Year 2000 Computing Crisis: USDA Needs to Accelerate Time Frames for
Completing Contingency Planning (Letter Report, 05/21/99,
GAO/AIMD-99-178).

Pursuant to a congressional request, GAO identified actions the
Department of Agriculture (USDA) is taking to develop year 2000 business
continuity and contingency plans (BCCP).

GAO noted that: (1) under the leadership of the department's chief
information officer (CIO) and year 2000 program office, USDA component
agencies are actively engaged in developing BCCPs to prepare for
unforeseen year 2000-related failures; (2) however, much work remains
over the next several months to complete and test USDA's BCCPs; and (3)
the department's December 1999 departmentwide goal for completing BCCPs
leaves no room for delays or sufficient time for correcting, revising,
and retesting plans if necessary.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  AIMD-99-178
     TITLE:  Year 2000 Computing Crisis: USDA Needs to Accelerate Time
	     Frames for Completing Contingency Planning
      DATE:  05/21/99
   SUBJECT:  Y2K
	     Computer security
	     Computer software
	     Computer software verification and validation
	     Data integrity
	     Information systems
	     Strategic information systems planning
	     Systems conversions
IDENTIFIER:  Y2K
	     USDA Year 2000 Program

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO report.  This text was extracted from a PDF file.        **
** Delineations within the text indicating chapter titles,      **
** headings, and bullets have not been preserved, and in some   **
** cases heading text has been incorrectly merged into          **
** body text in the adjacent column.  Graphic images have       **
** not been reproduced, but figure captions are included.       **
** Tables are included, but column deliniations have not been   **
** preserved.                                                   **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                                            **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************
ai99178 GAO United States General Accounting Office

Report to the Chairman, Subcommittee on Department Operations,
Oversight, Nutrition, and Forestry, Committee on Agriculture,
House of Representatives

May 1999 YEAR 2000 COMPUTING CRISIS

USDA Needs to Accelerate Time Frames for Completing Contingency
Planning

GAO/AIMD-99-178

  GAO/AIMD-99-178

Page 1 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning United
States General Accounting Office

Washington, D. C. 20548 Let t er Accounting and Information

Management Division

B-282664 Letter May 21, 1999 The Honorable Bob Goodlatte Chairman
Subcommittee on Department Operations, Oversight, Nutrition, and
Forestry Committee on Agriculture House of Representatives

Dear Mr. Chairman: As you know, the Department of Agriculture
(USDA) provides public services that are vital to the health,
safety, and well being of Americans. To minimize possible
disruptions in service caused by the Year 2000

computing issue, USDA needs to prepare and test business
continuity and contingency plans (BCCPs). At your request, we
identified actions USDA is taking to develop Year 2000 BCCPs and
briefed your office on the results of our work on April 20, 1999.
The briefing slides are in appendix I.

This report provides a high- level summary of information
presented at that briefing and presents recommendations we are
making to USDA to ensure that the department completes the
necessary contingency planning steps and validates its plans in
advance of the new year.

Results in Brief

Under the leadership of the department's chief information officer
(CIO) and Year 2000 program office, USDA component agencies are
actively engaged in developing BCCPs to prepare for unforeseen
Year 2000- related failures. However, much work remains over the
next several months to complete and test USDA's BCCPs. The
department's December 1999 departmentwide goal for completing
BCCPs leaves no room for delays or sufficient time for correcting,
revising, and retesting plans if necessary. Therefore, we are
recommending that USDA advance its time frame to no later than
September 30, 1999, and develop priorities for completing and
testing BCCPs that are aligned with the department's highest
priority

business processes to ensure that remaining work addresses these
processes first. USDA's CIO agreed to implement our
recommendations.

Lett er

B-282664 Page 2 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning

Background The Year 2000 computing problem poses significant risks
which, if not adequately addressed, could have serious
consequences. For example,

 public health and safety could be at risk if systems and
equipment used to detect and track diseases, unwholesome foods,
and agricultural pests do not function properly; and  food
assistance to needy households and food distribution to schools

and others could be stopped or delayed. Ensuring that these and
other vital public services are not disrupted at the turn of the
century is no small undertaking in such a large and diverse
organization as USDA. According to USDA's March 31, 1999, report
to the

Office of Management and Budget (OMB) on the status of its Year
2000 efforts, the department has 352 mission critical systems, of
which 337, or about 96 percent, are compliant. 1 USDA said it
expects to have the 15 remaining systems retired, replaced, or
repaired by October 31, 1999. The risk of Year 2000 failures,
however, is not limited to USDA's internal information systems. As
is the case with other federal agencies, USDA depends on
information and data provided by business partners including

other federal agencies, hundreds of state and local agencies,
international organizations, and private sector entities.
Dependencies on services provided by the public infrastructure
must also be taken into account including power, water,
transportation, and voice and data communications. One weak link
anywhere in the chain of critical dependencies can cause major
disruptions to business operations.

Given these interdependencies and risks, it is imperative that
BCCPs be developed to identify, assess, manage, and mitigate Year
2000 risks and help ensure the continuity of all core business
processes. Such plans focus on reducing the risk of Year 2000-
induced business failures by helping to safeguard an agency's
ability to produce a minimum acceptable level of outputs and
services in the event of failures of internal or external
missioncritical

information systems and services. It also links management and
mitigation efforts to the agency's Year 2000 program, and helps to
identify alternate resources and processes needed to operate the
agency's core business processes. 1 The department reported that
it had revised the number of mission critical systems from 352 to
350 on April 9, 1999.

