Federal operations and facilities have been disrupted by a range of events, including the terrorist attacks on September 11, 2001; the Oklahoma City bombing; localized shutdowns due to severe weather conditions, such as the closure of federal offices in Denver for 3 days in March 2003 due to snow; and building-level events, such as asbestos contamination at the Department of the Interior’s headquarters. Such disruptions, particularly if prolonged, can lead to interruptions in essential government services. Prudent management, therefore, requires that federal agencies develop plans for dealing with emergency situations, including maintaining services, ensuring proper authority for government actions, and protecting vital assets. Until relatively recently, continuity planning was generally the responsibility of individual agencies. In October 1998, PDD 67 identified FEMA—which is responsible for responding to, planning for, recovering from, and mitigating against disasters—as the executive agent for federal COOP planning across the federal executive branch. FEMA was an independent agency until March 2003, when it became part of the Department of Homeland Security, reporting to the Under Secretary for Emergency Preparedness and Response. PDD 67 is a Top Secret document controlled by the National Security Council. FPC 65 states that PDD 67 made FEMA, as executive agent for COOP, responsible for formulating guidance for agencies to use in developing viable plans; coordinating interagency exercises and facilitating interagency coordination, as appropriate; and overseeing and assessing the status of COOP capabilities across the executive branch. According to FEMA officials, PDD 67 also required that agencies have COOP plans in place by October 1999. In July 1999, FEMA issued FPC 65 to assist agencies in meeting the October 1999 deadline. FPC 65 states that COOP planning should address any emergency or situation that could disrupt normal operations, including localized emergencies. FPC 65 also determined that COOP planning is based first on the identification of essential functions—that is, those functions that enable agencies to provide vital services, exercise civil authority, maintain safety, and sustain the economy during an emergency. FPC 65 gives no criteria for identifying essential functions beyond this definition. Although FPC 65 gives no specific criteria for identifying essential functions, a logical starting point for this process would be to consider programs that had been previously identified as important. For example, in March 1999, as part of the efforts to address the Y2K computer problem, the Director of OMB identified 42 programs with a high impact on the public: Of these 42 programs, 38 were the responsibility of the 23 major departments and agencies that we reviewed. (App. III provides a list of these 38 high-impact programs and the component agencies that are responsible for them.) Of these 23 major departments and agencies, 16 were responsible for at least one high-impact program; several were responsible for more than one. Programs that were identified included weather service, disease monitoring and warnings, public housing, air traffic control, food stamps, and Social Security benefits. These programs, as well as the others listed in appendix III, continue to perform important functions for the public. The Y2K planning to support these high-impact programs included COOP planning and specifically addressed interdependencies. Planning included identifying partners integral to program delivery, testing data exchanges across partners, developing complementary business continuity and contingency plans, sharing key information on readiness with other partners and the public, and taking other steps to ensure that the agency’s high-impact program would work in the event of an emergency. Although the identification of essential functions was established as the first step in COOP planning, FPC 65 also identified an additional seven other planning topics that make up a viable COOP capability. The guidance provided a general definition of each of the eight topics and identified several actions that should be completed to address each topic. Table 1 lists the eight topic areas covered in FPC 65 and provides an example of an action under each. The identification of essential functions is a prerequisite for COOP planning because it establishes the planning parameters that drive the agency’s efforts in all other planning topics. For example, FPC 65 directs agencies to identify alternative facilities, staff, and resources necessary to support continuation of their essential functions. The effectiveness of the plan as a whole and the implementation of all other elements depend on the performance of this step. Of the 34 agency COOP plans we reviewed, 29 plans included at least one function that was identified as essential. These agency-identified essential functions varied in number and scope. The number of functions identified in each plan ranged from 3 to 399. In addition, the apparent importance of the functions was not consistent. For example, a number of essential functions were of clear importance, such as “ensuring uninterrupted command, control, and leadership of the “protecting critical facilities, systems, equipment and records”; and “continuing to pay the government’s obligations.” Other identified functions appeared vague or of questionable importance: “provide speeches and articles for the Secretary and