This is the accessible text file for GAO report number GAO-12-276T entitled 'National Capital Region: 2010 Strategic Plan is Generally Consistent with Characteristics of Effective Strategies' which was released on December 7, 2011. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office: GAO: Testimony: Before the Subcommittees on Disaster Recovery and Intergovernmental Affairs and Oversight of Government Management, the Federal Workforce and the District of Columbia; Senate Homeland Security and Governmental Oversight Committee: For Release on Delivery: Expected at 2:30 p.m. EST: December 07, 2011: National Capital Region: 2010 Strategic Plan is Generally Consistent with Characteristics of Effective Strategies: Statement of William O. Jenkins, Jr., Director: Homeland Security and Justice: GAO-12-276T: Chairmen Akaka and Pryor, Ranking Members Johnson and Paul, and Members of the Committees: I appreciate the opportunity to participate in today's hearing on the status of efforts to enhance emergency preparedness in the National Capital Region (NCR). The NCR is a partnership among the District of Columbia, the State of Maryland, the Commonwealth of Virginia, area local governments, the Department of Homeland Security's (DHS) Office for National Capital Region Coordination (NCRC) within the Federal Emergency Management Agency (FEMA), and nonprofit organizations and private sector interests.[Footnote 1] The partnership aims to help the region prepare for, prevent, protect against, respond to, and recover from "all-hazards" threats or events. Gridlock and hazardous conditions during recent events like the January 26, 2011, snow and ice storm and the August 23, 2011, earthquake demonstrate the importance of regional communication and coordination in the NCR and that challenges remain. Well-crafted and executed operational plans are critical for effective response to emergencies, but sound strategic planning is also important.[Footnote 2] As I have previously testified, a coordinated strategy to establish and monitor the achievement of regional goals and priorities is fundamental to enhancing emergency preparedness and response capabilities in the NCR. We reported on this issue repeatedly from 2004 through 2006, and I testified most recently on the NCR's preparedness before the Subcommittee on Oversight of Government Management, the Federal Workforce and the District of Columbia, Committee on Homeland Security and Governmental Affairs, U.S. Senate, in September 2006. My remarks today focus on the extent to which strategic planning for NCR preparedness is consistent with characteristics we have previously identified as desirable for strategies for complex undertakings, such as NCR preparedness. This statement is based on work we recently completed for you. To conduct this work, we compared the 2010 strategic-plan update with six characteristics of an effective homeland-security strategy we previously identified.[Footnote 3] We reviewed the content of the strategic plan and associated documents-- such as investment plans--but we did not evaluate whether and how well NCR has fostered, implemented, and executed coordinated capability efforts. We have recently initiated a review of NCR preparedness efforts for these subcommittees and expect to issue a report late next year. We conducted this work from November 2011 through December 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe the evidence provides a reasonable basis for our findings and conclusions based on our audit objectives. In summary, the 2010 NCR strategic plan, when accompanied by its supporting documents--investment plans, work plans, and a Performance Management Plan--collectively referred to in this statement as the NCR strategy, is largely consistent with the six characteristics of a strategy that we advocated for complex homeland-security undertakings where multiple organizations must act together to achieve goals and objectives.[Footnote 4] However, neither the Performance Management Plan nor the investment plans have yet been finalized; decisions remain regarding how the NCR will conduct future regional risk assessments; and it is not clear that NCR has systematic processes in place to identify the full range of resources available to support its goals.[Footnote 5] Finally, it is important to keep in mind that strategies themselves are not endpoints, but rather, starting points. As with any strategic planning effort, implementation is the key. The ultimate measure of the 2010 NCR strategy's value is how useful it is as guidance for policymakers and decisionmakers in allocating resources and balancing priorities. Background: The NCR is a unique regional partnership, in that it is the only region that has a statutorily created and federally funded office devoted solely to supporting coordination and cooperation within the region. Appendix I provides more information about the region and the organizations responsible for supporting preparedness coordination. We have reported in the past on preparedness efforts for the NCR. Our past work for Congress has tracked the evolution and development of increasingly effective efforts to develop a coordinated NCR preparedness strategy, along with some opportunities for continuing improvement in strategy-related efforts. See appendix II for more information about our past NCR work. The 2010 NCR Strategy Is Largely Consistent with Desirable Characteristics for Effective Strategies: We have previously identified six characteristics of effective strategies that could be applied to the NCR.[Footnote 6] We noted that these six characteristics would help to enable its implementers to effectively shape policies, programs, priorities, resource allocations, and standards and enable relevant stakeholders to achieve intended results. These characteristics call for strategies to include (1) purpose, scope, and methodology; (2) problem definition and risk assessment; (3) goals, subordinate objectives, activities, and performance measures; (4) resources, investments, and risk management; (5) organizational roles, responsibilities, and coordination; and (6) integration and implementation.