Internal Revenue Manual
IRM 10.6.7 — Emergency Notification System (AtHoc)
Part 10. Security, Privacy and Assurance
Chapter 6. Continuity Operations Section 7. Emergency Notification System (AtHoc) 10.6.7 Emergency Notification System (AtHoc) Manual Transmittal July 01, 2022 Purpose (1) This transmits new IRM 10.6.7 Emergency Notification System (AtHoc) Catalog Number 75036Y. Material Changes (1) This is a new IRM. Effect on Other Documents This supports processes in IRM 1.4.12 Senior Commissioner's Representatives Roles in Management of IRS Field and Headquarters Offices Audience IRM 10.6.7 applies to all involved in Emergency Management. Effective Date (07-01-2022) Pablo F. Meléndez Chief, Business Continuity Operations Officer, Deputy Chief of Staff Office C:CoS:DCoS
Program Scope and Objective
10.6.7.1 (07-01-2022) Program Scope and Objective Purpose: This IRM describes the AtHoc application, which is the system used for the IRS Emergency Alert Notification System (EANS) program. This is used to ensure employee security, safety, and accountability during any emergency. Audience. These procedures apply to IRS employees who are responsible for developing, implementing, and using this system including: Members of SCR Field Operations Members of Site Coordinator staffs in Campuses Members of SCR Continuity of Operations Other employees responsible or participating in emergency management. Policy Owner. The Deputy Chief of Staff Office of the Commissioner's Complex. Program Owner. The Director, Senior Commissioner's Representatives - Continuity of Operations within the Deputy Chief of Staff Office. Stakeholders. All IRS employees.
Background
10.6.7.1.1 (07-01-2022) Background AtHoc is the system designed for the EANS program for mass communication to end-users through text, email and/or phone call, and it also allows for end-user response. The system transmits to IRS computers and phones and allows end-users to specify their own personal devices on which to receive alert notifications. The EANS program has two processes which will be used: employee notification during an emergency situation and Continuity of Government Operations. Emergency Notification: The purpose is to provide a uniform, efficient, and comprehensive notification of emergency situations to IRS employees to ensure their safety; The AtHoc system allows consistent and appropriate messaging to ensure employees are informed about steps and procedures to ensure their safety. Continuity of Government Operations: The AtHoc system is used to notify members of the Commissioner's COOP Teams of Continuity of Government Readiness Conditions (COGCON) status changes. This system is designed for mass communication to IRS employees through text, email and/or phone call notifications and will be used to notify employees of security and emergency related matters in an expeditious manner.
Authority
10.6.7.1.2 (07-01-2022) Authority General Authority of SCRs: IRM 1.4.12Senior Commissioner's Representatives Roles in Management of IRS Field and Headquarters Offices. Specific Authority of SCRs for Emergency Management IRM 1.4.12.2.1Incident and Emergency Management. Agreement for the SCRs to handle large scale incidents at the campuses: Memorandum for Field Senior Commissioner's Representatives Wage and Investment Campus Stakeholders dated October 20, 2020.
Responsibilities:
10.6.7.1.3 (07-01-2022) Responsibilities: The Emergency Notification process has two categories of the Emergency Alert Notifications System users for the program: AtHoc Operations Team; End-users (all IRS employees). The Continuity of Governance Readiness Team consists of members of the Office of Continuity of Operations.
AtHoc Operations Team
10.6.7.1.3.1 (07-01-2022) AtHoc Operations Team Roles: Program Manager; Enterprise Administrators (SMEs); Area SMEs (including Campuses); Alert Publishers.
Program Manager
10.6.7.1.3.1.1 (07-01-2022) Program Manager Provides program administration to: Ensure adherence to IRS EANS policy statement; Conduct training on measures and analytics; Maintain metrics and reporting mechanisms to keep leadership (Field Office Manager and Director) informed of system operations and challenges; Act as liaison between IRS leadership, Department of Treasury, Operations team, and IT; Meet routinely with AtHoc operations team to monitor program management; Oversee and facilitates connection between operations team lead and emergency scripts team lead(s); Oversee User's Guide content and other operating procedures; Oversee day-to-day technical responsibilities. Develops communications strategies: Develop internal and external SCR-CO EANS communications, guidance, and education. System Responsibilities: Program Operations SME for technical issues (including system access and information quality). Program Responsibilities: Other technical operational aspects of the system such as troubleshooting and publishing messages Enterprise-wide.
