FEMA National Continuity Programs - Guide to Continuity Program Management.docx

Guide to Continuity

Program Management

FEMA National Continuity Programs

May 2020

This page intentionally left blank

Guide to Continuity Program Management

Table of Contents

1. Purpose ............................................................................................................................... 1

1.1. Multi-Year Strategy Plan vs. Project Plans ............................................................................... 1

2. Multi-Year Strategic Plan ....................................................................................................3

2.1. Form a Planning Team and Conduct an Analysis .................................................................... 4

2.2. Develop Continuity Goals, Objectives and Tasks .................................................................... 4

2.3. Develop a Multi-Year Strategic Plan ........................................................................................ 6

3. Continuity Project Plans ......................................................................................................7

4. Continuity Budget and Resource Requirements............................................................. 10

4.1. Ideas for Acquiring Funds and Resources .............................................................................. 10

5. Continuity Test, Training, and Exercise Calendar ........................................................... 12

5.1. Continuity Test, Training and Exercise Overview .................................................................. 12

Annex A. Multi-Year Strategic Plan Worksheet ........................................................................ 16

Annex B. Project Plan Worksheet ............................................................................................. 17

Annex C. Test, Training and Exercise (TT&E) Calendar............................................................ 18

Annex D. Resources and References ....................................................................................... 19

FEMA NCP i

Guide to Continuity Program Management

1. Purpose

Continuity planning is simply the good business practice of ensuring

the execution of essential functions and provision of critical services

and core capabilities through all circumstances. Today’s threat

environment and the potential for no-notice emergencies, including

localized natural hazards, accidents, technological emergencies and

terrorist-related incidents, underscore the need for strong continuity

planning that enables all communities, organizations and entities to

continue essential functions across a broad spectrum of emergencies.

This Guide to Continuity Program Management expands on continuity

program management guidance found in the Continuity Guidance

Circular (CGC) and Federal Continuity Directives (FCD) 1 and 2

. It

provides guidance and templates to assist continuity program managers

and planners to develop a Multi-Year Strategic Plan (MYSP), project

plans and a multi-year test, training and exercise (TT&E) calendar. This guide does not address

development of a continuity of operations plan. For information and guidance on how to develop a

continuity of operations plan, refer to the Continuity Resource Toolkit, which contains guidance

documents and templates

Figure 1: CGC

1.1. Multi-Year Strategy Plan vs. Project Plans

Planning has many benefits—it helps an organization achieve its mission more effectively, focuses

financial and human resources on specific agreed-upon needs and goals, and establishes

benchmarks for improving the program. A MYSP provides a vision for the future while a project

plan(s) establishes specific tasks that need to be accomplished to achieve the vision. Both are

needed to achieve your continuity program goals and build a comprehensive continuity program.

The CGC can be found at: https://www.fema.gov/media-library/assets/documents/132130

FCD 1 can be found at: https://www.fema.gov/media-library-data/1486472423990-

f640b42b9073d78693795bb7da4a7af2/January2017FCD1.pdf

The Continuity Resource Toolkit can be found at: https://www.fema.gov/continuity-resource-toolkit

FEMA NCP 1

MYSP Focus Project Plan(s) Focus

STRATEGIC PROGRAM EXECUTION

 Multi-y

ear (typically 3-5 years). Long-ran

 A more detailed plan or fa

mily of plans

with

goals that may take multiple years to

short-term goals, objectives and tasks with

achieve. Long-range goals are often attained

specific beginning and end dates.

in phases or

a series of shorter-term go

als.



Plans c

urrent program and funding for

 Positions the organization for the future.

specific goa

ls, objectives

and tasks.

 Input is gathered from leadership, planning

 Typically developed and

managed by

the

team members and oth

r stakeholders.

organization’s program manager o

 A proces

s that actively questions the

planners.

conti

nued long-range requirements of

the

 A tool that will assist the program ma

nager

program and

areas of need or improvement.

to implem

ent the work of the organizat

ion.

Guide to Continuity Program Management

Table 1: MYSP vs. Project Plan

FEMA NCP 2

Guide to Continuity Program Management

2. Multi-Year Strategic Plan

The purpose of the MYSP is to set the overall goals and objectives for your continuity program.