[Footnote 7] More information about the six desirable strategy characteristics and their application to a regional preparedness strategy appears in appendix III. Purpose, Scope, and Methodology: The 2010 NCR strategy addresses why the strategy was produced, the scope of its coverage, and the process by which it was developed. The introduction to the plan specifies that it was produced to help identify the capabilities needed to strengthen the region's homeland security efforts and to define the framework for achieving those capabilities. The scope of the plan, as outlined in the introduction, is strategic investment in new and existing capabilities to help all localities in the NCR prepare for, prevent, protect against, respond to, and recover from all-hazards threats and events. Specifically, the plan's goals and objectives are designed to build new and expanded capabilities and to ensure maintenance of previous investments. Additionally, the aim of these capabilities, according to the plan, is to help support the localities in the NCR as they execute their operational plans in all phases of homeland security. The plan's methodology appendix specifies that the effort to produce the 2010 plan started with an NCR partner-led assessment of progress under the 2006 NCR Strategic Plan and stakeholder recommendations on how best to update the goals to reflect current priorities of the NCR.[Footnote 8] As part of this effort, subject-matter experts identified priority capabilities from the 2010 UASI Investment Justifications that serve as the foundation for the plan's goals and objectives.[Footnote 9] Additionally, the appendix outlines how the NCR partners (1) accounted for legislative, policy, and economic factors; (2) facilitated stakeholder engagement; (3) drew on capabilities-based analysis to identify priorities; and (4) designed capability initiatives to be specific and measurable. Problem Definition and Risk Assessment: The 2010 NCR strategy generally addresses the particular problems and threats the strategy is directed towards, and the NCR has undertaken efforts to assess threats, vulnerabilities, and consequences. In our September 2006 statement on NCR strategic planning, we noted that an ongoing risk-assessment methodology is important to help ensure identification of emerging risks. It is not clear from the strategy how the NCR plans to update risk information, but according to responsible NCR officials, a regional risk assessment will be conducted every 2-4 years, and during this fiscal year the NCR will be making decisions about the timing and methodology for the next regional risk assessment. In addition, the officials said risk information can enter prioritization decisions as subject matter experts bring to bear their knowledge of critical-infrastructure sector-specific risk assessments and lessons learned from regional and worldwide incidents. The 2010 NCR Strategic Plan includes a profile of the region that details how particular social, economic, and critical-infrastructure factors in the region serve to increase both the threat and consequence components of its profile. For example, the plan's profile explains that the NCR has more than 340,000 federal workers; 2,000 political, social, and humanitarian nonprofit organizations; more than 20 million tourists per year; 4,000 diplomats at more than 170 embassies; and some of the most important symbols of national sovereignty and democratic heritage. The plan notes that the region needs to be prepared for a variety of threats and challenges. The region has historically experienced, and in some cases routinely experiences, natural events such as ice, snowstorms, and flooding; special events such as international summits, inaugurations, and parades; and human-caused threats such as terrorist attacks. The plan identifies previously conducted risk-assessment efforts that, along with other information, helped inform the identification of priority goals, objectives, and activities. First, the NCR's Hazard Information and Risk Assessment, conducted in 2006, was used to identify threats and vulnerabilities and then to consider consequences of various incidents. Second, NCRC conducted another assessment--the NCR Strategic Hazards Identification Evaluation for Leadership Decisions (SHIELD)--in 2008. NCRC developed SHIELD with input from federal, state, local, and private-sector partners and in collaboration with DHS's Office of Risk Management and Analysis. SHIELD's analysis ranks potential critical-infrastructure hazards and provides options for risk reduction, with a focus on probable scenarios for the region. Goals, Subordinate Objectives, Activities, and Performance Measures: The 2010 NCR strategy addresses what the strategy is trying to achieve, and steps to achieve those results in the next 3 to 5 years; however, the Performance Management Plan to help monitor progress toward those results is not expected to be finalized until December 31, 2011. The strategy clearly identifies updated and prioritized goals from the previous version of the strategy. Each of these four goals is accompanied by supporting objectives, which in turn, are supported by more targeted initiatives. According to the strategy, the goals, objectives, and initiatives were developed by multiple stakeholders, including emergency managers, first responders, health- care officials, and information-technology specialists, among others, and focus on developing and sustaining key capabilities in the region. (A full description of the goals, objectives, and initiatives identified in the 2010 NCR strategy appears in appendix IV.) In our work on desirable strategy characteristics, we reported that identification of priorities, milestones, and performance measures can aid implementing parties in achieving results in specific timeframes-- and could enable more effective oversight and accountability.[Footnote 10] The strategy states that a Performance Measurement Plan will guide monitoring of the strategy's implementation to evaluate progress in achieving its goals and objectives. NCR provided us with a draft copy of the Performance Measurement Plan, which is currently under development. Our review of this draft showed that the NCR has begun efforts to develop measures. While the 2010 plan states that the initiatives it defines are intended to be attained during the next 3 to 5 years, the strategy does not currently communicate specific milestones for achieving the plan's objectives and initiatives. However, according to NCR officials, with the annual planning and implementation cycle beginning in January 2012, they plan to enter into a new phase of their strategy efforts, designed to make the strategy process more data-driven and project-management focused. According to the officials, this phase entails each objective being assigned a designated leader, who will be responsible for setting milestones and monitoring project plans for achieving his or her objective across the region. The Performance Measurement Plan template information for each initiative includes (1) the strategic goal and objective the initiative supports; (2) a scale to track progress toward achieving the initiative;[Footnote 11] (3) the initiative's relationship to DHS's Target Capabilities List;[Footnote 12] (4) applicable national standards; and (5) multiple metrics for each initiative to be tracked separately for Maryland, Virginia, and Washington, D.C. For example, in the draft plan, the NCR initiative to "catalog all critical infrastructure and key resources in the NCR and conduct consequence-of- loss analysis" ties in with three separate DHS Target Capabilities and is based on the DHS National Infrastructure Protection Plan's definition of Tier-2 Critical Assets.