Year 2000 Computing Crisis: USDA Needs to Accelerate Time Frames for
Completing Contingency Planning (Letter Report, 05/21/99,
GAO/AIMD-99-178).
Pursuant to a congressional request, GAO identified actions the
Department of Agriculture (USDA) is taking to develop year 2000 business
continuity and contingency plans (BCCP).
GAO noted that: (1) under the leadership of the department's chief
information officer (CIO) and year 2000 program office, USDA component
agencies are actively engaged in developing BCCPs to prepare for
unforeseen year 2000-related failures; (2) however, much work remains
over the next several months to complete and test USDA's BCCPs; and (3)
the department's December 1999 departmentwide goal for completing BCCPs
leaves no room for delays or sufficient time for correcting, revising,
and retesting plans if necessary.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: AIMD-99-178
TITLE: Year 2000 Computing Crisis: USDA Needs to Accelerate Time
Frames for Completing Contingency Planning
DATE: 05/21/99
SUBJECT: Y2K
Computer security
Computer software
Computer software verification and validation
Data integrity
Information systems
Strategic information systems planning
Systems conversions
IDENTIFIER: Y2K
USDA Year 2000 Program
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. This text was extracted from a PDF file. **
** Delineations within the text indicating chapter titles, **
** headings, and bullets have not been preserved, and in some **
** cases heading text has been incorrectly merged into **
** body text in the adjacent column. Graphic images have **
** not been reproduced, but figure captions are included. **
** Tables are included, but column deliniations have not been **
** preserved. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** **
** **
** with the message 'info' in the body. **
******************************************************************
ai99178 GAO United States General Accounting Office
Report to the Chairman, Subcommittee on Department Operations,
Oversight, Nutrition, and Forestry, Committee on Agriculture,
House of Representatives
May 1999 YEAR 2000 COMPUTING CRISIS
USDA Needs to Accelerate Time Frames for Completing Contingency
Planning
GAO/AIMD-99-178
GAO/AIMD-99-178
Page 1 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning United
States General Accounting Office
Washington, D. C. 20548 Let t er Accounting and Information
Management Division
B-282664 Letter May 21, 1999 The Honorable Bob Goodlatte Chairman
Subcommittee on Department Operations, Oversight, Nutrition, and
Forestry Committee on Agriculture House of Representatives
Dear Mr. Chairman: As you know, the Department of Agriculture
(USDA) provides public services that are vital to the health,
safety, and well being of Americans. To minimize possible
disruptions in service caused by the Year 2000
computing issue, USDA needs to prepare and test business
continuity and contingency plans (BCCPs). At your request, we
identified actions USDA is taking to develop Year 2000 BCCPs and
briefed your office on the results of our work on April 20, 1999.
The briefing slides are in appendix I.
This report provides a high- level summary of information
presented at that briefing and presents recommendations we are
making to USDA to ensure that the department completes the
necessary contingency planning steps and validates its plans in
advance of the new year.
Results in Brief
Under the leadership of the department's chief information officer
(CIO) and Year 2000 program office, USDA component agencies are
actively engaged in developing BCCPs to prepare for unforeseen
Year 2000- related failures. However, much work remains over the
next several months to complete and test USDA's BCCPs. The
department's December 1999 departmentwide goal for completing
BCCPs leaves no room for delays or sufficient time for correcting,
revising, and retesting plans if necessary. Therefore, we are
recommending that USDA advance its time frame to no later than
September 30, 1999, and develop priorities for completing and
testing BCCPs that are aligned with the department's highest
priority
business processes to ensure that remaining work addresses these
processes first. USDA's CIO agreed to implement our
recommendations.
Lett er
B-282664 Page 2 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning
Background The Year 2000 computing problem poses significant risks
which, if not adequately addressed, could have serious
consequences. For example,
public health and safety could be at risk if systems and
equipment used to detect and track diseases, unwholesome foods,
and agricultural pests do not function properly; and food
assistance to needy households and food distribution to schools
and others could be stopped or delayed. Ensuring that these and
other vital public services are not disrupted at the turn of the
century is no small undertaking in such a large and diverse
organization as USDA. According to USDA's March 31, 1999, report
to the
Office of Management and Budget (OMB) on the status of its Year
2000 efforts, the department has 352 mission critical systems, of
which 337, or about 96 percent, are compliant. 1 USDA said it
expects to have the 15 remaining systems retired, replaced, or
repaired by October 31, 1999. The risk of Year 2000 failures,
however, is not limited to USDA's internal information systems. As
is the case with other federal agencies, USDA depends on
information and data provided by business partners including
other federal agencies, hundreds of state and local agencies,
international organizations, and private sector entities.
Dependencies on services provided by the public infrastructure
must also be taken into account including power, water,
transportation, and voice and data communications. One weak link
anywhere in the chain of critical dependencies can cause major
disruptions to business operations.
Given these interdependencies and risks, it is imperative that
BCCPs be developed to identify, assess, manage, and mitigate Year
2000 risks and help ensure the continuity of all core business
processes. Such plans focus on reducing the risk of Year 2000-
induced business failures by helping to safeguard an agency's
ability to produce a minimum acceptable level of outputs and
services in the event of failures of internal or external
missioncritical
information systems and services. It also links management and
mitigation efforts to the agency's Year 2000 program, and helps to
identify alternate resources and processes needed to operate the
agency's core business processes. 1 The department reported that
it had revised the number of mission critical systems from 352 to
350 on April 9, 1999.
