Internal Revenue Manual
IRM 10.6.3 — Test, Training, and Exercise Requirements
Part 10. Security, Privacy and Assurance
Chapter 6. Continuity Operations Section 3. Test, Training, and Exercise Requirements 10.6.3 Test, Training, and Exercise Requirements Manual Transmittal March 21, 2022 Purpose (1) This transmits revised IRM 10.6.3 Test, Training, and Exercise Requirements, catalogue number 71636Q. Material Changes (1) Sections added to conform to Publishing requirements. (2) Editorial changes for consistency. Effect on Other Documents This updates IRM 10.6.3Test, Training, and Exercise Requirements, dated March 12, 2020. Audience IRM 10.6.3 applies to all Business Unit personnel responsible for continuity planning activities, including managing day-to-day continuity programs, and developing, exercising, executing, and maintaining viable continuity plans and procedures. Effective Date (03-21-2022) Pablo F. Meléndez Chief, Business Continuity Operations Officer, Deputy Chief of Staff Office C:CoS:DCoS: Continuity Coordinator
Program Scope and Objectives
10.6.3.1 (03-21-2022) Program Scope and Objectives Purpose: This section provides policies and guidance to be used by IRS organizations to carry out an effective Test, Training, and Exercise (TT&E) Program. This includes guidance on roles and responsibilities, procedures, documentation, and evaluation, to ensure the organization remains in a constant state of readiness to perform the IRS's Mission Essential Functions (MEFs) during major incidents. These provisions apply to all Business Units (BUs) within the IRS. Audience. These procedures apply to IRS employees who are responsible for developing, implementing, and using the Business Unit Continuity tests and exercises including: Members of SCR Continuity Operations and Field Operations; Members of Headquarters Continuity Operations (COOP) Teams; National Continuity Points of Contact (NCPOCs); Local Continuity Representatives (LCRs). Policy Owner. The IRS Continuity Coordinator is the Business Continuity Operations Officer of the Deputy Chief of Staff Office of the Commissioner's Complex. Program Owner. The Program Manager of Continuity of Operations of the Senior Commissioner's Representatives within the Deputy Chief of Staff Office. Stakeholders. All audience listed above plus all other Continuity Planners.
Background
10.6.3.1.1 (03-21-2022) Background To ensure consistency, the IRS TT&E Program is requiring use of common language, various but standardized types of exercises, including customized and realistic scenarios, materials, and documents. National standards for the Federal Government have been set by the Homeland Security Exercise Evaluation Program (HSEEP) of the Department of Homeland Security (DHS). The IRS TT&E Program places emphasis on the following HSEEP principles: Objectives designed to mitigate risks specific to IRS; Progressive approach utilizing a common set of program-related priorities and objectives designed around IRS processes; Reliance on a multi-year training and exercise plan. The HSEEP handbook is found at Homeland Security Exercise and Evaluation Program (HSEEP) (fema.gov).
Authority
10.6.3.1.2 (03-21-2022) Authority TT&E requirements are detailed in FCD-1 Federal Continuity Directive 1 - January 17, 2017 (fema.gov) dated January 17, 2017. Federal Continuity Directive 1 (FCD-1), as signed by the Administrator of the Federal Emergency Management Agency (FEMA), implements requirements, and establishes the framework, requirements, and processes that support the development of executive departments and agencies' continuity programs and by specifying and defining elements of a continuity plan. IRS administers and executes its continuity program under the authority and direction of the Department of the Treasury (Treasury) Office of Emergency Preparedness.
Responsibilities
10.6.3.1.3 (03-21-2022) Responsibilities TT&Es are the responsibility of the SCR-CO:CO organization and all BU Heads of Office. The support of each BU and their attention to business continuity planning is critical to a successful Continuity Program at the IRS. BU Executives are required to assign knowledgeable key personnel to serve as continuity liaisons, including but not limited to: National Continuity Points of Contact (NCPOC) - A primary and alternate geographically who are dispersed and are appointed to ensure continuity requirements are met within their respective BUs; Local Continuity Representative (LCR) - A primary, first alternate, and second alternate who are geographically dispersed and are appointed to ensure representation for their BUs on Incident Management Teams (IMTs). Appointees must have knowledge of BU operations enabling them to perform all levels of related tasks. SCR-CO:CO will assist and guide them to ensure continuity responsibilities and requirements are met. Successful execution of the IRS continuity test and exercise program requirements involves collaboration between SCR-CO:CO and BU NCPOCs. At the beginning of each fiscal year, the IRS Continuity Coordinator issues a memorandum to all IRS BU Heads of Office that identifies the Annual Continuity Program RequirementsThe memorandum identifies the testing requirements and frequency for that year: SCR-CO:CO in concert with other IRS Continuity Stakeholders pre-determine the testing schedule and/or frequency for each fiscal year; The categories of Test and Exercises.
Program Reports
10.6.3.1.4 (03-12-2020) Program Reports All program reports are dependent on summaries of required information listed in IRM 10.6.3.9.4After Action Report/Improvement Plan (AAR/IP) Development. Test and Exercise Completion: Cumulative TT&E Completions by BU are reported monthly in the SCR-CO:CO Monthly Measures Report, SCR-CO:CO Monthly Report, and quarterly in the SCR-CO:CO Operational Review Managing BU Test, Training, and Exercise (% Complete); Test and Exercise Completions by type of exercise are reported monthly in the SCR-CO:CO Monthly Report; BU level completions are reported monthly in the Continuity Operations Working Group (COOPWG). Test and Exercise Corrective Actions: Summary TT&E Corrective Action completions are reported monthly in the SCR-CO:CO Monthly Measures Report, the SCR-CO:CO Monthly Report, and the COOPWG.
Terms
10.6.3.1.5 (03-21-2022) Terms See IRM 10.6.1Introduction to Continuity Planning for a general list of terms. A Situation Manual (SitMan) is document developed by the Exercise Planning Team to define the scenario(s) for the test or exercise. An Exercise Plan (ExPlan) is used to direct the phases or steps of the test or exercise.
Acronyms
10.6.3.1.6 (03-21-2022) Acronyms See IRM 10.6.1Introduction to Continuity Planning for a general list of acronyms. Specific acronyms for Test, Training, and Exercises are: AAR/IP - After Action Report/Improvement Plan; ANA - Alert Notification Activation Test; CAP - Corrective Action Plan; GETS - Government Emergency Telecommunications Service; HQRT - Headquarters Recovery Team; WPS - Wireless Priority Service; SAT - Satellite Phone Service.