[Footnote 13] It then provides five separate metrics to monitor the identification and documentation of assets, as well as the completion of consequence and loss analyses. A senior official in the NCR said that subject-matter experts are currently completing progress reports on the metrics for each of the initiatives in the strategy. Resources, Investments, and Risk Management: The 2010 NCR strategy contains information and processes designed to help address what the strategy will cost, the sources and types of resources and investments needed, and where resources and investments should be targeted based on balancing risk reductions with costs. According to the strategic plan, its implementation will be guided by investment plans that define the activities required to achieve the goals and objectives, and an annual work plan will lay out grant- funded projects needed to complete the investment plans. We have reviewed draft copies of 16 investment plans, which are out for NCR partner comment until December 22, 2011. Our review of the draft investment plans show that they specify their relationship to the strategic objective they are designed to support, but we did not evaluate how well the specific content of each investment plan is designed to achieve those objectives. In our work on desirable strategy characteristics, we reported that, ideally, a strategy would identify appropriate mechanisms to allocate resources, such as grants, in-kind services, loans, and user fees, based on identified needs.[Footnote 14] The strategic plan notes that the UASI grant program provides a key source of funding for achieving the priority capabilities in the NCR's Strategic Plan. The strategic plan's methodology appendix states that the 2010 UASI Investment Justifications serve as the foundation for the strategic plan's goals and objectives. In previous NCR work, we raised concerns about NCR's singular focus on UASI resources.[Footnote 15] The strategic plan states that the NCR draws upon federal grant programs outside of those provided by DHS, such as public health-related grants from the Department of Health and Human Services and Department of Justice. However, it is not clear that NCR has a systematic process for identifying and allocating funding other than UASI to help achieve priority objectives. According to responsible officials, NCR officials coordinate with local, state, and federal jurisdictions to help ensure UASI investments do not duplicate existing federal, state, and local assets. These officials also said the new Management Review Process, set to begin in January 2012, is to help with the identification and documentation of available resources. Similarly, the plan does not identify nonfinancial resources--such as Department of Defense (DOD) NORTHCOM or National Guard Bureau resources--that potentially could support priority objectives. [Footnote 16] The federal government has an array of resources that can be made available, at request, to assist state and local response. For example, DOD has significant capabilities to augment a federal chemical, biological, radiological, nuclear, and high-yield explosive (CBRNE) response, like those identified in the strategic plan, and also contributes to the organization, training, and equipping of state- controlled military units focused on consequence management. According to the 2010 strategic plan's methodology appendix, the region's priorities are informed by risk assessments--specifically SHIELD--gap analyses, after-action reports, and other studies. According to NCR officials, NCR and its jurisdictions coordinate with various DOD organizations to ensure the availability of CBRNE assets. Moreover, they said that subject-matter experts also bring their knowledge of other resources and capabilities to bear during efforts to identify gaps and prioritize resources. However, they acknowledged they have not systematically considered how existing federal capabilities--like DOD resources--relate to efforts to build the capabilities within their priority objectives, but are considering how they might further enhance coordination in the future. We will continue to monitor this issue as we conduct future work on NCR preparedness. Organizational Roles, Responsibilities, and Coordination: The 2010 NCR strategy addresses the roles and responsibilities of the various NCR organizations. We previously reported that identifying which organizations will implement the strategy, their roles and responsibilities, and mechanisms for coordinating their efforts helps answer the fundamental question about who is in charge, not only during times of crisis, but also during all phases of preparedness efforts: prevention, vulnerability reduction, and response and recovery. The NCR has responsibility for coordinating information and resources from multiple jurisdictions at the federal, state, and local levels to ensure that strategic goals are met. According to the 2010 NCR strategy, NCR stakeholders have constructed the strategy to complement state and local operational plans. Operational plans remain the responsibility of state and local emergency-management agencies, and state and local emergency- operations plans describe how each jurisdiction will coordinate its response to an event regionally. The Governance appendix to the NCR strategic plan details the various organizations involved in preparedness for all-hazards disasters in the region and their roles and responsibilities. For example, the Emergency Preparedness Council is described as the body that provides oversight of the Regional Emergency Coordination Plan and the NCR Strategic Plan to identify and address gaps in readiness in the NCR, among other responsibilities. Additionally, the appendix lays out the Regional Emergency Support Function committees for functions most frequently used to provide support for disasters and emergencies in the region. According to the plan, representatives from various sectors work together toward building capabilities within each support function and the chairs of the committees provide leadership in identifying gaps in regional capabilities in the committee's areas of responsibility and identify the need for UASI funds or other resources to address those gaps. An example of a Regional Emergency Support Function committee is the Agriculture and Natural Resources Committee which focuses on nutrition assistance, animal and plant disease and pest response, food safety