Lett er
B-282664 Page 3 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning
To help agencies manage the risk of potential Year 2000- induced
disruptions to their operations, we prepared the Year 2000
Computing Crisis: Business Continuity and Contingency Planning 2
guide. This guide,
which has been adopted by OMB as the standard federal agencies
should use in preparing BCCPs, identifies four phases initiation;
business impact analysis; contingency planning; and testing that
cover key steps necessary to complete business continuity and
contingency planning.
USDA and Its Agencies Are Actively Engaged in Developing BCCPs
In July 1998, the CIO's Year 2000 program office issued USDA's
Year 2000 Business Continuity (Contingency) Planning Guide 3 for
its agencies and offices to follow in preparing BCCPs. At the
CIO's direction, mission areas, agencies, and offices were
required to identify core business processes for each mission area
and prepare and submit BCCPs approved by their
mission area undersecretaries by September 30, 1998. This date was
later extended to October 30, 1998. Also, the Year 2000 program
office provided agencies with training as well as a template and
matrix to use in developing their BCCPs.
In January 1999, the Year 2000 program office obtained contractor
assistance with developing a departmentwide BCCP that is intended
to integrate the agencies' and offices' BCCPs and define the
highest risk processes and systems. As part of the department's
ongoing BCCP work, 43 of its 79 total core business processes and
52 of its 352 total mission critical systems have been identified
as USDA's highest priority processes and systems.
Fifteen USDA component agencies are most directly responsible for
accomplishing the department's missions and programs. 4 Eight of
these 2 Year 2000 Computing Crisis: Business Continuity and
Contingency Planning (GAO/ AIMD- 10.1.19, August 1998). 3 USDA's
guide parallels our guide, Year 2000 Computing Crisis: Business
Continuity and Contingency Planning. 4 The 15 component agencies
are: Agricultural Marketing Service (AMS); Agricultural Research
Service (ARS); Animal and Plant Health Inspection Service (APHIS);
Cooperative State Research, Education, and Extension Service
(CSREES); Economic Research Service (ERS); Farm Service Agency
(FSA); Food and Nutrition Service (FNS); Food Safety and
Inspection Service (FSIS); Foreign Agricultural Service (FAS);
Forest Service (FS); Grain Inspection, Packers and Stockyards
Administration (GIPSA); National Agricultural Statistics Service
(NASS); Natural Resources Conservation Service (NRCS); Risk
Management Agency (RMA); and Rural Development (RD). The RD
mission area includes Rural
Utilities Service, Rural Housing Service, and Rural Business-
Cooperative Service. Since there was only one BCCP addressing all
three, we counted these as one component agency.
B-282664 Page 4 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning
agencies submitted draft BCCPs by the October 30, 1998, deadline.
Another six submitted their draft plans from November 1998 through
January 1999. While the one remaining agency NRCS also submitted a
draft plan, the mission area undersecretary had not approved it at
the completion of our
review on March 31, 1999. The CIO's Year 2000 program office also
required that the agencies submit quarterly updates to their
BCCPs. These updates are to be submitted in April, July, October,
and December 1999.
Much Work Remains to Complete and Test Agencies' Draft BCCPs
Much more work remains over the next several months to complete
and test USDA's draft BCCPs. We reviewed the draft plans and
progress reports prepared by USDA's 15 component agencies using
the four- phased planning approach outlined in our business
continuity and contingency planning
guide and USDA's guide and found that, as of the end of our
review, the agencies had
completed the initiation phase or had it underway; completed
most of the business impact analysis phase, but had not yet
identified how minimum acceptable levels of output and recovery
time objectives would be defined; started the contingency
planning phase, but descriptions of contingency measures and
actions were too general and/ or vague to be implemented
as written; and not begun the testing phase and most had not
developed plans or milestones for doing so.
Progress Completing Key BCCP Steps Varied at Four Component
Agencies
At the four agencies we visited FSIS, APHIS, FSA, and FNS 5
progress in completing unaddressed key BCCP steps varied. Our
review of actions underway or planned by these agencies to
complete BCCPs found that, as of March 31, 1999, none had yet
determined minimal acceptable levels of output or completed work
defining contingency procedures; 5 Ensuring Year 2000 risks are
addressed at these agencies is especially important given their
vital health and safety, financial, and/ or economic missions.
B-282664 Page 5 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning
all planned to better define contingencies or were in the process
of doing so; FSIS and FSA had recently established testing
milestones, but APHIS
had not done so (FNS' draft BCCP included one testing milestone,
but this milestone had been missed); and all planned to do
testing when ready, but said they currently did not know how
testing would be performed.
USDA's Time Frame for Completing and Testing BCCPs Is Too Late
USDA reported in its February 1999 Year 2000 quarterly report to
OMB that it expected to complete all BCCPs by December 1999. This
time frame leaves no room for slippages in dates or time for
correcting and retesting the BCCPs should this be necessary.
