CG-2 

Source: NSPD-51/HSPD-20, DHS, I&A, and USCG CG-2. 

Office of Intelligence and Analysis 

I&A was created in 2003 and is responsible for ensuring that timely and 

actionable homeland security information and intelligence is provided to 

national leadership, as well as State, tribal, local, and private sector 

stakeholders. I&A has 15 divisions organized under three Deputy Under 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 7 
 

Secretaries and one directorate, as reflected in figure 2. I&A defines 

COOP as the ability of the office and its leadership to continue performing 

I&A Essential Functions in the event that its headquarters is inaccessible 

or uninhabitable. I&A must establish an operational capability and 

perform Essential Functions within 12 hours of COOP activation and 

sustain those functions up to 30 days or until resumption of normal 

operations. 

Figure 2: I&A Organizational Structure 

Source: I&A. 

COOP Program Evolution 

From 2003 to 2007, I&A’s COOP program functioned more in theory than 

in practice. This is attributed to unclear guidance from senior leaders and 

the fact that designated COOP managers did not completely understand 

how COOP programs are developed and maintained. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 8 
 

 

In 2007, I&A hired a COOP staff who are trained to develop, maintain, 

and execute its COOP program within established directives and policies. 

As a result, I&A has identified and defined Essential Functions, 

participated in government-wide and internal COOP exercises, and 

conducted periodic informational meetings to identify its level of COOP 

preparedness. I&A officials said that they maintain a level of COOP 

capability that would sustain the performance of Essential Functions. 

I&A has identified an Emergency Relocation Group (ERG) to ensure the 

continuation of I&A’s Essential Functions in the event of a COOP 

activation and execution. When I&A operations are disrupted, the I&A 

Under Secretary or a designated successor may activate its COOP plan. 

Upon notification of a COOP situation, the ERG will relocate to the 

designated alternate operations facility site to continue I&A’s Essential 

Functions. 

I&A’s COOP plan also includes ERG intelligence elements from other 

DHS components. In 2008, DHS’ Chief Intelligence Officer established 

the Intelligence Enterprise Continuity Working Group. The working 

group is responsible for developing plans and procedures to ensure that 

DHS intelligence elements are able to operate cohesively and effectively 

to respond to all-hazard emergencies. I&A collaborates with the DHS 

intelligence element to provide intelligence support to national and 

homeland security leaders, while supporting Federal, State, local, territorial, 

tribal, and private sector partners and customers.6 In addition to I&A and 

USCG CG-2, the DHS intelligence element consists of the following: 

•	 U.S. Customs and Border Protection’s Office of Intelligence and 

Operations Coordination 

•	 U.S. Immigration and Customs Enforcement’s Office of Intelligence 

•	 Transportation Security Administration’s Office of Intelligence 

and Analysis 

•	 U.S. Citizenship and Immigration Services’ Office of Fraud 

Detection & National Security 

•	 United States Secret Service’s Office of Strategic Intelligence and 

Information 

In I&A, 8 of the 15 divisions have individual Incident Management plans 

that align with the overall I&A headquarters COOP plan.7 The Homeland 

Counterterrorism, Current Intelligence, and Cyber, Infrastructure, and 

Science Divisions are relatively new and are drafting Incident 

6 U.S. Department of Homeland Security Intelligence Enterprise Continuity Draft Plan, June 2011. 

7 Incident Management plans detail how an organization will respond to emergency situations during 

Continuity of Operations events. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 9 
Management plans as of November 2011. The State and Local Program 

Office Incident Management plan covers its two divisions, and the 

Program Performance and Management and Strategy, Plans, and Policy 

Divisions do not have any Essential Functions or ERG personnel. 

Support and Planning Efforts 

COOP is a priority for I&A leadership and has consistent senior 

and midlevel leadership support. I&A has a 2010 COOP plan that 

addresses all FCD-1 elements, although the sections concerning 

devolution and vital records are not fully developed. COOP 

program officials believe that an I&A policy should be developed 

to direct each internal I&A office and division to develop and 

maintain COOP plans. The policy should also provide 

documentation of nonoperational program requirements, to allow 

the updated I&A COOP plan to focus on operational requirements 

and ensure that continuity applies to all I&A personnel and not just 

ERG members. 

COOP planning occurs at all I&A levels. The Continuity and 

Exercise Programs Branch manages I&A’s COOP program. 

Program managers collaborate with I&A management to build 

COOP awareness and support. 

I&A COOP program managers are former FEMA employees who 

are trained in all aspects of continuity operations. Contingency 

Plans and Exercise Branch personnel are capable of developing, 

executing, and maintaining a COOP program. Primary duties for 

I&A COOP program managers are building and sustaining COOP 

capabilities. Maintaining division-level COOP responsibilities is 

an additional duty. All division-level managers possess functional 

COOP program knowledge, with some possessing expert 

knowledge in maintaining a program. As a result, I&A officials 

said they have improved the accountability, oversight, and 

visibility of their COOP program. 

Working Group Collaboration 

I&A participates in several DHS and Office of Director of National 

Intelligence COOP working groups.8 The Office of Director of 

National Intelligence working groups include the National 

8 The Director of National Intelligence serves as the head of the IC, overseeing and directing National 

Intelligence Program implementation and acting as the principal advisor to the President, the National 

Security Council, and the Homeland Security Council for intelligence matters related to national security. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 10 
Intelligence Emergency Management Activity, the National 

Partners Advisory Group, and the Mission Technical Advisory 

Committee. The National Intelligence Emergency Management 

Activity focuses on Continuity of Government, while the National 

Partners Advisory Group focuses on the critical IC and non-IC 

support departments and agencies. The Mission Assurance 

Technology Committee focuses on information technology. 

DHS-led COOP working groups consist of the Interagency 

Continuity Test, Training, and Exercise Working Group, which is a 

FEMA-led forum that coordinates executive branch continuity 

issues, and the Department of Homeland Security Working Group, 

which is led by DHS’ Office of Operations Coordination and 

Planning and coordinates all DHS continuity issues. I&A also 

participates in the Office of Intelligence and Analysis Continuity 

Working Group, which coordinates I&A continuity issues, and the 

DHS Intelligence Enterprise Continuity Working Group, which 

coordinates I&A Intelligence Elements continuity issues. 

According to I&A COOP program and division managers, 

participation in these working groups and the exchange of ideas 

and information help I&A form a concerted and cohesive COOP 

plan that is in accordance with Federal regulations and Federal and 

Department policies. 

Implementing Federal Continuity Directive-1 Requirements 

Essential Functions 

FCD-1 requires departments and agencies to identify and prioritize 

their organization’s Essential Functions as a basis for COOP 

planning, and to identify staffing, resource requirements, and other 

supporting activities necessary to perform such functions. By 

identifying and prioritizing Essential Functions, a department or 

agency establishes planning parameters that drive its efforts in all 

other planning and preparedness areas. Mission-Essential 

Functions are a broad set of Essential Functions that include not 

only an agency’s Primary Mission-Essential Functions, but also all 

other functions that must be continued throughout or resumed after 

a disruption of normal activities but do not rise to the level of 

Primary Mission-Essential Functions. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 11 
I&A’s COOP plan prioritizes Essential Functions based on their 

criticality or time sensitivity according to likely COOP triggers and 

scenarios. I&A officials periodically review Essential Functions to 

ensure that mission continuity is met under all conditions. In 2010, 

I&A reviewed its Essential Functions and determined that they 

were adequate for I&A to continue its mission. That review 

included analyzing, prioritizing, and identifying interdependencies 

and required resources. In July 2012, I&A, along with the other 

DHS components, will be reviewing and assessing their Essential 

Functions to better enable the Department to perform missioncritical functions during and following a real-world emergency. 