and security, as well as the safety and well-being of household pets. Finally, the appendix highlights the Regional Programmatic Working Groups which consist of practitioners, policymakers, and representatives from the government, civic, and private sectors. The groups serve to fill gaps, coordinate across the Regional Emergency Support Function, and provide more focused attention on high-priority areas. For example, the Exercise and Training Operations Panel Working Group supports training and exercises for all Regional Emergency Support Functions. Integration and Implementation: The 2010 NCR strategy addresses how the plan is intended to integrate with the NCR jurisdictions' strategies' goals, objectives, and activities and their plans to implement the strategy. An appendix dedicated to the plan's alignment with national and state strategic plans lays out how the NCR's strategic plan aligns with related federal, state, and local strategies, programs and budgets, and emergency plans. The appendix states that the aim of the NCR strategic plan is to align regional strategic planning efforts with federal, state, and local planning efforts by identifying common goals, objectives, and initiatives to be implemented by the region. In addition, it says the strategic plan provides a framework by which state and local entities can plan, resource, and track priority homeland security-related programs and budgets. Concluding Observations: The NCR faces a significant challenge coordinating federal, state, local, and regional authorities for domestic preparedness activities. Due to the size and complexity of the NCR, coordination with relevant jurisdictions may confront challenges related to, among other things, different organizational cultures, varying procedures and work patterns among organizations, and a lack of communication between departments and agencies. A well-defined, comprehensive homeland security strategic plan for the NCR is essential for effectively coordinating investments in capabilities to address the risks that the region faces, and our preliminary observations are that the 2010 Strategic Plan was comprehensively developed. However, we have previously noted that strategies themselves are not endpoints, but rather, starting points. As with any strategic planning effort, implementation is the key. The ultimate measure of value for a strategy is how useful it is as guidance for policymakers and decisionmakers in allocating resources and balancing priorities. It remains to be seen the extent to which the plan is implemented effectively. We will continue to monitor this as part of our ongoing work. Chairmen Akaka and Pryor, Ranking Members Johnson and Paul, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you or other Members of the Committee may have at this time. Contacts and Staff Acknowledgments: For further information about this statement, please contact William O. Jenkins, Jr., Director, Homeland Security and Justice Issues, at (202) 512-8777 or jenkinswo@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. In addition to the contact named above, the following individuals from GAO's Homeland Security and Justice Team also made key contributions to this testimony: Chris Keisling, Assistant Director; Kathryn Godfrey, Susana Kuebler, David Lysy, Linda Miller, and Tracey King. [End of section] Appendix I: The NCR Region and Organizations: National Capital Region: The National Capital Region (NCR) is a complex multijurisdictional area comprising the District of Columbia and surrounding counties and cities in the states of Maryland and Virginia (as shown in figure 1) and is home to the federal government, many national landmarks, and military installations. In addition to being the headquarters to all three branches of the federal government, the NCR receives more than 20 million tourists each year. The NCR is the fourth-largest U.S. metropolitan area in the country and is also close to other densely populated areas, including Baltimore and Philadelphia. Those living and working in the NCR rely on a variety of critical infrastructure and key resources including transportation, energy, and water. The transportation system contains the nation's second-largest rail transit and fifth-largest bus systems. The intricate network of major highways and bridges serve the region's commuters and businesses, and the NCR also has two major airports within its borders. These attributes both heighten the threat and raise the consequences to the region in the instance of human-caused incidents. An incident caused by any hazard could result in catastrophic human, political, and economic harm to the region, as well as the entire nation. Figure 1: National Capital Region Jurisdictions: [Refer to PDF for image: area map] District of Columbia; Maryland: * Montgomery County; * Prince George's County; Virginia: * Arlington County; * City of Alexandria; * Fairfax County; * Loudoun County; * Prince William County. Source: National Capitol Planning Commission. [End of figure] Roles and Responsibilities of the NCRC: The Homeland Security Act established the Office of National Capital Region Coordination (NCRC) within the Department of Homeland Security. The NCRC is responsible for overseeing and coordinating federal programs for and relationships with state, local, and regional authorities in the NCR and for assessing and advocating for the resources needed by state, local, and regional authorities in the NCR to implement efforts to secure the homeland, among other things. One of the NCRC mandates is to coordinate with federal, state, local, and regional agencies and the private sector in the NCR to ensure adequate planning, information sharing, training, and execution of domestic preparedness activities among these agencies and entities. NCR Governance Structure and Organizations that Support Preparedness: Figure 2, below, depicts the NCR organizational structure. Figure 2: NCR Organizational Structure: [Refer to PDF for image: organizational structure] Top level: Senior Policy Group: DC, MD, VA, NCRC. Second level, reporting to Senior Policy Group: * Emergency Preparedness Council (Assessment & Advisory); * CAO Committee: - R-ESF/RPWG Committee Chairs. Third level, reporting to R-ESF/RPWG Committee Chairs: * R-ESF Committees & Working Groups. Emergency Preparedness Council (EPC): Provides oversight regarding the implementation of the Regional Emergency Coordination Plan and the NCR Homeland Security Strategic Plan to identify and address gaps in readiness in the NCR. The EPC functions as the federally required Urban Area Working Group with oversight responsibility for the Urban Area Security Initiative process in partnership with the SPG, CAO, and State Administrative Agencies. Regional Emergency Support Function (R-ESF)/Regional Program Work Group (RPWG) Committee Chairs: R-ESF Chairs are elected by members to lead the R-ESFs for a year and are responsible to the CAOs. RPWG chairs are selected by the SPG with concurrence of the CAOs and lead for RPWG for a year and are responsible to the SPG and CAOs. Senior Policy Group (SPG): Provides continuing policy and executive-level focus to the NCR's homeland security concerns. Membership consists of senior officials from Maryland, Virginia, District of Columbia, and DHS/FEMA's Office of National Capital Region Coordination. Regional Emergency Support Function Program Work Groups (RPWG): The 16 R-ESFs provide the structure for coordinating regional interagency support for a regional preparedness, response, and recover from an incident under leadership of CAOs. The 4 RPWGs provide the structure for coordination when multiple R- ESFs need to come together on a continuing basis to address matters for concern for the region. RPWGs are responsible to both the SPG and CAO. Chief Administrative Officers Committee (CAO): Comprised of Chief Administrative Officers, City Managers and Administrators, the General Manager of WMATA. The CAOs provide leadership for R-ESFs, RPWGs and committees and address regional concerns. Source: National Capital Region Homeland Security Program. [End of figure] [End of section] Appendix II: Our Past Work on NCR and Related Emergency Preparedness Efforts: GAO product: Homeland Security: Management of First Responder Grants in the National Capital Region Reflects the Need for Coordinated Planning and Performance Goals, GAO-04-433 (Washington, D.C.: May 28, 2004); Findings and recommendations: NCR faced several challenges organizing and implementing efficient and effective regional preparedness programs. Among these challenges included the lack of a coordinated strategic plan, performance standards, and reliable, centrally sourced data on funds available and the purposes for which they were spent. We concluded that, without these basic elements, it would be difficult to assess first-responder capacities, identify first-responder funding priorities, and evaluate the effective use of federal funds to enhance first-responder capacities and preparedness. We recommended, for example, that the Secretary of Homeland Security (1) work with local National Capital Region (NCR) jurisdictions to develop a coordinated strategic plan to establish goals and priorities. Department of Homeland Security (DHS) generally agreed with our recommendations and NCR finalized its first strategic plan in 2006. GAO product: Homeland Security: Effective Regional Coordination Can Enhance Emergency Preparedness, GAO-04-1009 (Washington, D.C. Sept. 15, 2004); Findings and recommendations: The characteristics of effective regional coordination we previously identified were applicable to the NCR's efforts to coordinate emergency preparedness. We noted that, if implemented as planned and as observed in its early stage, the NCR's Urban Area Security Initiative (UASI) program would include a collaborative regional organization. While we remained concerned that the NCR did not include a full array of homeland-security grants in its planning, we reported that the NCR's UASI program planned to address those issues by identifying non-UASI funding sources and collecting information about the funding allocations, expenditures, and purposes, as well as data on spending by NCR jurisdiction. NCR is currently planning to implement a process to help ensure identification of other funding resources. GAO product: Homeland Security: Managing First Responder Grants to Enhance Emergency Preparedness in the National Capital Region, GAO-05- 889T (Washington, D.C.: July 14, 2005); Findings and recommendations: In this statement, we reported on the implementation of the recommendations from our May 2004 report. DHS was working with the NCR jurisdictions to develop a coordinated strategic plan. At that time, we identified the need for NCR to gather data regarding the funding available and used for implementing the plan and enhancing first-responder capabilities in the NCR--data that were not routinely available. We reported that such data would allow DHS to implement and monitor the future plan, identify and address preparedness gaps, and evaluate the effectiveness of expenditures by conducting assessments based on established guidelines and standards. We remained concerned that no systematic gap analysis had been completed for the region. We noted that the NCR planned to complete an effort to use the Emergency Management Accreditation Program (EMAP) as a means of conducting a gap analysis and assess NCR jurisdictions against EMAP's national preparedness standards. Since we last reported, the District of Columbia has received its EMAP accreditation. GAO product: Homeland Security: The Status of Strategic Planning in the National Capital Region, GAO-06-559T (Washington, D.C.: Mar. 29, 2006); Findings and recommendations: At the time of this report, a completed NCR strategic plan was not yet available. We identified five areas that would be important for the NCR as it completed a strategic plan. Specifically, we reported that a well-defined, comprehensive strategic plan for the NCR was essential for assuring that the region is prepared for the risks it faces and that the NCR could focus on strengthening (1) initiatives that will accomplish objectives under the NCR strategic goals, (2) performance measures and targets that indicate how the initiatives will accomplish identified strategic goals, (3) milestones or time frames for initiative accomplishment, (4) information on resources and investments for each initiative, and (5) organizational roles, responsibilities, and coordination and integration and implementation plans. GAO product: Homeland Security: Assessment of the National Capital Region Strategic Plan, GAO-06-1096T (Washington, D.C.: Sept. 28, 2006); Findings and recommendations: We concluded that the 2006 NCR strategic plan included all six characteristics we consider desirable for a regional homeland-security strategy. To illustrate, the plan includes regional priorities and presents the rationale for the goals and related objectives and initiatives. However, we noted that the substance of the information within these six characteristics could be improved to guide decision makers. Source: GAO. [End of table] [End of section] Appendix III: Six Desirable Strategy Characteristics: We previously outlined a set of desirable characteristics for strategies involving complex endeavors that require coordination and collaboration among multiple entities.