AccessibilitySkip to Top NavigationSkip to Main ContentHome  |  Contact IRS  |  About IRS  |  Site Map  |  Español  |  Help  

Part 10. Security, Privacy and Assurance

Chapter 2. Physical Security Program

Section 10. Continuity Planning Requirements

10.2.10  Continuity Planning Requirements

10.2.10.1  (09-25-2008)
Purpose

  1. This manual provides policies and guidance to be used by IRS organizations to carry out their respective roles and responsibilities in continuity planning. It provides guidance for developing viable and executable continuity plans and procedures.

10.2.10.1.1  (09-25-2008)
Overview

  1. Continuity planning is a good business practice, part of the fundamental mission of IRS as a responsible and reliable public institution. The changing threat environment and recent emergencies, including localized acts of nature, accidents, technological emergencies, and terrorist attack-related incidents, have increased awareness of the need for continuity capabilities and plans that will enable the IRS to continue its mission essential functions across a broad spectrum of emergencies.

  2. Continuity planning applies to a wide range of potential emergencies or threats, including natural disasters, accidents, technological failures, workplace violence, and terrorism. Some of these hazards may produce emergencies that render a single facility unusable for a period of time, such as a local water main break or hazardous material incident. Others may result in more severe and widespread emergencies such as a major national or regional disaster

  3. The primary goal of the IRS continuity planning efforts is to ensure the continuation of IRS mission essential functions under all circumstances. This is accomplished through the development of comprehensive plans, procedures, and provisions for alternate facilities, personnel, resources, interoperable communications, and vital records.

  4. Continuity planning prepares the IRS for disaster prevention, response, and recovery and for the IRS to maintain viability of its mission essential operations during and following an emergency or continuity event.

10.2.10.1.2  (09-25-2008)
Applicability and Scope

  1. The provisions in this manual apply to all offices, business, operating, and functional units within IRS.

10.2.10.1.3  (09-25-2008)
General Policy

  1. In accordance with and in support of the National Continuity Policy, the IRS shall have in place a comprehensive and effective Continuity Program to ensure the continuity of IRS mission essential functions under all circumstances across the spectrum of threats, including localized acts of nature, accidents, and technological or attack-related emergencies.

  2. The IRS Continuity Program shall include plans and procedures, under all readiness levels that:

    1. Identify IRS mission essential functions.

    2. Specify succession to office and emergency delegations of authority.

    3. Provide for the safekeeping of and access to vital records.

    4. Identify a range of continuity facilities and locations.

    5. Provide for interoperable communications.

    6. Provide for human capital planning.

    7. Validate IRS continuity capabilities through tests, training, and exercises.

    8. Specify devolution of control and direction.

    9. Provide for reconstitution operations.

  3. The IRS Continuity Program is implemented through its related continuity plans and procedures and its continuity test, training, exercise and operational capability to support these plans and procedures.

  4. The IRS Continuity Program shall address geographic dispersion, risk management, security, and readiness and preparedness.

    1. The IRS shall incorporate geographic dispersion of its leadership, data storage, personnel, and other capabilities into its normal daily operations, as appropriate. Geographic dispersion of the IRS normal daily operations can significantly enhance IRS resilience and reduce the risk of losing the capability to perform IRS mission essential functions.

    2. The IRS shall apply risk management principles to ensure that appropriate operational readiness decisions are based on the probability of an attack or other incident and its consequences.

    3. The IRS shall integrate its security strategies that address personnel, physical, and information security to protect personnel, facilities, plans, and capabilities, to prevent adversaries from disrupting IRS continuity plans and operations.

    4. The IRS leadership shall ensure that the IRS, through normal procedures or with a continuity plan, can perform its mission essential functions before, during, and after an incident.

  5. The performance of IRS mission essential functions in an emergency or continuity event shall be the basis for continuity planning, preparation, and execution.

  6. The IRS shall develop and maintain continuity plans and procedures and implement test, training, exercise, and assessment programs that ensure continuity under all conditions.

  7. The IRS continuity plans shall be responsive and executable with or without warning.

  8. The IRS shall have in place a viable continuity capability to ensure continued performance of IRS mission essential functions from alternate operating sites during any emergency or situation that may disrupt normal operations.

  9. To ensure effective continuity capabilities, the IRS shall:

    1. Use a risk management methodology to identify, prioritize, and justify the allocation of continuity budgetary resources.

    2. Integrate continuity budgets with a multiyear strategy and a program management plan, and link the budgets directly to objectives and metrics set forth in that plan.