The eight divisions that have COOP plans each have Essential 

Functions listed in their plan. However, the different division 

Essential Functions are not listed in the overall I&A COOP plan. 

Should senior leadership need to determine a specific division 

function, they would have to review each plan, potentially losing 

critical time during a COOP event. 

Alternate Operating Facilities 

FCD-1 requires department and agency COOP plans to identify 

and prepare alternate operating facilities where staff can perform 

their Essential Functions. The alternate operations facility must be 

functional within 12 hours of COOP activation and sustainable for 

at least 30 days. These facilities should be located away from 

vulnerable areas and provide support, infrastructure, systems, and 

security for the relocated personnel. 

Since 2003, I&A has used the Bluemont Emergency Relocation 

Site as its alternate operating facility. The configuration of the 

Bluemont facility meets I&A COOP activities requirements and 

complies with FCD-1 requirements. I&A ERG members and 

senior leadership report to different buildings on the Bluemont 

Emergency Relocation Site. Due to the separation of senior 

leadership and the ERG, communication was not always timely. 

During the 2011 Eagle Horizon Exercise, I&A addressed the 

communication issue with technology that allowed senior 

leadership direct communication with ERG members.9 Personnel 

unable to reach the Bluemont facility can telework to continue 

I&A Essential Functions. However, as the majority of I&A 

9 The Eagle Horizon Exercise is an annual, integrated continuity exercise for all Federal departments and 

agencies, mandated by NSPD-51/HSPD-20 and the National Continuity Policy Implementation Plan. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 12 
 

Essential Functions depend on sensitive or classified information, 

telework is not feasible for most personnel. 

Most I&A division officials said that the Bluemont facility has 

enough resources to perform their Essential Functions. During a 

site visit to the Bluemont facility in June 2011, we determined that 

the size and configuration of both buildings that I&A occupies can 

accommodate 100 percent of the emergency personnel identified in 

I&A’s COOP plan. 

Orders of Succession 

FCD-1 requires departments and agencies to establish, promulgate, 

and maintain orders of succession to key positions. Orders should 

be of sufficient depth to ensure that the agency can manage and 

direct its essential functions and operations while remaining a 

viable part of the Federal Government throughout any emergency. 

I&A’s plan defines the order of succession of the Under Secretary, 

I&A Chief Intelligence Officer, and other I&A offices critical to 

ensuring leadership during an emergency. I&A Division succession 

orders are detailed in each division’s COOP implementation plan 

and maintained as separate documents. Each division is 

responsible for maintaining orders of succession for the office of 

Division Director. 

Delegations of Authority 

FCD-1 requires departments and agencies to predelegate 

authorities for making policy determinations and other decisions to 

ensure rapid response to any disaster or emergency requiring 

COOP plan activation. 

I&A’s COOP plan includes predelegation of authorities for making 

policy determinations and decisions, at headquarters and other 

organizational locations, that complies with FCD-1 requirements. 

The plan states that assumption of delegated authorities will occur 

when communications between I&A staff and primary office 

holders are severed for more than 2 hours. Authorities automatically 

transfer to the most senior available successor identified, and relief 

occurs when communication with the primary office holder is 

reestablished or a new authority is appointed. 

The plan’s delegations of authority and orders of succession are 

current and reflect changes in senior I&A leadership and I&A 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 13 
organizational structure occurring in the past 2 years. According 

to I&A COOP program officials, personnel who could be 

delegated authorities in an emergency or be designated successors 

are trained or briefed on their roles. Each division’s COOP plan 

contains delegations of authority and orders of succession that 

comply with FCD-1. 

Devolution Planning 

FCD-1 requires that departments and agencies conduct devolution 

planning to identify how they will continue Essential Functions 

during increased threat situations or in the aftermath of an 

emergency or catastrophic disaster. Devolution planning refers to 

the preparation necessary to transfer statutory authority and 

responsibilities for Essential Functions of a department or agency 

to another organizational element, such as a field office, if an 

organization’s alternate operating facility or emergency relocation 

personnel are unavailable or incapacitated. 

As of November 2011, I&A had identified a devolution site but 

had not developed a feasible devolution plan to ensure that its 

Essential Functions would be continued if the I&A headquarters or 

the alternate operating facility is unavailable. 

Vital Records Management 

FCD-1 requires departments and agencies to identify, protect, and 

make readily available vital records, databases, and hard copy 

documents to support Essential Functions during COOP disasters 

and emergencies. There are two types of vital records: 

•	 Emergency Operating Records: Records and databases are 

essential to the functioning of or reconstituting of an 

agency during and after a continuity event. Emergency 

plans and directives; orders of succession; delegations of 

authority; staffing assignments; and related records of a 

policy or procedural nature that provide staff with guidance 

and information resources necessary for conducting 

operations during an emergency situation, and for resuming 

formal operations at its conclusion. 

•	 Legal and Financial Records: Records that are critical to 

carrying out an organization’s essential legal and financial 

functions and activities, and that protect the legal and 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 14 
 

 

financial rights of individuals directly affected by its 

activities. 

The I&A COOP plan describes the need for a vital records 

program to support COOP operations, but the plan does not specify 

which records should be included. I&A program managers said 

that some vital records are paper-based and some are stored 

electronically at the permanent work center and alternate operating 

facility. However, the plan does not identify where vital records 

are stored; whether the records are paper-based, electronic, or both; 

or when the records should be updated. 

Interoperable Communications 

According to FCD-1, departments and agencies must establish 

interoperable communications that provide the capability to perform 

Essential Functions until normal operations can be resumed. 

In 2007, I&A had redundant systems only for its unclassified and 

SECRET networks. In July 2011, I&A conducted a successful test 

of the TOP SECRET network system. This was a major 

accomplishment, as the test demonstrated redundant communication 

capability with the IC and DHS components. Communications and 

databases are tested and updated regularly with software and 

changes requested by COOP program managers or division COOP 

coordinators. 

I&A has established interoperable and redundant communications, 

and systems are available to support communication with 

employees, Department leadership, and other elements and 

locations during an emergency. I&A officials said that I&A 

provides multiple communication modes capable of transmitting, 

receiving, and coordinating classified information at its alternate 

operating facility. This communication capability includes the use 

of the Joint Worldwide Intelligence Communications System and 

secure telephones and fax machines.10 I&A’s Information 

Technology Division is charged with ensuring continuity of 

communications at its primary workplace and the alternate 

operating facility. At the alternate operating facility, I&A has a 

full-time site coordinator and staff to ensure that communications 

10 The Joint Worldwide Intelligence Communications System is designed to meet the requirements for 

secure TOP SECRET/Sensitive Compartmented Information multimedia intelligence communications 

worldwide. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 15 
are reliable and updated with new databases or programs to support 

mission requirements. 