Enterprise Administrators (SMEs)
10.6.7.1.3.1.2 (07-01-2022) Enterprise Administrators (SMEs) Provide oversight of day-to-day system functionality. Provide system security and testing. Act as liaison to Program Manager and IRS leadership. Ensure compliance with the IRS EANS policy. Are support Area SMEs for technical troubleshooting within the application. Act as the AtHoc operations and technical support subject matter expert. Provide access control (BEARS) approvals. Liaison with SCR area SMEs. Ensure approved scripts are uploaded and available to Publishers. Provide and oversee continuous training for SCRs and SMEs for maximum system performance; Will add Alert Publishers, AOs, and Campus Site Coordinators to the system.
Area SMEs (including Campus)
10.6.7.1.3.1.3 (07-01-2022) Area SMEs (including Campus) Serve as the primary point of contact within SCR areas for training, guidance, and support of Publishers and the SCR – including support of Campus Site Coordinator Publishers. Assist other SCR areas as needed with publishing or support. Send messages across multiple SCR areas (AOs also have this ability). Serve as liaison to Enterprise Administrators for technical systems guidance and support. Ensure area email distribution lists are current and submits changes to Enterprise Administrators. Validate removal and notify Enterprise SME of Alert Publisher separation. Conduct system testing as requested by the Program Manager. Program Responsibilities: All SCRs, Continuity, and AOs can publish alerts (including accountability option) on any of the SCR Area Virtual Private Systems (VPS) (Field, Campus, and Satellite Campus PODs); Campus Site Coordinator staff with alert publishing rights are limited to their respective campus and campus satellite PODs for sending alerts including the accountability option.
Alert Publishers
10.6.7.1.3.1.4 (07-01-2022) Alert Publishers SCRs and Administrative Officers send messages to all customers for their assigned area, but may assist other SCR areas or Campuses. Campus Site Coordinators and their approved staff send messages to Campus locations. Each alert publisher MUST notify their Area SME immediately when they no longer have alert publisher responsibility. Each alert publisher will also be required to submit a BEARS request to remove their own access when they no longer have alert publisher emergency response responsibilities. Generate alert notification analytical reports. Will analyze data from all alert message results at the close of the event.
Continuity of Government Readiness Team
10.6.7.1.3.2 (07-01-2022) Continuity of Government Readiness Team COOP Advance Team (CAT) will: Compose alert messages for Continuity of Government Readiness; Issue alert messages; All other activities listed in Annex N of the Headquarters COOP program (access restricted to members of the HQCOOP Team and SCR-CO:CO). Criminal Investigation (CI) will: Information in an AtHoc message may cause initiation of the transport of designated Executives of the HQCOOP.
Other Responsibilities
10.6.7.1.3.3 (07-01-2022) Other Responsibilities Senior Commissioner's Representatives (SCRs): Oversee area AtHoc implementation and usage in their area; Develop Emergency scripts in the AtHoc system; Approve alert notifications and off-script messages; Ensure accountability and the success of each objective; Information Technology: Is responsible for system and server maintenance; Provides systemic oversight. Office of the Chief Procurement Officer: Provides contract oversight. Department of Treasury: Provide Data Oversight from HR Connect uploaded into the IRS AtHoc system.
Alert Recipients
10.6.7.1.3.4 (07-01-2022) Alert Recipients Alert recipients must maintain current information in HRConnect for preferred notifications. This includes the option to specify which personal devices they prefer to receive messages. Employees should input temporary POD while in travel status; This is not limited to temporary POD; Employees may set a schedule for notifications. This use is NOT a violation of the PATH Act restrictions on personal email for business purposes. Alert recipients will adhere to AtHoc instructions as directed.
Program Management and Review
10.6.7.1.4 (07-01-2022) Program Management and Review Available reports: Alerts issued; Number of employees targeted; Name/organization of targeted employees; Categories of devices targeted; Response rate/non-response rate; Receipt acknowledgement with time; Other User Defined reports using available data from Alerts. All reports are available upon request and will be generated by the alert publisher. System downtime is available on the IT TIER II Report. This report is maintained by IT and can be used to measure system performance.
Program Control
10.6.7.1.5 (07-01-2022) Program Control Control of the AtHoc system is by regular system maintenance and testing. Control of the EANS Program is by: Regular testing of process; Familiarization of participants roles and responsibilities.
Terms
10.6.7.1.6 (07-01-2022) Terms Alert Publishers - Responsible parties to deliver emergency notification. Area SME - SMEs in Field Operations are responsible for local emergency notifications and troubleshooting for employees with field offices, and SMEs in the Campuses are responsible for local emergency notifications and troubleshooting for employees with campuses. AtHoc - System currently used for employee alert notification during an event. EANS – Emergency Alert Notification System. Enterprise Administrator - Assist with technical troubleshooting and keep current the lists of Posts of Duty.