Organizations should develop a continuity focused MYSP that provides for the development,

maintenance and review of continuity programs and plans to ensure the program remains viable and

successful. When developing the MYSP, the planning team should account for the mitigation options

and key elements of a viable continuity capability (refer to Figure 3 and the CGC for full descriptions).

Figure 2: Continuity Mitigation Options and Key Elements

A MYSP with short and long-term goals and objectives serves as a framework for making decisions

and provides a basis for planning. Putting together a strategic plan can provide the insight needed to

keep an organization’s continuity program on track by setting goals and measuring

accomplishments. By analyzing the information in the strategic plan, leadership and continuity

planners can make necessary changes and set the stage for further project planning.

Figure 3: MYSP Development Process

FEMA NCP 3

Guide to Continuity Program Management

2.1. Form a Planning Team and Conduct an Analysis

Developing a strategic plan requires forming a planning team and completion of an analysis to examine

the areas of need, capabilities that need to be sustained, opportunities for improvement, resource

requirements, budget constraints, as well as concerns, issues, and obstacles that the organization may

face when implementing the plan. When analyzing the continuity program and plan, the planning team

should take into account the organization’s mission and vision and try to answer:

 Where are we now?

 Where do we want to be?

 How do we get there?

Organizations may form a planning team to perform the analysis. The planning team may consist of

organizational leadership and members of the organization’s continuity working group, or equivalent

and consist of one or more representatives from across the organization, including:

 Each organizational office;

 Information Technology;

 Accounting/Finance;

 Human Resources;

 Facilities Management;

 Comptroller;

 Legal/General Counsel;

 Devolution Team;

 Reconstitution Team; and

 Union or Bargaining Unit Representative (if applicable).

2.2. Develop Continuity Goals, Objectives and Tasks

The planning team should develop goals, objectives, and tasks for the continuity program:

 A goal is the outcome the organization seeks to achieve.

 An objective breaks each goal down into smaller steps and identifies the specific actions that

must be completed in order to achieve the goal.

 A task is a precise set of steps taken to achieve each objective.

FEMA NCP 4

Guide to Continuity Program Management

When developing goals, objectives and task

s, the planning tea

m should analyze:



Statutes, mandates, and regulations;



Mitigation options and key elements;



Overarching organizational strategic plans;



Leadership vision and intent;



Results from the organization’s Business Process Analysis (BPA) and Business Impact

Analysis (BIA);



Corrective Action and Improvement Plans (CAP/IP);



Lessons learned from tests, training, and exercises (TT&E);



Results from program assessments; and



Other identified program needs.

Goals, objectives and tasks should be “S.M.A.R.T.” (specific,

measurable, actionable, reasonable and timely). For example,

your organization may have a goal to obtain a notification

system to notify and inform all staff and provide situational

awareness. The S.M.A.R.T. objective may be to “acquire an

emergency notification system before the beginning of hurricane

season next June.”

Once goals and objectives have been defined, tasks for

accomplishment should be developed. If the objective is to

“acquire an emergency notification system,” the example tasks

might be:



Research existing products;



Contact vendors and suppliers;



Obtain cost estimates and prepare a budget submission; and



Formulate an implementation and training plan.

Once the goals, objectives and tasks for accomplishment have been identified, the planning team

should prioritize them and develop a schedule by those that require short-term action and those that

may require long-term planning.

SHORT TERM GOALS AND OBJECTIVES

Short-term goals and objectives should include everything you want to achieve in less than two years.

Short-term goals and objectives are those that may have a high priority and are actionable within a

short time frame. Funding and the resources and personnel to accomplish them are available for

short-term goals and objectives.

Figure 4: S.M.A.R.T. Objectives

FEMA NCP 5

Guide to Continuity Program Management

LONG-TERM GOALS AND OBJECTIVES

Long-term goals and objectives are those that require longer-term planning strategies or cross

multiple budget or planning cycles. Funding or the resources and personnel to accomplish them may

be lacking and may need to be planned for over multiple years or accomplished incrementally.