Lett er

B-282664 Page 3 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning

To help agencies manage the risk of potential Year 2000- induced
disruptions to their operations, we prepared the Year 2000
Computing Crisis: Business Continuity and Contingency Planning 2
guide. This guide,

which has been adopted by OMB as the standard federal agencies
should use in preparing BCCPs, identifies four phases initiation;
business impact analysis; contingency planning; and testing that
cover key steps necessary to complete business continuity and
contingency planning.

USDA and Its Agencies Are Actively Engaged in Developing BCCPs

In July 1998, the CIO's Year 2000 program office issued USDA's
Year 2000 Business Continuity (Contingency) Planning Guide 3 for
its agencies and offices to follow in preparing BCCPs. At the
CIO's direction, mission areas, agencies, and offices were
required to identify core business processes for each mission area
and prepare and submit BCCPs approved by their

mission area undersecretaries by September 30, 1998. This date was
later extended to October 30, 1998. Also, the Year 2000 program
office provided agencies with training as well as a template and
matrix to use in developing their BCCPs.

In January 1999, the Year 2000 program office obtained contractor
assistance with developing a departmentwide BCCP that is intended
to integrate the agencies' and offices' BCCPs and define the
highest risk processes and systems. As part of the department's
ongoing BCCP work, 43 of its 79 total core business processes and
52 of its 352 total mission critical systems have been identified
as USDA's highest priority processes and systems.

Fifteen USDA component agencies are most directly responsible for
accomplishing the department's missions and programs. 4 Eight of
these 2 Year 2000 Computing Crisis: Business Continuity and
Contingency Planning (GAO/ AIMD- 10.1.19, August 1998). 3 USDA's
guide parallels our guide, Year 2000 Computing Crisis: Business
Continuity and Contingency Planning. 4 The 15 component agencies
are: Agricultural Marketing Service (AMS); Agricultural Research
Service (ARS); Animal and Plant Health Inspection Service (APHIS);
Cooperative State Research, Education, and Extension Service
(CSREES); Economic Research Service (ERS); Farm Service Agency
(FSA); Food and Nutrition Service (FNS); Food Safety and
Inspection Service (FSIS); Foreign Agricultural Service (FAS);
Forest Service (FS); Grain Inspection, Packers and Stockyards
Administration (GIPSA); National Agricultural Statistics Service
(NASS); Natural Resources Conservation Service (NRCS); Risk
Management Agency (RMA); and Rural Development (RD). The RD
mission area includes Rural

Utilities Service, Rural Housing Service, and Rural Business-
Cooperative Service. Since there was only one BCCP addressing all
three, we counted these as one component agency.

B-282664 Page 4 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning

agencies submitted draft BCCPs by the October 30, 1998, deadline.
Another six submitted their draft plans from November 1998 through
January 1999. While the one remaining agency NRCS also submitted a
draft plan, the mission area undersecretary had not approved it at
the completion of our

review on March 31, 1999. The CIO's Year 2000 program office also
required that the agencies submit quarterly updates to their
BCCPs. These updates are to be submitted in April, July, October,
and December 1999.

Much Work Remains to Complete and Test Agencies' Draft BCCPs

Much more work remains over the next several months to complete
and test USDA's draft BCCPs. We reviewed the draft plans and
progress reports prepared by USDA's 15 component agencies using
the four- phased planning approach outlined in our business
continuity and contingency planning

guide and USDA's guide and found that, as of the end of our
review, the agencies had

 completed the initiation phase or had it underway;  completed
most of the business impact analysis phase, but had not yet

identified how minimum acceptable levels of output and recovery
time objectives would be defined;  started the contingency
planning phase, but descriptions of contingency measures and
actions were too general and/ or vague to be implemented

as written; and  not begun the testing phase and most had not
developed plans or milestones for doing so.

Progress Completing Key BCCP Steps Varied at Four Component
Agencies

At the four agencies we visited FSIS, APHIS, FSA, and FNS 5
progress in completing unaddressed key BCCP steps varied. Our
review of actions underway or planned by these agencies to
complete BCCPs found that, as of March 31, 1999,  none had yet
determined minimal acceptable levels of output or completed work
defining contingency procedures; 5 Ensuring Year 2000 risks are
addressed at these agencies is especially important given their
vital health and safety, financial, and/ or economic missions.

B-282664 Page 5 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning

 all planned to better define contingencies or were in the process
of doing so;  FSIS and FSA had recently established testing
milestones, but APHIS

had not done so (FNS' draft BCCP included one testing milestone,
but this milestone had been missed); and  all planned to do
testing when ready, but said they currently did not know how
testing would be performed.

USDA's Time Frame for Completing and Testing BCCPs Is Too Late

USDA reported in its February 1999 Year 2000 quarterly report to
OMB that it expected to complete all BCCPs by December 1999. This
time frame leaves no room for slippages in dates or time for
correcting and retesting the BCCPs should this be necessary.
Moreover, the department's December 1999 time frame falls after
the beginning of the new fiscal year (October 1, 1999). At that
time, the risks of Year 2000- induced failures will increase

because of federal agencies' use of fiscal year 2000 dates. In
January 1999, we testified that OMB should consider establishing
dates of April 30, 1999, for agencies to complete their BCCPs and
September 30, 1999, to complete testing. 6 By doing so, agencies
would have time to adjust work schedules should milestones slip
and to address any shortfalls found