    3. Provide for the acquisition of those resources necessary for continuity operations on an emergency basis.

    4. Budget for and acquire continuity capabilities.

  10. In accordance with the National Continuity Policy, the IRS shall use metrics to measure its ability to meet its continuity requirements. The IRS shall use the list of continuity requirements, key questions, and metrics guidance specified in Exhibit 10.2.10-1 to certify that it has a strong continuity capability.

10.2.10.1.4  (09-25-2008)
IRM Section Topics

  1. This manual contains information on the following topics:

    • Authorities

    • Roles and Responsibilities

    • Continuity Requirements

    • Continuity Planning

    • Requirements for Continuity Plans and Procedures

    • Elements of a Viable Continuity Capability

    • Continuity Plan Operational Phases and Implementation

    • Continuity Plan Content and Format

    • Continuity Requirements and Metrics (Exhibit 10.2.10-1)

    • National Essential Functions (Exhibit 10.2.10-2)

    • Glossary of Terms Used in Continuity Planning (Exhibit 10.2.10-3)

    • Acronyms/Abbreviations Used in Continuity Planning (Exhibit 10.2.10-4)

    • References (Exhibit 10.2.10-5)

10.2.10.1.5  (09-25-2008)
Authorities

  1. National Security Presidential Directive 51/Homeland Security Presidential Directive 20 (NSPD-51 /HSPD-20), National Continuity Policy, dated May 9, 2007, establishes a comprehensive national policy on the continuity of Federal Government structures and operations and a single National Continuity Coordinator responsible for coordinating the development and implementation of Federal continuity policies; establishes "National Essential Functions" ; prescribes continuity requirements for all executive departments and agencies; and provides guidance for State, local, territorial, and tribal governments, and private sector organizations in order to ensure a comprehensive and integrated national continuity program that will enhance the credibility of our national security posture and enable a more rapid and effective response to and recovery from a national emergency.

  2. National Continuity Policy Implementation Plan, dated August 2007, builds upon the National Continuity Policy and provides guidance to executive departments and agencies on appropriately identifying and carrying out their Primary Mission Essential Functions that support the eight National Essential Functions—the most critical functions necessary to lead and sustain the Nation during a catastrophic emergency.

  3. Federal Continuity Directive 1 (FCD 1), Federal Executive Branch National Continuity Program and Requirements, dated February 2008, provides direction to Federal Executive Branch departments and agencies for use in developing contingency plans and programs for continuity.

  4. These authorities can be found at: http://awss.web.irs.gov/PhysicalSecurity/site/EmergencyPrep/

10.2.10.2  (09-25-2008)
Roles and Responsibilities

  1. The IRS shall implement roles and responsibilities that ensure the continuing performance of its mission essential functions under all circumstances.

  2. The following roles and responsibilities are based on the National Security Presidential Directive 51/Homeland Security Presidential Directive 20 (NSPD-51/HSPD-20), National Continuity Policy, Homeland Security Presidential Directives, Federal Continuity Directives, and Department of Treasury policies and guidance.

10.2.10.2.1  (09-25-2008)
Agency Head

  1. As the Agency Head, the National Continuity Policy assigns the IRS Commissioner responsibilities for:

    1. Establishing an IRS Continuity Program.

    2. Ensuring continuing performance of IRS mission essential functions.

    3. Incorporating continuity requirements into daily IRS operations.

    4. Ensuring IRS has continuity plans for dealing with a national or localized emergency situation and ensuring continued performance of IRS mission essential functions.

    5. Appointing a senior accountable official as the IRS Continuity Coordinator.

    6. Validating and approving IRS mission essential functions.

    7. Developing a Continuity Multi-Year Strategy and Program Management Plan that includes a program budget to support a viable continuity capability.

    8. Planning, programming, and budgeting for secure continuity communications capabilities.

    9. Ensuring IRS mission essential functions interdependencies are coordinated within IRS, at the interagency level, and with private sector partners.

    10. Participating in the Department of Homeland Security’s National Exercise Program.

    11. Incorporating Office of Management and Budget (OMB) guidance on continuity, as provided, when developing continuity budgets.

    12. As required, submitting Continuity Readiness Reports and other reports, through designated channels (e.g., the Readiness Reporting System).

    13. Developing a Continuity Assessment Program to assist in documenting, prioritizing, and resourcing continuity issues during test, training, and exercise, assessments, and emergency operations.

    14. Evaluating IRS continuity program readiness to ensure the adequacy and capability of its continuity plans and programs.

    15. Promulgating and disseminating continuity guidance to all IRS subordinate organizational elements including field offices.

    16. Emphasizing geographic dispersion of leadership, staff, and infrastructure, as appropriate, in order to increase survivability and maintain uninterrupted government functions.