Moreover, the department's December 1999 time frame falls after
the beginning of the new fiscal year (October 1, 1999). At that
time, the risks of Year 2000- induced failures will increase
because of federal agencies' use of fiscal year 2000 dates. In
January 1999, we testified that OMB should consider establishing
dates of April 30, 1999, for agencies to complete their BCCPs and
September 30, 1999, to complete testing. 6 By doing so, agencies
would have time to adjust work schedules should milestones slip
and to address any shortfalls found
when testing plans and make necessary adjustments. These time
frames would also allow agencies to be prepared for Year 2000
failures that could have already occurred by the beginning of the
new fiscal year. Although OMB has not yet established specific
governmentwide milestones for
agencies to complete and test their BCCPs, OMB stated recently
that it is developing a process to coordinate work on BCCPs across
government agencies. In doing so, the agencies have been
informally notified to be prepared to submit BCCPs to OMB in June
1999. To allow time for any slippages that might occur or time for
correcting and retesting plans if necessary, USDA will need to
establish an earlier milestone for completing and testing BCCPs,
such as the September 1999 date we have suggested. Given the
substantial amount of BCCP work
remaining, moving up the department's December 1999 time frame
would also require USDA's agencies and offices to establish
priorities for ensuring that, at a minimum, BCCPs are first
completed for the highest priority business processes. USDA has
determined that 43 of the component 6 Year 2000 Computing Crisis:
Readiness Improving, But Much Work Remains to Avoid Major
Disruptions (GAO/T-AIMD-99-50, January 20, 1999).
B-282664 Page 6 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning
agencies' and offices' 79 core business processes are the
department's highest priority processes. However, neither USDA,
nor its component agencies and offices, have established
priorities for completing BCCPs to address Year 2000 risks for
these 43 high priority business processes first.
Recommendations We recommend that the Secretary of Agriculture
direct that the CIO advance the department's December 1999 time
frame for completing and
testing agencies' BCCPs to no later than September 30, 1999. We
also recommend that the Secretary direct that the Undersecretaries
for USDA's seven mission areas, as well as the CIO, Chief
Financial Officer, and Assistant Secretary for Administration,
have their respective agencies and offices
develop priorities for completing and testing BCCPs which are
aligned with the department's 43 highest priority business
processes to ensure that remaining work addresses these processes
first; establish specific milestones to complete key interim BCCP
steps that have not yet been addressed; and
report regularly to the Secretary progress on meeting these
milestones to ensure that the agencies and offices adequately
address all key BCCP steps that are appropriate to each agency. On
April 8, 1999, we provided a copy of our briefing materials, which
were used in preparing this report, to USDA's CIO, deputy CIO, and
officials representing USDA's Year 2000 program office. These
officials agreed with our findings and the CIO stated that USDA
planned to implement our recommendations.
Objective, Scope, and Methodology
As requested, our objective was to identify actions USDA has taken
to develop business continuity and contingency plans. To do this,
we reviewed departmental guidance and discussed with Year 2000
program officials in USDA's CIO office how this guidance was being
implemented. We also reviewed draft BCCPs and progress reports
prepared by the 15 USDA agencies most directly responsible for
accomplishing the department's missions and programs. We
identified what work remained to
complete these plans by comparing them, and information contained
in progress reports, to our business continuity and contingency
planning guide. Because we focused on the continuity of USDA's
core missions and
B-282664 Page 7 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning
programs, we did not include in our review the draft BCCPs
prepared by USDA staff offices, such as the CIO and the Chief
Financial Officer. Further, to determine actions underway or
planned to complete key BCCP steps, we interviewed Year 2000
planning officials at four agencies APHIS, FSA, FSIS, and FNS and
reviewed their documents and materials discussing BCCP activities.
Our focus at these agencies was on key steps that had not been
addressed by most agencies in their draft BCCPs. These
included six areas: (1) acceptable levels of output/ recovery time
objectives, (2) contingency plans and implementation modes, (3)
business resumption teams, (4) zero day strategy, (5) BCCP test
plans, and
(6) BCCP test completion milestones. We conducted our review from
September 1998 through March 1999 in accordance with generally
accepted government auditing standards. Our work was done at USDA
headquarters in Washington, D. C., at the CIO's office and the
CIO's Year 2000 program office. We also conducted work at agency
offices of FSIS and APHIS in Washington, D. C.; FNS in Alexandria,
Virginia; and FSA in Kansas City, Missouri.
As agreed with your office, unless you publicly announce its
contents earlier, we plan no further distribution of this report
until 30 days from the date of this letter. At that time, we will
send copies of this report to Representative Eva Clayton, Ranking
Minority Member of your Subcommittee; Representatives Larry
Combest, Chairman, and Charles Stenholm, Ranking Minority Member,
House Committee on Agriculture; Representatives Steven Horn,
Chairman, and Jim Turner, Ranking Minority Member, House Committee
on Government Reform, Subcommittee on Government Management,
Information and Technology; Senators Richard Lugar, Chairman, and
Tom Harkin, Ranking Minority Member, Senate Committee on
Agriculture, Nutrition, and Forestry; Senators Robert Bennett,
Chairman, and Christopher Dodd, Ranking Minority Member,
Senate Special Committee on the Year 2000 Technology Problem; the
Honorable Daniel Glickman, Secretary of Agriculture; and the
Honorable Jacob Lew, Director, Office of Management and Budget;
and other
interested parties. Copies will also be made available to others
upon request.
B-282664 Page 8 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning
If you have any questions on matters discussed in this letter,
please call me at (202) 512- 6408 or Stephen A. Schwartz, Senior
Assistant Director, at (202) 512- 6213. Other major contributors
to this report are listed in appendix II.