when testing plans and make necessary adjustments. These time
frames would also allow agencies to be prepared for Year 2000
failures that could have already occurred by the beginning of the
new fiscal year. Although OMB has not yet established specific
governmentwide milestones for

agencies to complete and test their BCCPs, OMB stated recently
that it is developing a process to coordinate work on BCCPs across
government agencies. In doing so, the agencies have been
informally notified to be prepared to submit BCCPs to OMB in June
1999. To allow time for any slippages that might occur or time for
correcting and retesting plans if necessary, USDA will need to
establish an earlier milestone for completing and testing BCCPs,
such as the September 1999 date we have suggested. Given the
substantial amount of BCCP work

remaining, moving up the department's December 1999 time frame
would also require USDA's agencies and offices to establish
priorities for ensuring that, at a minimum, BCCPs are first
completed for the highest priority business processes. USDA has
determined that 43 of the component 6 Year 2000 Computing Crisis:
Readiness Improving, But Much Work Remains to Avoid Major

Disruptions (GAO/T-AIMD-99-50, January 20, 1999).

B-282664 Page 6 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning

agencies' and offices' 79 core business processes are the
department's highest priority processes. However, neither USDA,
nor its component agencies and offices, have established
priorities for completing BCCPs to address Year 2000 risks for
these 43 high priority business processes first.

Recommendations We recommend that the Secretary of Agriculture
direct that the CIO advance the department's December 1999 time
frame for completing and

testing agencies' BCCPs to no later than September 30, 1999. We
also recommend that the Secretary direct that the Undersecretaries
for USDA's seven mission areas, as well as the CIO, Chief
Financial Officer, and Assistant Secretary for Administration,
have their respective agencies and offices

 develop priorities for completing and testing BCCPs which are
aligned with the department's 43 highest priority business
processes to ensure that remaining work addresses these processes
first;  establish specific milestones to complete key interim BCCP
steps that have not yet been addressed; and

 report regularly to the Secretary progress on meeting these
milestones to ensure that the agencies and offices adequately
address all key BCCP steps that are appropriate to each agency. On
April 8, 1999, we provided a copy of our briefing materials, which
were used in preparing this report, to USDA's CIO, deputy CIO, and
officials representing USDA's Year 2000 program office. These
officials agreed with our findings and the CIO stated that USDA
planned to implement our recommendations.

Objective, Scope, and Methodology

As requested, our objective was to identify actions USDA has taken
to develop business continuity and contingency plans. To do this,
we reviewed departmental guidance and discussed with Year 2000
program officials in USDA's CIO office how this guidance was being
implemented. We also reviewed draft BCCPs and progress reports
prepared by the 15 USDA agencies most directly responsible for
accomplishing the department's missions and programs. We
identified what work remained to

complete these plans by comparing them, and information contained
in progress reports, to our business continuity and contingency
planning guide. Because we focused on the continuity of USDA's
core missions and

B-282664 Page 7 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning

programs, we did not include in our review the draft BCCPs
prepared by USDA staff offices, such as the CIO and the Chief
Financial Officer. Further, to determine actions underway or
planned to complete key BCCP steps, we interviewed Year 2000
planning officials at four agencies APHIS, FSA, FSIS, and FNS and
reviewed their documents and materials discussing BCCP activities.
Our focus at these agencies was on key steps that had not been
addressed by most agencies in their draft BCCPs. These

included six areas: (1) acceptable levels of output/ recovery time
objectives, (2) contingency plans and implementation modes, (3)
business resumption teams, (4) zero day strategy, (5) BCCP test
plans, and

(6) BCCP test completion milestones. We conducted our review from
September 1998 through March 1999 in accordance with generally
accepted government auditing standards. Our work was done at USDA
headquarters in Washington, D. C., at the CIO's office and the
CIO's Year 2000 program office. We also conducted work at agency
offices of FSIS and APHIS in Washington, D. C.; FNS in Alexandria,
Virginia; and FSA in Kansas City, Missouri.

As agreed with your office, unless you publicly announce its
contents earlier, we plan no further distribution of this report
until 30 days from the date of this letter. At that time, we will
send copies of this report to Representative Eva Clayton, Ranking
Minority Member of your Subcommittee; Representatives Larry
Combest, Chairman, and Charles Stenholm, Ranking Minority Member,
House Committee on Agriculture; Representatives Steven Horn,
Chairman, and Jim Turner, Ranking Minority Member, House Committee
on Government Reform, Subcommittee on Government Management,
Information and Technology; Senators Richard Lugar, Chairman, and
Tom Harkin, Ranking Minority Member, Senate Committee on
Agriculture, Nutrition, and Forestry; Senators Robert Bennett,
Chairman, and Christopher Dodd, Ranking Minority Member,

Senate Special Committee on the Year 2000 Technology Problem; the
Honorable Daniel Glickman, Secretary of Agriculture; and the
Honorable Jacob Lew, Director, Office of Management and Budget;
and other

interested parties. Copies will also be made available to others
upon request.

B-282664 Page 8 GAO/AIMD-99-178 Year 2000 USDA Contingency
Planning

If you have any questions on matters discussed in this letter,
please call me at (202) 512- 6408 or Stephen A. Schwartz, Senior
Assistant Director, at (202) 512- 6213. Other major contributors
to this report are listed in appendix II.