    17. Executing IRS continuity plans and complying with the requirements and assigned responsibilities under the Continuity of Government Readiness Condition (COGCON) program.

    18. Participating in and conducting testing, as appropriate, to ensure viability of communications systems.

  2. In accordance with the National Continuity Policy, as the Agency Head, the IRS Commissioner shall, on an annual basis:

    1. Submit a report to the Department of Treasury’s Continuity Coordinator certifying that the IRS has a continuity capability plan with the required continuity requirements in accordance with the National Continuity Policy.

    2. Ensure that key IRS leaders and support staff are provided familiarization training of IRS mission essential functions.

    3. Conduct tests, training, and exercises of the IRS continuity plans, to include continuity personnel, essential IT systems and equipment, in order to evaluate program readiness and ensure adequacy and viability of continuity plans and communications systems.

  3. The above Agency Head responsibilities shall be clearly outlined in IRS continuity plans and internal documents.

10.2.10.2.2  (09-25-2008)
IRS Continuity Coordinator

  1. The Chief, Agency-Wide Shared Services, at the direction of the Commissioner, serves as the IRS Continuity Coordinator.

  2. As the IRS Continuity Coordinator, the Chief, Agency-Wide Shared Services, responsibilities include:

    1. Managing, overseeing, and ensuring the readiness and compliance of the IRS Continuity Program.

    2. Coordinating and managing all activities required for the IRS to perform its mission essential functions during an emergency or other situation that would disrupt normal operations.

    3. Developing the IRS Continuity Program short- and long-term goals and objectives.

    4. Working with the executive leadership of the IRS business, operating, and functional units to complete the IRS mission essential functions identification and analysis process.

    5. Identifying and assisting with resolving issues related to continuity plans development, activation, implementation, and reconstitution.

    6. Assisting with the identification of continuity planning team members.

    7. Acting as liaison between the IRS continuity planning team and executive leadership of the IRS business, operating, and functional units.

    8. Coordinating with IRS business, operating, and functional units on emergency preparedness and response issues.

    9. Ensuring the preparation and maintenance of emergency preparedness and post disaster response and recovery plans.

    10. Preparing and maintaining current rosters of IRS headquarters continuity or emergency response personnel who will assist in disaster operations.

    11. Coordinating appropriate training for continuity or emergency response personnel.

10.2.10.2.3  (09-25-2008)
Senior Management/Executives

  1. The senior management/executive responsible for a business, operating, or functional unit is responsible for:

    1. Ensuring that IRS continuity policies, guidance, and procedures are implemented and followed.

    2. Managing their organization’s day-to-day continuity programs.

    3. Ensuring they are capable of carrying out their respective mission essential functions related to continuity operations, including planning, activation, execution, and reconstitution.

    4. Planning, programming, and budgeting for continuity capabilities.

    5. Ensuring that comprehensive and viable continuity plans are developed, exercised, implemented, and maintained.

  2. The senior management/executive responsible for a business, operating, or functional unit shall, at a minimum:

    1. Identify and prioritize the mission essential functions within their organization.

    2. Identify mission critical data (vital records) and systems needed to perform each mission essential function.

    3. Establish critical resource requirements needed to perform each mission essential function.

    4. Identify communications systems needed to support each mission essential function.

    5. Develop recovery or resumption strategies for each identified mission essential function.

    6. Establish a roster of knowledgeable key personnel to serve on continuity operations or recovery teams.

    7. Establish orders of succession to key leadership positions within their organization.

    8. Pre-delegate authorities for making policy determinations and decisions within their organization, as appropriate.

    9. Establish and periodically (at least annually) test the capability to perform their mission essential functions.

  3. The senior management/executive responsible for a business, operating, or functional unit shall ensure that required continuity information is documented in the appropriate continuity plans and procedures.

10.2.10.2.4  (09-25-2008)
Continuity Planners

  1. Continuity planners at all levels have the responsibility of fully understanding their organization and monitoring the direction, guidance, and best practices of the government and private sector in order to develop the most relevant continuity plans.

  2. Continuity planners shall:

    1. Serve as continuity coordinators for their respective business, operating, or functional unit.

    2. Work with the IRS Continuity Coordinator on continuity activities.

    3. Participate in the business process analysis used to identify IRS mission essential functions.

    4. Represent their unit on continuity committees or working groups, as appropriate.

10.2.10.2.5  (09-25-2008)
Director, Physical Security and Emergency Preparedness

  1. The Director, Physical Security and Emergency Preparedness, is responsible for coordination and oversight of IRS-wide continuity planning and emergency preparedness activities.