Related Resources
10.6.3.1.7 (03-12-2020) Related Resources See IRM 10.6.1Introduction to Continuity Planning, IRM 10.6.2Continuity Plan Requirements,IRM 10.6.4Incident Management Program, IRM 10.6.5Annual Certification Requirements, and IRM 10.6.6Pandemic Plan Requirements for related topics to testing and reporting.
Categories of Tests and Exercises
10.6.3.2 (03-12-2020) Categories of Tests and Exercises The Test, Training, and Exercise TT&E Program is administered in the IRS by: Tests and Exercises count as training and participants receive credit in Integrated Talent Management (ITM) Training System for participating. Other training courses are accessed through ITM. IRM 10.6.1.13 Continuity Planning Overview, Program Scope and Objectives, Responsibilities lists these courses for each role; Testing involves validation of plans, procedures, as well as verifies capabilities of equipment and systems which support the organization's continuity infrastructure; Exercises put into action the components of testing and training, plans, procedures, systems, and continuity personnel, and in so doing enhances skills of personnel, as well as identifies gaps in procedures and areas for improvement. Related documents are: Multi-Year Test, Training and Exercise Program Plan will document the types of tests and exercises IRS will conduct during the next three years. It will be updated annually. This plan is an outline for the organization to demonstrate capability to continue MEFs and ESAs; Annual Continuity Program Requirements Memorandum will provide guidance on key requirements to facilitate effective business continuity planning across the IRS enterprise and is distributed to the heads of each BU; Annual Certification of Continuity Capabilities (see IRM 10.6.5 Annual Certification Requirements). SCR-CO tracks: Test and Exercise Completion; Training Completion of mandatory ITM Courses 30 days after appointment; Submission of After-Action Reports/ Improvement Plans (AAR/IP) within 30 days of Test or Exercise; Timely closeout of Corrective Actions listed in AAR/IP. Categories are: Tests Identifier Test/Exercise Purpose Participants Frequency T-1 Calling Tree Notification Test To test the accuracy and completeness of the organization's management and employees contact information and the procedures for reaching them timely All IRS Organizations Annually T-2 Alert, Notification, and Activation Procedures To test the procedures to timely alert, notify and activate recovery team members and validate the accuracy and completeness of their contact information All IRS Organizations Quarterly T-3a HQ EOC Communication Systems and Equipment Test To ensure emergency communications systems, equipment, and procedures for the HQ Emergency Operations Center (EOC) are kept in a constant state of readiness SAMC, SCR-CO, CSIRC Monthly T-3b GETS/WPS Communication Systems and Equipment Test To ensure emergency communications GETS Card Holders and WPS Users are familiar with the operating procedures GETS Card Holders and WPS Users Quarterly T-3c Satellite Phone Communication Systems and Equipment Test To ensure emergency communications Satellite Phone holders are familiar with the operating procedures Satellite Phone Holders Quarterly Exercises E-1 Integrated Functional Exercises (Operations based) To ensure IRS has the capability to continue its Mission Essential Functions within recovery time objectives Required Organizations Annually E-2 Eagle Horizon National Level Exercise (Operations-Based) To demonstrate IRS' readiness to respond and its ability to continue or resume essential and critical operations at alternate locations HC COOP Team Annually E-3 Senior Leadership Table-Top Exercises (Discussion-Based) To ensure IRS senior executive leadership are knowledgeable of their continuity roles and responsibilities and their plans and procedures All IRS Organizations As Needed E-4 Workshops/ Seminars (Discussion-Based) To ensure IRS continuity personnel are knowledgeable of specific continuity roles and responsibilities, plans, and/or procedures All IRS Organizations As Needed E-6 Pandemic Ability to continue essential functions during a pandemic All IRS Organizations Scenario, as needed
Test Program Requirements
10.6.3.3 (03-12-2020) Test Program Requirements The IRS continuity test program practices the implementation of our organization's policies, plans, and procedures. The test program: Demonstrates the correct operation of all equipment, procedures, processes, and systems that support an organization's continuity infrastructure; Ensures that resources and procedures are kept in a constant state of readiness; Cultivates better organizational knowledge, identifies gaps in coverage, and validates existing plans and programs.
Call Tree Notification Test
10.6.3.3.1 (03-12-2020) Call Tree Notification Test The purpose of the call-tree test is to validate the personnel notification process to be used in the event of an emergency on an annual basis. Managers should have the personnel call tree information accessible at all times. The test is to be conducted as quickly as possible to evaluate the time required to contact all personnel. The test requirements are for all personnel and should include calls from the Executive level down to the frontline personnel. This test will be performed as a stand-alone activity with all personnel currently at work. Personnel on authorized leave, or in training or travel status are exempt. When conducting the call tree, managers should use their documented contact list. Information to be validated includes: office location, office telephone number, contact number(s) for after hours, and out-of-area emergency contact names and number(s).
National Continuity Points of Contact (NCPOCs) Responsibilities
10.6.3.3.1.1 (03-12-2020) National Continuity Points of Contact (NCPOCs) Responsibilities Schedule test with office of the BU head or delegate. Initiate the call tree by contacting the office of the BU head or delegate. Track the receipt of the Divisional/Operational Response Forms and maintain copies of completed test.
Business Unit Managers Responsibilities
10.6.3.3.1.2 (03-21-2022) Business Unit Managers Responsibilities Contact personnel at work to validate office contact information (This test must be performed during work hours). Notify each person called that "This is a test to validate our telephone calling tree procedures and phone numbers. You are on my list to call in an emergency" . Using the Tree Notification Log track/enter the following information: Who was notified; The time notification was made; The number of employees not reached. Forward via email a copy of the completed Form 14576Call Tree Notification Log to your manager, to acknowledge and certify completion of this test. Division Managers will compile all the Call Tree Logs for their respective areas and forward them, along with the Form 14575Division or Operation Call Tree Response Form, to the BU NCPOC. Once the BU NCPOC has received all the Call Tree Logs from their areas they will complete Form 14571 NCPOC Call Tree Notification Test Response and forward it to cos.scrco.continuity@irs.gov within seven calendar days.