Sincerely yours, Joel C. Willemssen Director, Civil Agencies
Information Systems

Page 9 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

Page 10 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

Contents Letter 1 Appendix I: Briefing on Year 2000 USDA
Contingency Planning

12 Appendix II: Major Contributors to This Report

47

Page 11 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

Page 12 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

Appendix I Briefing on Year 2000 USDA Contingency Planning Appendi
x I

Accounting and Information Management Division

1 USDA's Year 2000

Business Continuity and Contingency Plans

House Committee on Agriculture Subcommittee on Department
Operations,

Oversight, Nutrition, and Forestry April 20, 1999

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 13 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

2

Purpose of briefing is to provide the results of our review of
USDA's efforts to develop business continuity and contingency
plans (BCCPs)

 Review Objective  Scope and Methodology  Background  Summary
Results  Steps Taken By USDA's Chief Information Officer (CIO) and
the

Agencies to Develop BCCPs  Status of Agencies' Draft BCCPs
Evaluation of Component Agencies' Draft BCCPs  Actions at Four
Component Agencies to Complete Key BCCP Steps  Observations on
USDA's BCCP Time Frames and Milestones  Recommendations

Purpose

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 14 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

3

We were asked to: Identify what action USDA has taken to develop
BCCPs for addressing its Year 2000 risks

Review Objective

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 15 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

4 Scope and Methodology

 We reviewed departmental BCCP guidance and discussed how this
guidance was being implemented with Year 2000 program officials

 We reviewed draft BCCPs prepared by the 15 USDA component
agencies most directly responsible for accomplishing the
department's seven key missions

*The RD mission area includes Rural Utilities Service, Rural
Housing Service, and Rural Business- Cooperative Service. Since
there was only one BCCP addressing all three, we counted these as
one component agency.

 Agricultural Research Service (ARS)

 Cooperative State Research, Education, and Extension Service
(CSREES)

 Economic Research Service (ERS)

 Food Safety and Inspection Service (FSIS)

 Animal and Plant Health Inspection Service (APHIS)

 Agricultural Marketing Service (AMS)

 Grain Inspection, Packers and Stockyards Administration (GIPSA)

 Natural Resources Conservation Service (NRCS)

 Forest Service (FS)

 Farm Service Agency (FSA)

 Foreign Agricultural Service (FAS)

 Risk Management Agency (RMA)

 Food and Nutrition Service (FNS)

 National Agricultural Statistics Service (NASS)

 Rural Development (RD)*

 Agricultural Research Service (ARS)

 Cooperative State Research, Education, and Extension Service
(CSREES)

 Economic Research Service (ERS)

 Food Safety and Inspection Service (FSIS)

 Animal and Plant Health Inspection Service (APHIS)

 Agricultural Marketing Service (AMS)

 Grain Inspection, Packers and Stockyards Administration (GIPSA)

 Natural Resources Conservation Service (NRCS)

 Forest Service (FS)

 Farm Service Agency (FSA)

 Foreign Agricultural Service (FAS)

 Risk Management Agency (RMA)

 Food and Nutrition Service (FNS)

 National Agricultural Statistics Service (NASS)

 Rural Development (RD)*

 Agricultural Research Service (ARS)

 Cooperative State Research, Education, and Extension Service
(CSREES)

 Economic Research Service (ERS)

 Food Safety and Inspection Service (FSIS)

 Animal and Plant Health Inspection Service (APHIS)

 Agricultural Marketing Service (AMS)

 Grain Inspection, Packers and Stockyards Administration (GIPSA)

 Natural Resources Conservation Service (NRCS)

 Forest Service (FS)

 Farm Service Agency (FSA)

 Foreign Agricultural Service (FAS)

 Risk Management Agency (RMA)

 Food and Nutrition Service (FNS)

 National Agricultural Statistics Service (NASS)

 Rural Development (RD)*

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 16 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

 We used our guide,* which was adopted by OMB as the standard
federal agencies should use in preparing BCCPs  The guide includes
key planning steps for completing the

following four phases *Year 2000 Computing Crisis: Business
Continuity and Contingency Planning (GAO/ AIMD10.1.19, August
1998)

5 Scope and Methodology (Cont'd)

Phase II Business Impact Analyses  Analyze risks and possible Year
2000 impacts, define failure scenarios, define minimum levels of
output and service for core processes

Phase IV Testing  Validate agencies' BCCPs Phase I Initiation
Establish a planning strategy, work group, milestones, and

identify core business processes Phase III Contingency Planning
Develop contingency plans and define when and

how they will be implemented

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 17 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

6 Scope and Methodology (Cont'd)

 We also visited four agencies-- FSIS, APHIS, FSA, and FNS-- to
identify additional actions either underway or planned for
completing work on the draft BCCPs

 We also reviewed agency progress reports and other USDA
documentation to identify time frames and milestones for
completing BCCPs and track departmentwide progress

 Because we focused on continuity of USDA's core missions and
programs, we did not include in our review draft BCCPs prepared by
USDA staff offices, such as the Office of Chief Information
Officer and the Office of the Chief Financial Officer

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 18 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

7 Scope and Methodology (Cont'd)

 We conducted work at  USDA's CIO Office and the CIO's Year 2000
program office,

FSIS, FSA, and APHIS in Washington, D. C.  FNS in Alexandria,
Virginia  FSA in Kansas City, Missouri

 We performed our work from September 1998 through March 1999 in
accordance with generally accepted government auditing standards

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 19 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

8 Background

 Year 2000 computing problems pose significant risks, which if not
adequately addressed, could result in severe consequences

 for example, at USDA  public health/ safety is at risk if systems
and equipment do

not work to detect unwholesome foods  food assistance to needy
households could be delayed