Examples may include purchasing expensive Information Technology (IT) equipment, (i.e. redundant

servers and communications systems), or building, leasing or acquiring alternate locations.

2.3. Develop a Multi-Year Strategic Plan

The next step is to develop the MYSP to detail the identified goals and objectives. The MYSP is a

working document and should be easy to change and update, but must also be specific about what

you are doing, when you will do it, who will be accountable, what resources will be needed and how

the accomplishment will be assessed.

Once a MYSP has been developed, the next step is to monitor progress and actions. It is

recommended that the organization hold regular meetings with the planning team to monitor

progress and review and update/modify the MYSP.

FEMA NCP 6

Guide to Continuity Program Management

3. Continuity Project Plans

Project plans are tools that will assist the organization’s continuity program manager and planners in

executing the work of the organization. Project plans provide task-level details, usually presented on

a timeline, to assist program managers and planners track all aspects of the continuity program and

to assign responsibilities. Project plans are primarily an internal resource for the program

manager/planner team to improve program efficiency and maintain an up-to-date view of how the

program is progressing and what needs to be accomplished. There are many software programs that

have pre-built project plan templates available (Microsoft Word, Excel, Project, etc.). There is no

“right” program or format. Projects vary in scope and requirements, which means the right program

and format will also vary. Regardless of the preferred program or format, continuity program

managers should follow the steps below to develop project plans:

1. Create and analyze program needs and requirements;

2. Identify and coordinate with stakeholders;

3. Set goals, objectives, and tasks;

4. Determine deliverables and create a timeline with milestones (daily, weekly, monthly, etc.);

5. Assign responsibility; and

6. Revise plans and modify, as needed.

The checklists below provide example lists of items that may need to be included in the

organization’s project plan(s). Refer to Annex A for a sample MYSP worksheet, which can be used to

assist organizations to begin development of a MYSP.

Table 2: Program Management, Plans, and Procedures Checklist

Program Management, Plans, and Procedures

ITEM TASKS FREQUENCY

Plan review and

update (e.g.

Continuity,

Devolution,

Reconstitution)

 Review for accuracy

 Incorporate corrective actions/lessons learned

and changes in policy and philosophy

 Manage distribution of plan updates

 Identify/review current/potential partnerships

 Review applicable requirements, guidance

Annually

Essential Functions

 Identify/review organization essential functions

 Obtain Leadership approval

Annually

BPA/BIA

 Conduct/review/update BPA/BIA

Biennial

FEMA NCP 7

Guide to Continuity Program Management

Program Management, Plans, and Procedures

Checklists and

Standard Operating

Procedures

 Update and revise checklists

 Ensure annual update/validation

As needed or at

least annually

Budget/Resources

 Identify budget and resource requirements

Annually

Multi-Year

 Develop/review MYSP

As needed or at

least annually

Strategic Plan

 Develop/review Project Plan(s)

As needed

Project Plan(s)

 Establish a schedule for evaluating and assessing

continuity plans and program

Annually

Table 3: Develop/Review Mitigation Options Checklist

Develop/Review Mitigation Options

ITEM TASKS FREQUENCY

Alternate Locations

 Maintain alternate location readiness

 Verify systems

 Verify access codes

 Cycle supplies and equipment as needed

 Update Memoranda of Understanding/

Memoranda of Agreement (MOU/MOA)

Annually

Monitor and Maintain

Equipment at

Alternate Location

 Train users and provide technical assistance

 Monitor volume/age of materials and assist with

cycling/removing files

Ongoing

Telework

 Establish telework agreements

 Conduct telework tests and training

Annually

Devolution

 Develop/review devolution plan

 Conduct devolution TT&E activities

Annually

Review and update

supporting

Memoranda of

Understanding/

Agreement

(MOU/MOA)

 Review for currency, annually

 Incorporate changes, if required

 Obtain signature renewing agreement

As required

FEMA NCP 8

Guide to Continuity Program Management

Table 4: Develop/Review Key Elements Checklist

Develop/Review Key Elements

ITEM TASKS FREQUENCY

Orders of

 Establish/update orders of succession and

As needed or at

Succession/

delegations of authority

least annually

Delegations of

 Ensure General Counsel review

Authorities

Communications and

Information Systems

 Identify/review (as part of BPA process)