Acronyms
10.6.7.1.7 (07-01-2022) Acronyms AO - Administrative Officers. BCO - Business Continuity Officer. BEARS - Business Entitlement Access Request System. COGCON - Continuity of Government Readiness Conditions. COOP - Continuity of Operations. CoS - Chief of Staff. EANS – Emergency Alert Notification System. HQCOOP - Headquarters COOP. POD - Post of Duty. SCR - Senior Commissioner's Representative. SCR-CO - Senior Commissioner's Representative-Continuity Operations program area. SCR-CO:FO - Senior Commissioner's Representative–Field Operations Branch. SCR-CO:CO - Senior Commissioner's Representative–Continuity of Operations Branch. SIP - Shelter-in-Place. SME - Subject Matter Experts. VPS - Virtual Private Systems.
Related Resources for End Users
10.6.7.1.8 (07-01-2022) Related Resources for End Users SCR Emergency Notification Scripts. Notification User Guide. Service Providers CyberGuide. AO Virtual Desk and Procedure Guide. Memorandum for Field Senior Commissioner's Representatives Wage and Investment Campus Stakeholders dated October 20, 2020 is the agreement for the SCRs to handle large scale incidents at the campuses. National Agreement (use most current version available). AtHoc Emergency Notification System.
System Overview
10.6.7.2 (07-01-2022) System Overview This system will communicate to IRS employees through text, email and/or phone call notifications and will be used to notify employees of security and emergency related matters in an expeditious manner. Employees are strongly encouraged to maintain accurate and up to date contact information to ensure receipt of emergency notifications from the Service. Employee contact data will be extrapolated from HR Connect. Alert Publishers are required to maintain the confidentiality of the data. The IRS Emergency Hotline is the responsibility of the business owner, Information Technology Services (IT), and will remain in place for emergency notifications.
Restrictions on Use
10.6.7.3 (07-01-2022) Restrictions on Use The system is restricted to be used for employee security, safety, and emergency situations that warrant the immediate distribution of information to all employees assigned to a specific building. Due to the nature and purpose of this system, its usage must be limited to security, safety, and emergency alert messages. SCR-CO has developed template messages to ensure consistency and quality. The SCR Emergency Notification Scripts provide examples of emergency situations such as Inclement Weather, Credible Threat, Active Shooter, Biological/Chemical Agent, Civil Disturbance, and possible directions (shelter in place (SIP), evacuation, all clear). Access to these scripts is limited to members of SCR-CO and Campus Site Coordinators. AtHoc is used during these situations. Continuity of Government Operations scripts are controlled by Continuity of Operations. Off-script, custom messages that do not address employee safety must be for unique situations and be approved by the SCR or the Campus Site Coordinator to ensure appropriate content and high quality. Usage not conforming to employee security, safety, and emergency situations must have prior approval by the Commissioner's Chief of Staff.
Notification in the National Capital Region
10.6.7.4 (07-01-2022) Notification in the National Capital Region In the National Capital Region, office closures will be initiated by Office of Personnel Management (OPM) for weather and other possible event. IRS will initiate office closures for issues specific to IRS facilities. In the field and campuses, IRS initiates office closure. In the National Capital Region, OPM maintains information on their own website, and Alert Publishers use this to generate an AtHoc message.
Emergency Employee Communication
10.6.7.4.1 (07-01-2022) Emergency Employee Communication This system is restricted to announce security and health related notifications regarding office status, such as full or partial day closures (delayed arrival, early dismissal). This is particularly helpful when an incident takes place after hours and may not be known to employees. Example: a water leak occurs at an office over the weekend and necessitates a delayed arrival announcement for Monday morning. On-site managers currently receive the same notifications as their employees. Remote managers must subscribe in AtHoc to receive the notifications for their remote employees. Further information is in the Alert Publisher Desk Guide. Home-as-POD employees will not receive building specific alerts, and must subscribe to PODs for which they wish to receive alerts. Those with Reasonable Accommodation or Hardship not assigned to a specific building will not receive building specific alerts unless they subscribe to those alerts. For travel purposes, employees may go into the AtHoc desktop application to receive messages for their temporary duty station. Contractors will not receive alert notification through AtHoc. To ensure contractor alert notifications from AtHoc, the Contracting Officers Technical Representatives (COTRs) must subscribe in the same way as a remote manager and must communicate to Project Managers. Further information is in the Alert Publisher Desk Guide. Employees who are traveling outside their area and want to receive alerts for the POD(s) they are visiting will need to subscribe to the temporary POD.
Continuity of Government Readiness Condition (COGCON)
10.6.7.5 (07-01-2022) Continuity of Government Readiness Condition (COGCON) The President of the United States alone determines and issues the COGCON Level. When the President directs a COGCON change, all executive departments and agencies are notified. The Continuity of Government Readiness Conditions (COGCON) system establishes executive branch readiness levels based on possible threats to the National Capital Region: COGCON 4: Federal executive branch government employees at their normal work locations. Maintain alternate facility and conduct periodic continuity readiness exercises. Continuity plan is fully operational within 12 hours; COGCON 3 Federal agencies and departments Advance Relocation Teams warm up their alternate sites and capabilities, which include testing communications and IT systems. Ensure that alternate facilities are prepared to receive continuity staff. Track agency leaders and successors daily. Continuity plan is fully operational within 8 hours; COGCON 2: Deployment of 50-75% of Emergency Relocation Group continuity staff to alternate locations. Establish their ability to conduct operations and prepare to perform their organization's essential functions in the event of a catastrophic emergency. Continuity plan is fully operational within 4 hours; COGCON 1: Full deployment of designated leadership and continuity staffs to perform the organization's essential functions from alternate facilities either because of, or in preparation for, a catastrophic emergency. Agency HQ continuity plan activated immediately and report operational status within 2 hours.
Required Notification Information
10.6.7.6 (07-01-2022) Required Notification Information All AtHoc notifications go to the employee's contact information as listed in HRConnect. Employees are required to update their contact information in HR Connect. Employee data will be uploaded into AtHoc daily (including weekends). AtHoc User Profiles are extracted into AtHoc from HR Connect: Employee Name and SEID; City, State, and Zip Code; Building Number; Department; Business Phone; Business Mobile Phone; Business Mobile Text; Business Email; Personal Email; Personal Mobile Phone; Personal Mobile Text. Employees may download the AtHoc app to their Government mobile devices and their personal cell phones. This is NOT a violation of the PATH Act restrictions on personal email for business purposes.
System Access
10.6.7.7 (07-01-2022) System Access Only employees responsible for building-wide communication of emergency information will be authorized to publish messages using this system. The AtHoc Program Manager will establish controls and program reviews that will ensure system security and establish the procedures by which these controls will be administered. These controls are necessary not only due to the nature of the communications being shared, but also due to the public domain transmission to personal devices, and access to employee's personal contact information. New users must request system access through BEARS. The AtHoc Operations Team will review the request, and issue training materials. When the training has been completed, the AtHoc Operations Team will approve access to AtHoc. The new user must certify the training is completed within 30 days or the BEARS request will need to be resubmitted. Questions regarding the use of AtHoc should be directed to the SCR-CO Field Operations Branch. The list of Publishers will be audited by the AtHoc Program Management Team on an annual basis to ensure only those who meet the necessary criteria have access to the system. The AtHoc Operations Team will require Publishers to review and certify annually the AtHoc User Guide and associated Interim Guidance AtHoc Usage and Policy to maintain access to the system.
Training
10.6.7.8 (07-01-2022) Training Alert Publishers will be required to take: End User Briefing for new Alert Publishers by the AtHoc Operations Team and/or Area SMEs before certification in BEARS; New users must take ITM Course 32294 Introduction to Continuity Planning within 30 days. This will be added to their Learning Plans in ITM; Annual Refresher Training conducted by the AtHoc Operations Team; Analyzing a Published Alert conducted by the AtHoc Operations Team; Accountability Training conducted by SCR-CO Continuity of Operations. Special topic seminars will be conducted by SCR-CO AtHoc Operations Team.
Testing
10.6.7.9 (07-01-2022) Testing Using the system for tests and drills reminds employees of the benefits/necessity of having messages sent to their personal devices. Three tests will take place during the fiscal year: Alert Publishers will participate in practice sessions annually by sending messages internally to other publishers rather than to end-users; Each SCR and Campus Site Coordinator will conduct one test to include all field and campus locations; AtHoc Program Management Team will conduct one Enterprise-wide test annually. The AtHoc system is used in the performance of emergency drills (SIP, evacuation). These drill messages must be followed by a corresponding "All Clear" message to conclude the event. Following the conclusion of the test, each test administrator will submit successful completion numbers to the Program Manager along with any issues which must be resolved. SCRs have the discretion to conduct more testing as needed.
Links for Procedures
10.6.7.10 (07-01-2022) Links for Procedures AtHoc Emergency Notification System is the general information page for all employees on IRS Source. SCR Emergency Notification Scripts for SCRs and delegated officers for emergency notification only. Service Providers CyberGuide for SCR Field Operations, FMSS, and IT for cross-functional activities. Alert Publisher Desk Guide for publishers (SCRs, AOs, and Site Coordinators). AO Virtual Desk and Procedure Guide for SCRs and AOs only, and covers all general procedures including those that may be covered by AtHoc.
Source: official text