[Footnote 17] The desirable characteristics are presented in table 1, along with a brief description and the benefit of each characteristic. Table 1: Desirable Characteristics for a Strategic Plan, Their Description, and Benefit: Characteristic: Purpose, scope, and methodology; Description: Addresses why the strategy was produced, the scope of its coverage, and the process by which it was developed; Benefit: A complete description of the purpose, scope, and methodology in a strategy could make the document more useful to the entities it is intended to guide, as well as to oversight organizations, such as Congress. Characteristic: Problem definition and risk assessment; Description: Addresses the particular problems and threats the strategy is directed towards; Benefit: Use of common definitions promotes more effective intergovernmental operations and more accurate monitoring of expenditures, thereby eliminating problematic concerns. Comprehensive assessments of vulnerabilities, including risk assessments, can help identify key factors external to an organization that can significantly affect that organization's attainment of its goals and objectives and can help identify risk potential if such problem areas are not effectively addressed. Characteristic: Goals, subordinate objectives, activities, and performance measures; Description: Addresses what the strategy is trying to achieve, steps to achieve those results, as well as the priorities, milestones, and performance measures to gauge results; Benefit: Better identification of priorities, milestones, and performance measures can aid implementing entities in achieving results in specific time frames--and could enable more effective oversight and accountability. Characteristic: Resources, investments, and risk management; Description: Addresses what the strategy will cost, the sources and types of resources and investments needed, and where resources and investments should be targeted based on balancing risk reductions with costs; Benefit: Guidance on resource, investment, and risk management could help implementing entities allocate resources and investments according to priorities and constraints, track costs and performance, and shift such investments and resources as appropriate. Such guidance could also assist organizations in developing more effective programs to stimulate desired investments, enhance preparedness, and leverage finite resources. Characteristic: Organizational roles, responsibilities, and coordination; Description: Addresses who will be implementing the strategy, what their roles will be compared to others, and mechanisms for them to coordinate their efforts; Benefit: Inclusion of this characteristic in a strategy could be useful to organizations and other stakeholders in fostering coordination and clarifying specific roles, particularly where there is overlap, and thus enhancing both implementation and accountability. Characteristic: Integration and implementation; Description: Addresses how a strategy relates to other strategies' goals, objectives, and activities (horizontal integration), and to subordinate levels of government and their plans to implement the strategy (vertical integration); Benefit: Information on this characteristic in a strategy could build on the aforementioned organizational roles and responsibilities--and thus further clarify the relationships between various implementing entities, both vertically and horizontally. This, in turn, could foster effective implementation and accountability. Source: GAO. [End of table] [End of section] Appendix IV: NCR 2010 Strategic Plan Goals, Objectives, and Initiatives: Goal: Ensure Interoperable Communications Capabilities; Ensure response partners have the ability to transmit and receive voice, data, and video communications: Objectives: Ensure response partners can communicate by voice in all environments on a day-to-day basis; Initiatives: Increase access to voice systems capable of transmitting and receiving voice information to and from National Capital Region (NCR) response partners. Objectives: Ensure response partners can communicate and share necessary, appropriate data in all environments and on a day-to-day basis; Initiatives: * Develop and maintain secure data communications governed by common standards and operating procedures. * Share Computer Aided Dispatch data between jurisdictions and other related data systems to streamline the process of capturing 911 information and responding to incidents. * Share Geographic Information System data between jurisdictions and other related data systems. Objectives: Ensure response partners can communicate and share necessary, appropriate video information in all environments on a day- to-day basis; Initiatives: Increase access to video systems capable of transmitting and receiving video information to and from NCR response partners. Goal: Enhance Information Sharing and Situational Awareness; Ensure NCR partners share the information needed to make informed and timely decisions; take appropriate actions; and communicate accurate, timely information with the public: Objectives: Ensure the public has all information necessary to make appropriate decisions and take protective actions; Initiatives: Improve the dissemination of accurate, timely information to the public using multiple venues, including social media outlets, to ensure that the content of emergency messages and alerts is easily accessible and available to the public. Objectives: Define, obtain, and share appropriate situational information with NCR partners so that they have the necessary information to make informed decisions; Initiatives: Define essential elements of data and information for situational awareness for each discipline and all partners in the NCR. Then develop, maintain, and utilize business practices and common technical standards for situational awareness in order to make informed decisions.[A] Objectives: Improve the NCR's ability to collect, analyze, share, and integrate intelligence and law enforcement information so that NCR partners receive appropriate information; Initiatives: * Ensure all NCR fusion centers share information through secure and open systems, produce relevant and standardized analytical products, and share information in a timely manner with appropriate NCR partners.