I&A is able to receive, coordinate, and deliver information at all 

security and classification levels. All I&A divisions have access to 

all files and databases that are needed to continue Essential 

Functions. 

To coordinate with personnel during an emergency, I&A uses the 

Government Emergency Telecommunications Service and the 

Wireless Priority Service emergency telephone and wireless 

services. All I&A ERG personnel have government-issued cellular 

telephones. 

Test, Training, Exercise, and Program Evaluation 

FCD-1 requires that departments and agencies assess, demonstrate, 

and improve their ability to execute COOP plans and programs 

through testing, training, and an exercise program. 

I&A has participated in several internal and government-wide 

COOP exercises, and has developed a test, training, and exercise 

program. The program validates, identifies issues for subsequent 

correction, and specifies aspects of COOP capabilities, procedures, 

systems, and facilities used in response to emergencies. 

I&A COOP officials said that COOP procedure and system tests 

have occurred during national COOP exercises and in association 

with events such as the 2009 Presidential inauguration, the 2009 

State of the Union Address, and the 2011 Eagle Horizon Exercise. 

I&A is starting to use more tabletop exercises to provide additional 

participants with opportunities to work through various scenarios 

and the COOP process.11 COOP program managers encourage all 

division-level COOP coordinators to conduct tabletop exercises to 

foster a better understanding of their COOP procedures and 

processes. 

I&A’s COOP program manager explained that I&A uses the 

automated Emergency Notification System to notify essential 

personnel of an emergency. The notification system will inform 

personnel of the event, the COOP level, and where and when to 

11 A tabletop exercise is a discussion guided by a facilitator(s) that simulates an emergency situation in an 

informal environment. The focus of the exercise is on training and familiarization with roles, procedures, 

and responsibilities. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 16 
report. Testing consists of calling or sending an email to all 

essential employees and ensuring that they received the message. 

COOP program officials said the system is tested regularly to 

ensure that contact information is correct. I&A also uses a “phone 

tree” system—a system of successive telephone calls that start and 

end with a specified person—as a backup procedure to inform 

personnel of COOP situations. 

As of November 2011, National-Level Exercises and internal 

tabletop exercises were scripted, with information communicated 

in advance. COOP program officials and division-level 

coordinators have weeks to plan and ensure that information is 

understood. For example, the 2011 Eagle Horizon Exercise 

provided predetermined scenarios and timelines for the event. 

Scripted exercises are useful in ensuring that personnel know the 

notification process, where to be, and how to access their systems 

to continue performing Essential Functions. However, the 2011 

Eagle Horizon Exercise tested the I&A notification system and 

how personnel deployed, but did not test the COOP process to 

react to a real emergency. 

The exercise was conducted as a tabletop exercise, with limited 

COOP activities for I&A divisions, and provided no opportunity 

for a “hot wash” or After Action Report to determine the success 

of the exercise.”12 Division-level coordinators interviewed said 

that no-notice exercises would be more practical in gauging how 

the COOP program functions. They also said that exercises should 

always be evaluated. 

I&A has ensured that its personnel are trained to implement COOP 

plans and carry out Essential Functions in a COOP situation. All 

division coordinators we interviewed said that they had completed 

the mandatory FEMA COOP training. Three division coordinators 

said that more training could enhance their knowledge of COOP 

and that they would be interested in attending additional training. 

I&A leadership requires all I&A personnel to complete the online 

FEMA COOP and emergency preparedness training through the 

DHS Intranet DHScovery website. This system informs COOP 

officials when I&A personnel have taken the basic-level COOP 

12 A hot wash normally includes all parties who participated in an exercise or response activities. These 

events are used to create an After Action Report to discuss and evaluate performance and areas requiring 

remediation. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 17 
 

orientation. Upon completion of the COOP orientation course, all 

I&A personnel should have a basic knowledge of COOP. 

An effective testing, training, and exercise program is vital to 

improve the ability of departments and agencies to manage and 

execute their COOP programs. With an effective testing, training, 

and exercise program in place, I&A should have confidence that its 

COOP program is capable of supporting the execution of Essential 

Functions during a COOP situation. 

Evaluation 

During exercises or real emergencies, it is important to record 

lessons learned so that COOP program evaluation and corrective 

action can occur. I&A does not have a process in its plan for 

documenting lessons learned, but is developing an official process 

for recording lessons learned and corrective action plans. 

I&A officials describe their process as collecting comments on 

questionnaires developed by the COOP program managers and 

then developing an after-action plan within 30 days based on those 

comments and observations. Then, a series of working group 

meetings are held to address issues that should be included in a 

corrective action plan. The corrective action plan prioritizes what 

actions or issues should be addressed to enhance responses to realworld threats. One program official said that approximately 

90 percent of the lessons learned from the 2010 Eagle Horizon 

Exercise were incorporated into the I&A plan for the 2011 exercise. 

Each division COOP team is responsible for collecting and 

recording its lessons learned or feedback. Usually, those lessons 

learned are maintained at the division level, but they can be 

elevated for inclusion in overall I&A lessons. There is no formal 

requirement, however, for divisions to share feedback with the 

I&A COOP program office. 

I&A uses FEMA’s Continuity Evaluation Tool to assess elements 

of continuity described in FCD-1 and Federal Continuity 

Directive-2 (FCD-2), Federal Executive Branch Mission Essential 

Function and Primary Mission Essential Function Identification 

and Submission Process (February 2008).13 The Continuity 

13 FCD-2 implements the requirements of FCD-1, Annex C. It provides guidance and direction to 

executive branch departments and agencies for identifying their Mission-Essential Functions and potential 

Primary Mission-Essential Functions. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness
 

Page 18
 
 

Evaluation Tool supports the Readiness Report System, which 

evaluates an organization’s continuity plans and procedures. 

Exercises are scored by FEMA observers or self-scored by the 

COOP program manager. I&A retains the evaluations from 

multiple exercises to establish a baseline for the program. 

Reconstitution 

FCD-1 requires departments and agencies to provide reconstitution 

plans to transition from COOP status to an efficient normal 

operations status once the threat or disruption has passed. 

I&A’s COOP plan provides options for reconstitution from all 

disruption levels and movement from the COOP alternate 

operating facility or devolution site to the original facility or new 

operating site. It mentions that within 24 hours of an emergency 

relocation, the Office of the I&A Chief of Staff and the 

Information and Knowledge Management Division, in conjunction 

with the Continuity and Exercise Programs Branch, are to initiate 

and coordinate operations to salvage, recover, and restore I&A 

after receiving approval from appropriate law enforcement and 

emergency services officials. When the Under Secretary for I&A 

or other authorized official deems that the emergency situation has 

ended and is unlikely to recur— 

•	 Operations may continue from the alternate operating 

facility/emergency relocation site; 

•	 I&A headquarters may be reconstituted with returning 

staff; or 

•	 I&A may begin to reconstitute in another designated 

location. 

I&A’s COOP plan requires each division to appoint a representative 

to the Reconstitution Working Group. This working group is led 

by the Reconstitution Manager, who oversees the transition. In 

planning for reconstitution, the Reconstitution Working Group and 

Reconstitution Manager are tasked with the following: 

•	 Coordinating with the General Services Administration to 

obtain office space when I&A’s alternate operating facility 

is deemed uninhabitable; 

•	 Developing space allocation and facility requirements; 

•	 Developing a time-phase plan, listing functions and projects 

in order of priority for resuming normal operations; and 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 19 
•	 Developing procedures, as necessary, for reconstituting 

I&A staff. 

