oversight

Year 2000 Computing Crisis: USDA Needs to Accelerate Time Frames for Completing Contingency Planning

Published by the Government Accountability Office on 1999-05-21.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                  United States General Accounting Office

GAO               Report to the Chairman, Subcommittee
                  on Department Operations, Oversight,
                  Nutrition, and Forestry, Committee on
                  Agriculture, House of Representatives

May 1999
                  YEAR 2000
                  COMPUTING CRISIS

                  USDA Needs to
                  Accelerate Time
                  Frames for
                  Completing
                  Contingency Planning




GAO/AIMD-99-178
United States General Accounting Office                                             Accounting and Information
Washington, D.C. 20548                    Leter
                                                                                         Management Division



                                    B-282664                                                                  Letter

                                    May 21, 1999

                                    The Honorable Bob Goodlatte
                                    Chairman
                                    Subcommittee on Department Operations,
                                    Oversight, Nutrition, and Forestry
                                    Committee on Agriculture
                                    House of Representatives

                                    Dear Mr. Chairman:

                                    As you know, the Department of Agriculture (USDA) provides public
                                    services that are vital to the health, safety, and well being of Americans. To
                                    minimize possible disruptions in service caused by the Year 2000
                                    computing issue, USDA needs to prepare and test business continuity and
                                    contingency plans (BCCPs). At your request, we identified actions USDA is
                                    taking to develop Year 2000 BCCPs and briefed your office on the results of
                                    our work on April 20, 1999. The briefing slides are in appendix I.

                                    This report provides a high-level summary of information presented at that
                                    briefing and presents recommendations we are making to USDA to ensure
                                    that the department completes the necessary contingency planning steps
                                    and validates its plans in advance of the new year.



Results in                          Under the leadership of the department’s chief information officer (CIO)
                                    and Year 2000 program office, USDA component agencies are actively
Brief                               engaged in developing BCCPs to prepare for unforeseen Year 2000-related
                                    failures. However, much work remains over the next several months to
                                    complete and test USDA’s BCCPs. The department’s December 1999
                                    departmentwide goal for completing BCCPs leaves no room for delays or
                                    sufficient time for correcting, revising, and retesting plans if necessary.
                                    Therefore, we are recommending that USDA advance its time frame to no
                                    later than September 30, 1999, and develop priorities for completing and
                                    testing BCCPs that are aligned with the department’s highest priority
                                    business processes to ensure that remaining work addresses these
                                    processes first. USDA’s CIO agreed to implement our recommendations.




                   Leter            Page 1                       GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                     B-282664




Background           The Year 2000 computing problem poses significant risks which, if not
                     adequately addressed, could have serious consequences. For example,

                     • public health and safety could be at risk if systems and equipment used
                       to detect and track diseases, unwholesome foods, and agricultural pests
                       do not function properly; and
                     • food assistance to needy households and food distribution to schools
                       and others could be stopped or delayed.

                     Ensuring that these and other vital public services are not disrupted at the
                     turn of the century is no small undertaking in such a large and diverse
                     organization as USDA. According to USDA’s March 31, 1999, report to the
                     Office of Management and Budget (OMB) on the status of its Year 2000
                     efforts, the department has 352 mission critical systems, of which 337, or
                     about 96 percent, are compliant.1 USDA said it expects to have the
                     15 remaining systems retired, replaced, or repaired by October 31, 1999.

                     The risk of Year 2000 failures, however, is not limited to USDA’s internal
                     information systems. As is the case with other federal agencies, USDA
                     depends on information and data provided by business partners—including
                     other federal agencies, hundreds of state and local agencies, international
                     organizations, and private sector entities. Dependencies on services
                     provided by the public infrastructure must also be taken into account—
                     including power, water, transportation, and voice and data
                     communications. One weak link anywhere in the chain of critical
                     dependencies can cause major disruptions to business operations.

                     Given these interdependencies and risks, it is imperative that BCCPs be
                     developed to identify, assess, manage, and mitigate Year 2000 risks and help
                     ensure the continuity of all core business processes. Such plans focus on
                     reducing the risk of Year 2000-induced business failures by helping to
                     safeguard an agency’s ability to produce a minimum acceptable level of
                     outputs and services in the event of failures of internal or external mission-
                     critical information systems and services. It also links management and
                     mitigation efforts to the agency’s Year 2000 program, and helps to identify
                     alternate resources and processes needed to operate the agency’s core
                     business processes.


                     1
                      The department reported that it had revised the number of mission critical systems from 352 to 350 on
                     April 9, 1999.




             Leter   Page 2                                GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                        B-282664




                        To help agencies manage the risk of potential Year 2000-induced
                        disruptions to their operations, we prepared the Year 2000 Computing
                        Crisis: Business Continuity and Contingency Planning2 guide. This guide,
                        which has been adopted by OMB as the standard federal agencies should
                        use in preparing BCCPs, identifies four phases—initiation; business impact
                        analysis; contingency planning; and testing—that cover key steps
                        necessary to complete business continuity and contingency planning.



USDA and Its Agencies   In July 1998, the CIO’s Year 2000 program office issued USDA’s Year 2000
                        Business Continuity (Contingency) Planning Guide3 for its agencies and
Are Actively Engaged    offices to follow in preparing BCCPs. At the CIO’s direction, mission areas,
in Developing BCCPs     agencies, and offices were required to identify core business processes for
                        each mission area and prepare and submit BCCPs approved by their
                        mission area undersecretaries by September 30, 1998. This date was later
                        extended to October 30, 1998. Also, the Year 2000 program office provided
                        agencies with training as well as a template and matrix to use in developing
                        their BCCPs.

                        In January 1999, the Year 2000 program office obtained contractor
                        assistance with developing a departmentwide BCCP that is intended to
                        integrate the agencies’ and offices’ BCCPs and define the highest risk
                        processes and systems. As part of the department’s ongoing BCCP work,
                        43 of its 79 total core business processes and 52 of its 352 total mission
                        critical systems have been identified as USDA’s highest priority processes
                        and systems.

                        Fifteen USDA component agencies are most directly responsible for
                        accomplishing the department’s missions and programs.4 Eight of these

                        2
                          Year 2000 Computing Crisis: Business Continuity and Contingency Planning (GAO/AIMD-10.1.19,
                        August 1998).

                        3USDA’s guide parallels our guide, Year 2000 Computing Crisis: Business Continuity and Contingency
                        Planning.