 Maintain operational readiness through

tests/training

Annually

Essential Records

 Functional area training on essential records

Annually

and Databases

needed to support essential functions

 Emergency Relocation Group (ERG) function

reviews and maintains established Essential

Records Plan

 Review and update

Human Resources

 Determine needs and qualifications

 ERG, Devolution Emergency Response Group

(DERG), and Reconstitution team appointments

 Issue appointment letter and schedule member for

orientation

 Family Support Plan

 Drive-Away Kits

As needed

Table 5: Test, Training and Exercise (TT&E) Checklist

Test, Training and Exercise (TT&E)

ITEM TASKS FREQUENCY

Test, Training, and

Exercise Program

 Establish a schedule for conducting regular TT&E

activities

 Conduct internal exercises and tests

 Support external exercise planning and execution

activities

 Develop/review CAP/IP

Ongoing

Orient New Policy

Officials and Senior

Management

 Brief officials on continuity and roles and

responsibilities

Within 60-days

of appointment

FEMA NCP 9

Guide to Continuity Program Management

4. Continuity Budget and

Resource Requirements

People, communications, facilities, infrastructure and transportation resources are necessary for the

successful implementation and management of an organization’s continuity program. Through the

budgeting and planning process, an organization’s leaders and staff ensure the availability of critical

continuity resources needed to continue the performance of the organization’s essential functions.

Once an organization has identified its goals, objectives and tasks, an organization must align its

resources and budget for its continuity activities before, during and following a continuity plan

activation.

Despite continuity being a good business practice (and a requirement for many organizations)

developing a budget and acquiring needed resources can be one of the most challenging aspects of

the continuity program managers position. Acquiring funds and resources should not be the sole

responsibility of the office tasked with developing the continuity program and plan. The entire

organization benefits from a viable continuity capability and should contribute to its development

and maintenance.

4.1. Ideas for Acquiring Funds and Resources

In an era of declining budgets, planners and managers may need to be innovative in identifying

avenues to fund continuity planning, equipment and initiatives. Examples include:

1. Explore grant funding. Continuity planning is an allowable use of funding under the DHS

Homeland Security Grant Program (HSGP) and Emergency Management Performance Grant

(EMPG). Tribal governments may use the competitive grant process through the Tribal HSPG.

Each government agency sets its priorities for use of grant funding under both programs.

Program Managers and organizations should contact their jurisdiction’s grant funding program

for additional information and to determine if continuity needs will qualify.

2. Identify dual-use technology and resources. The acquisition and upgrade of equipment or

systems can benefit an organization’s continuity capability, if considered and planned for

accordingly. For example, when organization computers are due for a lifecycle replacement,

replacing desktop computers with laptops can enable the flexibility and dispersion of an

organization. Similarly, upgrades or purchases of some continuity equipment benefit the entire

organization; therefore, the cost should be borne by the whole organization rather than one

program (i.e. generator back up power at the primary facility).

FEMA NCP 10

Guide to Continuity Program Management

Leverage low- or no-cost resources. FEMA offers free continuity training, tools and templates

Virtual training, such as internet-based courses or webinars, also provide a low-cost alternative.

Teaming with other organizations through use of mutual aid agreements, the Emergency

Management Assistance Compact (EMAC) or MOU/MOAs are low-cost methods of enhancing

capabilities.

Below are examples of resources that may need to be accounted for in the budgeting and

planning process:

Example Budget Items

 Communications equipment (radios, Emergency Notification System, etc.)

 Infrastructure

 Test, training and exercise activities

 Travel and overtime costs

 Equipment, supplies and resources

 Contracts

 Alternate locations and devolution sites (lease, acquisition costs, etc.)