[B] * Ensure NCR partners have the systems, processes, security clearances, tools, and procedures to access, gather, and share appropriate intelligence, law enforcement, and classified data. Goal: Enhance Critical Infrastructure Protection; Enhance the protection and resilience of critical infrastructure and key resources (CI/KR) in the NCR to reduce their vulnerability to disruption from all-hazards events: Objectives: Understand and prioritize risks to CI/KR; Initiatives: * Catalog all CI/KR in the NCR and conduct consequence-of-loss analysis. * Conduct a comprehensive risk analysis of the NCR CI/KR, including a review of the critical systems upon which they depend and the interdependencies of those systems. * Develop and implement a plan for sharing CI/KR information among public and private entities throughout the NCR. Objectives: Reduce vulnerabilities and enhance resiliency of CI/KR; Initiatives: * Develop and implement sector vulnerability-reduction plans. * Conduct a technology-feasibility assessment and develop a plan for technology investments for CI/KR. * Develop and implement a cybersecurity plan for NCR critical systems. Objectives: Ensure continuity of critical services required during emergencies and disaster recovery[C]; Initiatives: * Identify key facilities throughout the NCR that require backup critical services. * Assess facilities' plans for loss of critical services. Objectives: Promote broad participation in CI/KR community outreach and protection programs; Initiatives: * Develop a community-awareness training and education program. * Develop a strategy for using CI/KR data to inform law enforcement. * Establish a regional business information-sharing committee. Objectives: Monitor Critical Infrastructure to provide situational awareness and to promote rapid response; Initiatives: * Develop and implement a plan for a comprehensive CI/KR monitoring program. * Develop and implement a plan that integrates CI/KR monitoring information into response operations. Goal: Ensure Development and Maintenance of Regional Core Capabilities; Develop and maintain the basic building blocks of preparedness and response by ensuring the NCR develops a baseline of capabilities including: Mass Casualty, Health Care System Surge, and Mass Prophylaxis; Mass Care and Evacuation; Citizen Participation, Alert, and Public Information; Chemical, Biological, Radiological, Nuclear, and Explosive Detection and Response; and Planning, Training, and Exercises: Objectives: Increase the Region's capacity for medical surge preparedness and response to an all-hazards event to reduce deaths and injuries; Initiatives: * Ensure that private health care, federal, state, and local public health, and EMS programs and providers in the NCR can increase surge capacity to respond to mass-casualty incidents and events requiring mass prophylaxis. * Establish a regional monitoring and response system that allows for health and medical-response partners to track patients, hospital bed availability, alerts, and EMS/hospital activity in a shared, secure environment. * Ensure the ability to track patients from the start of pre-hospital care to discharge from the health-care system during both daily operations and mass-casualty incidents. Objectives: Improve the region's capacity to evacuate and provide mass care for the public, including special needs individuals, when impacted by an all-hazards event; Initiatives: * Develop, coordinate, and integrate local and state evacuation plans so that evacuation polices and routes complement each other to ensure the NCR's ability to coordinate evacuation across the region. * Ensure the NCR's ability to provide sheltering and feeding for the first 72 hours following an incident for individuals in the general population, persons with special needs, persons with special medical needs, and pets. Objectives: Strengthen individual, community, and workplace preparedness for emergency events through public engagement and citizen participation designed to reach the general population and special needs citizens in response to and recovery from all-hazards events; Initiatives: * Sustain the NCR's ability to alert and warn residents, businesses, and visitors using multiple methods including social media. * Bolster recruitment, management, and retention of volunteers through Community Emergency Response Team, other citizen corps programs, Volunteer Organizations Active in Disaster member agencies, the Medical Reserve Corps, and registration in Emergency System for Advance Registration of Volunteer Health Professionals programs. * Ensure post-incident human services and recovery assistance throughout the NCR including case management, emergency housing, behavioral health, spiritual care, and family reunification. Objectives: Ensure the NCR has region-wide capacity to detect, respond, and recover in a timely manner from CBRNE events and other attacks requiring tactical response and technical rescue; Initiatives: * Enhance the NCR's ability to detect chemical, biological, radiological, and other types of contamination. * Ensure region-wide access to Type 1 hazardous material (HazMat), bomb response/Explosive Ordnance Device units, and tactical teams and ensure each unit/team is able to respond in a reasonable amount of time. * Ensure all responders in the NCR have access to Personal Protective Equipment, equipment, and apparatus that match the identified capability needs. * Establish a regional monitoring and response system that provides health and medical-response partners with central access to biosurveillance. Objectives: Improve capacity to develop and coordinate plans among all NCR partners and ensure the availability of region-wide training and exercise programs to strengthen preparedness, response, and recovery efforts from all-hazards events; Initiatives: * Develop and exercise key regional emergency response and recovery plans. * Ensure regional procedures, memoranda of understanding, and mutual- aid agreements are in place to allow for rapid coordination of resources including health assets across jurisdictional boundaries. * Develop and update a matrix of training and exercises that meet Homeland Security Exercise and Evaluation Program standards needed to maintain core regional capabilities. This matrix should address new and emerging threats and concerns raised in gap analyses and after- action reports from events and exercises. Source: 2010 National Capital Region Homeland Security Plan. [A] Although the specific elements needed for situational awareness vary according to the field and area of expertise, the term "situational awareness" in the 2010 strategic plan refers to the ability to identify, monitor, and process important information, understand the interrelatedness of that information and its implications, and apply that understanding to make critical decisions in the present and near future. For example, if the region is threatened by a hurricane, awareness of the status of roads, shelters, traffic, available medical resources, power outages, and the like is important in making decisions about what type of assistance is needed and where it is needed. To coordinate an effective response, NCR partners need to share their information and have access to the information of others. [B] The NCR fusion centers include the Maryland Coordination and Analysis Center, the Washington Regional Threat