                        4
                         The 15 component agencies are: Agricultural Marketing Service (AMS); Agricultural Research Service
                        (ARS); Animal and Plant Health Inspection Service (APHIS); Cooperative State Research, Education,
                        and Extension Service (CSREES); Economic Research Service (ERS); Farm Service Agency (FSA);
                        Food and Nutrition Service (FNS); Food Safety and Inspection Service (FSIS); Foreign Agricultural
                        Service (FAS); Forest Service (FS); Grain Inspection, Packers and Stockyards Administration (GIPSA);
                        National Agricultural Statistics Service (NASS); Natural Resources Conservation Service (NRCS); Risk
                        Management Agency (RMA); and Rural Development (RD). The RD mission area includes Rural
                        Utilities Service, Rural Housing Service, and Rural Business-Cooperative Service. Since there was only
                        one BCCP addressing all three, we counted these as one component agency.




                        Page 3                                GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                        B-282664




                        agencies submitted draft BCCPs by the October 30, 1998, deadline. Another
                        six submitted their draft plans from November 1998 through January 1999.
                        While the one remaining agency—NRCS—also submitted a draft plan, the
                        mission area undersecretary had not approved it at the completion of our
                        review on March 31, 1999.

                        The CIO’s Year 2000 program office also required that the agencies submit
                        quarterly updates to their BCCPs. These updates are to be submitted in
                        April, July, October, and December 1999.



Much Work Remains to    Much more work remains over the next several months to complete and
                        test USDA’s draft BCCPs. We reviewed the draft plans and progress reports
Complete and Test       prepared by USDA’s 15 component agencies using the four-phased planning
Agencies’ Draft BCCPs   approach outlined in our business continuity and contingency planning
                        guide and USDA’s guide and found that, as of the end of our review, the
                        agencies had

                        • completed the initiation phase or had it underway;
                        • completed most of the business impact analysis phase, but had not yet
                          identified how minimum acceptable levels of output and recovery time
                          objectives would be defined;
                        • started the contingency planning phase, but descriptions of contingency
                          measures and actions were too general and/or vague to be implemented
                          as written; and
                        • not begun the testing phase and most had not developed plans or
                          milestones for doing so.



Progress Completing     At the four agencies we visited— FSIS, APHIS, FSA, and FNS5—progress in
                        completing unaddressed key BCCP steps varied. Our review of actions
Key BCCP Steps Varied   underway or planned by these agencies to complete BCCPs found that, as
at Four Component       of March 31, 1999,
Agencies                • none had yet determined minimal acceptable levels of output or
                          completed work defining contingency procedures;



                        5
                         Ensuring Year 2000 risks are addressed at these agencies is especially important given their vital health
                        and safety, financial, and/or economic missions.




                        Page 4                                  GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                        B-282664




                        • all planned to better define contingencies or were in the process of
                          doing so;
                        • FSIS and FSA had recently established testing milestones, but APHIS
                          had not done so (FNS’ draft BCCP included one testing milestone, but
                          this milestone had been missed); and
                        • all planned to do testing when ready, but said they currently did not
                          know how testing would be performed.



USDA’s Time Frame for   USDA reported in its February 1999 Year 2000 quarterly report to OMB that
                        it expected to complete all BCCPs by December 1999. This time frame
Completing and          leaves no room for slippages in dates or time for correcting and retesting
Testing BCCPs Is Too    the BCCPs should this be necessary. Moreover, the department’s December
                        1999 time frame falls after the beginning of the new fiscal year (October 1,
Late                    1999). At that time, the risks of Year 2000-induced failures will increase
                        because of federal agencies’ use of fiscal year 2000 dates.

                        In January 1999, we testified that OMB should consider establishing dates
                        of April 30, 1999, for agencies to complete their BCCPs and September 30,
                        1999, to complete testing.6 By doing so, agencies would have time to adjust
                        work schedules should milestones slip and to address any shortfalls found
                        when testing plans and make necessary adjustments. These time frames
                        would also allow agencies to be prepared for Year 2000 failures that could
                        have already occurred by the beginning of the new fiscal year. Although
                        OMB has not yet established specific governmentwide milestones for
                        agencies to complete and test their BCCPs, OMB stated recently that it is
                        developing a process to coordinate work on BCCPs across government
                        agencies. In doing so, the agencies have been informally notified to be
                        prepared to submit BCCPs to OMB in June 1999.

                        To allow time for any slippages that might occur or time for correcting and
                        retesting plans if necessary, USDA will need to establish an earlier
                        milestone for completing and testing BCCPs, such as the September 1999
                        date we have suggested. Given the substantial amount of BCCP work
                        remaining, moving up the department’s December 1999 time frame would
                        also require USDA’s agencies and offices to establish priorities for ensuring
                        that, at a minimum, BCCPs are first completed for the highest priority
                        business processes. USDA has determined that 43 of the component


                        6
                         Year 2000 Computing Crisis: Readiness Improving, But Much Work Remains to Avoid Major
                        Disruptions (GAO/T-AIMD-99-50, January 20, 1999).




                        Page 5                              GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                        B-282664




                        agencies’ and offices’ 79 core business processes are the department’s
                        highest priority processes. However, neither USDA, nor its component
                        agencies and offices, have established priorities for completing BCCPs to
                        address Year 2000 risks for these 43 high priority business processes first.



Recommendations         We recommend that the Secretary of Agriculture direct that the CIO
                        advance the department’s December 1999 time frame for completing and
                        testing agencies’ BCCPs to no later than September 30, 1999.

                        We also recommend that the Secretary direct that the Undersecretaries for
                        USDA’s seven mission areas, as well as the CIO, Chief Financial Officer, and
                        Assistant Secretary for Administration, have their respective agencies and
                        offices

                        • develop priorities for completing and testing BCCPs which are aligned
                          with the department’s 43 highest priority business processes to ensure
                          that remaining work addresses these processes first;
                        • establish specific milestones to complete key interim BCCP steps that
                          have not yet been addressed; and
                        • report regularly to the Secretary progress on meeting these milestones
                          to ensure that the agencies and offices adequately address all key BCCP
                          steps that are appropriate to each agency.

                        On April 8, 1999, we provided a copy of our briefing materials, which were
                        used in preparing this report, to USDA’s CIO, deputy CIO, and officials
                        representing USDA’s Year 2000 program office. These officials agreed with
                        our findings and the CIO stated that USDA planned to implement our
                        recommendations.