 Information technology support (laptops, servers)

Tools and templates can be found on FEMA’s Continuity Resource Toolkit: https://www.fema.gov/continuity-resource-toolkit

Information on available continuity training can be found at: https://www.fema.gov/continuity-excellence-series-

professional-and-master-practitioner-continuity-certificate-programs

FEMA NCP 11

Guide to Continuity Program Management

5. Continuity Test, Training and

Exercise Calendar

5.1. Overview

One project plan that almost all organizations will develop is a test, training and exercise (TT&E)

activities plan or calendar. TT&E activities assess and validate continuity plans, policies, procedures

and systems. Achieving the goal of continuity mission readiness is possible only if TT&E activities are

conducted on a regular schedule and if each event contributes to increasing the organization’s

readiness and resilience. Conducting TT&E events using an all-hazards approach using threats,

hazards and vulnerabilities identified through organizational risk assessments affirms the viability of

continuity plans and programs. This calendar is continuity focused to assist the program manager,

but then it should be incorporated into the organization’s overall training and exercise plan.

TESTS

Testing demonstrates the correct operation of all equipment, procedures, processes and systems

that support an organization’s continuity program. This ensures resources and procedures are kept

in a constant state of readiness. As detailed in FCD 1, testing and exercising an organization’s

policies, plans, and procedures cultivates better organizational knowledge, identifies gaps in

coverage and validates existing plans and programs.

Organizations should test:

1. Alert and notification systems and procedures for all employees and for continuity personnel;

2. Protection, access and recovery strategies found in continuity and information

technology/disaster recovery plans for essential records, critical information systems, services

and data;

3. Internal and external interoperability and functionality of primary and backup communications

systems;

4. Backup infrastructure systems and services, such as power, water and fuel;

5. Other systems and procedures necessary to the organization’s continuity strategy, such as the IT

infrastructure required to support telework options during a continuity plan activation; and

6. Measures to ensure accessibility for employees and members of the public with disabilities.

FEMA NCP 12

Guide to Continuity Program Management

TRAINING

Training familiarizes individuals with roles, responsibilities, plans and procedures for conducting

essential functions and providing critical services when normal operations are disrupted.

Organizations should train personnel on:

1. Expectations, roles and responsibilities during a continuity plan activation and how these aspects

differ from normal operations for all personnel;

2. Continuity plans and strategies, such as relocation, mutual aid agreements and telework, for

those identified to perform essential functions and provide critical services during a continuity

plan activation;

3. Backup communications and IT systems that may be necessary to support or sustain essential

functions for those expected to use such systems; and

4. Orders of succession and delegations of authority for those individuals filling positions outlined

within those documents.

EXERCISE

Exercises play a vital role in preparedness by enabling partners, stakeholders and elected officials to

shape planning, test and validate plans and capabilities, and identify and address gaps and areas

for improvement. Exercise programs improve an organization’s preparedness posture and

emphasize the value of integrating continuity functions into daily operations. Exercises provide a low-

risk environment to test capabilities, familiarize personnel with roles and responsibilities and foster

meaningful interaction and communication across organizations.

The Homeland Security Exercise and Evaluation Program (HSEEP)

provides guiding principles for

exercise programs, as well as a common approach to exercise program management, design,

development, conduct, evaluation and improvement planning.

Organizations should exercise:

1. Continuity plans and procedures in order to validate the organization’s strategy and ability to

continue its essential functions and services;

2. Intra- and interagency backup communications capabilities;

3. Backup data and records required to support essential functions for sufficiency, completeness,

currency and accessibility;

For additional information on HSEEP, refer to: https://www.fema.gov/hseep

FEMA NCP 13

Guide to Continuity Program Management

Internal and external interdependencies, including support to essential functions, services and

situational awareness; and

Recovery from the continuity plan activation and environment and a transition back to normal

operations.

EXERCISE TYPES

HSEEP describes seven types of exercises, each of which is either discussion-based or operations-

based. Discussion-based exercises (seminars, workshops, tabletop exercises and games) familiarize

participants with current plans, policies, agreements and procedures or may be used to develop new

plans, policies, agreements and procedures. Operations-based exercises (drills, functional exercises

and full-scale exercises) validate plans, policies, agreements and procedures, clarify roles and

responsibilities and identify resource gaps in an operational environment.

Organizations should use a combination of each type of exercise to ensure the mission readiness of

all elements of their continuity program. The type of exercise that best meets the organization’s

requirements is identified through an analysis of the capabilities and requirements the organization

is attempting to test and validate; the training and exercises it has already conducted; and the

resources available for exercise planning, conduct, and evaluation.