Alert Notification and Activation Tests
10.6.3.3.2 (03-12-2020) Alert Notification and Activation Tests The purpose of all Alert Notification and Activation (ANA) Tests is to authenticate all contact/notification information and validate the alert process. ANA Tests are primarily telephone based, but may include other communications devices, such as computer email or text chat, and mobile phone text messaging. Procedures are different for Headquarters (HQ) Recovery Teams and for IMTs.
Alert Notification and Activation Test Procedures for HQ Recovery Teams at Headquarters Locations
10.6.3.3.2.1 (03-21-2022) Alert Notification and Activation Test Procedures for HQ Recovery Teams at Headquarters Locations The purpose of the Headquarters Recovery Team (HQRT) ANA Test is to authenticate HQRT contact/notification information and validate the alert process to be used in the event of an incident on a quarterly basis. NCPOCs and Executive Leadership should have their HQRT contact information accessible 24/7. The test is to be conducted as quickly as possible during normal business hours to evaluate the time required to contact all HQRT members. This test will be performed as a stand-alone activity. When conducting the initial contact, use the most current HQRT Roster. The test duration must not exceed 24 hours, and must be conducted during normal business hours. Information to be validated includes: work telephone number; work email address; and any applicable contact number(s) for after hours. During the test, the following information must be tracked and entered in the Form 14570Alert Notification Activation (ANA) Test: Who was notified; The time notification was made; If the team member was reached on the first call; If the team member returned the call; The contact information was verified. (Note: Changes to information should be noted in the Corrective Actions section of Form 14570 and reflected within the business unit's respective roster). The NCPOC will initiate the test by following these steps: Initiate the test by calling the HQRT members (primary and alternates) at work to validate office contact and alternate information. (This test must be performed during work hours); Notify each person called that "This is a test of our HQRT contact list and not an emergency" ; The NCPOC completes the Form 14570 and forward to cos.scrco.continuity@irs.gov within seven days of completing the test.
Alert Notification and Activation Test Procedures for Incident Management Teams
10.6.3.3.2.2 (03-21-2022) Alert Notification and Activation Test Procedures for Incident Management Teams The purpose of the IMT ANA Test is to authenticate IMT contact/notification information and validate the alert process to be used in the event of an incident on an annual basis. Incident Commanders (IC) should have their IMT contact information accessible 24/7. The test is to be conducted as quickly as possible during normal business hours to evaluate the time required to contact all IMT members. The test requirements are for all ICs. This test will be performed as a stand-alone activity. When conducting the initial contact, use the most current Incident Management Plan (IMP) Contact List. The test duration must not exceed 24 hours, and must be conducted during normal business hours. Information to be validated includes: work telephone number, work email address, and any applicable contact number(s) for after hours. During the test, the following information must be tracked and entered in the IMT Alert Notification Activation Test Log: Who was notified; The time notification was made; If the team member was reached on the first call; If the team member returned the call; The contact information was verified. (Note: If necessary, update the contact information). The IC will initiate the test by following these steps: Initiate the test by calling the IMT members (primary and alternates) at work to validate office contact and alternate information. (This test must be performed during work hours); Notify each person called that "This is a test of our IMT contact list and not an emergency" ; Forward the completed Form 14570Alert Notification Activation (ANA) Test to the BU NCPOC immediately following the test; The NCPOC completes the Form 14570 and applicable rosters and forward to cos.scrco.continuity@irs.gov within seven days of test completion.
Alert Notification and Activation Test Procedures for Local Continuity Representatives
10.6.3.3.2.3 (03-21-2022) Alert Notification and Activation Test Procedures for Local Continuity Representatives The purpose of the LCR ANA Test is to authenticate LCR contact/notification information and validate the alert process to be used in the event of an incident on an annual basis. NCPOCs and ICs should have their LCR contact information accessible 24/7. The test is to be conducted as quickly as possible during normal business hours to evaluate the time required to contact all LCRs. This test will be performed as a stand-alone activity. When conducting the initial contact, use the most current LCR Roster. The test duration must not exceed 24 hours, and must be conducted during normal business hours. Information to be validated includes: work telephone number, work email address, and any applicable contact number(s) for after hours. During the test, the following information must be tracked and entered in the Form 14570Alert Notification Activation (ANA) Test: Who was notified; The time notification was made; If the team member was reached on the first call; If the team member returned the call; The contact information was verified (Note: If necessary, update the contact information). The NCPOC will initiate the test by following these steps: Initiate the test by calling the LCRs (primary and alternates) at work to validate office contact and alternate information (this test must be performed during work hours); Notify each person called that "This is a test of our LCR contact list and not an emergency" ; The NCPOC completes the Form 14570 and applicable rosters and forward to cos.scrco.continuity@irs.gov within seven days of completing the test.
Communication Systems and Equipment Test
10.6.3.3.3 (03-12-2020) Communication Systems and Equipment Test The purposes of the Communications Systems and Equipment Tests are to: To validate the status of the continuity communications tools that can be used in the event of an emergency and/or during communications systems disruptions; To promote operational readiness ensuring those responsible for using the Continuity Communication tool is familiar enough to use it during an emergency. There are three alternative means of communications available to the IRS in the event of an emergency Government Emergency Telecommunication Service (GETS) subscribers receive priority access to the local/national telephone network during times of network congestion; Wireless Priority Service (WPS) is a feature added to the approved government mobile device of a GETS subscriber. During an emergency, this feature allows priority access to the mobile telephone network during times of network congestion; Satellite phones have a non-secure wireless voice capability and should not be used to discuss sensitive information. The phones work best outdoors with an unobstructed view of the sky to the horizon, and require a fully charged battery.
Government Emergency Telecommunication Service (GETS)
10.6.3.3.3.1 (03-21-2022) Government Emergency Telecommunication Service (GETS) GETS Card holders should keep their cards secure and accessible 24/7. SCR-CO should follow these steps for conducting a GETS Card Test: Schedule quarterly test(s) with GETS Card Holders; Request validation of GETS Card holders from the BU NCPOCs; Remind NCPOCs of upcoming test to promote timely compliance; Initiate the test by contacting GETS card holders; Track test results by maintaining support document of conducting the test, and BU PASS/FAILURE responses; Within seven business days of conducting the test, submit Form 14569GETS Card/WPS/Satellite Phone Test to cos.scrco.continuity@irs.gov. NCPOCs should: Review results documented for their BU on Form 14569 GETS Card/WPS/Satellite Phone Test ; Follow-up with users who did not test or failed the test, in an effort to mitigate future issues. Any employee who fails to test their GETS account for three consecutive quarters will have their GETS account terminated and will need to reapply to restore their account.