Objective, Scope, and   As requested, our objective was to identify actions USDA has taken to
                        develop business continuity and contingency plans. To do this, we
Methodology             reviewed departmental guidance and discussed with Year 2000 program
                        officials in USDA’s CIO office how this guidance was being implemented.
                        We also reviewed draft BCCPs and progress reports prepared by the
                        15 USDA agencies most directly responsible for accomplishing the
                        department’s missions and programs. We identified what work remained to
                        complete these plans by comparing them, and information contained in
                        progress reports, to our business continuity and contingency planning
                        guide. Because we focused on the continuity of USDA’s core missions and



                        Page 6                       GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
B-282664




programs, we did not include in our review the draft BCCPs prepared by
USDA staff offices, such as the CIO and the Chief Financial Officer.

Further, to determine actions underway or planned to complete key BCCP
steps, we interviewed Year 2000 planning officials at four agencies—
APHIS, FSA, FSIS, and FNS—and reviewed their documents and materials
discussing BCCP activities. Our focus at these agencies was on key steps
that had not been addressed by most agencies in their draft BCCPs. These
included six areas: (1) acceptable levels of output/recovery time objectives,
(2) contingency plans and implementation modes, (3) business resumption
teams, (4) “zero day” strategy, (5) BCCP test plans, and
(6) BCCP test completion milestones.

We conducted our review from September 1998 through March 1999 in
accordance with generally accepted government auditing standards. Our
work was done at USDA headquarters in Washington, D.C., at the CIO’s
office and the CIO’s Year 2000 program office. We also conducted work at
agency offices of FSIS and APHIS in Washington, D.C.; FNS in Alexandria,
Virginia; and FSA in Kansas City, Missouri.


As agreed with your office, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days from the
date of this letter. At that time, we will send copies of this report to
Representative Eva Clayton, Ranking Minority Member of your
Subcommittee; Representatives Larry Combest, Chairman, and Charles
Stenholm, Ranking Minority Member, House Committee on Agriculture;
Representatives Steven Horn, Chairman, and Jim Turner, Ranking Minority
Member, House Committee on Government Reform, Subcommittee on
Government Management, Information and Technology; Senators Richard
Lugar, Chairman, and Tom Harkin, Ranking Minority Member, Senate
Committee on Agriculture, Nutrition, and Forestry; Senators Robert
Bennett, Chairman, and Christopher Dodd, Ranking Minority Member,
Senate Special Committee on the Year 2000 Technology Problem; the
Honorable Daniel Glickman, Secretary of Agriculture; and the Honorable
Jacob Lew, Director, Office of Management and Budget; and other
interested parties. Copies will also be made available to others upon
request.




Page 7                       GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
B-282664




If you have any questions on matters discussed in this letter, please call me
at (202) 512-6408 or Stephen A. Schwartz, Senior Assistant Director, at
(202) 512-6213. Other major contributors to this report are listed in
appendix II.

Sincerely yours,




Joel C. Willemssen
Director, Civil Agencies Information Systems




Page 8                       GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Page 9   GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Contents



Letter                                                                             1


Appendix I:                                                                       12
Briefing on Year 2000
USDA Contingency
Planning

Appendix II:                                                                      47
Major Contributors to
This Report




                        Page 10   GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Page 11   GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Appendix I

Briefing on Year 2000 USDA Contingency
Planning                                                                                AppeInxdi




               Accounting and Information
               Management Division
                 USDA’s Year 2000
               Business Continuity and
                 Contingency Plans

                House Committee on Agriculture
             Subcommittee on Department Operations,
                Oversight, Nutrition, and Forestry

                         April 20, 1999


                                                                            1




                    Page 12           GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                     Appendix I
                     Briefing on Year 2000 USDA Contingency
                     Planning




                 Purpose

Purpose of briefing is to provide the results of our review of
USDA’s efforts to develop business continuity and contingency
plans (BCCPs)
 •   Review Objective
 •   Scope and Methodology
 •   Background
 •   Summary Results
 •   Steps Taken By USDA’s Chief Information Officer (CIO) and the
     Agencies to Develop BCCPs
 •   Status of Agencies’ Draft BCCPs
 •   Evaluation of Component Agencies’ Draft BCCPs
 •   Actions at Four Component Agencies to Complete Key BCCP Steps
 •   Observations on USDA’s BCCP Time Frames and Milestones
 •   Recommendations


                                                                                           2




                     Page 13                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
           Appendix I
           Briefing on Year 2000 USDA Contingency
           Planning




        Review Objective


We were asked to:

Identify what action USDA has taken to
develop BCCPs for addressing its Year 2000
risks




                                                                                3




           Page 14                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                                 Appendix I
                                 Briefing on Year 2000 USDA Contingency
                                 Planning




                         Scope and Methodology
• We reviewed departmental BCCP guidance and discussed
  how this guidance was being implemented with Year 2000
  program officials

• We reviewed draft BCCPs prepared by the 15 USDA
  component agencies most directly responsible for
  accomplishing the department’s seven key missions
     • Agricultural Research Service (ARS)               • Natural Resources Conservation Service
    • Agricultural Research Service (ARS)               • Natural Resources Conservation Service
   • • Agricultural
         Cooperative    State Research,
                    Research             Education, and• Natural
                              Service (ARS)                   (NRCS)
                                                                   Resources Conservation Service
    • Cooperative State Research, Education, and            (NRCS)
   • Cooperative
         ExtensionState
                      Service (CSREES)
                           Research,  Education, and     • (NRCS)
                                                              Forest Service (FS)
        Extension Service (CSREES)                      • Forest Service (FS)
     • Extension
         Economic     Research
                  Service       Service (ERS)
                            (CSREES)                   • • Forest
                                                              Farm  Service
                                                                  Service    Agency (FSA)
                                                                           (FS)
    • Economic Research Service (ERS)                   • Farm Service Agency (FSA)
   • • Economic
         Food Safety    and Inspection
                  Research              Service (FSIS) • • Farm
                             Service (ERS)                    Foreign  Agricultural
                                                                 Service            Service (FAS)
                                                                         Agency (FSA)
    • Food Safety and Inspection Service (FSIS)         • Foreign Agricultural Service (FAS)
   • • Food
         Animal
            Safetyand  Plant
                     and     Health Inspection
                         Inspection            Service • • Foreign
                                     Service (FSIS)           Risk Management     Agency(FAS)
                                                                   Agricultural Service    (RMA)
    • Animal and Plant Health Inspection Service        • Risk Management Agency (RMA)
   • Animal
         (APHIS)
               and Plant Health Inspection Service     • • Risk
                                                              Food  and Nutrition
                                                                Management        Service
                                                                               Agency       (FNS)
                                                                                        (RMA)
        (APHIS)                                         • Food and Nutrition Service (FNS)
     • (APHIS)
         Agricultural Marketing Service (AMS)          • • Food
                                                              National Agricultural
                                                                 and Nutrition      Statistics
                                                                               Service   (FNS)Service
    • Agricultural Marketing Service (AMS)              • National Agricultural Statistics Service
   • • Agricultural
         Grain Inspection,
                    MarketingPackers
                               Serviceand Stockyards • National
                                       (AMS)                  (NASS)Agricultural Statistics Service
    • Grain Inspection, Packers and Stockyards              (NASS)
   • Grain
         Administration   (GIPSA) and Stockyards
             Inspection, Packers                         • (NASS)
                                                              Rural Development (RD)*
        Administration (GIPSA)                          • Rural Development (RD)*
       Administration (GIPSA)                          • Rural Development (RD)*