 Data exchanges with business partners and public infrastructures
(i. e., telephone, power, etc.) create additional risks

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 20 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

9 Background (Cont'd)

 BCCPs safeguard an agency's ability to produce a minimum
acceptable level of outputs and services in the event of Year 2000
failures by

 identifying critical functions that may be affected by the
agency's internal information systems as well as outside services,
such as the ability of suppliers to provide products, services,
data, or the loss of critical infrastructure (i. e.,
communications, power, etc.)

 describing risk mitigation strategies and work- around
alternatives to ensure continuity of the agency's core business
functions, especially those functions with the most immediate and
direct effect on the public

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 21 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

10 Background (Cont'd)

 Ensuring that vital public services are not disrupted at the turn
of the century is no small undertaking in such a large and diverse
organization as USDA

 As of OMB's March 31, 1999 deadline for achieving Year 2000
compliance for all internal information systems, USDA reported

 337 of its 352 mission critical systems are compliant

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 22 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

11 Background (Cont'd)

 USDA's CIO is responsible for leading the department's
preparation for Year 2000

 CIO established a Year 2000 program office, under the direction
of a Year 2000 Program Executive, to:  oversee efforts to ensure
that all critical USDA information

systems are Year 2000 compliant and operational before the end of
1999

 provide departmentwide leadership and direction in Year 2000
business continuity and contingency planning, which includes:

 providing departmentwide BCCP guidance and training  assisting
agencies/ offices in identifying core business

processes and developing their BCCPs  monitoring agencies'/
offices' efforts to fully develop and test

BCCPs for USDA's core business processes

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 23 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

12 Summary Results

 Under the leadership of the CIO and Year 2000 program office,
USDA agencies are actively engaged in developing business
continuity and contingency plans to address the department's Year
2000 risks

 Agencies have submitted draft BCCPs  Much more work remains over
the next several months to

complete and test USDA's BCCPs

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 24 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

13 Summary Results (Cont'd)

 Our review of agencies' draft BCCPs and progress reports found
that overall, the agencies had

 completed initiation (Phase I) or had it underway  completed some
business impact analysis (Phase II), but had

not yet identified how minimum acceptable levels of output and
recovery time objectives would be defined  started contingency
planning (Phase III), but descriptions of

contingency measures and actions were too general and/ or vague to
be implemented as written  not begun testing BCCPs (Phase IV) and
most had not

developed plans or milestones for doing so

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 25 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

14 Summary Results (Cont'd)

 Our visits to four agencies showed that, as of the end of March
1999, progress varied on completing key BCCP steps left in Phases
II- IV that had not been addressed in their draft plans

 USDA's recently established December 1999 time frame for
completing BCCPs

 leaves no room for slippage in dates or for correcting and
retesting plans if necessary

 is after the beginning of fiscal year 2000 (October 1, 1999),
when potential failures could have already occurred

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 26 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

15 Steps Taken By USDA's CIO and the

Agencies to Develop BCCPs

 In July 1998, the CIO  issued USDA's Year 2000 Business
Continuity

(Contingency) Planning Guide that parallels our BCCP guidance
required mission areas, agencies, and offices to

 identify core business processes for each mission area  prepare
and submit completed BCCPs to the CIO's Year

2000 program office by September 30, 1998  In August 1998, the
Secretary extended the deadline for

submitting BCCPs to October 30, 1998

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 27 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

Action to eliminate/ reduce likelihood of risk/ threat prior to
time horizon or failure

 In September 1998, the Year 2000 program office, with the
assistance of a contractor, provided agencies with training and a
template to use in developing BCCPs and a matrix for each core
process they identified to describe

16 Steps Taken By USDA's CIO and the

Agencies to Develop BCCPs (Cont'd) Risks and Threats Events having
a negative impact on core business function or critical system

Date when risk/ threat first impacts Business Priorities Areas of
emphasis

Contingencies Planned action to eliminate or reduce impact of
risk/ threat Triggers Risk Mitigation

Event causing contingency plan to be implemented Time Horizon To
Failure

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 28 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

|

17 Steps Taken By USDA's CIO and the

Agencies to Develop BCCPs (Cont'd)

 In January 1999, the Year 2000 program office obtained contractor
assistance to support the department's ongoing BCCP effort by

 starting to evaluate USDA agencies' and offices' draft BCCPs
providing advice to agencies on carrying out contingency

planning activities  assisting with the development of a
departmentwide BCCP that

integrates the agencies' and offices' BCCPs and defines highest
risk processes and systems

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 29 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

18 Steps Taken By USDA's CIO and the

Agencies to Develop BCCPs (Cont'd)

 As part of USDA's ongoing BCCP work,  43 of the department's 79
total core business processes were

identified as its highest priority  52 of the department's 352
total mission critical systems were

identified as its highest priority (USDA has determined that these
43 processes and 52 systems represent the greatest health and
safety, financial, and /or economic impacts)

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 30 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

19 Status of Agencies' Draft BCCPs

 Component agencies we reviewed have submitted draft BCCPs  8
submitted draft plans approved by mission area

undersecretaries by the October 30, 1998 deadline  6 submitted
approved draft plans between November 1998 and

January 1999  NRCS submitted a draft plan that has not yet been
approved

 Since January 1999  agencies have begun to modify the draft plans
in response to

comments by the CIO's Year 2000 program office that identified
items such as

 template/ matrices not completed  core business processes/
critical systems not discussed  agencies are required to submit
quarterly updates of their