However, I&A’s reconstitution process has not been fully tested. 

As a result, it may not be adequate and will need to be tested to 

ensure conformity with FCD-1. 

Human Capital and Resources 

FCD-1 requires departments and agencies to ensure that human 

capital strategies for their continuity staff are adaptable to 

changing circumstances and a variety of emergencies. 

I&A’s COOP plan includes the required procedures and guidance 

on human resource issues related to continued operations. I&A 

has a comprehensive plan that responds to the threats its employees 

are likely to encounter during an emergency. The plan includes the 

human factors that need to be considered during a crisis, such as 

expected roles and responsibilities, staffing, pay, and notification 

protocols. The plan indicates detailed administrative and 

personnel services support procedures for deploying I&A staff 

during an emergency. I&A has addressed telework as an 

emergency strategy in its COOP plan and program, albeit on a 

limited basis because of the classified networks and databases 

needed to complete I&A’s mission. I&A’s draft plan will address 

the use of existing DHS component field infrastructures and 

consider other options such as joint or shared facilities. 

Recommendations 

We recommend that the Under Secretary for Intelligence and 

Analysis/Chief Intelligence Officer: 

Recommendation #1: Develop an I&A COOP policy to codify 

COOP roles and responsibilities of all I&A divisions and offices in 

maintaining and enhancing COOP plans. 

Recommendation #2: Include all I&A division-level Essential 

Functions as annexes in I&A’s overall COOP Plan. 

Recommendation #3: Use the current emergency relocation site 

as an interim location for I&A devolution and establish a combined 

permanent and rotational cadre of I&A personnel to staff the site, 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 20 
while continuing to pursue options for establishing an emergency 

relocation site. 

Recommendation #4: Incorporate no-notice exercises that 

include realistic and factually based scenarios to simulate realworld threats, hazards, incidents, and events to gauge and evaluate 

I&A’s COOP program functionality. 

Recommendation #5: Conduct hot washes or similar actions to 

create After Action Reports for all COOP exercises or real-world 

events when COOP activation is considered or actual execution 

occurs, and use these reports to enhance COOP program 

capabilities. 

We evaluated the consolidated I&A and USCG written comments 

and have made changes to the report where we deemed 

appropriate. A summary of the written response to the report 

recommendations and our analysis of the response follow each 

recommendation. A copy of Department’s consolidated response, 

in its entirety, is included as appendix C. 

In addition, we received technical comments from I&A and USCG 

and incorporated these comments into the report where appropriate. 

I&A concurred with Recommendations 1, 2, 4, and 5, and did not 

concur with Recommendation 3. USCG concurred with 

Recommendations 6, 7, and 8 (below). We appreciate the 

comments and contributions made by each entity. 

Management Comments and OIG Analysis 

Management Response: I&A officials concurred with 

Recommendation 1. In its response, I&A said it has developed a 

draft continuity policy to codify the roles and responsibilities of 

I&A divisions and offices in maintaining and enhancing the 

program. In addition, I&A’s continuity policy provides 

documentation of nonoperational program requirements, allowing 

the updated I&A continuity plan to focus on operational 

requirements and ensuring that continuity applies to all I&A 

personnel and not just the Emergency Response Group. I&A 

expects to publish this policy by September 30, 2012. 

OIG Analysis: We consider I&A’s actions responsive to the 

intent of Recommendation 1, which is resolved and open. This 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 21 
 

recommendation will remain open pending our receipt of the 

updated I&A continuity policy. 

Management Response: I&A officials concurred with 

Recommendation 2. In its response, I&A said it is adding the 

division-level Essential Functions to the existing I&A continuity 

plan as well as the Essential Functions annex of the draft updated 

I&A continuity plan. I&A expects to finalize these by 

September 30, 2012. 

OIG Analysis: We consider I&A’s actions responsive to the 

intent of Recommendation 2, which is resolved and open. This 

recommendation will remain open pending our receipt of the 

updated I&A Continuity plan and the Essential Functions annex. 

Management Response: I&A officials did not concur with 

Recommendation 3. In its response, I&A said that, while this 

recommendation was valid during OIG fieldwork, because I&A 

had not identified a devolution site, I&A has since identified a 

devolution site and is training site personnel to perform the priority 

I&A Essential Functions and tasks. Rather than invest resources in 

an interim solution, I&A is focusing on the required equipment and 

training enhancements for the permanent devolution site. I&A 

expects to complete the first phase of these enhancements this 

year. I&A believes these actions address Recommendation 3 and 

respectfully requests it be closed. 

OIG Analysis: We consider I&A’s actions responsive to the 

intent of Recommendation 3, which is resolved and open. In 

response to I&A technical comments, this recommendation was 

modified from the draft report and now reads as follows: 

Revised Recommendation #3: Use the current emergency 

relocation site as an interim location for I&A devolution and 

establish a combined permanent and rotational cadre of I&A 

personnel to staff the site, while continuing to prepare devolution 

site for its role. 

This recommendation will remain open pending our receipt of 

documentation that evidences the plan for the identified devolution 

site. 

Management Response: I&A officials concurred with 

Recommendation 4. In its response, I&A said it will conduct the 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 22 
first in a series of annual no-notice COOP exercises to be 

conducted prior to the end of this calendar year. 

OIG Analysis: We consider I&A’s actions responsive to the 

intent of Recommendation 4, which is resolved and open. This 

recommendation will remain open pending our receipt of 

documentation that evidences the conduct of a no-notice COOP 

exercise. 

Management Response: I&A officials concurred with 

Recommendation 5. In its response, I&A said that rather than 

conducting a staged hot wash at the conclusion of exercise Eagle 

Horizon 2011, as was done for Eagle Horizon 2008, 2009, and 

2010, I&A required each 2011 participant to complete an 

observation and a participation form, thereby capturing all I&A 

Eagle Horizon 2011 participants’ issues in writing. The reports 

were then analyzed by I&A Continuity and Exercise Programs 

Branch personnel for trends to include in the DHS-wide hot wash, 

the I&A Eagle Horizon 2011 Quick Look After Action Report, and 

the I&A Corrective Actions Database. The Corrective Actions 

Database then tracks the status of in-process and resolved issues. 

Further, I&A will reincorporate staged hot washes and the creation 

of After Action Reports at the conclusion of all future COOP 

exercises and real-world events. I&A believes these actions 

address Recommendation 5 and respectfully requests it be closed. 

OIG Analysis: We consider I&A’s actions responsive to the 

intent of Recommendation 5, which is resolved and closed. No 

further reporting concerning this recommendation is necessary. 