  *The RD mission area includes Rural Utilities Service, Rural Housing Service, and Rural
  Business-Cooperative Service. Since there was only one BCCP addressing all three, we
  counted these as one component agency.

                                                                                                            4




                                 Page 15                              GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                           Appendix I
                           Briefing on Year 2000 USDA Contingency
                           Planning




                  Scope and Methodology (Cont’d)
• We used our guide,* which was adopted by OMB as the
  standard federal agencies should use in preparing BCCPs
• The guide includes key planning steps for completing the
  following four phases
    Phase I       Initiation — Establish a planning strategy, work group, milestones, and
                  identify core business processes



    Phase II      Business Impact Analyses — Analyze risks and possible Year 2000
                  impacts, define failure scenarios, define minimum levels of output and
                  service for core processes


    Phase III     Contingency Planning — Develop contingency plans and define when and
                  how they will be implemented



    Phase IV      Testing — Validate agencies’ BCCPs




  *Year 2000 Computing Crisis: Business Continuity and Contingency Planning (GAO/AIMD-
  10.1.19, August 1998)


                                                                                                           5




                           Page 16                                   GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                    Appendix I
                    Briefing on Year 2000 USDA Contingency
                    Planning




               Scope and Methodology (Cont’d)

• We also visited four agencies--FSIS, APHIS, FSA, and FNS--to
  identify additional actions either underway or planned for
  completing work on the draft BCCPs

• We also reviewed agency progress reports and other USDA
  documentation to identify time frames and milestones for
  completing BCCPs and track departmentwide progress

• Because we focused on continuity of USDA’s core missions and
  programs, we did not include in our review draft BCCPs
  prepared by USDA staff offices, such as the Office of Chief
  Information Officer and the Office of the Chief Financial Officer




                                                                                          6




                    Page 17                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                    Appendix I
                    Briefing on Year 2000 USDA Contingency
                    Planning




               Scope and Methodology (Cont’d)

• We conducted work at

   – USDA’s CIO Office and the CIO’s Year 2000 program office,
     FSIS, FSA, and APHIS in Washington, D.C.

   – FNS in Alexandria, Virginia

   – FSA in Kansas City, Missouri

• We performed our work from September 1998 through March
  1999 in accordance with generally accepted government
  auditing standards




                                                                                         7




                    Page 18                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                   Appendix I
                   Briefing on Year 2000 USDA Contingency
                   Planning




               Background

• Year 2000 computing problems pose significant risks, which
  if not adequately addressed, could result in severe
  consequences
    – for example, at USDA
        • public health/safety is at risk if systems and equipment do
          not work to detect unwholesome foods
        • food assistance to needy households could be delayed

• Data exchanges with business partners and public
  infrastructures (i.e., telephone, power, etc.) create additional
  risks




                                                                                         8




                   Page 19                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                     Appendix I
                     Briefing on Year 2000 USDA Contingency
                     Planning




               Background (Cont’d)

• BCCPs safeguard an agency’s ability to produce a minimum
  acceptable level of outputs and services in the event of Year
  2000 failures by

    – identifying critical functions that may be affected by the agency’s
      internal information systems as well as outside services, such as the
      ability of suppliers to provide products, services, data, or the loss of
      critical infrastructure (i.e., communications, power, etc.)

    – describing risk mitigation strategies and work-around alternatives to
      ensure continuity of the agency’s core business functions, especially
      those functions with the most immediate and direct effect on the
      public




                                                                                           9




                     Page 20                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                    Appendix I
                    Briefing on Year 2000 USDA Contingency
                    Planning




              Background (Cont’d)

• Ensuring that vital public services are not disrupted at the
  turn of the century is no small undertaking in such a large
  and diverse organization as USDA

• As of OMB’s March 31, 1999 deadline for achieving Year
  2000 compliance for all internal information systems, USDA
  reported

    – 337 of its 352 mission critical systems are compliant




                                                                                          10




                    Page 21                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                     Appendix I
                     Briefing on Year 2000 USDA Contingency
                     Planning




                Background (Cont’d)

• USDA’s CIO is responsible for leading the department’s
  preparation for Year 2000

• CIO established a Year 2000 program office, under the
  direction of a Year 2000 Program Executive, to:
   – oversee efforts to ensure that all critical USDA information
      systems are Year 2000 compliant and operational before the
      end of 1999
    – provide departmentwide leadership and direction in Year
      2000 business continuity and contingency planning, which
      includes:
        • providing departmentwide BCCP guidance and training
        • assisting agencies/offices in identifying core business
          processes and developing their BCCPs
        • monitoring agencies’/offices’ efforts to fully develop and test
          BCCPs for USDA’s core business processes

                                                                                           11




                     Page 22                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                Appendix I
                Briefing on Year 2000 USDA Contingency
                Planning




            Summary Results

• Under the leadership of the CIO and Year 2000 program
  office, USDA agencies are actively engaged in developing
  business continuity and contingency plans to address the
  department’s Year 2000 risks

• Agencies have submitted draft BCCPs

• Much more work remains over the next several months to
  complete and test USDA’s BCCPs




                                                                                      12




                Page 23                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                   Appendix I
                   Briefing on Year 2000 USDA Contingency
                   Planning




              Summary Results (Cont’d)

• Our review of agencies’ draft BCCPs and progress reports
  found that overall, the agencies had
   – completed initiation (Phase I) or had it underway
   – completed some business impact analysis (Phase II), but had
     not yet identified how minimum acceptable levels of output
     and recovery time objectives would be defined
   – started contingency planning (Phase III), but descriptions of
     contingency measures and actions were too general and/or
     vague to be implemented as written
   – not begun testing BCCPs (Phase IV) and most had not
     developed plans or milestones for doing so