Deputy Secretary”; “schedule all activities of the Secretary”; and “review fiscal and programmatic integrity and efficiency of Departmental activities.” In contrast to the examples just given, agencies did not list among their essential functions 20 of the 38 “high-impact” programs identified during the Y2K effort at the agencies we reviewed. Another important consideration in identifying essential functions is the assessment of interdependencies among functions and organizations. As we have previously reported, many agency functions rely on the availability of resources or functions controlled by another organization, including other agencies, state and local governments, and private entities. (For example, the Department of the Treasury’s Financial Management Service receives and makes payments for most federal agencies.) The identification of such interdependencies continues to be essential to the related areas of information security and critical infrastructure protection. Although FPC 65 does not use the term “interdependencies,” it directs agencies to “integrate supporting activities to ensure that essential functions can be performed.” Of the 34 plans we reviewed, 19 showed no evidence of an effort to identify interdependencies and link them to essential functions, which is a prerequisite to developing plans and procedures to support these functions and all other elements of COOP planning. Nine plans identified some key partners, but appeared to have excluded others: for instance, six agencies either make or collect payments, but did not mention the role of the Treasury Department in their COOP plans. The high level of generality in FEMA’s guidance on essential functions contributed to the inconsistencies in agencies’ identification of these functions. In its initial guidance, FPC 65, FEMA provided minimal criteria for agencies to make these identifications, giving a brief definition only. According to FEMA officials, the agency is currently developing revised COOP guidance that will provide more specific direction on identifying essential functions. According to these officials, FEMA expects to release the revised guidance in March 2004. Further, although FEMA conducted several assessments of agency COOP planning between 1995 and 2001, none of these addressed the identification of essential functions. In addition, FEMA has begun development of a system to collect data from agencies on the readiness of their COOP plans, but FEMA officials told us that they will not use the system to validate the essential functions identified by each agency or their interdependencies. According to FEMA officials, the agencies are better able to make those determinations. However, especially in view of the wide variance in number and importance of functions identified, as well as omissions of high-impact programs, the lack of FEMA review lowers the level of assurance that the essential functions that have been identified are appropriate. Additionally, in its oversight role, FEMA had the opportunity to help agencies refine their essential functions through an interagency COOP test or exercise. According to FPC 65, FEMA is responsible for coordinating such exercises. FEMA is developing a test and training program for COOP activities, but it has not yet conducted an interagency exercise to test the feasibility of these planned activities. FEMA had planned a governmentwide exercise in 2002, but the exercise was cancelled after the September 11 attacks. FEMA is currently preparing to conduct a governmentwide exercise in mid-May 2004. Improper identification of essential functions can have a negative impact on the entire COOP plan, because other aspects of the COOP plan are designed around supporting these functions. If an agency fails to identify a function as essential, it will not make the necessary arrangements to perform that function. If it identifies too many functions as essential, it risks being unable to adequately address all of them. In either case, the agency increases the risk that it will not be able to perform its essential functions in an emergency. As of October 1, 2002, almost 3 years after the planning deadline established by PDD 67, 3 of the agencies we reviewed had not developed and documented a COOP plan. The remaining 20 major federal civilian agencies had COOP plans in place, and the 15 components that we reviewed also had plans. (App. IV identifies the 15 components and the high-impact programs for which they are responsible.) However, none of these plans addressed all the guidance in FPC 65. Of the eight topic areas identified in FPC 65, these 34 COOP plans generally complied with the guidance in one area (developing plans and procedures); generally did not comply in one area (tests, training, and exercises); and showed mixed compliance in the other six areas. The following sections present the results of our analysis for each of the eight planning topics outlined in FPC 65. In analyzing each plan, we looked for the answers to a series of questions regarding each planning topic. We present the compiled results for each topic in the form of a table showing the answers to these questions. Appendix I provides more detail on our analysis and methods. Although most agency plans identified at least one essential function, less than half the COOP plans fully addressed other FPC 65 guidance related to essential functions, such as prioritizing the functions or identifying interdependencies among them (see table 2).