Wireless Priority Service (WPS)
10.6.3.3.3.2 (03-21-2022) Wireless Priority Service (WPS) WPS Users should keep their GETS cards secure and accessible 24/7 and inform their NCPOC immediately if their mobile device, its phone number, or service provider changes. SCR-CO should follow these steps for conducting a WPS Test: Schedule quarterly test(s) with WPS Users; Request validation of WPS Users from the BU NCPOCs; Remind NCPOCs of upcoming test to promote timely compliance; Track test results by maintaining support document of conducting the test, and PASS/FAILURE responses; Within seven business days of conducting the test, submit Form 14569GETS Card/WPS/Satellite Phone Test to cos.scrco.continuity@irs.gov. NCPOCs should: Review Form 14569GETS Card/WPS/Satellite Phone Test results; Follow-up with users who did not test or failed the test, in an effort to mitigate future issues. Any employee who fails to test their WPS account for three consecutive quarters will have their WPS account terminated and will need to reapply to restore their account.
Satellite Phones
10.6.3.3.3.3 (03-21-2022) Satellite Phones Satellite Phone Users should keep their phones secure and accessible 24/7 and participate in quarterly tests to remain familiar with the operating procedures by placing a successful call to either the phone number provided or any other phone number. SCR-CO should follow these steps for conducting a Satellite Phone Test: Schedule quarterly test(s) with Satellite Phone Users and NCPOCs; Initiate the test by contacting Satellite Phone Users; Notify NCPOCs of test initiation to ensure timely compliance and User assistance; Track test results by reconciling support document of conducting the test, and PASS/FAILURE responses; Within seven business days of conducting the test, complete for management with results. NCPOCs should: Review Form 14569GETS Card/WPS/Satellite Phone Test. Follow-up with users who did not test or failed the test, in an effort to mitigate future issues and/or ensure the device works properly; Partner with SCR-CO:CO to rectify technical issues and provide instructions for inoperable phones.
Exercise Program Requirements
10.6.3.4 (03-12-2020) Exercise Program Requirements HSEEP requirements state that all Test and Exercises should include: Record of Changes; Purpose and Scope; Strategic Plan Fiscal Year (FY) Test and Exercise Requirements (Type, Audience, Quantity); Design; Schedule; Resources needed; Evaluator(s); After Action Report requirements; Maintenance. Exercises should be designed to: Focus on demonstration of continuity capabilities, as required by DHS Exercise Evaluation Program Requirements Include external stakeholders as participants based on the scenario; Be based on risks (examples include: hurricane, tornado, earthquake scenarios appropriate for geographic location); Conducted jointly based on scenario (campus/field, multiple campus, multiple field); Ensure previously identified weaknesses and gaps were corrected; Be conducted periodically with no notice; Have an accountability component in coordination with the local Occupant Emergency Plan Program owner; Include multiple buildings and/or multiple tenant buildings based on the scenario; Involve Single Point of Failure at the sites. Exercises may be designed to meet more than one requirement. Testing Requirements and frequency required: Call Tree Notification Test - Annual; ANA Test Procedures for HQ Recovery Teams at Headquarters locations - Quarter; ANA Test Procedures for IMT - Annual; ANA Test Procedures for LCRs - Quarter; Communication Systems and Equipment Test – Quarterly tests of all emergency communications equipment (GETS/WPS/SAT) is initiated by SCR-CO:CO, and are conducted by each end user; Emergency Alert Notification System (EANS-AtHoc) is to be tested monthly by SCR-CO. See IRM 10.6. IRM Emergency Notification System (AtHoc); Communication Systems and Equipment Test – Monthly tests are conducted by the Situational Awareness Management Center (SAMC), Computer Security Incident Reporting Center (CSIRC), and HQ Emergency Operations Center (EOC). Exercises: Integrated Functional Exercises for HCO SCRs, Campus Locations; Senior Leadership Tabletop Exercise for BUs. The IRS continuity exercise program focuses primarily on evaluating objectives and capabilities or an element of a capability in a simulated situation. The IRS exercise program must include: An annual opportunity for continuity personnel to demonstrate their familiarity with continuity plans and procedures and to demonstrate the agency's capability to continue essential functions; An annual exercise that incorporates the deliberate and preplanned movement of continuity personnel to an alternate facility or location; An annual opportunity to demonstrate intra- and interagency communications capabilities; An annual opportunity to demonstrate that backup data and records required to support essential functions at alternate facilities or locations are sufficient, complete, and current; An annual opportunity for continuity personnel to demonstrate their familiarity with the reconstitution procedures to transition from a continuity environment to normal activities when appropriate; A comprehensive debriefing or hot wash after each exercise, which allows participants to identify weaknesses in plans and procedures and to recommend revision to their continuity plans. Exercise Types include Discussion-Based and Operations-Based. Discussion-based exercises include seminars, workshops, and tabletop exercises (TTXs) and are used to familiarize players with, or develop new, plans, policies, agreements, and procedures. Operations-based exercises include drills, functional exercises (FEs), and full-scale exercises (FSEs) that require actual reaction to an exercise scenario, such as initiating communications or mobilizing personnel and resources. These exercises can be used to validate plans, policies, agreements, and procedures; clarify roles and responsibilities; and identify resource gaps. Exercise Types: Note: BUs are not limited to these exercise types. BUs may conduct additional types of exercises as long as they follow the requirements listed in this IRM Workshop/Seminar orients participants to, or provides an overview of, authorities, strategies, policies and/or procedures; TTXs are intended to generate discussion of various issues regarding a hypothetical, simulated emergency. TTXs can be used to enhance general awareness, validate plans and procedures, rehearse concepts, and/or assess the types of systems needed to guide the prevention of, protection from, mitigation of, response to, and recovery from a defined incident; IFEs are designed to validate and evaluate capabilities, multiple functions and/or sub-functions, or interdependent groups of functions. IFEs are typically focused on exercising plans, policies, procedures, and staff members involved in management, direction, command, and control functions. IFE events are projected through an exercise scenario with event updates that drive activity typically at the management level. IFEs are conducted in a realistic, real-time environment; however, movement of personnel and equipment is usually simulated; Eagle Horizon is a component of the National Level Exercise that focuses on continuity of operations and reconstitution plans that require Federal departments and agencies to activate continuity plans and perform MEFs at alternate locations.