10.2.10.2.6  (09-25-2008)
Associate Director, Security and Emergency Programs Division

  1. The Associate Director, Security and Emergency Programs Division is responsible for developing and maintaining IRS-wide continuity planning and emergency preparedness policy, guidance, and procedures.

10.2.10.3  (09-25-2008)
Continuity Requirements

  1. The IRS must be capable of continuing the performance of its mission essential functions during any emergency for a period up to 30 days or until normal operations can be resumed.

  2. The IRS must have the capability to be fully operational at its continuity facilities as soon as possible after the occurrence of an emergency, but not later than 12 hours after continuity operations activation.

  3. Succession orders and pre-planned delegations of authority to ensure there is an orderly and predefined transition of leadership and delegation of authority within IRS during any emergency must be planned and documented in accordance with applicable laws.

  4. The IRS must safeguard its vital resources, facilities, and records, and provide official access to them.

  5. The IRS must make provisions for acquisition of the staff and resources necessary for continuity operations on an emergency basis.

  6. The IRS must make provisions for the availability and redundancy of critical communications capabilities at continuity sites in order to support connectivity between and among key government leadership, IRS organizational elements, other executive departments and agencies, critical partners, and the public.

  7. The IRS must make provisions for reconstitution capabilities that allow for recovery from a catastrophic emergency and resumption of normal operations.

  8. The IRS must make provisions for the identification, training, and preparedness of IRS personnel capable of relocating to continuity facilities to support the continuation of the performance of IRS mission essential functions.

  9. The IRS shall incorporate these continuity requirements into its daily operations to ensure a seamless and immediate continuation of its mission essential functions capabilities.

10.2.10.4  (09-25-2008)
Continuity Planning

  1. Continuity planning includes IRS activities and efforts to document and ensure that the IRS is capable of continuing its mission essential functions during a wide range of potential emergencies.

  2. The IRS continuity plans and supporting procedures, when implemented, shall provide for the continued performance of IRS mission essential functions under all circumstances.

10.2.10.4.1  (09-25-2008)
Continuity Planning Objectives

  1. Federal Continuity Directive 1 (FCD 1) outlines the objectives of a continuity plan. These objectives have been adopted by the IRS as a best practice and include:

    1. Ensuring the safety of IRS personnel and visitors.

    2. Ensuring the IRS can continue to perform its mission essential functions, including conducting activities from an alternate location, if necessary.

    3. Reducing the loss of life and minimizing property damage and loss.

    4. Executing, as required, successful succession to office with accompanying delegation of authorities in the event a disruption renders IRS leadership unable, unavailable, or incapable of assuming and performing their duties and responsibilities.

    5. Reducing or mitigating disruptions to IRS operations.

    6. Ensuring that IRS has facilities available where it can continue to perform its mission essential functions during a continuity event or emergency.

    7. Protecting essential facilities, equipment, vital records, and other assets, in the event of a disruption.

    8. Achieving a timely and orderly recovery and reconstitution from a continuity event or emergency.

    9. Ensuring and validating IRS continuity readiness through an integrated continuity test, training, and exercise program to support the implementation of the IRS continuity plans.

  2. IRS continuity planning shall be based on the assumption that there will be no warning of potential emergencies or incidents, using a worst-case scenario (e.g., the inaccessibility or unavailability of an IRS facility and all of its contents).

10.2.10.5  (09-25-2008)
Requirements for Continuity Plans and Procedures

  1. The key elements of continuity to include: mission essential functions, orders of succession, delegations of authority, continuity facilities, continuity communications systems, vital records, human capital, test, training, and exercises, devolution, and reconstitution shall be addressed.

  2. IRS mission essential functions and critical activities, interdependencies, and the resources needed to perform them shall be identified.

  3. Orders of succession and preplanned delegations of authority for the position of IRS Commissioner as well as for other key IRS leadership positions shall be established.

  4. Procedures to ensure IRS vital resources, facilities, and records are safeguarded, available, and accessible to support continuity operations shall be identified.

  5. Instructions for acquisition of necessary personnel, equipment, supplies, and other resources that are not already in place for continuity operations on an emergency basis shall be provided.

  6. Measures taken to ensure the availability and redundancy of critical communications capabilities at continuity sites in order to support connectivity between and among key government leadership, within IRS, other executive departments and agencies, critical partners, and the public shall be identified.

  7. Components, processes, and requirements for the identification, training, and preparedness of IRS personnel who are capable of relocating to continuity facilities to support the continuation of the performance of IRS mission essential functions shall be identified.

  8. A decision-making process (matrix) for determining appropriate actions in activating (implementing) IRS continuity plans and procedures shall be outlined.

  9. Alert and notification procedures for all continuity personnel throughout all phases of a continuity event or emergency shall be established.