Sincerely yours, Joel C. Willemssen Director, Civil Agencies
Information Systems
Page 9 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Page 10 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Contents Letter 1 Appendix I: Briefing on Year 2000 USDA
Contingency Planning
12 Appendix II: Major Contributors to This Report
47
Page 11 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Page 12 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Appendix I Briefing on Year 2000 USDA Contingency Planning Appendi
x I
Accounting and Information Management Division
1 USDA's Year 2000
Business Continuity and Contingency Plans
House Committee on Agriculture Subcommittee on Department
Operations,
Oversight, Nutrition, and Forestry April 20, 1999
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 13 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
2
Purpose of briefing is to provide the results of our review of
USDA's efforts to develop business continuity and contingency
plans (BCCPs)
Review Objective Scope and Methodology Background Summary
Results Steps Taken By USDA's Chief Information Officer (CIO) and
the
Agencies to Develop BCCPs Status of Agencies' Draft BCCPs
Evaluation of Component Agencies' Draft BCCPs Actions at Four
Component Agencies to Complete Key BCCP Steps Observations on
USDA's BCCP Time Frames and Milestones Recommendations
Purpose
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 14 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
3
We were asked to: Identify what action USDA has taken to develop
BCCPs for addressing its Year 2000 risks
Review Objective
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 15 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
4 Scope and Methodology
We reviewed departmental BCCP guidance and discussed how this
guidance was being implemented with Year 2000 program officials
We reviewed draft BCCPs prepared by the 15 USDA component
agencies most directly responsible for accomplishing the
department's seven key missions
*The RD mission area includes Rural Utilities Service, Rural
Housing Service, and Rural Business- Cooperative Service. Since
there was only one BCCP addressing all three, we counted these as
one component agency.
Agricultural Research Service (ARS)
Cooperative State Research, Education, and Extension Service
(CSREES)
Economic Research Service (ERS)
Food Safety and Inspection Service (FSIS)
Animal and Plant Health Inspection Service (APHIS)
Agricultural Marketing Service (AMS)
Grain Inspection, Packers and Stockyards Administration (GIPSA)
Natural Resources Conservation Service (NRCS)
Forest Service (FS)
Farm Service Agency (FSA)
Foreign Agricultural Service (FAS)
Risk Management Agency (RMA)
Food and Nutrition Service (FNS)
National Agricultural Statistics Service (NASS)
Rural Development (RD)*
Agricultural Research Service (ARS)
Cooperative State Research, Education, and Extension Service
(CSREES)
Economic Research Service (ERS)
Food Safety and Inspection Service (FSIS)
Animal and Plant Health Inspection Service (APHIS)
Agricultural Marketing Service (AMS)
Grain Inspection, Packers and Stockyards Administration (GIPSA)
Natural Resources Conservation Service (NRCS)
Forest Service (FS)
Farm Service Agency (FSA)
Foreign Agricultural Service (FAS)
Risk Management Agency (RMA)
Food and Nutrition Service (FNS)
National Agricultural Statistics Service (NASS)
Rural Development (RD)*
Agricultural Research Service (ARS)
Cooperative State Research, Education, and Extension Service
(CSREES)
Economic Research Service (ERS)
Food Safety and Inspection Service (FSIS)
Animal and Plant Health Inspection Service (APHIS)
Agricultural Marketing Service (AMS)
Grain Inspection, Packers and Stockyards Administration (GIPSA)
Natural Resources Conservation Service (NRCS)
Forest Service (FS)
Farm Service Agency (FSA)
Foreign Agricultural Service (FAS)
Risk Management Agency (RMA)
Food and Nutrition Service (FNS)
National Agricultural Statistics Service (NASS)
Rural Development (RD)*
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 16 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
We used our guide,* which was adopted by OMB as the standard
federal agencies should use in preparing BCCPs The guide includes
key planning steps for completing the
following four phases *Year 2000 Computing Crisis: Business
Continuity and Contingency Planning (GAO/ AIMD10.1.19, August
1998)
5 Scope and Methodology (Cont'd)
Phase II Business Impact Analyses Analyze risks and possible Year
2000 impacts, define failure scenarios, define minimum levels of
output and service for core processes
Phase IV Testing Validate agencies' BCCPs Phase I Initiation
Establish a planning strategy, work group, milestones, and
identify core business processes Phase III Contingency Planning
Develop contingency plans and define when and
how they will be implemented
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 17 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
6 Scope and Methodology (Cont'd)
We also visited four agencies-- FSIS, APHIS, FSA, and FNS-- to
identify additional actions either underway or planned for
completing work on the draft BCCPs
We also reviewed agency progress reports and other USDA
documentation to identify time frames and milestones for
completing BCCPs and track departmentwide progress
Because we focused on continuity of USDA's core missions and
programs, we did not include in our review draft BCCPs prepared by
USDA staff offices, such as the Office of Chief Information
Officer and the Office of the Chief Financial Officer
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 18 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
7 Scope and Methodology (Cont'd)
We conducted work at USDA's CIO Office and the CIO's Year 2000
program office,
FSIS, FSA, and APHIS in Washington, D. C. FNS in Alexandria,
Virginia FSA in Kansas City, Missouri
We performed our work from September 1998 through March 1999 in
accordance with generally accepted government auditing standards
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 19 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
8 Background
Year 2000 computing problems pose significant risks, which if not
adequately addressed, could result in severe consequences
for example, at USDA public health/ safety is at risk if systems
and equipment do
not work to detect unwholesome foods food assistance to needy
households could be delayed
Data exchanges with business partners and public infrastructures
(i. e., telephone, power, etc.) create additional risks
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 20 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
9 Background (Cont'd)
BCCPs safeguard an agency's ability to produce a minimum
acceptable level of outputs and services in the event of Year 2000
failures by
identifying critical functions that may be affected by the
agency's internal information systems as well as outside services,
such as the ability of suppliers to provide products, services,
data, or the loss of critical infrastructure (i. e.,
communications, power, etc.)