Exercise Scope
10.6.3.4.1 (03-12-2020) Exercise Scope Determining exercise scope enables planners to scale an exercise to meet the objectives while staying within the resource and personnel constraints of the exercising organizations. Key elements in defining exercise scope include exercise type, participation level, exercise duration, exercise location, and exercise parameters. Some of these elements are determined, or initially discussed, through program management activities. However, the exercise planning team finalizes the scope based on the exercise objectives. The planners should: Encourage active participation by everyone. Active participation by appropriate staff and key leaders is paramount to meeting the exercise objectives successfully; Determine how long it will take to address the exercise objectives effectively. Discussion-based exercises are generally shorter, ranging from a couple of hours to a full day; Outline clearly the exercise parameters as to what should be included in an exercise scenario based on the objectives and scope, and what should not be exercised. Often there is a desire to add exercise activities that fall outside of the scope of the exercise in order to meet diverse planning and training requirements. While these activities may be useful to an organization, they may impact the ability of players to meet exercise objectives or may reduce the benefit of the exercise by diluting its focus; Define clearly the exercise scope early in the design process will help exercise planners keep the exercise to a manageable and realistic level.
Exercise Objectives
10.6.3.4.2 (03-12-2020) Exercise Objectives The exercise planning team selects one or more exercise program priorities on which to focus an individual exercise. These priorities drive the development of exercise objectives, which are distinct outcomes that an organization wishes to achieve during an exercise. Exercise objectives should incorporate exercise participants' plans and procedures, operating environment, and desired outcomes. Planners should select a reasonable number of specific, measurable, achievable, relevant, and time-bound exercise objectives to facilitate effective scenario design, exercise conduct, and evaluation.
Exercise Scenario
10.6.3.4.3 (03-12-2020) Exercise Scenario A scenario is an outline or model of the simulated sequence of events for the exercise. It can be written as a narrative or depicted by an event timeline. A scenario provides background information about the incident catalyst(s) of the exercise, drives players participation. and is contained in a SitMan or ExPlan. Exercise planners should select and develop scenarios that enable an exercise to assess objectives and core capabilities. All scenarios should be realistic, plausible, and challenging; however, designers must ensure the scenario is not so complicated that it overwhelms players. A scenario consists of three basic elements: The general context or comprehensive story; The required conditions that will allow players to demonstrate proficiency and competency in conducting critical tasks, demonstrating core capabilities, and meeting objectives; The technical details necessary to accurately depict scenario conditions and events. The exercise planning team ensures that the design effort is not characterized by a fixation on scenario development; rather, the scenario facilitates assessment of exercise objectives and core capabilities. Exercise planners should refrain from developing the scenario until after the scope and objectives of the exercise have been clearly defined. Scenarios should avoid any sensitivity that may arise, such as the use of real names of terrorist groups or sensitive venues.
Exercise Documentation
10.6.3.4.4 (03-21-2022) Exercise Documentation Comprehensive, organized exercise documentation is critical to ensure an accurate account of the exercise is preserved. This in turn allows for leverage of past documentation to support future exercises and, more importantly, ensures that all critical issues, lessons learned, and corrective actions are appropriately captured to support improvement efforts. It is important for the exercise sponsor(s) to understand the specific requirements for security marking rules and requirements, access and dissemination, storage, disposal, and incident reporting of sensitive documents. Additionally, all documents produced must be 508 compliant. A SitMan or an ExPlan provides the conceptual background for an exercise, presents the scenario narrative designed to drive participation during the exercise, and serves as the primary reference material for the exercise planning team. Typically, a SitMan or ExPlan contains exercise scope, objectives, and core capabilities; participant roles and responsibilities; rules of conduct; safety issues, notably real emergency codes and phrases; safety controller responsibilities, prohibited activities, and weapons policies; logistics; security of and access to the exercise site; communications; duration, date, and time of exercise and schedule of events; and maps or directions. A Master Scenario Events List (MSEL) is a chronological timeline of expected actions and scripted events (injects) to be inserted into exercise play by controllers in order to generate or prompt player activity. A MSEL ensures necessary events happen so that all exercise objectives are met. A Facilitator Guide is designed to help facilitators manage a discussion-based exercise. It usually outlines instructions and key issues for discussion during the event and provides background information to help the facilitator answer questions from participants or players. The Player Handout provides key information to exercise players. A Player Handout can supplement the SitMan or ExPlan by providing a quick-reference guide to logistics, agenda or schedule, and key contact data for players. A Participant Feedback Form allows players to provide input regarding observed strengths and areas for improvement that identified during the exercise.
Exercise Planning
10.6.3.5 (03-12-2020) Exercise Planning Effective exercise design and development involve a combination of exercise planning activities, often in the form of planning meetings. Planning activities bring together exercise stakeholders to discuss and agree on key aspects of the exercise's design and development. Various factors, including exercise scope, type, and complexity are identified, and exercise planners tailor the planning schedule to suit the nature of the exercise. Exercises will require sufficient planning to identify desired participants, outcomes, and strategies. The core of the exercise planning activities begins and ends with four planning meetings. These meetings serve as the key mechanism for executing the major steps of exercise design and will ensure all aspects of planning for the IFE are met. These meetings can be conducted via conference calls, pc-based video communication, or face-to-face. These meetings serve as the key mechanism for executing the major steps of exercise design and will ensure all aspects of planning for the exercise are met. These four meetings are: Concepts and Objective Meeting; Initial Planning Meeting; Mid-Term Planning Meeting; Final Planning Meeting.