  10. A process for reporting IRS continuity readiness and activation status shall be provided.

  11. The roles and responsibilities of those individuals who support the IRS Continuity Program shall be defined.

  12. Point of contact rosters of trained continuity personnel who are fully equipped and have the authority to perform IRS mission essential functions, including the execution of the devolution of control plan, shall be established and maintained. Rosters shall include, at a minimum, names and home, work, and cellular telephone numbers.

  13. Procedures for the activation and relocation, including guidance for continuity personnel, shall be provided.

  14. Methods and procedures used to communicate and coordinate activities with continuity and non-continuity personnel before, during, and after a continuity event shall be provided.

  15. Procedures in place to ensure that the continuity plan can be implemented with and without warning shall be provided.

  16. Process or methodology for attaining operational capability at the continuity facility within 12 hours of continuity plan activation shall be provided.

  17. Instructions for the acquisition of necessary personnel and resources to ensure that sustained operations can be maintained for up to 30 days after a continuity event or until normal IRS business activities can be resumed shall be provided.

  18. Provision for an all-hazards risk assessment of all IRS continuity facilities shall be provided.

  19. All continuity facilities for continuity operations shall be identified.

  20. Procedures for notifying continuity facilities and on-site support teams shall be provided.

  21. Procedures for the reconstitution of IRS capabilities and transition from continuity operations to normal operations provisions shall be provided.

  22. Recommended contents of drive-away/fly-away kits and guidance for maintenance of kits shall be provided.

  23. Contingency plans for the performance of IRS mission essential functions in the event key resources, including vital records, supplies, and personnel, are not available shall be established.

  24. The IRS continuity plans must outline the process that will be followed to:

    1. Designate and review mission essential functions and resources.

    2. Define short and long-term continuity goals and objectives.

    3. Forecast budgetary requirements.

    4. Identify continuity program issues, concerns, potential obstacles, and the strategy for addressing these.

    5. Establish continuity planning, training, and exercise activities and milestones for these activities.

    6. Identify the people, infrastructure, communications, transportation, and funding needed to support continuity programs.

  25. Provisions and procedures for assisting all IRS personnel, especially those who are disaster victims, with special human capital concerns following a catastrophic disaster shall be provided.

  26. Guidance to all IRS employees in developing Family Support Plans which will increase personal and family preparedness throughout the organization and support employee availability during a continuity event shall be provided.

  27. At a minimum, the entire continuity plan must be reviewed annually and updated accordingly. Significant changes (e.g., mission essential functions, continuity facilities) to the continuity plan must be made as they occur.

10.2.10.6  (09-25-2008)
Elements of a Viable Continuity Capability

  1. The IRS continuity capability, its ability to perform its mission essential functions continuously, depends on IRS leadership, trained personnel, communications, facilities, and other assets necessary to conduct IRS mission essential functions and supporting activities.

  2. The IRS shall have a viable continuity capability in place. The following continuity elements are needed to provide a complete and effective continuity capability: mission essential functions, orders of succession, delegations of authority, continuity facilities, continuity communications, vital records management, human capital, test, training and exercise, devolution of control and direction, and reconstitution.

10.2.10.6.1  (09-25-2008)
Mission Essential Functions

  1. Mission essential functions are those functions that enable IRS to provide vital services, exercise civil authority, maintain the safety of the public, and sustain the industrial and economic base during an emergency. Mission essential functions are described as the limited set of agency-level government functions that must be continued throughout or resumed rapidly after a disruption of normal activities.

    1. Primary Mission Essential Functions are a subset of agency-level mission essential functions that must be performed in order to support or implement the performance of the National Essential Functions before, during, and in the aftermath of an emergency.

    2. National Essential Functions (NEFs) are the eight government functions the President and national leadership will focus on to lead and sustain the Nation during a catastrophic emergency. The NEFs ensure continuity at the highest levels of government. The NEFs are listed in Exhibit 10.2.10-2.

  2. The IRS shall identify and prioritize its mission essential functions. Once identified, these mission essential functions serve as key continuity planning factors to determine appropriate staffing, communications, information, facilities, training, and other continuity requirements.

  3. When identifying its mission essential functions, the IRS shall:

    1. Determine which IRS functions must be continued under all circumstances.

    2. Prioritize these mission essential functions based on criticality of the function. To the extent possible, prioritize these mission essential functions against likely continuity operations triggers and scenarios.

    3. Establish staffing, resource requirements, and any other supporting activities needed to perform these mission essential functions. Examples of supporting activities include situational awareness, computer and IT support, administrative management, infrastructure preparation, personnel and personal preparation, coordination of clearances and accesses with alternate facilities, instructions for continuity staffs, and logistics.