                                                                                         13




                   Page 24                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                     Appendix I
                     Briefing on Year 2000 USDA Contingency
                     Planning




               Summary Results (Cont’d)

• Our visits to four agencies showed that, as of the end of March
  1999, progress varied on completing key BCCP steps left in
  Phases II-IV that had not been addressed in their draft plans

• USDA’s recently established December 1999 time frame for
  completing BCCPs

    – leaves no room for slippage in dates or for correcting and
      retesting plans if necessary

    – is after the beginning of fiscal year 2000 (October 1, 1999),
      when potential failures could have already occurred




                                                                                           14




                     Page 25                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                  Appendix I
                  Briefing on Year 2000 USDA Contingency
                  Planning




              Steps Taken By USDA’s CIO and the
              Agencies to Develop BCCPs

• In July 1998, the CIO
   – issued USDA’s “Year 2000 Business Continuity
     (Contingency) Planning Guide” that parallels our BCCP
     guidance
   – required mission areas, agencies, and offices to
       • identify core business processes for each mission area
       • prepare and submit completed BCCPs to the CIO’s Year
         2000 program office by September 30,1998

• In August 1998, the Secretary extended the deadline for
  submitting BCCPs to October 30, 1998




                                                                                        15




                  Page 26                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                              Appendix I
                              Briefing on Year 2000 USDA Contingency
                              Planning




                          Steps Taken By USDA’s CIO and the
                          Agencies to Develop BCCPs (Cont’d)

• In September 1998, the Year 2000 program office, with the
  assistance of a contractor, provided agencies with training and
  a template to use in developing BCCPs and a matrix for each
  core process they identified to describe

    Risks and Threats          Events having a negative impact on core business function or critical system


    Time Horizon To Failure    Date when risk/threat first impacts


    Business Priorities        Areas of emphasis


    Risk Mitigation            Action to eliminate/reduce likelihood of risk/threat prior to time horizon or
                               failure

    Contingencies              Planned action to eliminate or reduce impact of risk/threat


    Triggers                   Event causing contingency plan to be implemented




                                                                                                               16




                              Page 27                                GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                    Appendix I
                    Briefing on Year 2000 USDA Contingency
                    Planning




                    |




               Steps Taken By USDA’s CIO and the
               Agencies to Develop BCCPs (Cont’d)

• In January 1999, the Year 2000 program office obtained
  contractor assistance to support the department’s ongoing
  BCCP effort by

   – starting to evaluate USDA agencies’ and offices’ draft BCCPs

   – providing advice to agencies on carrying out contingency
     planning activities

   – assisting with the development of a departmentwide BCCP that
     integrates the agencies’ and offices’ BCCPs and defines
     highest risk processes and systems




                                                                                          17




                    Page 28                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                    Appendix I
                    Briefing on Year 2000 USDA Contingency
                    Planning




              Steps Taken By USDA’s CIO and the
              Agencies to Develop BCCPs (Cont’d)

• As part of USDA’s ongoing BCCP work,


   – 43 of the department’s 79 total core business processes were
     identified as its highest priority

   – 52 of the department’s 352 total mission critical systems were
     identified as its highest priority

     (USDA has determined that these 43 processes and 52
     systems represent the greatest health and safety, financial,
     and /or economic impacts)




                                                                                          18




                    Page 29                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                      Appendix I
                      Briefing on Year 2000 USDA Contingency
                      Planning




                Status of Agencies’ Draft BCCPs

• Component agencies we reviewed have submitted draft BCCPs
   – 8 submitted draft plans approved by mission area
     undersecretaries by the October 30, 1998 deadline
   – 6 submitted approved draft plans between November 1998 and
     January 1999
   – NRCS submitted a draft plan that has not yet been approved

• Since January 1999
   – agencies have begun to modify the draft plans in response to
     comments by the CIO’s Year 2000 program office that identified
     items such as
        • template/matrices not completed
        • core business processes/critical systems not discussed
    – agencies are required to submit quarterly updates of their
      BCCPs to the CIO’s Year 2000 program office in April, July,
      October, and December 1999

                                                                                            19




                      Page 30                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                    Appendix I
                    Briefing on Year 2000 USDA Contingency
                    Planning




               Evaluation of Component Agencies’
               Draft BCCPs

• We reviewed draft BCCPs and available progress reports
  prepared by 15 component agencies and found that much more
  work remains over the next several months to complete and test
  these plans

• Overall, the agencies generally had
    – completed initiation (Phase I) or had it underway
    – completed most of the business impact analysis (Phase II), but
      had not yet identified whether or how minimum acceptable
      levels of output and recovery time objectives would be defined
    – started contingency planning (Phase III), but descriptions of
      contingency measures and actions were too general and/or
      vague to be implemented as written
    – not begun testing BCCPs (Phase IV) and most had not
      developed plans or milestones for doing so

                                                                                          20




                    Page 31                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                          Appendix I
                          Briefing on Year 2000 USDA Contingency
                          Planning




                  Evaluation of Component Agencies’ Draft
                  BCCPs (Cont’d)

                          Initiation
                         Initiation             1.      Establishwork
                                                                   workgroups
                                                                          groups
Status of               Initiation
                          KeySteps
                                Steps        1.1.2.    Establish
                                                      Establish
                                                        Develop  work   groupsplanning strategy
                                                                  high-level
                         Key
                        Key   Steps          2.2.3.    Develophigh-level
                                                      Develop    high-levelplanning
                                                        Identifycore
                                                                              planning strategy
                                                                        processes strategy
                                                                 coreprocesses
Phase I Efforts                              3.3.4.    Identify
                                                      Identify
                                                        Definecore
                                                                rolesprocesses
                                                                       andresponsibilities
                                                                             responsibilities
                                             4.4.5.    Define
                                                      Define   roles
                                                              roles
                                                        Develop
                                                                      and
                                                                    and
                                                                  master  responsibilities
                                                                            schedule/milestones
                                             5.5.6.    Developmaster
                                                      Develop    masterschedule/milestones
                                                        Implementrisk
                                                                           schedule/milestones
                                                                     riskmanagement
                                                                          management
                                             6.6.7.    Implement
                                                      Implement   risk management
                                                        Assessexisting
                                                                 existing   disasterrecovery
                                                                                     recovery
                                             7.7.      Assess
                                                      Assess   existing
                                                        capabilities
                                                                          disaster
                                                                         disaster recovery
                                                       capabilities
                                                      capabilities
                                                8.      Implementquality
                                                                     qualityassurance
                                                                              assurancereviews
                                                                                           reviews
                                             8.8.      Implement
                                                      Implement   quality assurance     reviews

•   Draft plans showed all agencies had initiated BCCP planning efforts by
    –   establishing work groups
    –   developing a planning strategy
    –   identifying core business processes
    –   defining roles and responsibilities
•   Status of work on the remaining BCCP initiation steps varied by agency,
    but generally, was not yet complete
    – for example, most plans mentioned milestones, but did not include time frames
      for completing interim BCCP steps and for completing and testing plans

                                                                                                     21




                          Page 32                            GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                         Appendix I
                         Briefing on Year 2000 USDA Contingency
                         Planning




                Evaluation of Component Agencies’ Draft
                BCCPs (Cont’d)
                        Business
                       Business            1. Define
                                                Defineinformation
                                                        informationrequirements
                                                                          requirementsand and
Status of             Business
                        Impact Analysis 1.1. Define  information
                                                methods     to be     requirements
                                                                   used     in         and BCCP
                                                                               developing
                       ImpactAnalysis
                              Analysis         methodstotobe  beused
                                                                  usedinindeveloping
                                                                              developingBCCP
                                                                                          BCCP
                      Impact
                        KeySteps
                       Key  Steps          2. methods
                                          2.    DefineYear
                                               Define   Year20002000failure
                                                                         failurescenarios
                                                                                  scenarios
Phase II Efforts      Key Steps         2. 3. Define Yearrisk
                                                Perform      2000andfailure
                                                                        impact scenarios
                                                                                 analysesofofeach
                                                                                               each
                                        3.3. Perform
                                               Perform
                                                core
                                                         riskand
                                                       risk
                                                      business
                                                               and   impact
                                                                   impact
                                                                   process
                                                                                analyses
                                                                              analyses   of each
                                               corebusiness
                                                    businessprocess
                                                                 process
                                           4. core
                                          4.    Assessand
                                               Assess    anddocument
                                                                documentinfrastructure
                                                                               infrastructurerisks
                                                                                               risks
                                        4. 5. Assess
                                                Defineand    document
                                                        minimum             infrastructure
                                                                       levels   of outputs  risks
                                                                                           and
                                        5.5. Define
                                               Defineminimum
                                                       minimumlevels
                                                servicesforforeach
                                                                    levelsofofoutputs
                                                                eachcore
                                                                                 outputsand
                                                                         corebusiness
                                                                                          and
                                                                               businessprocess
                                                                                         process
                                               services
                                              services for each core business process

•   Agencies’ draft plans
    – discussed information requirements
    – identified methods of developing BCCPs and Year 2000 failure scenarios
    – included results of risk and impact analysis for each core process

•   However, none of the agencies’ BCCPs identified whether or how
    minimum acceptable levels of output and recovery time objectives for all
    their core processes would be defined
      [This step is important for choosing appropriate contingency alternatives
      and establishing the agency’s recovery priorities (Phase III)]


                                                                                                       22




                         Page 33                             GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                        Appendix I
                        Briefing on Year 2000 USDA Contingency
                        Planning




                Evaluation of Component Agencies’ Draft
                BCCPs (Cont’d)
                        Contingency
                       Contingency         1.1. Assess
                                                   Assesscost/benefits
                                                             cost/benefitsofofcontingency
                                                                                contingency
Status of             Contingency
                        Planning
                       Planning
                                          1.    Assess    cost/benefits
                                                   alternatives
                                                 alternativesand andselect
                                                                          of contingency
                                                                  and select   best contingency
                                                                      selectbest
                                                                              bestcontingency
                                                                                    contingency
                      Planning
                        KeySteps
                            Steps               alternatives
                                                   foreach
                                                       eachcore
                                                              corebusiness
                                                                    business    process
Phase III Efforts      Key
                      Key Steps
                                                 for
                                             2. for each core
                                                   Identify      business
                                                                              process
                                                                  documentprocess
                                                             anddocument       contingencyplans
                                                                                            plans
                                          2.2. Identify
                                                 Identify
                                                   and
                                                           and
                                                          and   document modes
                                                        implementation
                                                                              contingency
                                                                             contingency  plans
                                                 andimplementation
                                                and    implementationmodes modes
                                           3.3. Define
                                                   Definetriggers
                                                            triggersfor
                                                                      foractivating
                                                                          activatingplans
                                                                                      plans
                                          3. 4. Define   triggers
                                                   Establish       for activating
                                                               business            plansteam for
                                                                           resumption
                                          4.4. Establish
                                                 Establishbusiness
                                                              businessresumption
                                                                         resumptionteamteamfor
                                                                                            for
                                                   eachcore
                                                 each     corebusiness
                                                                businessprocess
                                                                            process
                                             5. each   core business
                                                   Develop           day”process
                                                              “zeroday”    strategyand
                                                                                     and
                                          5.5. Develop
                                                 Develop     “zero        strategy
                                                           “zero
                                                   procedures     day” strategy    and
                                                 procedures
                                                procedures

• Agencies identified contingencies in their draft BCCPs in very general
  and/or vague terms and did not cover all contingency planning steps
   –for example, for many of FNS’ contingencies, it said only that it would revert to
    manual processes, identify the problem, and work with contractor to correct it, but
    gave no further information to describe how this would be done

   –other agencies, such as FS, APHIS, GIPSA, NRCS, NASS, and RD, also
    discussed using manual processes in general terms, but did not identify
    contingency procedures, resources and staff roles, and timetables to implement
    them
                                                                                                    23




                        Page 34                          GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                      Appendix I
                      Briefing on Year 2000 USDA Contingency
                      Planning




              Evaluation of Component Agencies’ Draft
              BCCPs (Cont’d)
                     Testing              1.      Validatebusiness
                                                           businesscontinuity
                                                                      continuitystrategy
                                                                                   strategy
Status of
                    Testing
                   Testing
                     KeySteps
                         Steps         1.1.2.    Validate
                                                Validate
                                                  Developbusiness   continuity
                                                           contingency     test  strategy
                                                                                plans
                    Key
                   Key Steps           2.2.3.    Developcontingency
                                                Develop   contingencytest
                                                  Establishtest
                                                            testteams
                                                                 teamsand
                                                                          testplans
                                                                               plans
                                                                           andacquire
                                                                                acquire
Phase IV Efforts                       3.3.      Establish
                                                Establish test teams and acquire
                                                  resources
                                                 resources
                                                resources
                                          4.      Prepareand
                                                           andexecute
                                                                executetests
                                                                           tests
                                       4.4.5.    Prepare
                                                Prepare  and
                                                  Validate    executeoftests
                                                           capability      contingency    plans
                                       5.5.6.    Validatecapability
                                                Validate
                                                  Rehearse
                                                          capabilityofofcontingency
                                                             business
                                                                          contingencyplans
                                                                         resumption
                                                                                         plans
                                                                                       teams
                                       6.6.7.    Rehearsebusiness
                                                Rehearse    businessresumption
                                                  UpdateBCCPs
                                                          BCCPsbased
                                                                       resumptionteams
                                                                   basedupon
                                                                                      teams
                                                                             uponlessons
                                                                                   lessons
                                       7.7.      Update
                                                Update  BCCPs
                                                  learned        basedifupon
                                                          andre-test,
                                                               re-test,          lessons
                                                                            necessary
                                                 learned
                                                learned  and
                                                        and  re-test, ififnecessary
                                                                           necessary
                                          8.      Updatedisaster
                                                          disasterrecovery
                                                                   recoveryplansplansand
                                                                                       and
                                       8.8.      Update
                                                Update  disaster recovery
                                                  procedures                  plans and
                                                 procedures
                                                procedures


• Some BCCPs and progress reports indicated that testing (Phase IV
  steps) would be done in the future

• Six agencies (FNS, FSA, FAS, FS, AMS, and ARS) identified testing
  milestones, but none showed that test plans had been developed




                                                                                                  24




                      Page 35                            GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                   Appendix I
                   Briefing on Year 2000 USDA Contingency
                   Planning




               Actions At Four Component Agencies to
               Complete Key BCCP Steps

• To identify actions underway or planned by agencies to
  complete key planning steps in their draft BCCPs, we visited
  the following four agencies
   –   FSIS
   –   APHIS
   –   FSA
   –   FNS

• Ensuring Year 2000 risks are addressed at these agencies is
  especially important given their vital health and safety,
  financial, and/or economic missions




                                                                                         25




                   Page 36                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                      Appendix I
                      Briefing on Year 2000 USDA Contingency
                      Planning




                Actions At Four Component Agencies
                to Complete Key BCCP Steps (Cont’d)
•   As of the end of March 1999, progress varied among the four
    agencies on completing key BCCP steps left in Phases II-IV
    that had not been addressed in their draft plans

•   Specifically, our visits to the four agencies found that
     – none had yet determined minimal acceptable levels of output or
       completed work defining contingency procedures
     – all planned to better define contingencies or were in the process
       of doing so
     – FSIS and FSA had recently established testing milestones, but
       APHIS had not done so (FNS’ draft BCCP included one testing
       milestone, but this milestone had been missed)
     – all planned to do testing when ready, but said they currently did
       not know how testing would be performed



                                                                                           26




                      Page 37                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                              Appendix I
                              Briefing on Year 2000 USDA Contingency
                              Planning




                      Actions At Four Component Agencies
                      to Complete Key BCCP Steps (Cont’d)
FSIS ensures that our nation’s meats, poultry, and processed egg
product supply is safe
   Key BCCP Steps Remaining At FSIS
    Acceptable Levels of    Step is not being done because FSIS believes its core business processes must
    Output/Recovery Time    continue at current operational levels and cannot be down for any period of time.
    Objective
    Contingency Plans and   FSIS plans to hire a contractor in April 1999 for providing assistance with
    Implementation Modes    developing contingency plans for FSIS and its local offices.


    Business Resumption     Step has not yet been addressed, but FSIS says it plans to establish
    Teams                   business resumption teams.

    “Zero Day” Strategy     Step has not yet been addressed, but FSIS says it plans to develop a zero day
                            strategy with contractor assistance.


    BCCP Test Plans         Step has not yet been addressed, but FSIS says it plans to develop test plans
                            with contractor assistance.


    BCCP Test               Step has not yet been addressed, but FSIS says it plans to establish BCCP testing
    Completion              milestones with contractor assistance.
    Milestones


                                                                                                                27




                              Page 38                                GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                            Appendix I
                            Briefing on Year 2000 USDA Contingency
                            Planning




                     Actions At Four Component Agencies
                     to Complete Key BCCP Steps (Cont’d)
APHIS protects U.S. agriculture from imported pest and diseases
and enhances marketability of our nation’s agricultural products
abroad
   Key BCCP Steps Remaining At APHIS
   Acceptable Levels of   Step has not yet been addressed, but APHIS said acceptable levels of output
   Output/Recovery Time   and recovery time objectives will be defined as BCCPs are developed at
   Objective              APHIS’ more than 800 local offices.

   Contingency Plans      Managers were asked to prepare local plans by March 31, 1999, but status is
   and Implementation     unknown as the local plans are not being collected by APHIS headquarters.
   Modes

   Business Resumption    APHIS said that local offices are reporting that teams are being established as
   Teams                  part of their BCCP development effort, but overall status is unknown.

   “Zero Day” Strategy    APHIS has begun working to define a zero day strategy.


   BCCP Test Plans        APHIS said that several local offices are reporting that they have developed test
                          plans and have already conducted some testing, but overall status is unknown.

   BCCP Test              No testing milestones have been established.
   Completion
   Milestones


                                                                                                              28




                            Page 39                                GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                              Appendix I
                              Briefing on Year 2000 USDA Contingency
                              Planning




                       Actions At Four Component Agencies
                       to Complete Key BCCP Steps (Cont’d)
FSA provides expanded economic opportunities for agricultural
producers through commodity and income support and farm credit
programs
   Key BCCP Steps Remaining At FSA
 Acceptable Levels of    Output levels are not being established, but FSA has defined the time period in
 Output/ Recovery Time   which it could continue to operate before a contingency must be implemented.
 Objective

 Contingency Plans       FSA has been developing more detailed contingency plans, and has a deadline
 and Implementation      of April 1999 for their completion.
 Modes
 Business Resumption     Business Resumption Teams are not being established—instead, contingency team
 Teams                   managers have been designated to work with teams to perform similar purpose.


 “Zero Day” Strategy     Step has not yet been addressed, but FSA says it plans to develop a zero day
                         strategy.
 BCCP Test Plans         Test plans have not yet been developed, but FSA says it expects to do
                         desktop exercises, given the short amount of time remaining.


 BCCP Test               A June 1999 milestone has been established for completing BCCP
 Completion              testing.
 Milestones

                                                                                                           29




                              Page 40                              GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                               Appendix I
                               Briefing on Year 2000 USDA Contingency
                               Planning




                         Actions At Four Component Agencies
                         to Complete Key BCCP Steps (Cont’d)
FNS administers America’s domestic nutrition programs--food stamps,
WIC, and child nutrition and commodity assistance--and delivers
these programs working in partnerships with the states
   Key BCCP Steps Remaining At FNS
  Acceptable Levels of     FNS believes current operations for benefits systems are the minimum necessary and
  Output/ Recovery Time    FNS is revising its draft plan to address recovery times.
  Objective
  Contingency Plans        FNS is revising its draft plan to describe contingencies more fully. A contractor will
  and Implementation       be hired in April 1999 to help FNS regions determine states’ progress on developing
  Modes                    BCCPs, but FNS does not plan to develop contingencies for responding to potential
                           Year 2000 failures at state levels.

   Business Resumption     FNS is revising its draft plan to address business resumption teams. Generally, these
   Teams                   are the same individuals as those currently responsible for operating FNS’ information
                           systems.
   “Zero Day” Strategy     FNS is revising its draft plan to address a zero day strategy, but this strategy will not be
                           finalized until more information is obtained from the states.
  BCCP Test Plans          Test procedures for contingencies for financial operations exist, but are not
                           referenced in the draft BCCP. FNS said it will develop plans for testing
                           contingencies for other FNS core processes.
   BCCP Test               Draft plan includes a date for testing financial systems contingencies, but this date has
   Completion              been missed. Milestones for testing contingencies for all core processes will be
   Milestones              included in revised draft plan.

                                                                                                                          30




                               Page 41                                  GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                  Appendix I
                  Briefing on Year 2000 USDA Contingency
                  Planning




           Observations on USDA’s BCCP
           Time Frames and Milestones

• USDA reported in its February 1999 Year 2000 quarterly
  report to OMB that it expected to complete all BCCPs by
  December 1999

• USDA’s December 1999 time frame for completing BCCPs

   – leaves no room for slippage in dates or time for correcting
     and retesting plans if necessary
   – is after the beginning of fiscal year 2000 (October 1, 1999),
     when potential failures could have already occurred




                                                                                       31




                  Page 42                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                   Appendix I
                   Briefing on Year 2000 USDA Contingency
                   Planning




           Observations on USDA’s BCCP
           Time Frames and Milestones (Cont’d)
•   In January 1999, we testified that OMB, which oversees the
    government’s Year 2000 efforts, should consider
    establishing dates of April 30, 1999 to complete BCCPs and
    September 30, 1999 to complete testing, which allows
    agencies time to

    – adjust work schedules should milestones slip
    – address any shortfalls found when testing their plans
      and make necessary adjustments
    – be prepared for Year 2000 failures that could have
      already occurred by the start of fiscal year 2000

•   Recently, OMB indicated it
    – is developing a process to coordinate work on BCCPs across
      the agencies
    – has informally notified the agencies to be prepared to submit
      BCCPs to OMB in June 1999

                                                                                          32




                   Page 43                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                     Appendix I
                     Briefing on Year 2000 USDA Contingency
                     Planning




             Observations on USDA’s BCCP
             Time Frames and Milestones (Cont’d)
•   However, specific governmentwide milestones for agencies
    to complete and test BCCPs have not yet been established
    by OMB

•   To provide time for any slippages or for correcting and
    retesting plans if necessary, it is important that USDA move
    up its time frame for completing and testing BCCPs earlier,
    such as the September 30, 1999 date we suggested

•   Given the substantial amount of BCCP work remaining,
    advancing the department’s time frames would require that
    USDA agencies and offices set priorities to ensure that, at a
    minimum, BCCPs are completed for the highest priority
    business processes

•   Currently, priorities have not been established for first
    completing BCCPs that address Year 2000 risks for the
    department’s 43 highest priority business processes
                                                                                           33




                     Page 44                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                     Appendix I
                     Briefing on Year 2000 USDA Contingency
                     Planning




                Recommendations

•   We recommend that the Secretary of Agriculture direct that the
    CIO advance the department’s December 1999 time frame for
    completing and testing agencies’ BCCPs to no later than
    September 30,1999
•


•   We also recommend that the Secretary direct that the
    Undersecretaries for USDA’s 7 mission areas--as well as the
    CIO, Chief Financial Officer, and Assistant Secretary for
    Departmental Administration--have their respective agencies
    and offices:
    – develop priorities for completing and testing BCCPs which are
      aligned with the department’s 43 highest priority business
      processes to ensure that remaining work addresses these
      processes first


                                                                                      34




                     Page 45                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
                   Appendix I
                   Briefing on Year 2000 USDA Contingency
                   Planning




               Recommendations (Cont’d)

– establish specific milestones to complete key interim BCCP steps
  that have not yet been adequately addressed, including:
    • defining acceptable levels of output/recovery time objectives
    • documenting contingency plans that clearly describe contingency
      triggers and implementation modes
    • establishing business resumption teams
    • developing “zero day” strategies
    • developing contingency test plans
    • conducting contingency tests

– report regularly to the Secretary progress on meeting these
  milestones to ensure that the agencies adequately address all key
  business continuity and contingency planning steps that are
  appropriate to each agency



                                                                                         35




                   Page 46                         GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Appendix II

Major Contributors to This Report                                                                   AppIex
                                                                                                         ndi




Accounting and         Mark D. Shaw, Assistant Director
                       Heather W. McIntyre, Senior Information Systems Analyst
Information            Richard B. Hung, Technical Advisor
Management Division,
Washington, D.C.

Kansas City Field      Troy G. Hottovy, Senior Information Systems Analyst
                       Janet M. Jamison, Senior Evaluator
Office




(511478)      L
              ertet    Page 47                    GAO/AIMD-99-178 Year 2000 USDA Contingency Planning
Ordering Information

The first copy of each GAO report and testimony is free.
Additional copies are $2 each. Orders should be sent to the
following address, accompanied by a check or money order made
out to the Superintendent of Documents, when necessary, VISA and
MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address are
discounted 25 percent.

Orders by mail:

U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013

or visit:

Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000
or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any list
from the past 30 days, please call (202) 512-6000 using a touchtone
phone. A recorded menu will provide information on how to obtain
these lists.

For information on how to access GAO reports on the INTERNET,
send an e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov
United States                       Bulk Rate
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. GI00
Official Business
Penalty for Private Use $300

Address Correction Requested