Design and Development
10.6.3.5.1 (03-12-2020) Design and Development The design of the Test or Exercise is a crucial step to be able to define participants, goals, and measurements. The exercise design and development process builds on exercise program management. During this phase participants, are selected for an exercise planning team. They schedule planning meetings, identify and develop exercise objectives, design the scenario, create documentation, plan exercise conduct, select a focus evaluation, and coordinate logistics. Scenario provides the storyline that drives an exercise. The first step in designing a scenario is determining the type of threat/hazard (chemical, explosive, cyber, natural disaster) to be used in an exercise. The hazards selected for an exercise should realistically stress the resources an entity is attempting to improve through its exercise program. The scenario should also be a realistic representation of potential threats and hazards faced by the exercising entity. The next step in designing a scenario is to determine the venue (facility or site) in which exercise play will take place. Venue selection should reflect the hazard selected, allowing for realistic, exercise-based simulation of the hazard.
Exercise Planning Team
10.6.3.5.2 (03-12-2020) Exercise Planning Team The exercise planning team is responsible for the successful execution of all aspects of an individual exercise. The planning team works with exercise stakeholders to determine or refine exercise objectives. The exercise planning team also creates a realistic scenario to achieve exercise objectives and develops documentation to guide exercise conduct and evaluation. The exercise planning team should consist of both members of SCR-CO:CO Continuity Planning Team and the BU or function being tested.
Exercise Planning Activities
10.6.3.5.3 (03-12-2020) Exercise Planning Activities Effective exercise design and development involve a combination of exercise planning activities, often in the form of planning meetings. Planning activities bring together exercise stakeholders to discuss and agree on key aspects of the exercise's design and development. Various factors, including exercise scope, type, and complexity are identified, and exercise planners tailor the planning schedule to suit the particular nature of the exercise. The core of the exercise planning activities begins and ends with the four planning meetings. These meetings serve as the key mechanism for executing the major steps of exercise design and will ensure all aspects of planning for the IFE are met.
Situation Manual
10.6.3.6 (03-12-2020) Situation Manual A SitMan is the core document for facilitation of discussion-based and IFEs. IRS uses the SitMan for IFEs and the annual National-Level Eagle Horizon Exercise. It provides the conceptual basis for the exercise, including scope, schedule, and objectives. It also provides background information and presents the scenario narrative designed to drive participant discussions during the exercises. MSELs are required in the SitMan Exercise Control Planning Exercise control maintains exercise scope, pace, and integrity during conduct under safe and secure conditions. The control structure in a well-developed exercise ensures that exercise play stays on target and players are do not lose focus of the exercise objectives. In the design and development phase, exercise planners consider control-related issues such as the staffing, structure, training, and communications of the control staff. Exercise Evaluation Planning Exercise evaluation activities begin as soon as exercise objectives are identified. In the design and development phase, exercise planners should account for issues such as the staffing, structure, training, and communications of evaluation staff members. Logistics Planning Effective logistics are essential to a successful exercise. They can make the difference between a smooth, seamless exercise and one that is confusing and ineffective. Exercise planners consider the full range of logistics-related issues, such as venue layout, onsite communications, and site security.
Details of Exercise Planning Stages and Meetings
10.6.3.7 (03-12-2020) Details of Exercise Planning Stages and Meetings Four exercise planning stages and meetings are recommended for all exercises: Concepts and Objective Meeting; Initial Planning Meeting; Mid-Term Planning Meeting; Final Planning Meeting. Large scale exercises may require additional stages and meetings. Participant lists in these meetings should be stable.
Concepts and Objective Meeting
10.6.3.7.1 (03-12-2020) Concepts and Objective Meeting The Concept and Objectives Meeting is the formal beginning of the planning process. It is held to identify the type, scope, objectives, and purpose of the exercise. For less complex exercises and for entities with limited resources, the Concept and Objectives Meeting can be conducted in conjunction with the Initial Planning Meeting . Discussion points for this meeting include: Exercise purpose; Proposed exercise scenario, capabilities, tasks, and objectives; Available exercise resources; Proposed exercise location, date, and duration; Exercise planning team and exercise participants; Exercise assumptions and artificialities; Exercise control and evaluation; Exercise security organization and structure; Local issues, concerns, and sensitivities; Exercise logistics. The primary tools for the Concept and Objectives Meeting are the read-ahead packet, the agenda, and background/rationale for conducting the exercise. Briefings are useful for presenting the exercise background/rationale as well as the proposed exercise methodology for those unfamiliar with HSEEP.
Initial Planning Meeting
10.6.3.7.2 (03-12-2020) Initial Planning Meeting The Initial Planning Meeting marks the beginning of the exercise development phase. Unless a separate Concept and Objectives Meeting is conducted, the Initial Planning Meeting is typically the first official step in the planning process. Its purpose is to determine exercise scope by gathering: input from the exercise planning team; design requirements and conditions (assumptions and artificialities); objectives; extent of play; and scenario variables (time, location, hazard selection). The Initial Planning Meeting is also used to develop exercise documentation by obtaining the planning team's input on exercise location, schedule, duration, and other relevant details. During the Initial Planning Meeting , exercise planning team members are assigned responsibility for activities associated with designing and developing exercise documents such as the MSEL and the Situation Manual (SitMan), and logistics, such as scene management and personnel. Activities during the Initial Planning Meeting include: Clearly defined exercise objectives and aligned core capabilities; Evaluation requirements, including capability targets and critical tasks; Relevant plans, policies, and procedures to be tested in the exercise; Exercise scenario; Extent of play for each participating organization; Ensuring clearly defined and measurable capabilities, tasks, and objectives; Optimum duration of the exercise; Exercise planners' roles and responsibilities; Decision to record exercise proceedings (audio or video); Local issues, concerns, or sensitivities; Consensus regarding the date, time, and location for the next meeting.
Mid-Term Planning Meeting
10.6.3.7.3 (03-12-2020) Mid-Term Planning Meeting Mid-Term Planning Meetings are typically used in more complex exercises. Mid-Term Planning Meetings provide additional opportunities to settle logistical and organizational issues that may arise during planning. The Mid-Term Planning Meeting is a working session to discuss exercise organization and staffing concepts, scenario and timeline development, scheduling, logistics, and administrative requirements. It is also a session to review draft documentation. A portion of the Mid-Term Planning Meeting should be devoted to developing the MSEL, as needed. Activities during the Mid-Term Planning Meeting include: Comments on draft exercise documentation; Identification of exercise venue artificialities and/or limitations; Agreement on final logistical items; Assignment of additional responsibilities; Developing Facilitator Guides and handbooks.