describing risk mitigation strategies and work- around
alternatives to ensure continuity of the agency's core business
functions, especially those functions with the most immediate and
direct effect on the public
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 21 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
10 Background (Cont'd)
Ensuring that vital public services are not disrupted at the turn
of the century is no small undertaking in such a large and diverse
organization as USDA
As of OMB's March 31, 1999 deadline for achieving Year 2000
compliance for all internal information systems, USDA reported
337 of its 352 mission critical systems are compliant
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 22 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
11 Background (Cont'd)
USDA's CIO is responsible for leading the department's
preparation for Year 2000
CIO established a Year 2000 program office, under the direction
of a Year 2000 Program Executive, to: oversee efforts to ensure
that all critical USDA information
systems are Year 2000 compliant and operational before the end of
1999
provide departmentwide leadership and direction in Year 2000
business continuity and contingency planning, which includes:
providing departmentwide BCCP guidance and training assisting
agencies/ offices in identifying core business
processes and developing their BCCPs monitoring agencies'/
offices' efforts to fully develop and test
BCCPs for USDA's core business processes
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 23 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
12 Summary Results
Under the leadership of the CIO and Year 2000 program office,
USDA agencies are actively engaged in developing business
continuity and contingency plans to address the department's Year
2000 risks
Agencies have submitted draft BCCPs Much more work remains over
the next several months to
complete and test USDA's BCCPs
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 24 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
13 Summary Results (Cont'd)
Our review of agencies' draft BCCPs and progress reports found
that overall, the agencies had
completed initiation (Phase I) or had it underway completed some
business impact analysis (Phase II), but had
not yet identified how minimum acceptable levels of output and
recovery time objectives would be defined started contingency
planning (Phase III), but descriptions of
contingency measures and actions were too general and/ or vague to
be implemented as written not begun testing BCCPs (Phase IV) and
most had not
developed plans or milestones for doing so
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 25 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
14 Summary Results (Cont'd)
Our visits to four agencies showed that, as of the end of March
1999, progress varied on completing key BCCP steps left in Phases
II- IV that had not been addressed in their draft plans
USDA's recently established December 1999 time frame for
completing BCCPs
leaves no room for slippage in dates or for correcting and
retesting plans if necessary
is after the beginning of fiscal year 2000 (October 1, 1999),
when potential failures could have already occurred
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 26 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
15 Steps Taken By USDA's CIO and the
Agencies to Develop BCCPs
In July 1998, the CIO issued USDA's Year 2000 Business
Continuity
(Contingency) Planning Guide that parallels our BCCP guidance
required mission areas, agencies, and offices to
identify core business processes for each mission area prepare
and submit completed BCCPs to the CIO's Year
2000 program office by September 30, 1998 In August 1998, the
Secretary extended the deadline for
submitting BCCPs to October 30, 1998
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 27 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Action to eliminate/ reduce likelihood of risk/ threat prior to
time horizon or failure
In September 1998, the Year 2000 program office, with the
assistance of a contractor, provided agencies with training and a
template to use in developing BCCPs and a matrix for each core
process they identified to describe
16 Steps Taken By USDA's CIO and the
Agencies to Develop BCCPs (Cont'd) Risks and Threats Events having
a negative impact on core business function or critical system
Date when risk/ threat first impacts Business Priorities Areas of
emphasis
Contingencies Planned action to eliminate or reduce impact of
risk/ threat Triggers Risk Mitigation
Event causing contingency plan to be implemented Time Horizon To
Failure
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 28 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
|
17 Steps Taken By USDA's CIO and the
Agencies to Develop BCCPs (Cont'd)
In January 1999, the Year 2000 program office obtained contractor
assistance to support the department's ongoing BCCP effort by
starting to evaluate USDA agencies' and offices' draft BCCPs
providing advice to agencies on carrying out contingency
planning activities assisting with the development of a
departmentwide BCCP that
integrates the agencies' and offices' BCCPs and defines highest
risk processes and systems
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 29 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
18 Steps Taken By USDA's CIO and the
Agencies to Develop BCCPs (Cont'd)
As part of USDA's ongoing BCCP work, 43 of the department's 79
total core business processes were
identified as its highest priority 52 of the department's 352
total mission critical systems were
identified as its highest priority (USDA has determined that these
43 processes and 52 systems represent the greatest health and
safety, financial, and /or economic impacts)
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 30 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
19 Status of Agencies' Draft BCCPs
Component agencies we reviewed have submitted draft BCCPs 8
submitted draft plans approved by mission area
undersecretaries by the October 30, 1998 deadline 6 submitted
approved draft plans between November 1998 and
January 1999 NRCS submitted a draft plan that has not yet been
approved
Since January 1999 agencies have begun to modify the draft plans
in response to
comments by the CIO's Year 2000 program office that identified
items such as
template/ matrices not completed core business processes/
critical systems not discussed agencies are required to submit
quarterly updates of their
BCCPs to the CIO's Year 2000 program office in April, July,
October, and December 1999