BCCPs to the CIO's Year 2000 program office in April, July,
October, and December 1999

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 31 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

20 Evaluation of Component Agencies'

Draft BCCPs

 We reviewed draft BCCPs and available progress reports prepared
by 15 component agencies and found that much more work remains
over the next several months to complete and test these plans

 Overall, the agencies generally had  completed initiation (Phase
I) or had it underway  completed most of the business impact
analysis (Phase II), but

had not yet identified whether or how minimum acceptable levels of
output and recovery time objectives would be defined  started
contingency planning (Phase III), but descriptions of

contingency measures and actions were too general and/ or vague to
be implemented as written  not begun testing BCCPs (Phase IV) and
most had not

developed plans or milestones for doing so

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 32 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

21 Evaluation of Component Agencies' Draft

BCCPs (Cont'd)

Status of Phase I Efforts

 Draft plans showed all agencies had initiated BCCP planning
efforts by  establishing work groups  developing a planning
strategy  identifying core business processes  defining roles and
responsibilities  Status of work on the remaining BCCP initiation
steps varied by agency,

but generally, was not yet complete  for example, most plans
mentioned milestones, but did not include time frames

for completing interim BCCP steps and for completing and testing
plans

Initiation Key Steps 1. Establish work groups

2. Develop high- level planning strategy 3. Identify core
processes 4. Define roles and responsibilities 5. Develop master
schedule/ milestones 6. Implement risk management 7. Assess
existing disaster recovery

capabilities 8. Implement quality assurance reviews

Initiation Key Steps 1. Establish work groups

2. Develop high- level planning strategy 3. Identify core
processes 4. Define roles and responsibilities 5. Develop master
schedule/ milestones 6. Implement risk management 7. Assess
existing disaster recovery

capabilities 8. Implement quality assurance reviews

Initiation Key Steps 1. Establish work groups

2. Develop high- level planning strategy 3. Identify core
processes 4. Define roles and responsibilities 5. Develop master
schedule/ milestones 6. Implement risk management 7. Assess
existing disaster recovery

capabilities 8. Implement quality assurance reviews

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 33 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

22 Evaluation of Component Agencies' Draft

BCCPs (Cont'd)

Status of Phase II Efforts

 Agencies' draft plans  discussed information requirements
identified methods of developing BCCPs and Year 2000 failure
scenarios  included results of risk and impact analysis for each
core process

 However, none of the agencies' BCCPs identified whether or how
minimum acceptable levels of output and recovery time objectives
for all their core processes would be defined

[This step is important for choosing appropriate contingency
alternatives and establishing the agency's recovery priorities
(Phase III)]

Business Impact Analysis Key Steps

1. Define information requirements and methods to be used in
developing BCCP 2. Define Year 2000 failure scenarios 3. Perform
risk and impact analyses of each

core business process 4. Assess and document infrastructure risks
5. Define minimum levels of outputs and

services for each core business process

Business Impact Analysis Key Steps

1. Define information requirements and methods to be used in
developing BCCP 2. Define Year 2000 failure scenarios 3. Perform
risk and impact analyses of each

core business process 4. Assess and document infrastructure risks
5. Define minimum levels of outputs and

services for each core business process

Business Impact Analysis Key Steps

1. Define information requirements and methods to be used in
developing BCCP 2. Define Year 2000 failure scenarios 3. Perform
risk and impact analyses of each

core business process 4. Assess and document infrastructure risks
5. Define minimum levels of outputs and

services for each core business process

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 34 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

23 Evaluation of Component Agencies' Draft

BCCPs (Cont'd)

Status of Phase III Efforts

 Agencies identified contingencies in their draft BCCPs in very
general and/ or vague terms and did not cover all contingency
planning steps

for example, for many of FNS' contingencies, it said only that it
would revert to manual processes, identify the problem, and work
with contractor to correct it, but gave no further information to
describe how this would be done

other agencies, such as FS, APHIS, GIPSA, NRCS, NASS, and RD, also
discussed using manual processes in general terms, but did not
identify contingency procedures, resources and staff roles, and
timetables to implement them

Contingency Planning Key Steps

1. Assess cost/ benefits of contingency alternatives and select
best contingency for each core business process 2. Identify and
document contingency plans

and implementation modes 3. Define triggers for activating plans
4. Establish business resumption team for

each core business process 5. Develop zero day strategy and

procedures

Contingency Planning Key Steps

1. Assess cost/ benefits of contingency alternatives and select
best contingency for each core business process 2. Identify and
document contingency plans

and implementation modes 3. Define triggers for activating plans
4. Establish business resumption team for

each core business process 5. Develop zero day strategy and

procedures

Contingency Planning Key Steps

1. Assess cost/ benefits of contingency alternatives and select
best contingency for each core business process 2. Identify and
document contingency plans

and implementation modes 3. Define triggers for activating plans
4. Establish business resumption team for

each core business process 5. Develop zero day strategy and

procedures

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 35 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

24 Evaluation of Component Agencies' Draft

BCCPs (Cont'd)

Status of Phase IV Efforts

 Some BCCPs and progress reports indicated that testing (Phase IV
steps) would be done in the future

 Six agencies (FNS, FSA, FAS, FS, AMS, and ARS) identified testing
milestones, but none showed that test plans had been developed