Final Planning Meeting
10.6.3.7.4 (03-12-2020) Final Planning Meeting The Final Planning Meeting is the final forum for reviewing exercise processes and procedures. Prior to the Final Planning Meeting, the exercise planning team receives final drafts of all exercise materials. The Final Planning Meeting allows the exercise planning an opportunity to ensure the exercise is aligning with their intent, address any questions, and make any last-minute updates. A Final Planning Meeting should be conducted for all exercises to ensure that all elements of the exercise are ready for conduct. No major changes to the design or scope of the exercise, or its supporting documentation, should take place at the Final Planning Meeting. The Final Planning Meeting ensures that all logistical requirements have been met, all outstanding issues have been identified and resolved, and all exercise products are ready for printing. Activities during the Final Planning Meeting include: Resolve any open issues related to exercise planning and identify last-minute concerns that may arise; Review all exercise logistical activities (schedule, registration, attire, special needs); Conduct a comprehensive, final review of, with approval for all exercise documents and presentation materials. By the conclusion of the Final Planning Meeting, planners should be able to: Ensure attendees have a clear understanding of, and give final approval for, exercise processes and procedures; Identify and resolve last-minute issues; Confirm logistical elements, including audio visual equipment, room configuration and setup, refreshments, and schedule.
Exercise Conduct
10.6.3.8 (03-12-2020) Exercise Conduct After design and development activities are complete, the exercise is ready to take place. Exercise conduct involves activities such as preparing for exercise play, managing exercise play, and conducting immediate exercise wrap-up activities. Key elements of exercise conduct include: Exercise Play Preparation: Immediately prior to exercise play, exercise planners conduct a series of activities to prepare for exercise play. These activities include communication test to test all aspects of media that will be used for the exercise as well as finalizing location setup and confirming important location or exercise- specific logistical details. In addition, exercise planners hold a series of briefings targeted to different types of exercise participants (e.g., controllers, evaluators, players). These briefings are an opportunity to distribute exercise documentation, provide necessary instructions and administrative information, and answer any outstanding questions prior to exercise play beginning; Exercise Play: During exercise conduct, participants play various, specific roles. These roles may depend on the type of exercise being conducted; Exercise Wrap-Up: Immediately following the end of exercise conduct, exercise planners conduct a series of activities to conclude exercise conduct. Key wrap-up activities often include a Player Hot Wash and various debriefing sessions in which exercise players, controllers, and evaluators can discuss exercise performance and identify strengths and areas for improvement from exercise play. The information from these wrap-up activities can be included in the After Action Report/Improvement Plan (AAR/IP). Each participant in an exercise has specific roles and responsibilities: Role Responsibilities Exercise Director The Exercise Director oversees all exercise functions during exercise conduct, oversees and remains in contact with Controllers and Evaluators, debriefs Controllers and Evaluators following the exercise, and oversees setup and cleanup of the exercise as well as positioning of Controllers and Evaluators. Evaluator Evaluators are chosen based on their expertise in the specific functional areas they will observe. Evaluators use evaluation documents to document observations, capture unresolved issues, and analyze exercise results. Evaluators do not interfere with exercise flow. Lead Evaluator The Lead Evaluator should participate as a member of the exercise planning team and be familiar with all relevant issues associated with the exercise, including plans, policies, and procedures; incident command and decision-making processes; and interagency and/or inter-jurisdictional coordination issues. The Lead Evaluator should have the management skills needed to oversee a team of Evaluators over an extended process as well as the knowledge and analytical skills to undertake a thorough and accurate analysis of all capabilities. Facilitator During a discussion-based exercise, the Facilitator(s) is responsible for keeping participant discussions on track with exercise objectives and ensuring all issues and objectives are explored as thoroughly as possible within time constraints. If an exercise uses breakout groups, more than one Facilitator may be needed. Controller In operations-based exercises and some games, Controllers plan and manage exercise play, set up and operate the exercise incident site, and possibly take the roles of individuals and agencies not actually participating in the exercise. Controllers direct the pace of exercise play, provide key data to players, and may prompt or initiate certain player actions and injects to the players as described in the MSEL to ensure exercise continuity. Controllers issue exercise materials to players as required, monitor the exercise timeline, and supervise the safety of all exercise participants. Controllers are the only participants who should provide information or direction to players. All Controllers should be accountable to one Senior Controller. Senior Controller The Senior Controller (sometimes known as a lead controller) is responsible for the overall organization of the exercise. The Senior Controller monitors actions by Controllers and exercise progress, and coordinates decisions regarding deviations or significant changes to the scenario caused by unexpected developments during play. The Senior Controller debriefs controllers and evaluators after the exercise and oversees the setup and take down of the exercise Safety Controller The Safety Controller is responsible for monitoring exercise safety during exercise setup, conduct, and cleanup. All Controllers assist the safety controller by reporting any safety concerns. The Safety Controller should not be confused with the Safety Officer, who is identified by the Incident Commander during exercise play. Exercise Documentation is a critical component of effective exercise design and development. In general, a variety of exercise documentation is good for all types of exercises. Factors such as exercise scope, type, complexity and structure are examples of what should be included in exercise documentation.
Record Keeping and Evaluation
10.6.3.9 (03-12-2020) Record Keeping and Evaluation Exercise evaluation maintains the fundamental link between the exercise and improvement planning. Through exercise evaluation, IRS assess the capabilities needed to accomplish a mission, function, or objective. Planning for the evaluation should be considered during Exercise Planning. Exercise planners should collaborate to ensure a consistent approach for evaluating capabilities during an exercise. Identifying clear evaluation requirements early in the planning process will ensure that the design, development, and conduct of the exercise best support an effective evaluation. Collecting data during the exercise is a crucial step for developing the AAR/IP. Exercise observations may vary from a note-taker recording data from participant discussions, to an evaluation team collecting and recording participant actions to form an analytical basis for determining if critical tasks were successfully demonstrated and capability targets were met. Evaluators and/or observers should be knowledgeable of the exercise objectives and scope. They should not jump ahead to analysis until the exercise has ended, nor prompt players with specific responses or otherwise interfere with player performance in any way. Following the exercise, all Evaluations, Observer Feedback, Participants Forms, and any other notes captured should be provided to the exercise owners within seven (7) days. Refer to the National Archives and Records Administration (NARA) approved disposition authority, General Records Schedule 4.1, Item 30 (DAA-GRS-2013-0002-0008) on agency records created and maintained relating to management of records and information including Vital or Essential Records.