HSEEP AND THE PROGRESSIVE APPROACH

Organizations should utilize the “progressive approach” outlined in HSEEP. HSEEP calls for the

development of a multi-year plan that employs a progressive approach, in which TT&E activities are

aligned to a common set of exercise program priorities and objectives with an increasing level of

complexity over time. The “progressive approach” does not imply a linear progression of exercise

types. See Figure 8 for a depiction of the progressive approach.

Figure 8: Progressive Approach

FEMA NCP 14

Guide to Continuity Program Management

CORRECTIVE ACTION AND IMPROVEMENT PLANNING

Documenting the strengths, areas for improvement and associated corrective actions contributes to

the strengthening of continuity preparedness and helps organizations build capabilities as part of a

larger continuous improvement process. Over time, exercises should yield observable improvements

in readiness and preparedness in future exercises and real-world incidents.

Organizations should incorporate evaluations, after action reports, and lessons learned into the

development and implementation of an improvement plan. The corrective actions identified during

individual exercises, real-world incidents and assessments are tracked to completion, ensuring

tangible improvements in capabilities. An effective corrective action program develops improvement

plans that are dynamic documents, which are continually monitored and implemented as part of the

larger system of improving preparedness.

An Improvement Plan Template can be found on the HSEEP Resources page on the FEMA

Preparedness Toolkit website https://preptoolkit.fema.gov/web/hseep-resources.

Refer to Annex C for a TT&E multi-year calendar template.

FEMA NCP 15

Guide to Continuity Program Management

Annex A. Multi-Year Strategic Plan Worksheet

Table 6: Sample MYSP Worksheet

Goals Objectives Tasks Due Date

Responsible

Party

Issues/

Obstacles/

Constraints

Current Year

Year 2

Year 3

Year 4

FEMA NCP 16

Guide to Continuity Program Management

Annex B. Project Plan Worksheet

Table 7: Sample Project Plan Worksheet

Year TT&E Event Date(s) planned/Completed Participants

Quarter

Jan

Feb

Mar

Quarter

Apr

May

Jun

Quarter

Jul

Aug

Sep

Quarter

Oct

Nov

Dec

FEMA NCP 17

Guide to Continuity Program Management

Annex C. Test, Training and Exercise (TT&E)

Calendar

Table 8: Test, Training and Exercise (TT&E) Calendar Template

Year TT&E Event Date(s) planned/Completed Participants

Quarter

Insert Month/Day Insert Event Insert Dates Planned/Completed Insert Participants

Quarter

FEMA NCP 18

Guide to Continuity Program Management

Annex D. Resources and

References

REFERENCES

 Presidential Policy Directive 40 “National Continuity Policy.”

 Continuity Guidance Circular:

https://www.fema.gov/media-library-data/1520878493235-

1b9685b2d01d811abfd23da960d45e4f/ContinuityGuidanceCircularMarch2018.pdf

 Federal Continuity Directive 1:

https://www.fema.gov/media-library-data/1486472423990-

f640b42b9073d78693795bb7da4a7af2/January2017FCD1.pdf

 Federal Continuity Directive 2:

https://www.fema.gov/media-library-data/1499702987348-

c8eb5e5746bfc5a7a3cb954039df7fc2/FCD-2June132017.pdf

 Homeland Security Exercise and Evaluation Program (HSEEP) Toolkit:

https://preptoolkit.fema.gov/web/hseep-resourcesh

RESOURCES

 Continuity Resource Toolkit:

https://www.fema.gov/continuity-resource-toolkith

 FEMA Continuity Training and Continuity Certificates:

https://www.fema.gov/continuity-excellence-series-professional-and-master-practitioner-

continuity-certificate-programsh

 FEMA Business Process Analysis and Business Impact Analysis User Guide:

https://www.fema.gov/media-library-data/1565364767950-

771197cf15ae239d988f02153b2b2442/BPA_BIA_Users_Guide.pdfh

 Continuity Assessment Tool (CAT):

https://www.fema.gov/media-library/assets/documents/158679

FEMA NCP 19