Testing Key Steps 1. Validate business continuity strategy

2. Develop contingency test plans 3. Establish test teams and
acquire

resources 4. Prepare and execute tests 5. Validate capability of
contingency plans 6. Rehearse business resumption teams 7. Update
BCCPs based upon lessons

learned and re- test, if necessary 8. Update disaster recovery
plans and

procedures

Testing Key Steps 1. Validate business continuity strategy

2. Develop contingency test plans 3. Establish test teams and
acquire

resources 4. Prepare and execute tests 5. Validate capability of
contingency plans 6. Rehearse business resumption teams 7. Update
BCCPs based upon lessons

learned and re- test, if necessary 8. Update disaster recovery
plans and

procedures

Testing Key Steps 1. Validate business continuity strategy

2. Develop contingency test plans 3. Establish test teams and
acquire

resources 4. Prepare and execute tests 5. Validate capability of
contingency plans 6. Rehearse business resumption teams 7. Update
BCCPs based upon lessons

learned and re- test, if necessary 8. Update disaster recovery
plans and

procedures

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 36 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

25 Actions At Four Component Agencies to

Complete Key BCCP Steps

 To identify actions underway or planned by agencies to complete
key planning steps in their draft BCCPs, we visited the following
four agencies

 FSIS APHIS FSA FNS

 Ensuring Year 2000 risks are addressed at these agencies is
especially important given their vital health and safety,
financial, and/ or economic missions

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 37 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

26 Actions At Four Component Agencies

to Complete Key BCCP Steps (Cont'd)

 As of the end of March 1999, progress varied among the four
agencies on completing key BCCP steps left in Phases II- IV that
had not been addressed in their draft plans

 Specifically, our visits to the four agencies found that  none
had yet determined minimal acceptable levels of output or

completed work defining contingency procedures  all planned to
better define contingencies or were in the process

of doing so  FSIS and FSA had recently established testing
milestones, but

APHIS had not done so (FNS' draft BCCP included one testing
milestone, but this milestone had been missed)  all planned to do
testing when ready, but said they currently did

not know how testing would be performed

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 38 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

FSIS ensures that our nation's meats, poultry, and processed egg
product supply is safe

Key BCCP Steps Remaining At FSIS 27 Actions At Four Component
Agencies

to Complete Key BCCP Steps (Cont'd) Zero Day Strategy Step has not
yet been addressed, but FSIS says it plans to develop a zero day

strategy with contractor assistance. BCCP Test Plans

Step has not yet been addressed, but FSIS says it plans to
establish BCCP testing milestones with contractor assistance.
Contingency Plans and

Implementation Modes FSIS plans to hire a contractor in April 1999
for providing assistance with

developing contingency plans for FSIS and its local offices. Step
has not yet been addressed, but FSIS says it plans to establish
business resumption teams. Business Resumption

Teams Step has not yet been addressed, but FSIS says it plans to
develop test plans with contractor assistance.

BCCP Test Completion Milestones Acceptable Levels of

Output/ Recovery Time Objective

Step is not being done because FSIS believes its core business
processes must continue at current operational levels and cannot
be down for any period of time.

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 39 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

Acceptable Levels of Output/ Recovery Time Objective

Step has not yet been addressed, but APHIS said acceptable levels
of output and recovery time objectives will be defined as BCCPs
are developed at APHIS' more than 800 local offices.

Contingency Plans and Implementation Modes

Managers were asked to prepare local plans by March 31, 1999, but
status is unknown as the local plans are not being collected by
APHIS headquarters.

Business Resumption Teams

APHIS said that local offices are reporting that teams are being
established as part of their BCCP development effort, but overall
status is unknown.

Zero Day Strategy APHIS has begun working to define a zero day
strategy. BCCP Test Plans APHIS said that several local offices
are reporting that they have developed test

plans and have already conducted some testing, but overall status
is unknown. BCCP Test Completion Milestones

No testing milestones have been established.

APHIS protects U. S. agriculture from imported pest and diseases
and enhances marketability of our nation's agricultural products
abroad

Key BCCP Steps Remaining At APHIS 28 Actions At Four Component
Agencies

to Complete Key BCCP Steps (Cont'd)

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 40 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

Contingency Plans and Implementation Modes

FSA provides expanded economic opportunities for agricultural
producers through commodity and income support and farm credit
programs

Key BCCP Steps Remaining At FSA

29 Actions At Four Component Agencies

to Complete Key BCCP Steps (Cont'd) 29 Output levels are not being
established, but FSA has defined the time period in

which it could continue to operate before a contingency must be
implemented. FSA has been developing more detailed contingency
plans, and has a deadline of April 1999 for their completion.

Zero Day Strategy Step has not yet been addressed, but FSA says it
plans to develop a zero day strategy.

BCCP Test Completion Milestones

A June 1999 milestone has been established for completing BCCP
testing. Acceptable Levels of

Output/ Recovery Time Objective

Business Resumption Teams

Business Resumption Teams are not being established instead,
contingency team managers have been designated to work with teams
to perform similar purpose.

BCCP Test Plans Test plans have not yet been developed, but FSA
says it expects to do desktop exercises, given the short amount of
time remaining.

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 41 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

30 30

FNS administers America's domestic nutrition programs-- food
stamps, WIC, and child nutrition and commodity assistance-- and
delivers these programs working in partnerships with the states

Key BCCP Steps Remaining At FNS

Actions At Four Component Agencies to Complete Key BCCP Steps
(Cont'd)

Contingency Plans and Implementation Modes Acceptable Levels of

Output/ Recovery Time Objective

FNS believes current operations for benefits systems are the
minimum necessary and FNS is revising its draft plan to address
recovery times.