United States Coast Guard Intelligence and Criminal 

Investigations 

For more than 200 years, USCG has safeguarded our Nation’s maritime 

interests in the heartland, in the ports, at sea, and around the globe. It 

protects the maritime economy and the environment, defends our maritime 

borders, saves those in peril at sea, and has the following 11 missions: 

• Ports, waterways, and coastal security 

• Drug interdiction 

• Aids to navigation 

• Search and rescue 

• Living marine resources 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 23 
 

• Marine safety 

• Defense readiness 

• Migrant interdiction 

• Marine environmental protection 

• Ice operations 

• Other law enforcement 

USCG CG-2’s mission is to direct, coordinate, and oversee intelligence 

and investigative operations and activities that support all USCG 

objectives.14 It conducts intelligence activities as defined in Executive 

Order 12333 and as part of the Law Enforcement Intelligence Program.15 

CG-2 includes headquarters elements as well as elements colocated with 

other intelligence departments and agencies (see figure 3). 

Figure 3: CG-2 Organizational Structure 

Source: CG-2. 

14 Hereinafter, USCG CG-2 is referred to as CG-2. 15 Executive Order 12333 § 1.4 requires that the agencies within the IC shall be in accordance with 

applicable U.S. law and with the other provisions of this order in conducting intelligence activities 

necessary for the conduct of foreign relations and the protection of the national security of the United 

States. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 24 
 

COOP Program Evolution 

Due to USCG’s military organizational structure and principles, continuity 

capabilities have always been established in policies and guidance. CG-2 

COOP plan development has been continually updated since USCG’s 

inclusion in the IC in 2001. The plan has evolved from being military 

based to including all requirements in FCD-1. CG-2 leadership and 

program managers have reshaped COOP policies to satisfy USCG, DHS, 

and IC requirements. CG-2 senior leaders understand how continuity 

plans are developed and maintained. 

Program officials define COOP as the ability of CG-2 and its leadership to 

continue performing its Essential Functions in the event that USCG 

headquarters is unsafe, unusable, or inaccessible. CG-2 must establish an 

operational capability and perform Essential Functions within 12 hours of 

COOP activation and sustain those functions for up to 30 days or until 

normal operations resume. 

CG-2 has defined its Essential Functions, participates in government-wide 

and internal COOP exercises, and conducts periodic informational 

meetings to identify its COOP preparedness level. USCG officials said 

they maintain a level of COOP capability that would sustain performance 

of its Essential Functions. 

CG-2 has identified an ERG to ensure continuation of its Essential 

Functions after COOP activation. If normal USCG operations are 

disrupted, the Assistant Commandant or a designated successor will 

activate the CG-2 COOP plan. Members of the ERG will then relocate to 

their respective alternate operations facilities to continue CG-2’s Essential 

Functions. 

Support and Planning Efforts 

The COOP program has consistent senior and midlevel leadership 

support, and senior officials have a stake in ensuring that CG-2 

programs comply with all Federal regulations and policies. CG-2 

management has recently dedicated more efforts to building COOP 

awareness and support because it believes more outreach will 

improve the accountability, oversight, and visibility of its COOP 

programs. 

As of November 2011, CG-2 was using a 2009 plan as guidance. 

The 2009 plan addresses all the requirements for an effective 

COOP program. However, prioritization of Essential Functions 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 25 
 

and clearly defined order of succession and delegation of authority 

need improvement. Prioritization of Essential Functions will help 

determine where and how resources will be most effective. Order 

of succession and delegation of authority are two distinct functions, 

and better delineation is needed in the CG-2 COOP plan. CG-2 is 

drafting a new plan, which it expects to complete by summer 2012. 

CG-2’s Office of Plans and Policy Division manage its COOP 

program. A designated COOP program manager develops, 

implements, and maintains its COOP plan. CG-2 has trained 

personnel to develop, maintain, and execute a COOP program 

within established directives and policies. The CG-2 COOP 

program manager has other assigned duties. Program officials said 

that more of the program manager’s time should be dedicated to 

the COOP program; however, other duties may take priority. 

The divisions within CG-2 have designated COOP managers who 

work with COOP program officials to ensure that their plan 

encompasses all of CG-2. All division-level managers have 

functional COOP knowledge, with some possessing expert 

knowledge in maintaining a COOP program. COOP planning 

occurs at all CG-2 levels and takes into account different USCG 

work functions, depending on the emergency. 

Working Group Collaboration 

CG-2 participates in the same external Office of Director of 

National Intelligence COOP working groups and DHS internal 

working groups as I&A. CG-2 provides a different perspective to 

the working groups because of USCG’s unique mix of missions— 

military, law enforcement, and intelligence. 

Implementing Federal Continuity Directive-1 Requirements 

Essential Functions 

Each Essential Function contains Essential Tasks that support each 

function. CG-2’s Essential Functions are as follows: 

•	 Protective service operations for the USCG Commandant 

and Vice Commandant, or alternates 

•	 Intelligence support to USCG senior leadership and DHS 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 26 
 

 

•	 Intelligence systems/information technology and related 

connectivity 

•	 Physical/personnel security systems and safeguards 

•	 Intelligence support to area and subordinate field 


commanders
 

•	 Investigative operations in support of area and subordinate 

field commanders 

•	 Counterintelligence operations 

•	 IC requirements: Continued support for all necessary IC 

requirements 

As a result of changes in processes and new information, CG-2’s 

2009 COOP plan needs to be updated. COOP personnel said the 

Essential Functions and annexes need to be updated and 

prioritized. Because USCG is a multimission organization, 

prioritization will be challenging, but necessary to execute duties, 

allocate resources, and perform exercises more effectively. Until 

the plan is revised, it is difficult to assess which areas require 

resource modification. 

Alternate Operating Facilities 

CG-2 COOP personnel deploy to multiple locations during a 

COOP event. The specific relocation site will be determined by 

the Commandant or successor based on the nature of the incident 

or threat. However, as of November 2011, the location for all 

scenarios is the Operations Systems Center for the Intelligence 

Command Center for CG-2 essential staff and USCG Atlantic area 

headquarters for CG-2 Deputy Commandant and the Vice 

Commandant. CG-2 offices and members colocated with a hosting 

organization will work with that organization in support of USCG 

functions. Also, CG-2 personnel may need to relocate to the 

Bluemont Emergency Relocation Site with DHS intelligence 

elements. 

The Operations Systems Center is a government-owned, 

contractor-operated facility, which provides full support for the 

operationally focused USCG automated information systems. The 

Operations Systems Center has a full-time staff that maintains all 

its information systems. The center meets FCD-1 requirements for 

an alternate operating facility, and its configuration supports 

USCG and its 11 mission areas. The Operations Systems Center 

has space to accommodate current CG-2 COOP requirements and 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 27 
 

maintains unclassified, SECRET, and TOP SECRET systems 

needed to continue CG-2’s Essential Functions. 

Orders of Succession 

The COOP plan states that order of succession will occur in the 

absence, disability, or death of the CG-2 Assistant Commandant. 

Successors to the position of Assistant Commandant will serve 

until CG-2 is able to return to duty or a successor is chosen by the 

USCG Commandant. 

However, the plan does not clearly establish order of succession. 

No wording or displays illustrate who will succeed the Assistant 

Commandant or other positions if the person is unavailable to 

assume command. 

Delegations of Authority 

The CG-2 COOP plan includes predelegation of authorities that are 

in compliance with FCD-1 for making policy determinations and 

decisions at headquarters and other organizational locations. 