Pre-exercise Preparation
10.6.3.9.1 (03-12-2020) Pre-exercise Preparation The evaluator must be familiar with the exercise objectives, scenario for discussion, and key evaluation areas and have: Reviewed appropriate plans, procedures, and protocols; Attended required evaluator training and other briefings; Reviewed appropriate exercise materials, including the exercise schedule and evaluator instructions.
Observing the Exercise
10.6.3.9.2 (03-12-2020) Observing the Exercise During the exercise the observer should listen closely to the players' discussion and take detailed notes relative to the assigned area of evaluation: The observer should be familiar with the activities and tasks for evaluation; The observer should not jump ahead to analysis until the exercise has ended; The observer should not prompt players with specific responses or interfere with player performance in any way. The primary duty is to document player discussion. After the exercise, that information will be used to determine whether the exercised objectives and plans were effectively demonstrated and to identify strengths and improvement items. Evaluators should not start to complete the evaluation form during this time.
Data Analysis
10.6.3.9.3 (03-21-2022) Data Analysis Following the exercise, owners should use notes and the participant feedback forms to develop the AAR/IP. In all IRS exercises, evaluators and players should provide copies of the forms to the exercise owners for the development of the AAR/IP. All players should completed these forms as they serve to identify strengths and areas for improvement for each activity. Below are some key reminders of evaluators: Participate in the Hot Wash, and take notes on findings identified by players. Before the Hot Wash, do not discuss specific issues or problems with participants; After the Hot Wash, summarize notes and prepare for the Evaluator Debrief. Have summary ready for the lead evaluator, if applicable; Use data to determine whether the exercise objectives and plans were effectively implemented or demonstrated; Use data to identify observations as strengths or areas for improvement.
After Action Report/Improvement Plan (AAR/IP) Development
10.6.3.9.4 (03-21-2022) After Action Report/Improvement Plan (AAR/IP) Development In this step, the detailed notes as well as the participant feedback forms from observing the exercise are provided to the exercise owners. At minimum the AAR/IP should contain detailed recommendations for continuous improvement of any issues identified. The exercise owners should use the data collected to develop the AAR/IP. The AAR/IP will document whether the exercise objectives and plans were effectively implemented or demonstrated; and identify observations as strengths or areas for improvement. Form 14572Test and Exercise After Action Report/Improvement Plan (AAR/IP) is the final exercise document that summarizes key exercise-related evaluation information. The length and format of AAR/IP depends on the exercise type and scope and is determined by the exercise planning team. Key elements of the AAR/IP include, but are not limited to: Exercise Summary: This includes the exercise objectives and capabilities; Exercise Overview: This includes identifying information, such as exercise name, date, duration, and participants; Exercise Scenario: This includes a summary of key scenario events; Observations, Strengths and Areas of Improvement: This includes an assessment of exercise performance in relation to exercise objectives and capabilities. It also highlights relevant areas for improvements, strengths, lessons learned, and gaps; Corrective Actions: This identifies specific corrective actions from the exercise, assigns these actions to responsible parties and establishes target dates for completion. NCPOCs are responsible for ensuring that AAR/IPs are completed for their BU SLTs. The plan owners, usually the ICs are responsible for ensuring that AAR/IPs are completed for their IFEs. Refer to the NARA approved disposition authority, General Records Schedule 4.1, Item 30 (DAA-GRS-2013-0002-0008) on agency records created and maintained relating to management of records and information including Vital or Essential Records. In both cases, within thirty calendar days of completing the exercise copies, of the Form 14572 Test and Exercise After Action Report/Improvement Plan (AAR/IP) should be submitted to the SCR-CO:CO Planning Team and the cos.scrco.continuity@irs.govSCR-CO:CO Continuity Mailbox identified on the form.
Supporting Documentation
10.6.3.10 (03-21-2022) Supporting Documentation The purpose of supporting documentation is to summarize key information related to each test and exercise. Supporting documentation should include strengths, observations, suggested improvements, and corrective actions. Applicable supporting documentation forms have been identified in relevant test and exercise sections of this IRM. Supporting documentation for continuity tests should be submitted within seven calendar days of completing the test to the SCR-CO:CO Planning Team and the cos.scrco.continuity@irs.gov SCR-CO:CO Continuity Mailbox identified on each form. Supporting documentation for continuity exercises should be submitted within thirty calendar days of completing the exercise to the SCR-CO:CO Planning Team and the cos.scrco.continuity@irs.gov SCR-CO:CO Continuity Mailbox identified on each form.
Corrective Actions for Tests and Exercises
10.6.3.10.1 (03-12-2020) Corrective Actions for Tests and Exercises FCD-1 requires that corrective actions identified during exercises are tracked to completion, ensuring that exercises yield tangible preparedness improvements. An effective corrective action program develops improvement plans that are dynamic documents, which are continually monitored and implemented as part of the larger system of improving preparedness. The IRS maintains a Corrective Action Plan (CAP), which includes deficiencies for both tests and exercises. The CAP must identify: Continuity deficiencies and/or other areas requiring improvement; Responsible parties and timelines for corrective action. SCR-CO is responsible for: Managing and tracking all corrective actions; Complying with all requirements described in SOP-FY18-CO-004 Test, Training, and Exercise Corrective Action Program or SOP-FY18-CO-004 Test, Training, and Exercise Corrective Action Program; Ensuring the Corrective Action Tracking Report is kept current by identifying delinquent or incomplete issues and following-up with the individual BUs; Maintaining a AAR/IP available for the Continuity Operations Program Manager upon request. This includes a listing of delinquent or incomplete corrective actions with aging information. NCPOCs and other Continuity Personnel are responsible for: Documenting Corrective Actions including expected completion dates on applicable supporting documents; Submitting supporting documentation timely; Monitoring the corrective action plan in partnership with BU NCPOCs and engage leadership as needed to elevate challenges and issues; Requesting extensions to corrective action completion dates, when necessary; Reporting the completion of corrective actions to the SCR-CO:CO Planning Team via email.
Source: official text