    4. Identify equipment, including IT hardware and telecommunications hardware needed to perform mission essential functions.

    5. Identify mission critical data (vital records) and IT systems necessary to conduct mission essential functions.

    6. Determine consumable office supplies needed to perform mission essential functions.

    7. Integrate supporting activities to ensure mission essential functions can be performed as efficiently as possible during emergency relocation.

    8. Defer functions not deemed mission essential until additional personnel and resources become available.

  4. The IRS shall be capable of sustaining its mission essential functions for a period up to 30 days or until normal business activities can be resumed.

  5. The lists of resources required to perform the IRS mission essential functions shall be reviewed annually and updated as necessary.

10.2.10.6.2  (09-25-2008)
Orders of Succession

  1. Orders of succession are provisions for the assumption of senior IRS leadership positions during an emergency when the incumbents are unable or unavailable to perform their authorized duties, roles, and responsibilities. Orders of succession allow an orderly and predefined transition of leadership.

  2. The IRS shall provide for a clear line of succession in the absence of existing IRS leadership and the necessary delegations of authority to ensure that the succeeding leadership has the legal authorities to carry out their duties and responsibilities.

  3. The IRS leadership is responsible for establishing, promulgating, and maintaining orders of succession to key positions.

  4. Orders of succession shall be of sufficient depth to ensure that IRS is able to perform its mission essential functions. At a minimum:

    1. Establish an order of succession for the position of agency head, the IRS Commissioner.

    2. Establish orders of succession for other key IRS leadership positions, including but not limited to administrators, regional or field directors, key managers, other key mission essential personnel or their equivalent positions (e.g. Deputy Commissioners, heads of IRS business, operating, and functional units; directors of computing centers, submission processing sites, and campuses, etc.). Orders of succession should also be established for devolution counterparts in these positions.

    3. Identify any limitations of authority based on delegations of authority to others.

    4. Describe orders of succession by positions or titles, rather than by names of individuals holding those offices. To ensure their legal sufficiency, coordinate the development of orders of succession with the IRS Chief Counsel.

    5. Revise orders of succession, as necessary, and distribute revised versions promptly as changes occur.

    6. Establish the procedures that designated alternates are to follow when facing the issues of succession to office in emergency situations.

    7. Include in the succession procedures the conditions under which succession will take place, method of notification, and time, geographical, or organizational limitations of authorities granted by the orders of succession.

    8. Develop and provide a duties and responsibilities briefing to the designated successors to the position of agency head (IRS Commissioner), when named, and other key IRS leadership positions, on their responsibilities as successors and on any provisions for their relocation.

  5. Designated successors shall be provided annual refresher briefings on IRS continuity preparations.

  6. Orders of succession shall be included in the vital records and be available at all continuity facilities in the event the continuity plan is activated.

10.2.10.6.3  (09-25-2008)
Delegations of Authority

  1. A delegation of authority identifies who is authorized to act on behalf of the agency head or other agency officials for specified purposes and ensures that designated individuals have the legal authorities to carry out their duties. To the extent possible, these authorities should be identified by title or position, and not by the individual office holder’s name.

  2. The IRS shall pre-delegate authorities for making policy determinations and other decisions to ensure rapid response to any emergency situation requiring implementation of its continuity plans.

  3. Generally, predetermined delegations of authority will take effect when normal channels of direction are disrupted and will terminate when these channels are reestablished. Delegation of authority is an essential part of IRS continuity plans and should reach to a sufficient depth and have sufficient breadth—at least three positions deep and geographically dispersed where feasible—to ensure the IRS can perform its mission essential functions while remaining a viable part of the Federal Government during the course of any emergency.

  4. A delegation of authority must document, in advance, the legal authority of officials (including those below the level of IRS Commissioner) to make key policy decisions during a continuity situation.

  5. To ensure IRS primary mission essential functions and mission essential functions are performed, delegations of authority must be planned and documented in advance of an incident and in accordance with applicable laws, including by:

    1. Delineating the limits of authority and accountability.

    2. Outlining explicitly in a statement, the authority (including any exceptions to that authority) of an official so designated to exercise IRS direction, and the authority of an official to re-delegate functions and activities, as appropriate.

    3. Defining the circumstances under which delegation of authorities would take effect and would be terminated.

  6. Delegations of authority must ensure that those officials who might be expected to assume authorities in a continuity situation are properly informed and trained to carry out their emergency responsibilities.

  7. Delegations of authority must ensure the orderly (and predefined) transition of leadership, for the position of IRS Commissioner as well as for key supporting positions within IRS, during an emergency and be closely tied to succession.