However, under delegation of authorities, two charts allude to 

succession of the program management and the delegation of 

authority for the intelligence advisors.16 This may lead to 

confusion over who is the successor for the CG-2 program and 

who has intelligence advisor authority. USCG headquarters COOP 

officials said the plan’s succession of command and delegations of 

authority need to be better defined. 

Devolution Planning 

USCG headquarters devolution planning supports overall 

continuity planning and addresses multiple threats and all-hazards 

emergency events that may render USCG leadership unavailable or 

incapable of supporting the execution of its Essential Functions 

from either USCG headquarter or alternate operating facilities. 

USCG headquarters’ Disaster and Continuity Division has 

developed a devolution option for continuity that incorporates 

succession of command and geographical separation of leadership, 

and addresses how USCG will conduct Essential Functions during 

an increased threat situation or in the aftermath of a catastrophic 

16 CG-2 COOP plan, August 2009. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness
 

Page 28
 
emergency. When the Commandant or a Continuity of Government 

Readiness change directs geographic separation of leadership, the 

ERG will proceed to Atlantic Area Headquarters. When the 

Commandant is unable to perform his or her duties, the Vice 

Commandant will assume the office and perform the duties with 

the support of the ERG and the Atlantic Area staff. 

Vital Records Program 

CG-2’s COOP plan identifies each vital record and its current 

location. The plan states that each record is accessible electronically 

at the primary facility in addition to being pre-positioned 

electronically at the alternate operating facilities. To ensure the 

redundancy and personnel resources needed to perform current 

missions, USCG requires each CG-2 member to have a “drive 

away kit.” The kit is to include any paper-based copies of the vital 

records needed to perform an Essential Function, Essential Task, 

or any other important function while operating under COOP 

conditions. 

However, COOP officials said that the Vital Records Program 

needs to define responsibilities, checklists, overall duties, and 

missions better. 

Interoperable Communications 

CG-2 has interoperable and redundant systems available to support 

communication with employees, Department leadership, and other 

elements and locations during an emergency. CG-2 program 

officials said that USCG has multiple communication modes at its 

alternate operating facilities, including unclassified, SECRET, and 

TOP SECRET levels. The USCG headquarters Intelligence 

Security Management Division has continuity of communications 

at the primary workplace and the alternate operating facilities. At 

the facilities, USCG has full-time site coordinators with staff to 

ensure that communications are reliable and continuously updated. 

USCG alternate operating facilities can communicate with all IC 

members’ systems through the use of the Joint Worldwide 

Intelligence Communication System and secure telephones and fax 

machines. CG-2 can receive, coordinate, and deliver information 

at all classification and security levels. At each alternate operating 

facility, CG-2 personnel have access to all files and databases to 

continue Essential Functions. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 29 
CG-2 uses the Government Emergency Telecommunications 

Service and the Wireless Priority Service to ensure access to 

telephone and wireless communications to contact and coordinate 

with personnel in an emergency. All CG-2 personnel have cellular 

telephones. In some situations, personal pagers can be used in 

classified spaces. 

Test, Training, Exercise, and Evaluation Program 

Testing, training, and exercising COOP capabilities are essential to 

demonstrate, assess, and improve CG-2’s ability to execute COOP 

plans. Training familiarizes COOP personnel with the Essential 

Functions and Essential Tasks they may have to perform in an 

emergency. Periodic testing also ensures that equipment is 

available and maintained and procedures are validated. 

The USCG National Command Center can activate the COOP 

notification process by using the Alert and Notification automated 

system. The senior officer available within CG-2 can also use the 

phone tree method to activate CG-2 COOP. 

CG-2 participates in several internal and government-wide COOP 

exercises. Its test, training, and exercise program works in concert 

with USCG’s overall headquarters plan. The program validates, 

identifies issues for subsequent correction, and specifies aspects of 

COOP capabilities, procedures, systems, and facilities used in 

response to an emergency. 

CG-2’s continuity training and exercises sufficiently prepare and 

assess USCG’s ability to conduct its Essential Functions during a 

significant emergency. However, CG-2 training could benefit 

from more realistic scenarios and better participation among all 

divisions. For example, during the National-Level Exercises, 

CG-2’s primary focuses are testing equipment, communication 

systems, and access to records. However, CG-2 has not tested full 

COOP capability, as scenarios have not required complete resource 

deployment. 

Evaluation 

CG-2 has a consistent process for addressing recommendations or 

gaps identified from lessons learned during exercises. The 2009 

and 2010 National-Level Exercise reports we reviewed contained 

sections where the COOP manager identifies action items and 

recommendations on how to complete those items, and designates 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 30 
which staff or group is responsible for each item. The After 

Action Reports were in the same format; however, they contained 

no consistent completion schedules. 

After an exercise, initial comments are collected, with 

approximately 30 days allowed to draft an After Action Report. 

Comments come from feedback questions generated by the COOP 

program managers. A series of working group meetings are held 

to address issues that should be included in a corrective action 

plan. The plan attempts to prioritize what should be worked on to 

respond to real-world threats. 

CG-2 uses the FEMA Continuity Evaluation Tool to assess 

elements of continuity outlined in FCD-1 and FCD-2. It also uses 

reports from DHS headquarters and I&A as part of the internal 

DHS working groups. Each division COOP team is responsible 

for collecting and recording its lessons learned or feedback. The 

lessons learned are incorporated into corrective action plans for 

CG-2, but can also be elevated for incorporation into overall 

USCG headquarters and DHS headquarters lessons learned. 

Although there is no mandate for divisions to share feedback 

outside USCG, CG-2 has a standard general practice to voluntarily 

provide feedback and follow up input from COOP lessons learned 

and After Action Reports to USCG headquarters COOP and 

planning offices, the Office of the Director of National Intelligence 

Exercise and Plans Office, I&A, and DHS headquarters. 

Lessons learned are incorporated into the COOP plan as solutions 

or enhancements for corrective action. According to CG-2 COOP 

program officials, when new lessons learned are not in the plan, 

new guidance for the next exercise or emergency may be issued. 

Reconstitution 

The USCG headquarters COOP plan states that the Commanding 

Officer of the Headquarters Support Command is responsible for 

reconstitution activities for USCG headquarters, which ensure that 

adequate facilities are available to house and support the 

Commandant and headquarters staff in a COOP environment. 

CG-2 is responsible for coordinating with Headquarters Support 

Command to ensure that space, systems, records, and security 

requirements are met at the reconstituted site. When that is not 

feasible, CG-2 will decide how to house USCG’s Intelligence 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 31 
Program assets and resources to ensure that all Essential Functions 

and Essential Tasks are fulfilled to the extent possible. 

Human Capital and Resources 

CG-2’s COOP plan includes the required procedures and guidance 

on human resource issues related to continued operations. The 

plan covers human capital resources and addresses the flexibilities 

that exist to assist managers and employees in an emergency. The 

plan covers communicating with employees, recall processes, pay 

and staffing flexibilities, and employee roles and responsibilities. 

CG-2’s plan also ensures that COOP capabilities take advantage of 

existing field infrastructures and considers other options, such as 

telecommuting locations, residential telework, virtual offices, and 

joint or shared facilities. Individuals who are unable to reach the 

alternate operating facilities and those who are not mission 

essential have options in communicating with managers and 

leadership to continue the USCG mission. 

Recommendations 

We recommend that the CG-2 Assistant Commandant for 

Intelligence and Criminal Investigations: 

Recommendation #6: Determine Essential Function priorities 

and appropriate resource requirements for each function in the 

updated CG-2 COOP plan. 

Recommendation #7: Clearly list and define order of succession 

and delegations of authority in the updated COOP plan and include 

the orders of succession in Vital Records, as stated in FCD-1. 

Recommendation #8: Incorporate no-notice exercises into COOP 

testing and training and base such exercises on real-world 

scenarios that are focused on the CG-2 mission. 

Management Comments and OIG Analysis 

Management Response: USCG officials concurred with 

Recommendation 6. In its response, USCG said that the corrective 

action plan will include a new section in the COOP plan that 

identifies each CG-2 office and/or unit’s Essential Function 

priorities and the appropriate resource requirements assigned to 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 32 
each function. USCG expects to incorporate this recommendation 

into the updated CG-2 COOP plan by October 1, 2012. 

OIG Analysis: We consider USCG’s actions responsive to the 

intent of Recommendation 6, which is resolved and open. This 

recommendation will remain open pending our receipt of the 

updated CG-2 COOP plan. 

Management Response: USCG officials concurred with 

Recommendation 7. In its response, USCG said that the corrective 

action plan will include a new section in the COOP plan that 

identifies each CG-2 office and/or unit’s order of succession and 

delegations of authority. This section will also include orders of 

succession in Vital Records, as stated in FCD-1. USCG expects to 

incorporate this recommendation into the updated CG-2 COOP 

plan by October 1, 2012. 

OIG Analysis: We consider USCG’s actions responsive to the 

intent of Recommendation 7, which is resolved and open. This 

recommendation will remain open pending our receipt of the 

updated CG-2 COOP plan. 

Management Response: USCG officials concurred with 

Recommendation 8. In its response, USCG said that the corrective 

action plan will include a new section in the COOP plan that 

details incorporating no-notice exercises into COOP testing and 

training, basing such exercises on real-world scenarios that are 

focused on the CG-2 mission. The results and lessons learned 

from the exercise will be documented in After Action Reports. 

USCG expects to incorporate this recommendation into the 

updated CG-2 COOP plan by October 1, 2012. 

OIG Analysis: We consider USCG’s actions responsive to the 

intent of Recommendation 8, which is resolved and open. This 

recommendation will remain open pending our receipt of the 

updated CG-2 COOP plan. 

Conclusion 

I&A and CG-2 have developed COOP plans that enable personnel to 

conduct Essential Functions at their alternate operating facilities during 

emergencies. Both plans establish alternate work sites, interoperable 

communications, and dedicated resources, enabling Essential Functions to 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 33 
be performed. I&A and CG-2 program offices have made COOP planning 

a priority and aligned their programs with Federal regulations and 

guidelines. 

With complete COOP plans, I&A and CG-2 are able to support, 

coordinate, and direct homeland security issues. As a result, DHS’ IC 

members are prepared to provide essential services during a significant 

national event. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 34 
 

Appendix A 

Purpose, Scope, and Methodology 

In January 2010, the Assistant Inspectors General for Inspections 

Working Group of the Intelligence Community Inspectors General 

Forum agreed to conduct evaluations of COOP and Intelligence 

Readiness programs within their organizations. These evaluations 

were to assess COOP for elements and capabilities in each 

organization that are funded by the National Intelligence Program. 

Within DHS, I&A and CG-2 are responsible for ensuring the 

integration and continuity of intelligence to and from the IC during 

regular operational periods and national emergencies. 

We assessed the status of the I&A and CG-2 COOP programs that 

pertain to the IC and determined whether policies, guidance, and 

processes are effective; whether Essential Functions can be 

performed during a wide range of emergencies; and the capability 

for sharing information between DHS and the IC. Specifically, our 

objectives were to determine whether— 

•	 The definitions of COOP that I&A and CG-2 use align with 

the National Continuity Policy; 

•	 I&A and CG-2 COOP plans adequately address 

requirements set forth in the National Continuity Policy; 

•	 COOP training and exercises test capabilities and identify 

potential areas of improvement; and 

•	 New planning efforts incorporate lessons learned and 

corrective actions from prior exercises or actual events. 

To achieve our objectives, we reviewed documents such as 

guidance, policies, procedures, and plans, and performed data 

analysis of information provided by DHS regarding organizational 

COOP. We interviewed DHS officials who have a role in 

preparing, planning, maintaining, and implementing COOP, as 

well as officials from the Federal Bureau of Investigation and 

Department of State. This allowed us to assess the effectiveness of 

DHS efforts and the level of collaboration among DHS 

components, external Federal departments and agencies, and the IC. 

Our review began in June 2011 and concluded in November 2011. 

We initiated this review under the authority of the Inspector 

General Act of 1978, as amended, and according to the Quality 

Standards for Inspections issued by the President’s Council on 

Integrity and Efficiency. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 35 
Appendix B 

Recommendations 

We recommend that the Under Secretary for Intelligence and 

Analysis/Chief Intelligence Officer: 

Recommendation #1: Develop an I&A COOP policy to codify 

COOP roles and responsibilities of all I&A divisions and offices in 

maintaining and enhancing COOP plans. 

Recommendation #2: Include all I&A division-level Essential 

Functions as annexes in I&A’s overall COOP Plan. 

Revised Recommendation #3: Use the current emergency 

relocation site as an interim location for I&A devolution and 

establish a combined permanent and rotational cadre of I&A 

personnel to staff the site, while continuing to prepare devolution 

site for its role. 

Recommendation #4: Incorporate no-notice exercises that 

include realistic and factually based scenarios to simulate realworld threats, hazards, incidents, and events to gauge and evaluate 

I&A’s COOP program functionality. 

Recommendation #5: Conduct hot washes or similar actions to 

create After Action Reports for all COOP exercises or real-world 

events when COOP activation is considered or actual execution 

occurs, and use these reports to enhance COOP program 

capabilities. 

We recommend that the CG-2 Assistant Commandant for 

Intelligence and Criminal Investigations: 

Recommendation #6: Determine Essential Function priorities 

and appropriate resource requirements for each function in the 

updated CG-2 COOP plan. 

Recommendation #7: Clearly list and define order of succession 

and delegations of authority in the updated COOP plan and include 

the orders of succession in Vital Records, as stated in FCD-1. 

Recommendation #8: Incorporate no-notice exercises into COOP 

testing and training and base such exercises on real-world 

scenarios that are focused on the CG-2 mission. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 36 
Appendix C 

Management Comments to the Draft Report 

UNCLASSIFIEDIIFOR OFFICIAL USE ONLY 

U.S. Dtplll1mtnt or Hcmriud Secu rity 

Washington. DC 20528 

Homeland 

Security 

APR 1 3 1012 

MEMORANDUM FOR: Charles K. Edwards 

FROM: 

SUBJECT: Draft Report 010-10-150- HS ' Intelligence 

Comm!mity Members ' ContinuiTY o/Operafions and Intelligence 

ReadineJs 

The Office of Intelligence and Analysis (I&A) and the US Coast Guard (USCG) appreciate the 

opportunity to review and comment on the Office of Inspector General (OIG) draft reiXlrt 0 10 -

I O-lSO-ISP-J&A, USCG, Dl-fS' Intelligence Community Members' Continuity a/Operations and 

intelligence Readiness. I&A and USCG CG-2 are actively resolving the issues identified in the 

report. 

For recommendations directed to the Under Secretary for Intelligence and Analysis/Chief 

Intelligence Officer: 

Recommendation #1: Develop an I&A Continuity of Operations (COOP) policy to codify 

COOP roles and responsibilities of all divisions and offices in maintaining and enhancing COOP 

plans. 

DUS Response: Concur. I&A has developed a draft continuity policy to codity the roles and 

responsibilities of l&A divisions and offices in maintaining and enhancing the program. 

Additionally, the I&A Contin ui ty Policy provides documentation of non-operational program 

requirements. allowing the updated I&A Continuity PiEm to focus on operational requirements 

and ensuring that continuity applies to alll&A personnel and not just the Emergency Response 

Group. I&A expects to publish this poli cy by September 30, 20 12. 

Recommendation ~2: include aU l&A division-level Essential Functions as annexes in I&A's 

overall COOP Plan. 

DHS Response: Concur. I&A is adding the division-level Essential Functi ons to the existing 

I&A Continuity Plan as well as the Essential Functions Annex of the draft updated I&A 

Continuily Plan. I&A expects tu finalize these by September 30, 2012. 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness
 

Page 37
 
Appendix C 

Management Comments to the Draft Report 

UNCLASSIFI EDIIFOR OFFICIAL USE ONLY 

Recommendation #3: Use the current emergency relocation site as an interim location for I&A 

devolution and establish a combined permanent and rotational cadre ofI&A personnel to staff 

the site while continuing to pursue options for establishing an emergency relocation site. 

DRS Response: J&A Does Not Concur. While this recommendation was valid during the 

0 10's fieldwork because l&A had not identified a devolution site, I&A has since identified a 

devolution site and is training site personnellO perfonn the priority T&A essential functions and 

tasks. Rather than invest resources in an interim solution, I&A is focusing on the required 

equipment and training enhancements for the permanent devolution site. I&A expects to 

complete the first phase of lhese enhancements this year. 

l&A believes th e~'e acti ' address the intent oft/,e recommendation and respectfully requests 

this recommendation be closed. 

Recommendation #4: Incorporate no-notice exercises that include realistic and faeluaUy based 

scenarios to simulate real-world threats, hazards, incidents, and events to gauge and evaluate 

I&A's COOP program functionality. 

DRS Response: Concur. I&A will conduct the first in a series of annual no-notice COOP 

exercises to be conductcd prior to the end of this calendar year. 

Recommendation #5: Conduct hOl washes or similar actions to create After Action Reports for 

all COOP exercises or real-world events when COOP activation is considered or actual 

execution occurs, and use these repons to enhance COOP program capabilities. 

DRS Response: Concur. Ratht.7 than conducting a staged hot wash at the conclusion of 

Exercise EAGLE HORIZON (EH) II, as was done ror EH 8, 9, and IO,I&A required each EH 

11 participant to complete an observation and a participation form, thereby capturing all I&A EH 

11 participants' issues in writing. The reports were then analyzed by I&A Continuity and 

Exercise Programs Branch persolUlcl for trends to include in the O HS-wide hot wash, the l&A 

EH 11 Quick Look After Action Report, and the I&A Corrective Actions Database. The 

Corrective Actions Database then tracks the status of in-process and resolved issues. Further, 

I&A will reincorporate staged hOI washes and the creation of After Action Reports at the 

conclusion of all future COOP exercises and real-world events. 

I&A believes these actions address th e recommendation and respectfully requests this 

recommendation be closed. 

For recommendations directed to the CG-2 Assistant Commandant for Intelligence and 

Criminal Investigations: 

Recommendation #6: Detennine Essential Function priorities and appropriate resource 

requirements for each function in the updated CG-2 COOP plan. 

UNCLASSlFlED/lFOR OFFICIAL USE ONLY 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness
 

Page 38
 
Appendix C 

Management Comments to the Draft Report 

UNCLASSIFIED/IFOR OFFICIAL USE ONLY 

USCG CG-2 Response: Concur. The corrective action plan will include a new section in the 

COOP plan that identifies each CO-2 office andlor units essential function priorities and the 

appropriate resource requirements assigned to each function. USCG expects to incorporate this 

recommendation into the updated CG·2 COOP plan by October 1.2012. 

Recommendation #17: Clearly list Wld define order of succession and delegations of authority in 

the updated COOP plan and include the orders of succession in Vital Records, as stated in FeD· 

I. 

USCG CG-2 Re.lliponse: Concur. The corrective action plan will include a new section in the 

COOP plan that identifies each CG-2 office and/or units' order of succession and delegations of 

authority. This section wiU also include orders of succession in Vital Records, as stated in FCDI. USCG expects to incorporate this recommendation into the updated CG-2 COOP plan by 

October 1, 2012. 

Recommendation #8: Lncorporate no-nolice exercises into COOP testing and training and base 

such exercises on real-world scenarios that arc focused on the CG-2 mission. 

USCG CG-2 Response: Concur. The corrective action plan will include a new section in the 

COOP plan that details incorporating no-notice exercises into COOP testing, and training basing 

such exercises on real-world scenarios that nrc focused on the CG-2 mission. The results and 

lessons learned from the exercise will be documented in after-action reports. USCG expects to 

incorporate this recommendation into the updated CG-2 COOP plan by October 1,2012. 

We look forward to continuing our work with you to ensure all required actions are completed. 

Should you require additional information, please do not hesitate to contact me or have your stafT 

contact Keith Jones at 202-282-9553 or David Plaza at 202-447-3099. 

UNCLASSIFIEDllfOR OFFICIAL USE ONLY 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness
 

Page 39
 
Appendix D 

Major Contributors to This Report 

Marcia Moxey Hodges, Chief Inspector 

Anthony Crawford, Team Leader 

Ryan Cassidy, Inspector 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 40 
Appendix E 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretariat 

Under Secretary, Office of Intelligence and Analysis 

Commandant, U.S. Coast Guard 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Officer for Civil Rights & Civil Liberties 

Chief Privacy Officer 

I&A Audit Liaison 

USCG Audit Liaison 

Office of the Director of National Intelligence 

Assistant Inspectors General for Inspections Working Group of the 

Intelligence Community Inspectors General Forum 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 

appropriate 

DHS’ Intelligence Community Members’ Continuity of Operations and Intelligence Readiness 

Page 41 
 

 

ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General 

(OIG) at (202)254-4100, fax your request to (202)254-4305, or e-mail your request to 

our OIG Office of Public Affairs at DHS-OIG.OfficePublicAffairs@dhs.gov. For 

additional information, visit our OIG website at www.oig.dhs.gov or follow us on Twitter 

@dhsoig. 

OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal 

or noncriminal misconduct relative to Department of Homeland Security programs and 

operations: 

• Call our Hotline at 1-800-323-8603 

• Fax the complaint directly to us at (202)254-4292 

• E-mail us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 

Attention: Office of Investigation - Hotline, 

245 Murray Drive SW, Building 410 

Washington, DC 20528 

The OIG seeks to protect the identity of each writer and caller.