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 31 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
20 Evaluation of Component Agencies'
Draft BCCPs
We reviewed draft BCCPs and available progress reports prepared
by 15 component agencies and found that much more work remains
over the next several months to complete and test these plans
Overall, the agencies generally had completed initiation (Phase
I) or had it underway completed most of the business impact
analysis (Phase II), but
had not yet identified whether or how minimum acceptable levels of
output and recovery time objectives would be defined started
contingency planning (Phase III), but descriptions of
contingency measures and actions were too general and/ or vague to
be implemented as written not begun testing BCCPs (Phase IV) and
most had not
developed plans or milestones for doing so
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 32 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
21 Evaluation of Component Agencies' Draft
BCCPs (Cont'd)
Status of Phase I Efforts
Draft plans showed all agencies had initiated BCCP planning
efforts by establishing work groups developing a planning
strategy identifying core business processes defining roles and
responsibilities Status of work on the remaining BCCP initiation
steps varied by agency,
but generally, was not yet complete for example, most plans
mentioned milestones, but did not include time frames
for completing interim BCCP steps and for completing and testing
plans
Initiation Key Steps 1. Establish work groups
2. Develop high- level planning strategy 3. Identify core
processes 4. Define roles and responsibilities 5. Develop master
schedule/ milestones 6. Implement risk management 7. Assess
existing disaster recovery
capabilities 8. Implement quality assurance reviews
Initiation Key Steps 1. Establish work groups
2. Develop high- level planning strategy 3. Identify core
processes 4. Define roles and responsibilities 5. Develop master
schedule/ milestones 6. Implement risk management 7. Assess
existing disaster recovery
capabilities 8. Implement quality assurance reviews
Initiation Key Steps 1. Establish work groups
2. Develop high- level planning strategy 3. Identify core
processes 4. Define roles and responsibilities 5. Develop master
schedule/ milestones 6. Implement risk management 7. Assess
existing disaster recovery
capabilities 8. Implement quality assurance reviews
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 33 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
22 Evaluation of Component Agencies' Draft
BCCPs (Cont'd)
Status of Phase II Efforts
Agencies' draft plans discussed information requirements
identified methods of developing BCCPs and Year 2000 failure
scenarios included results of risk and impact analysis for each
core process
However, none of the agencies' BCCPs identified whether or how
minimum acceptable levels of output and recovery time objectives
for all their core processes would be defined
[This step is important for choosing appropriate contingency
alternatives and establishing the agency's recovery priorities
(Phase III)]
Business Impact Analysis Key Steps
1. Define information requirements and methods to be used in
developing BCCP 2. Define Year 2000 failure scenarios 3. Perform
risk and impact analyses of each
core business process 4. Assess and document infrastructure risks
5. Define minimum levels of outputs and
services for each core business process
Business Impact Analysis Key Steps
1. Define information requirements and methods to be used in
developing BCCP 2. Define Year 2000 failure scenarios 3. Perform
risk and impact analyses of each
core business process 4. Assess and document infrastructure risks
5. Define minimum levels of outputs and
services for each core business process
Business Impact Analysis Key Steps
1. Define information requirements and methods to be used in
developing BCCP 2. Define Year 2000 failure scenarios 3. Perform
risk and impact analyses of each
core business process 4. Assess and document infrastructure risks
5. Define minimum levels of outputs and
services for each core business process
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 34 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
23 Evaluation of Component Agencies' Draft
BCCPs (Cont'd)
Status of Phase III Efforts
Agencies identified contingencies in their draft BCCPs in very
general and/ or vague terms and did not cover all contingency
planning steps
for example, for many of FNS' contingencies, it said only that it
would revert to manual processes, identify the problem, and work
with contractor to correct it, but gave no further information to
describe how this would be done
other agencies, such as FS, APHIS, GIPSA, NRCS, NASS, and RD, also
discussed using manual processes in general terms, but did not
identify contingency procedures, resources and staff roles, and
timetables to implement them
Contingency Planning Key Steps
1. Assess cost/ benefits of contingency alternatives and select
best contingency for each core business process 2. Identify and
document contingency plans
and implementation modes 3. Define triggers for activating plans
4. Establish business resumption team for
each core business process 5. Develop zero day strategy and
procedures
Contingency Planning Key Steps
1. Assess cost/ benefits of contingency alternatives and select
best contingency for each core business process 2. Identify and
document contingency plans
and implementation modes 3. Define triggers for activating plans
4. Establish business resumption team for
each core business process 5. Develop zero day strategy and
procedures
Contingency Planning Key Steps
1. Assess cost/ benefits of contingency alternatives and select
best contingency for each core business process 2. Identify and
document contingency plans
and implementation modes 3. Define triggers for activating plans
4. Establish business resumption team for
each core business process 5. Develop zero day strategy and
procedures
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 35 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
24 Evaluation of Component Agencies' Draft
BCCPs (Cont'd)
Status of Phase IV Efforts
Some BCCPs and progress reports indicated that testing (Phase IV
steps) would be done in the future
Six agencies (FNS, FSA, FAS, FS, AMS, and ARS) identified testing
milestones, but none showed that test plans had been developed
Testing Key Steps 1. Validate business continuity strategy
2. Develop contingency test plans 3. Establish test teams and
acquire
resources 4. Prepare and execute tests 5. Validate capability of
contingency plans 6. Rehearse business resumption teams 7. Update
BCCPs based upon lessons
learned and re- test, if necessary 8. Update disaster recovery
plans and
procedures
Testing Key Steps 1. Validate business continuity strategy
2. Develop contingency test plans 3. Establish test teams and
acquire
resources 4. Prepare and execute tests 5. Validate capability of
contingency plans 6. Rehearse business resumption teams 7. Update
BCCPs based upon lessons
learned and re- test, if necessary 8. Update disaster recovery
plans and
procedures
Testing Key Steps 1. Validate business continuity strategy
2. Develop contingency test plans 3. Establish test teams and
acquire
resources 4. Prepare and execute tests 5. Validate capability of
contingency plans 6. Rehearse business resumption teams 7. Update
BCCPs based upon lessons
learned and re- test, if necessary 8. Update disaster recovery
plans and
procedures
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 36 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
25 Actions At Four Component Agencies to
Complete Key BCCP Steps
To identify actions underway or planned by agencies to complete
key planning steps in their draft BCCPs, we visited the following
four agencies
FSIS APHIS FSA FNS
Ensuring Year 2000 risks are addressed at these agencies is
especially important given their vital health and safety,
financial, and/ or economic missions
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 37 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
26 Actions At Four Component Agencies
to Complete Key BCCP Steps (Cont'd)
As of the end of March 1999, progress varied among the four
agencies on completing key BCCP steps left in Phases II- IV that
had not been addressed in their draft plans
Specifically, our visits to the four agencies found that none
had yet determined minimal acceptable levels of output or
completed work defining contingency procedures all planned to
better define contingencies or were in the process
of doing so FSIS and FSA had recently established testing
milestones, but
APHIS had not done so (FNS' draft BCCP included one testing
milestone, but this milestone had been missed) all planned to do
testing when ready, but said they currently did
not know how testing would be performed
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 38 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
FSIS ensures that our nation's meats, poultry, and processed egg
product supply is safe
Key BCCP Steps Remaining At FSIS 27 Actions At Four Component
Agencies
to Complete Key BCCP Steps (Cont'd) Zero Day Strategy Step has not
yet been addressed, but FSIS says it plans to develop a zero day
strategy with contractor assistance. BCCP Test Plans
Step has not yet been addressed, but FSIS says it plans to
establish BCCP testing milestones with contractor assistance.
Contingency Plans and
Implementation Modes FSIS plans to hire a contractor in April 1999
for providing assistance with
developing contingency plans for FSIS and its local offices. Step
has not yet been addressed, but FSIS says it plans to establish
business resumption teams. Business Resumption
Teams Step has not yet been addressed, but FSIS says it plans to
develop test plans with contractor assistance.
BCCP Test Completion Milestones Acceptable Levels of
Output/ Recovery Time Objective
Step is not being done because FSIS believes its core business
processes must continue at current operational levels and cannot
be down for any period of time.
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 39 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Acceptable Levels of Output/ Recovery Time Objective
Step has not yet been addressed, but APHIS said acceptable levels
of output and recovery time objectives will be defined as BCCPs
are developed at APHIS' more than 800 local offices.
Contingency Plans and Implementation Modes
Managers were asked to prepare local plans by March 31, 1999, but
status is unknown as the local plans are not being collected by
APHIS headquarters.
Business Resumption Teams
APHIS said that local offices are reporting that teams are being
established as part of their BCCP development effort, but overall
status is unknown.
Zero Day Strategy APHIS has begun working to define a zero day
strategy. BCCP Test Plans APHIS said that several local offices
are reporting that they have developed test
plans and have already conducted some testing, but overall status
is unknown. BCCP Test Completion Milestones
No testing milestones have been established.
APHIS protects U. S. agriculture from imported pest and diseases
and enhances marketability of our nation's agricultural products
abroad
Key BCCP Steps Remaining At APHIS 28 Actions At Four Component
Agencies
to Complete Key BCCP Steps (Cont'd)
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 40 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Contingency Plans and Implementation Modes
FSA provides expanded economic opportunities for agricultural
producers through commodity and income support and farm credit
programs
Key BCCP Steps Remaining At FSA
29 Actions At Four Component Agencies
to Complete Key BCCP Steps (Cont'd) 29 Output levels are not being
established, but FSA has defined the time period in
which it could continue to operate before a contingency must be
implemented. FSA has been developing more detailed contingency
plans, and has a deadline of April 1999 for their completion.
Zero Day Strategy Step has not yet been addressed, but FSA says it
plans to develop a zero day strategy.
BCCP Test Completion Milestones
A June 1999 milestone has been established for completing BCCP
testing. Acceptable Levels of
Output/ Recovery Time Objective
Business Resumption Teams
Business Resumption Teams are not being established instead,
contingency team managers have been designated to work with teams
to perform similar purpose.
BCCP Test Plans Test plans have not yet been developed, but FSA
says it expects to do desktop exercises, given the short amount of
time remaining.
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 41 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
30 30
FNS administers America's domestic nutrition programs-- food
stamps, WIC, and child nutrition and commodity assistance-- and
delivers these programs working in partnerships with the states
Key BCCP Steps Remaining At FNS
Actions At Four Component Agencies to Complete Key BCCP Steps
(Cont'd)
Contingency Plans and Implementation Modes Acceptable Levels of
Output/ Recovery Time Objective
FNS believes current operations for benefits systems are the
minimum necessary and FNS is revising its draft plan to address
recovery times.
FNS is revising its draft plan to describe contingencies more
fully. A contractor will be hired in April 1999 to help FNS
regions determine states' progress on developing BCCPs, but FNS
does not plan to develop contingencies for responding to potential
Year 2000 failures at state levels.
Zero Day Strategy FNS is revising its draft plan to address a zero
day strategy, but this strategy will not be finalized until more
information is obtained from the states.
Draft plan includes a date for testing financial systems
contingencies, but this date has been missed. Milestones for
testing contingencies for all core processes will be included in
revised draft plan. BCCP Test
Completion Milestones
Business Resumption Teams
FNS is revising its draft plan to address business resumption
teams. Generally, these are the same individuals as those
currently responsible for operating FNS' information systems.
BCCP Test Plans Test procedures for contingencies for financial
operations exist, but are not referenced in the draft BCCP. FNS
said it will develop plans for testing contingencies for other FNS
core processes.
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 42 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
31 Observations on USDA's BCCP
Time Frames and Milestones
USDA reported in its February 1999 Year 2000 quarterly report to
OMB that it expected to complete all BCCPs by December 1999
USDA's December 1999 time frame for completing BCCPs leaves no
room for slippage in dates or time for correcting
and retesting plans if necessary is after the beginning of fiscal
year 2000 (October 1, 1999),
when potential failures could have already occurred
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 43 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
32 Observations on USDA's BCCP
Time Frames and Milestones (Cont'd)
In January 1999, we testified that OMB, which oversees the
government's Year 2000 efforts, should consider establishing dates
of April 30, 1999 to complete BCCPs and September 30, 1999 to
complete testing, which allows agencies time to
adjust work schedules should milestones slip address any
shortfalls found when testing their plans
and make necessary adjustments be prepared for Year 2000 failures
that could have
already occurred by the start of fiscal year 2000 Recently, OMB
indicated it
is developing a process to coordinate work on BCCPs across the
agencies has informally notified the agencies to be prepared to
submit
BCCPs to OMB in June 1999
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 44 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
33 Observations on USDA's BCCP
Time Frames and Milestones (Cont'd)
However, specific governmentwide milestones for agencies to
complete and test BCCPs have not yet been established by OMB
To provide time for any slippages or for correcting and retesting
plans if necessary, it is important that USDA move up its time
frame for completing and testing BCCPs earlier, such as the
September 30, 1999 date we suggested
Given the substantial amount of BCCP work remaining, advancing
the department's time frames would require that USDA agencies and
offices set priorities to ensure that, at a minimum, BCCPs are
completed for the highest priority business processes
Currently, priorities have not been established for first
completing BCCPs that address Year 2000 risks for the department's
43 highest priority business processes
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 45 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
34 Recommendations
We recommend that the Secretary of Agriculture direct that the
CIO advance the department's December 1999 time frame for
completing and testing agencies' BCCPs to no later than September
30,1999
We also recommend that the Secretary direct that the
Undersecretaries for USDA's 7 mission areas-- as well as the CIO,
Chief Financial Officer, and Assistant Secretary for Departmental
Administration-- have their respective agencies and offices:
develop priorities for completing and testing BCCPs which are
aligned with the department's 43 highest priority business
processes to ensure that remaining work addresses these processes
first
Appendix I Briefing on Year 2000 USDA Contingency Planning
Page 46 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
35 Recommendations (Cont'd)
establish specific milestones to complete key interim BCCP steps
that have not yet been adequately addressed, including:
defining acceptable levels of output/ recovery time objectives
documenting contingency plans that clearly describe contingency
triggers and implementation modes establishing business
resumption teams developing zero day strategies developing
contingency test plans conducting contingency tests
report regularly to the Secretary progress on meeting these
milestones to ensure that the agencies adequately address all key
business continuity and contingency planning steps that are
appropriate to each agency
Page 47 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Appendix II Major Contributors to This Report Appendi x I I
Accounting and Information Management Division, Washington, D. C.
Mark D. Shaw, Assistant Director Heather W. McIntyre, Senior
Information Systems Analyst Richard B. Hung, Technical Advisor
Kansas City Field Office
Troy G. Hottovy, Senior Information Systems Analyst Janet M.
Jamison, Senior Evaluator
(511478) Let t er
Ordering Information The first copy of each GAO report and
testimony is free. Additional copies are $2 each. Orders should be
sent to the following address, accompanied by a check or money
order made out to the Superintendent of Documents, when necessary,
VISA and
MasterCard credit cards are accepted, also. Orders for 100 or more
copies to be mailed to a single address are discounted 25 percent.
Orders by mail: U. S. General Accounting Office P. O. Box 37050
Washington, DC 20013
or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW)
U. S. General Accounting Office Washington, DC
Orders may also be placed by calling (202) 512- 6000 or by using
fax number (202) 512- 6061, or TDD (202) 512- 2537.
Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any
list from the past 30 days, please call (202) 512- 6000 using a
touchtone phone. A recorded menu will provide information on how
to obtain these lists.
For information on how to access GAO reports on the INTERNET, send
an e- mail message with info in the body to:
info@ www. gao. gov or visit GAO's World Wide Web Home Page at:
http:// www. gao. gov
United States General Accounting Office Washington, D. C. 20548-
0001
Official Business Penalty for Private Use $300
Address Correction Requested Bulk Rate
Postage & Fees Paid GAO Permit No. GI00
*** End of document. ***