  8. At a minimum, annual training is required of IRS officials who might be expected to assume authorities in a continuity situation or an emergency.

  9. Delegations of authority shall be included in the vital records and be available at all continuity facilities in the event the continuity plan is activated.

10.2.10.6.4  (09-25-2008)
Continuity Facilities

  1. An alternate facility is a location, other than the normal facility, used to carry out IRS mission essential functions during continuity operations activation.

  2. The IRS, at a minimum, shall identify and maintain an alternate facility. The IRS shall designate alternate facilities, alternate usages of existing facilities, and, as appropriate, virtual office options (e.g., work at home, telecommuting facilities), as a part of its continuity planning.

  3. Alternate facilities shall be identified for the relocation of a limited number of key IRS leaders and staff. These facilities must be able to provide survivable protection and enable continued, endurable operations.

  4. The IRS shall prepare its personnel for the possibility of an unannounced relocation of IRS mission essential functions, and/or continuity personnel to these designated facilities.

  5. Alternate facilities shall be capable of supporting operations in a threat-free environment, as determined by the geographical location of the facility, assessment of the local threat, and/or the collective protection characteristics of the facility. These facilities should replicate essential capabilities by providing systems and configurations that are used in daily activities.

  6. At a minimum, the designated alternate facilities must provide:

    1. Immediate availability to allow continuity operations to commence rapidly in the event of a no warning attack.

    2. Sufficient space, infrastructure, power, life support, and network connectivity to accommodate the continuity personnel and equipment required to continue IRS mission essential functions and primary mission essential functions.

    3. Operational capability to perform IRS mission essential functions and primary mission essential functions within 12 hours of an interruption or continuity event.

    4. Capability to sustain mission essential functions operations for up to 30 days after an event or until normal IRS operations can be resumed.

    5. Computer equipment, software, and other equipment necessary to carry out mission essential functions and primary mission essential functions.

    6. Interoperable communications, including means for secure communications if appropriate, with all identified essential internal and external organizations, customers, and the public.

    7. Physical security including perimeter, access, and internal functions commensurate with operations.

    8. Access to reliable logistical support and essential resources such as food, lodging, water, fuel, medical facilities, and office supplies.

    9. Capabilities to access and use the vital records needed to facilitate the performance of mission essential functions.

  7. All IRS personnel shall be briefed on IRS continuity plans that involve using, or relocating personnel to alternate facilities, existing facilities, or virtual offices.

  8. The IRS shall develop executable transportation plans for movement of its continuity personnel to alternate facilities.

  9. The IRS shall develop procedures for maintaining readiness of alternate facilities, procuring equipment and supplies that are not pre-positioned, and to notify and coordinate activation of alternate facilities.

10.2.10.6.5  (09-25-2008)
Continuity Communications

  1. The IRS ability to successfully execute its mission essential functions at its headquarters and at its alternate or other continuity facilities, as well as the ability of the IRS senior leadership to collaborate, develop policy and recommendations, and respond under all-hazards conditions, depends on the availability of effective communications systems.

  2. The IRS communication systems must support full connectivity, under all conditions, within IRS, among key government leadership, other agencies, customers, and the public.

  3. The IRS communications and IT systems (e.g., secure/non-secure, voice, data, video, fax, internet access, email), including hardware and software for continuity operations, should mirror those used in day-to-day operations to assist continuity leadership and staff in a seamless transition to crisis operations.

  4. The IRS shall ensure that it has sufficient communications capabilities for its headquarters and its alternate and other continuity facilities to support the continuation of its mission essential functions.

  5. The IRS shall plan accordingly for mission essential functions that require uninterrupted communications and IT support. All necessary and required communications and IT capabilities shall be:

    1. Operational within 12 hours of continuity operations activation.

    2. Sustained for up to 30 days or until normal operations can be resumed.

  6. The IRS must:

    1. Implement minimum communications requirements for IRS headquarters and its alternate and other continuity facilities, as appropriate, which support the continuation of the IRS mission essential functions and primary mission essential functions.

    2. Possess interoperable and available communications capabilities in sufficient quantity and mode/media that are commensurate with IRS responsibilities during conditions of an emergency.

    3. Possess communications capabilities that can support the IRS senior leadership while they are in transit to alternate facilities.

    4. Ensure that the communications capabilities are maintained and readily available for a period of sustained usage of no less than 30 days or until normal operations can be reestablished.

    5. Ensure that all continuity staff is properly trained, as appropriate, in the use of these communications capabilities.