FNS is revising its draft plan to describe contingencies more
fully. A contractor will be hired in April 1999 to help FNS
regions determine states' progress on developing BCCPs, but FNS
does not plan to develop contingencies for responding to potential
Year 2000 failures at state levels.

Zero Day Strategy FNS is revising its draft plan to address a zero
day strategy, but this strategy will not be finalized until more
information is obtained from the states.

Draft plan includes a date for testing financial systems
contingencies, but this date has been missed. Milestones for
testing contingencies for all core processes will be included in
revised draft plan. BCCP Test

Completion Milestones

Business Resumption Teams

FNS is revising its draft plan to address business resumption
teams. Generally, these are the same individuals as those
currently responsible for operating FNS' information systems.

BCCP Test Plans Test procedures for contingencies for financial
operations exist, but are not referenced in the draft BCCP. FNS
said it will develop plans for testing contingencies for other FNS
core processes.

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 42 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

31 Observations on USDA's BCCP

Time Frames and Milestones

 USDA reported in its February 1999 Year 2000 quarterly report to
OMB that it expected to complete all BCCPs by December 1999

 USDA's December 1999 time frame for completing BCCPs  leaves no
room for slippage in dates or time for correcting

and retesting plans if necessary  is after the beginning of fiscal
year 2000 (October 1, 1999),

when potential failures could have already occurred

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 43 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

32 Observations on USDA's BCCP

Time Frames and Milestones (Cont'd)

 In January 1999, we testified that OMB, which oversees the
government's Year 2000 efforts, should consider establishing dates
of April 30, 1999 to complete BCCPs and September 30, 1999 to
complete testing, which allows agencies time to

 adjust work schedules should milestones slip  address any
shortfalls found when testing their plans

and make necessary adjustments  be prepared for Year 2000 failures
that could have

already occurred by the start of fiscal year 2000  Recently, OMB
indicated it

 is developing a process to coordinate work on BCCPs across the
agencies  has informally notified the agencies to be prepared to
submit

BCCPs to OMB in June 1999

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 44 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

33 Observations on USDA's BCCP

Time Frames and Milestones (Cont'd)

 However, specific governmentwide milestones for agencies to
complete and test BCCPs have not yet been established by OMB

 To provide time for any slippages or for correcting and retesting
plans if necessary, it is important that USDA move up its time
frame for completing and testing BCCPs earlier, such as the
September 30, 1999 date we suggested

 Given the substantial amount of BCCP work remaining, advancing
the department's time frames would require that USDA agencies and
offices set priorities to ensure that, at a minimum, BCCPs are
completed for the highest priority business processes

 Currently, priorities have not been established for first
completing BCCPs that address Year 2000 risks for the department's
43 highest priority business processes

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 45 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

34 Recommendations

 We recommend that the Secretary of Agriculture direct that the
CIO advance the department's December 1999 time frame for
completing and testing agencies' BCCPs to no later than September
30,1999

 We also recommend that the Secretary direct that the
Undersecretaries for USDA's 7 mission areas-- as well as the CIO,
Chief Financial Officer, and Assistant Secretary for Departmental
Administration-- have their respective agencies and offices:

 develop priorities for completing and testing BCCPs which are
aligned with the department's 43 highest priority business
processes to ensure that remaining work addresses these processes
first

Appendix I Briefing on Year 2000 USDA Contingency Planning

Page 46 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

35 Recommendations (Cont'd)

 establish specific milestones to complete key interim BCCP steps
that have not yet been adequately addressed, including:

 defining acceptable levels of output/ recovery time objectives
documenting contingency plans that clearly describe contingency

triggers and implementation modes  establishing business
resumption teams  developing zero day strategies  developing
contingency test plans  conducting contingency tests

 report regularly to the Secretary progress on meeting these
milestones to ensure that the agencies adequately address all key
business continuity and contingency planning steps that are
appropriate to each agency

Page 47 GAO/AIMD-99-178 Year 2000 USDA Contingency Planning

Appendix II Major Contributors to This Report Appendi x I I

Accounting and Information Management Division, Washington, D. C.

Mark D. Shaw, Assistant Director Heather W. McIntyre, Senior
Information Systems Analyst Richard B. Hung, Technical Advisor

Kansas City Field Office

Troy G. Hottovy, Senior Information Systems Analyst Janet M.
Jamison, Senior Evaluator

(511478) Let t er

Ordering Information The first copy of each GAO report and
testimony is free. Additional copies are $2 each. Orders should be
sent to the following address, accompanied by a check or money
order made out to the Superintendent of Documents, when necessary,
VISA and

MasterCard credit cards are accepted, also. Orders for 100 or more
copies to be mailed to a single address are discounted 25 percent.

Orders by mail: U. S. General Accounting Office P. O. Box 37050
Washington, DC 20013

or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW)
U. S. General Accounting Office Washington, DC

Orders may also be placed by calling (202) 512- 6000 or by using
fax number (202) 512- 6061, or TDD (202) 512- 2537.

Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any
list from the past 30 days, please call (202) 512- 6000 using a
touchtone phone. A recorded menu will provide information on how
to obtain these lists.

For information on how to access GAO reports on the INTERNET, send
an e- mail message with info in the body to:

info@ www. gao. gov or visit GAO's World Wide Web Home Page at:
http:// www. gao. gov

United States General Accounting Office Washington, D. C. 20548-
0001

Official Business Penalty for Private Use $300

Address Correction Requested Bulk Rate

Postage & Fees Paid GAO Permit No. GI00

*** End of document. ***