and Analysis Center, the NCR Intelligence Center, and the Virginia Fusion Center. A fusion center is a physical location where data can be collected from a variety of sources, including but not limited to police departments, fire departments, health departments, and the private sector. Experts analyze the incoming information and create intelligence products, which can be used to maximize resources, streamline operations, and improve the ability to address all-hazards incidents and threats. Fusion centers help to prevent terrorism and criminal activities as well as support preparedness for man-made and natural hazards to trigger quick and effective response to all-hazards events. [C] Critical services are defined as life-sustainment services during an emergency and include energy (electric power and gas), water supply, transportation, food, and communications. These are all supplied routinely by the CI/KR sectors. During a disaster, providing critical life-sustaining services ensures that government and private health, safety, and emergency services continue, and that plans are in place to compensate for losses among interdependent systems. [End of table] [End of section] Footnotes: [1] The Office for National Capital Region Coordination was established in the Homeland Security Act. Pub. L. No. 107-296, § 882, 116 Stat. 2135, 2246-47 (2002). [2] According to the 2010 NCR Homeland Security Strategic Plan, operational plans are the responsibility of state and local emergency management agencies and they are to describe how each jurisdiction will coordinate its response to an event regionally. [3] See GAO, Combating Terrorism: Evaluation of Selected Characteristics in National Strategies Related to Terrorism, [hyperlink, http://www.gao.gov/products/GAO-04-408T] (Washington, D.C.: Feb 3, 2004) and Homeland Security: The Status of Strategic Planning in the National Capital Region, [hyperlink, http://www.gao.gov/products/GAO-06-559T] (Washington, D.C.: Mar. 29, 2006). [4] [hyperlink, http://www.gao.gov/products/GAO-04-408T] and [hyperlink, http://www.gao.gov/products/GAO-06-559T]. In February 2004, we identified six characteristics of effective strategies that could be applied to the NCR. We noted that these six characteristics would help to enable its implementers to effectively shape policies, programs, priorities, resource allocations, and standards and enable relevant stakeholders to achieve intended results. In our testimony on the 2006 NCR Strategic Plan, we elaborated on the desirable characteristics of a strategic plan at the regional level based on our six characteristics. The six characteristics are: (1) purpose, scope, and methodology; (2) problem definition and risk assessment; (3) goals, subordinate objectives, activities, and performance measures; (4) resources, investments, and risk management; (5) organizational roles, responsibilities, and coordination; and (6) integration and implementation. For more details, see appendix III. [5] The UASI Program provides funding to address the unique planning, organization, equipment, training, and exercise needs of high-threat, high-density urban areas, and assists them in building an enhanced and sustainable capacity to prevent, protect against, respond to, and recover from acts of terrorism. [6] [hyperlink, http://www.gao.gov/products/GAO-04-408T]. [7] [hyperlink, http://www.gao.gov/products/GAO-04-408T]. [8] NCR partners refers to the region's local, state, regional, and federal entities, citizen community groups, private-sector organizations, nonprofit organizations, and nongovernmental organizations. [9] UASI applicants must develop investment justifications that demonstrate how proposed projects address gaps and deficiencies in current capabilities. [10] [hyperlink, http://www.gao.gov/products/GAO-04-408T]. [11] The status scale for the draft Performance Measurement Plan is as follows: 0 = No effort underway or recognition of the need; 1 = Recognition of the need but no effort or resources to accomplish the output; 2 = Initial efforts and resources underway to achieve the output; 3 = Moderate progress towards accomplishing the output; 4 = Sustained efforts underway and outputs nearly fulfilled; 5 = Output achieved and resources devoted to sustain the effort. [12] The Target Capabilities List is a national-level, generic model of operationally ready capabilities defining all-hazards preparedness. It is intended to help jurisdictions assess capabilities, identify needs, and inform plans and strategies, taking into account their risk. [13] Tier 1 or Tier 2 assets are those that if destroyed or disrupted could cause significant casualties, major economic losses, or widespread and long-term disruptions to national well-being and governance capacity. According to DHS, the overwhelming majority of the assets and systems identified through this effort are classified as Tier 2. Only a small subset of assets meet the Tier 1 consequence threshold--those whose loss or damage could result in major national or regional effects similar to the effects of Hurricane Katrina or the September 11, 2001, attacks. [14] [hyperlink, http://www.gao.gov/products/GAO-04-408T]. [15] GAO, Homeland Security: Effective Regional Coordination Can Enhance Emergency Preparedness, [hyperlink, http://www.gao.gov/products/GAO-04-1009] (Washington, D.C. Sept. 15, 2004). [16] NORTHCOM is the unified military command responsible for planning, organizing, and executing DOD's homeland defense and federal military support to civil authorities' missions within the continental United States, Alaska, and U.S. territorial waters. DOD's civil- support missions include providing support during disasters and declared emergencies (both natural and man-made); providing support for restoring public health and services and civil order; and providing support for national special security events. [17] [hyperlink, http://www.gao.gov/products/GAO-04-408T]. [End of section] GAO’s Mission: The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s website [hyperlink, http://www.gao.gov]. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e mail you a list of newly posted products, go to [hyperlink, http://www.gao.gov] and select “E- mail Updates.” Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO: Connect with GAO on facebook, flickr, twitter, and YouTube. Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts. Visit GAO on the web at [hyperlink, http://www.gao.gov]. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; E-mail: fraudnet@gao.gov; Automated answering system: (800) 424-5454 or (202) 512-7470. Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 U.S. Government Accountability Office, 441 G Street NW, Room 7125 Washington, DC 20548. Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548.