    6. Satisfy the requirement to provide assured and priority access to communications resources.

    7. Have sufficient communications capabilities to accomplish the IRS mission essential functions from an alternate facility. If the IRS alternate facility is shared with another agency, also have a signed agreement with that agency which ensures that each has adequate access to communications resources.

  7. The communications capabilities shall be tested at the alternate facilities at least monthly in order to ensure internal and external interoperability and viability.

10.2.10.6.6  (09-25-2008)
Vital Records Management

  1. A critical element of the IRS continuity plans is the identification, protection, and ready availability of its vital records that are needed to support its mission essential functions during a continuity event or emergency. These vital records include electronic and hardcopy documents, references, records, and information systems and applications.

  2. The IRS shall identify all vital records needed to continue its mission essential functions and to resume normal operations throughout all phases of the continuity event. Procedures shall be established to ensure these vital records are safeguarded, available, and accessible to support continuity operations.

  3. The IRS continuity personnel shall have access to and be able to use the required vital records and systems to perform IRS mission essential functions and to reconstitute or resume normal IRS operations.

  4. Categories of these vital records include:

    1. Emergency Operating Records which include records and databases that are essential to the continued functioning or reconstitution of IRS during and after a continuity event or emergency.

    2. Rights and Interest Records which include records critical to carrying out IRS essential legal and financial functions, and records vital to the protection of the legal and financial rights of individuals who are directly affected by IRS activities.

  5. The IRS continuity plans shall identify and establish procedures to ensure its vital records are safeguarded, available, and accessible to support continuity operations.

  6. The IRS shall identify and preposition its Emergency Operating Records that are needed to continue IRS mission essential functions. Rights and Interest Records considered critical to performing mission essential functions should be included in the Emergency Operating Records and maintained at the appropriate alternate continuity facility.

  7. A vital records plan packet must be developed and maintained. The records packet will include:

    1. A hard copy or electronic list of key IRS personnel and continuity personnel with up-to-date telephone numbers.

    2. A vital records inventory with the exact locations of vital records.

    3. Updates to the vital records.

    4. Necessary keys or access codes.

    5. Alternate facility locations.

    6. Access requirements and lists of sources of equipment necessary to access the records (this may include hardware and software, microfilm readers, Internet access, and/or dedicated telephone lines).

    7. Lists of records recovery experts and vendors.

    8. A copy of the IRS Continuity Plans.

  8. At a minimum, vital records must be annually reviewed, rotated, or cycled so that the latest versions are available. A copy of the vital records packet shall be securely maintained at the IRS alternate facilities and other continuity locations where it is easily accessible to appropriate personnel when needed.

10.2.10.6.7  (09-25-2008)
Human Capital

  1. The IRS shall identify its continuity leadership and staff and establish IRS human capital strategies that are adaptable to changing circumstances and a variety of emergencies for use during activation of a continuity plan.

  2. In a continuity event or an emergency, IRS continuity personnel and other special categories of employees will be activated by IRS to perform their assigned emergency response duties.

  3. The IRS plans and procedures for those employees who have not been designated as continuity or emergency response personnel should be addressed in the IRS continuity plans as well as in other types of emergency response planning documents, such as the occupant emergency plans or shelter-in-place plans.

  4. The IRS shall:

    1. Develop and implement a process to identify, document, communicate with and train IRS continuity personnel.

    2. Provide guidance to IRS continuity personnel on individual preparedness measures they should take to ensure response to a continuity event.

    3. Implement a process to communicate the IRS operating status to all employees.

    4. Implement a process to contact and account for all employees in the event of an emergency.

    5. Keep employees informed during emergencies whether they work at the alternate site or not.

    6. Identify a human capital liaison from the IRS human resources staff to work with the IRS continuity coordinator or continuity manager when developing the IRS emergency plans.

    7. Implement a process to communicate human capital guidance for emergencies (pay, leave, staffing and other human resources flexibilities) to managers and make employees aware of that guidance in an effort to help IRS continue its mission essential functions during an emergency.

  5. The IRS must ensure that its continuity personnel are officially informed of their roles or designations by providing documentation to ensure that continuity personnel know and accept their roles and responsibilities. IRS continuity personnel must:

    1. Understand the continuity planning requirements.

    2. Understand their roles and responsibilities.

    3. Participate in the IRS continuity test, training, and exercise program.

  6. IRS managers shall:

    1. Ensure that all employees have a clear understanding of what they are able to do in an emergency.

    2. Place the right people in the right jobs to perform IRS mission essential functions most effectively.

    3. Know where their employees are and how to contact them.

    4. Maintain specific protocols for designating and activating special needs employees.

    5. Conduct regular exercises and simulations.

    6. Develop, review, and update emergency guidance, as needed.

  7. The IRS should also: