National Biodefense Strategy: Additional Efforts Would Enhance Likelihood of Effective Implementation

GAO has reported on the inherent fragmented nature of the federal and nonfederal resources needed to protect the nation from potentially catastrophic biological threats. GAO called for a strategic approach to help the federal government better leverage resources and manage risk The White House issued the National Biodefense Strategy and the Presidential Memorandum on the Support for National Biodefense to promote a more efficient and coordinated biodefense enterprise.

The National Defense Authorization Act for Fiscal Year 2017 included a provision that GAO review the strategy. This report addresses the extent to which the Strategy and implementation efforts are designed to enhance national biodefense capabilities and any implementation challenges that exist.

GAO analyzed the Strategy, plans, and NSPM-14, and compared them to selected characteristics of GAO's work on effective national strategies, enterprise risk management, organizational transformation, and interagency coordination. GAO interviewed officials from the eight federal agencies that comprised the Biodefense Steering Committee to learn about early implementation.

Issued in September 2018, the National Biodefense Strategy (Strategy) and implementation plan, along with National Security Presidential Memorandum-14 (NSPM-14), are designed to enhance national biodefense capabilities. NSPM-14 established a governance structure composed of relevant federal agencies and chaired by the Secretary of Health and Human Services (HHS) to guide implementation. It also required federal agencies with biodefense responsibilities to collect and assess data on their biodefense activities to, among other things, identify gaps. The Strategy defined the scope of the biodefense enterprise (which includes partners at all levels of government and the private sector) and brought all of the biological threats—intentional, accidental, and naturally-occurring—together, establishing an overarching vision, goals, and objectives.

There are a number of challenges, however, that could limit long-term implementation success. Among other things, there was no documented methodology or guidance for how data are to be analyzed to help the enterprise identify gaps and opportunities to leverage resources, including no guidance on how nonfederal capabilities are to be accounted for in the analysis. Many of the resources that compose national capbilities are not federal, so enterprise-wide assessment efforts should account for nonfederal capabilities.

Agency officials were also unsure how decisions would be made, especially if addressing gaps or opportunties to leverage resources involved redirecting resources across agency boundaries. Although HHS officials pointed to existing processes and directives for interagency decision making, GAO found there are no clear, detailed processes, roles, and responsibilities for joint decision-making, including how agencies will identify opportunities to leverage resources or who will make and enforce those decisions. As a result, questions remain about how this first-year effort to catalogue all existing activities will result in a decision-making approach that involves jointly defining and managing risk at the enterprise level. Without clearly documented methods, guidance, processes, and roles and responsibilities for enterprise-wide decision-making, the effort runs the risk of failing to move away from traditional mission stovepipes toward a strategic enterprise-wide approach that meaningfuly enhances national capabilities.

GAO is making four recommendations to the Secretary of HHS, including working with other agencies to document methods for analysis and the processes, roles, and responsibilities for enterprise-wide decision making. HHS concurred with all the recommendations and described steps to implement them.

Catastrophic biological threats highlight the inextricable link between  security and public health concerns. These threats—whether naturally  occurring, intentional, or accidental—have the potential to cause loss of  life and sustained damage to the economy, societal stability, and global  security. For example, the unpredictable nature of naturally-occurring  disease poses threats to human and animal health and agricultural  security. Further, while the revolution in biotechnology presents  opportunities to advance the life sciences, that same technology in the  wrong hands could be used to create crippling biological weapons.

Because the biological threat landscape is vast, it requires a  multidisciplinary, enterprise-wide approach. The nation’s biodefense  capabilities consist of all efforts to counter biological threats, reduce risks,  and prepare for, respond to, and recover from biological incidents that  could have catastrophic consequences. We have reported on the inherent  fragmented nature of the biodefense enterprise and long-standing  challenges to building and maintaining the nation’s biological defense  capabilities that transcend what any one federal department or agency  can address on its own. Responding to the ever-changing nature and  broad array of biological threats often entails developing new  technologies and approaches and making decisions about how to apply  limited resources to achieve the best benefit. We have called for a more  strategic approach to guiding the systematic identification of risks,  assessing resources needed to address those risks; and prioritizing and  allocating investment across the biodefense enterprise.

Since March 2011, we have reported that the biodefense enterprise  would benefit from institutionalized leadership with sufficient time,  responsibility, authority, and resources needed to promote efficiency and  accountability. Similarly, so that this leadership can help to ensure that  federal programs are well coordinated, and that gaps and duplication in  capabilities are avoided, we have called for a strategy that helps ensure  that plans and actions across various biodefense functions are cohesive,  compatible, and mutually reinforcing.

Signed into law on December 23, 2016, the National Defense  Authorization Act for Fiscal Year 2017 (NDAA) required the Departments  of Defense (DOD), Health and Human Services (HHS), Homeland  Security (DHS), and Agriculture (USDA) to jointly develop a national  biodefense strategy and associated implementation plan.

On September 18, 2018, the White House issued the National Biodefense  Strategy (Strategy). On the same day, the President issued the  Presidential Memorandum on the Support for National  Biodefense/National Security Presidential Memorandum-14 (NSPM-14),  which provides a governance structure to guide the Strategy’s  implementation.

The NDAA included a provision that we review the Strategy and  implementation plan to analyze gaps and resources mapped against the  requirements of the Strategy and existing United States biodefense policy  documents. In response to that provision, we briefed committees of  concern (as identified in the NDAA) in March 2019 on the extent to which  the Strategy addressed each of the requirements outlined in the NDAA.  We found the National Biodefense Strategy and associated plans  generally addressed most of the requirements at that time, and agencies  continued to develop additional key components. Our March 2019  findings are summarized in appendix I along with a description of the  methods we used to perform that review.

This report addresses the extent to which the National Biodefense  Strategy and related implementation efforts are designed to allow an  enterprise-wide approach to leveraging and enhancing national  biodefense capabilities and identifies any challenges with early  implementation.

The scope of this work included the Strategy implementation efforts of  HHS, DOD, USDA, and DHS; the Departments of State, Justice  (specifically the Federal Bureau of Investigation), and Veterans Affairs  (VA); as well as the Environmental Protection Agency (EPA). We selected  these eight agencies because they were explicitly identified in NSPM-14  as members of the Biodefense Steering Committee, and because based  on our prior work, they are the agencies with the largest stake in carrying  out biodefense efforts from a homeland security and national security  perspective.

To determine the extent to which the National Biodefense Strategy and  associated plans are designed to allow an enterprise-wide approach to  leveraging and enhancing national biodefense capabilities and to identify  any challenges with early implementation, we analyzed the Strategy and  plans, reviewed agency products created in response to requirements set  forth in NSPM-14, reviewed our prior work on long-standing biodefense  challenges, and solicited perspectives from key officials in the eight  agencies named above. To solicit those perspectives, we conducted two  rounds of interviews, employing both unstructured and structured  interview techniques and collected additional written follow-up  documentation. We asked questions about the roles of various groups  involved in implementing the Strategy, successes and positive  experiences with the early implementation, any challenges that could  affect the Strategy’s implementation, and the magnitude and prevalence  of challenges we and the agency officials had identified.

We also reviewed our prior work on biodefense challenges to identify  issues that may limit the Strategy’s success or be key areas that the  Strategy must address, such as engaging all key stakeholders, guiding  the systematic identification of risk, identifying resources needed to  address those risks, and providing a structure to prioritize and allocate  resources. As part of our interviews with officials from the eight agencies,  we also asked what, if any, actions have been identified or implemented  to mitigate challenges.

We interviewed Office of Management and Budget (OMB) staff for  additional information on OMB’s role in developing and implementing the  Strategy based on their role outlined in NSPM-14 regarding the budget.  We also communicated our research objectives and preliminary findings  to staff at the National Security Council within the White House, but were  not able to directly interview subject matter experts there.

We compared the Strategy and associated plans to our prior work on  desirable characteristics of national strategies, and to selected leading  practices on organizational transformations, interagency collaboration,  and enterprise risk management. We selected leading practices—such as  clarifying roles and responsibilities, documenting policies and procedures,  identifying resources to help facilitate collaboration, and identifying and  assessing risk—that were most relevant to helping the multidisciplinary  biodefense enterprise bridge organizational cultures and make enterprise- wide risk-based decisions effectively. We also referred to our prior work  calling for a biodefense strategy. Specifically, we assessed the Strategy,  NSPM-14, and information collected from the eight agencies against  leading practices in government transformation, interagency coordination,  and enterprise risk management to determine whether sufficient  mechanisms were established and roles and responsibilities were  delineated to help enable enterprise-wide decision-making. Further, we  assessed the Strategy and NSPM-14 against our prior work on national  strategies and prior call for a biodefense strategy to determine the extent  to which the current efforts reflected characteristics that would lead to the  effective and efficient use of resources across the biodefense enterprise.

We conducted this performance audit from October 2018 to February  2020 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

The Vast and Constantly Evolving Biological Threats

Cultivating a strong biological defense requires an understanding of a  multitude of biological threats. The nature of these threats can be  intentional, naturally occurring, or accidental and can be exacerbated by  changes in behavior and environment. The vast and evolving biological  threat landscape includes threats of biological warfare, bioterrorism,  infectious disease threats to humans and animals, crop failure, and safety  and security lapses at facilities that house biological threat agents.

The use of biological weapons or their proliferation by state or non-state  actors presents a significant challenge to our national security, our  population, our agriculture, the economy, and the environment. Despite  ratification of the Biological Weapons Convention in 1975 and the end of  the Cold War decades later, the threat of biological warfare persists  today. For example, the State Department reported in 2019 that China,  Iran, North Korea, Russia, and Syria continue to engage in dual-use or  biological weapons-specific activities.

Additionally, the biotechnology revolution presents opportunities to  advance the life sciences, yet that same technology in the wrong hands  could be used to catastrophic effect. For example, synthetic biology may  lead to advances in public health, such as the development of biosensors  that can permanently reside in the body to detect and treat abnormalities  such as cancer. However, if used to create and combine agents to create  biological weapons, synthetic biology poses a significant threat. Finally,  non-state actors such as terrorist organizations, domestic militia groups,  and “lone wolves” have both the interest and, in some cases, the limited  capacity to develop biological weapons.

Biological threats can be unpredictable, as humans, animals, and plants  are vulnerable to a variety of naturally occurring infectious disease and  pest threats. Urbanization, habitat encroachment, and increased and  faster travel, coupled with weak health systems, increase the risk of  infectious diseases to spread rapidly across the globe. Pandemic  influenza presents a constant threat to global public health and  exemplifies the susceptibility of humans to diseases with animal origins.  For example, in 2009 when an H1N1 influenza virus emerged with a new  combination of genes from swine, avian, and human influenza viruses, it  demonstrated how the genetic compositions of some viruses naturally  change, meaning most people have little or no immunity to the new virus.  In 2009, this led to a global pandemic with a novel H1N1 influenza virus  (see fig.1). Other examples of zoonotic disease threats—infectious  diseases that are transmissible from animals to humans—include Ebola,  Zika, and Eastern Equine Encephalitis.

Biological threats may also arise from changes in human behaviors.  Habitat loss and human encroachment on rural and wildlife environments  are bringing populations of humans and animals into closer and more  frequent contact. These changing relationships with animals increase the  risk of disease transmission among people, pets, livestock, and wildlife.  Other changes in human behavior—such as vaccine hesitancy, mass  migration, and conflict—put stress on health care systems around the  world. In an ever increasing interconnected world, building biological  defenses globally can help maintain health security domestically, because  a disease threat anywhere is a disease threat everywhere.

Biodefense capabilities are also needed to address changes in the  environment which have the potential to negatively affect human health  and the agriculture industry. As we reported in October 2015, climate  change may contribute to the spread of vector-borne diseases that are  transmitted to humans by animals, including invertebrate animals such as  mosquitoes and ticks. Additionally, extreme climate conditions, such as  sustained drought and heat waves can affect crops and livestock, and  excess precipitation can also increase flooding events and erosion, and  decrease soil quality. Losses of livestock and crops from the biological  threats of disease, pests, or extreme climate conditions could have  devastating effects on trade and the national economy.

Finally, in many countries around the world, pathogens are stored in  laboratories that lack appropriate biosecurity measures where they could  be diverted by actors who wish to do harm. Advances in science and  technology bring revolutionary cures and progress, but they also have the  potential to facilitate intentional misuse. As we reported in 2016, some  laboratories do not have appropriate biocontainment or biosafety  protocols. These shortfalls could lead to outbreaks through laboratory  acquired infections or pathogens accidently being released into the  environment.

GAO’s Prior Work on Biodefense-Related Challenges and Enterprise Risk Management

We have previously reported on a wide range of biodefense-related  efforts carried out by multiple federal departments and agencies. Since  2009, we have identified broad, cross-cutting issues in leadership,  coordination, and collaboration that arise from fragmentation throughout  the complex interagency, intergovernmental, and intersectoral biodefense  enterprise. For example, our past work has identified a number of key  challenges related to the nation’s ability to detect and respond to  biological incidents that transcend what any one agency can address on  its own. They include: (1) assessing enterprise-wide threats, (2)  determining optimal biodetection technologies, (3) building and  maintaining emerging infectious disease surveillance, (4) establishing  situational awareness and data integration, and (5) enhancing biological  laboratory safety and security. (Additional detail on these challenges and  our related reports is presented in appendix II.) The complexity and  fragmentation of roles and responsibilities across numerous federal and  nonfederal entities presents challenges to ensuring efficiency and  effectiveness across the entire biodefense enterprise. We called for a  national biodefense strategy and focused leadership because addressing  these issues is a difficult and complex challenge that crosses mission  areas, federal departments, and sectors.

Additionally, we have reported on enterprise risk management principles  that can support enterprise-wide decision-making under complex and  uncertain conditions. Enterprise risk management is a strategy for  helping policymakers make decisions about assessing risks, allocating  resources, and taking actions under conditions of uncertainty. While  often applied at an agency level, we have also recognized that the size  and complexity of certain issues, such as homeland security, involves  multiple partners which can add another degree of difficulty to enterprise  risk management. For certain areas, like biodefense, where activities cut  across multiple federal and nonfederal entities, applying enterprise risk  management principles becomes more challenging, but equally important  to help ensure the responsible parties can make decisions that help to  ensure effectiveness and maximize opportunities to better manage risk.

Enterprise risk management in the larger interagency and  intergovernmental context does not replace what each agency needs to  do to pursue its own core missions. Rather, it allows agency decision makers to consider their missions and the alternatives they have to meet  them from an enterprise-wide perspective. In this manner, decision  makers can consider the risk-reduction contributions their actions make to  the larger enterprise—for example by selecting alternatives that meet  their immediate needs and provide collateral benefits to some other part  of the enterprise—as one of many factors in individual agency decision- making.

National Biodefense Strategy and National Security Presidential Memorandum-14

On September 18, 2018, the White House released the National  Biodefense Strategy and characterized it as a new direction to protect the  nation against biological threats and that its implementation would  promote a more efficient, coordinated, and accountable biodefense  enterprise. The Strategy’s five high-level goals are to help enable the  efficient assessment, prevention, preparation, response, and recovery  from natural, accidental, or deliberate biological threats. When the  National Biodefense Strategy was released, the White House issued  NSPM-14: Presidential Memorandum on the Support for National  Biodefense. According to the Strategy, NSPM-14 “creates a dedicated  mechanism, housed within the U.S. Department of Health and Human  Services, to coordinate federal biodefense activities and assess the  effectiveness with which the National Biodefense Strategy’s goals and  objectives are being met.”

NSPM-14 details a governance structure and implementation process to  achieve the Strategy’s goals. The governance structure includes the  creation of a Biodefense Steering Committee chaired by the Secretary of  HHS, and includes seven other agency heads as members: the Attorney  General, the Secretaries from the Departments of State and VA, DOD,  USDA, and DHS, and the Administrator of the EPA. Additionally, NSPM- 14 required the formation of a Biodefense Coordination Team to assist  the Biodefense Steering Committee in carrying out its responsibilities.  Administratively located within HHS, the Biodefense Coordination Team  consists of staff from multiple agencies with biodefense responsibilities  and is designed to assist the Biodefense Steering Committee in  monitoring and coordinating implementation of the Strategy (see fig.2).  The Biodefense Coordination Team may convene working groups and  maintain awareness of biodefense activities across the biodefense  enterprise and has responsibility for establishing policies, processes, and  procedures to govern its activities, subject to the approval from the  Biodefense Steering Committee. NSPM-14 also establishes that the  Assistant to the President for National Security Affairs will serve as the  lead for policy coordination and review, providing strategic input and  policy integration for federal biodefense efforts.

NSPM-14 also outlines an implementation process, which sets  requirements and deadlines for the interagency group to achieve the  Strategy’s goals and also requires the heads of agencies identified by the  Biodefense Steering Committee as having responsibilities pertaining to  biodefense to review the Strategy every 2 years, and revise as  appropriate.

Strategy-Related Efforts Are Designed to Support an Enterprise-Wide Approach, but Implementation Challenges Could Limit Long-term Success

The National Biodefense Strategy and associated plans bring together all  the key elements of federal biodefense capabilities, which presents an  opportunity to identify gaps and consider enterprise-wide risk and  resources for investment trade-off decisions. However, challenges with  planning to manage change, limited guidance and methods for analyzing  capabilities, and lack of clarity about decision-making processes, roles,  and responsibilities while adapting to a new enterprise-wide approach  could limit the success of the Strategy’s implementation.

The Strategy and Associated Plans Create a Framework to Assess Enterprise-Wide National Biodefense Capabilities for the First Time

The National Biodefense Strategy and its associated plans bring together  the efforts of federal agencies with significant biodefense roles,  responsibilities, and resources to address intentional, accidental, and  naturally-occurring threats. The Strategy and plans also provide  processes for collecting and analyzing comprehensive information across  the enterprise, an important step toward the kind of enterprise-wide  strategic decision-making we have called for.

For example, our prior work identified the need for a strategy to help  ensure efficiency and effectiveness across the entire biodefense  enterprise by connecting strategic approaches and investment decisions  across disparate but interrelated functions within the biodefense  enterprise. These functions are (1) understanding and defining threats,  (2) taking action to prevent and protect against attacks and significant  national and international infectious disease outbreaks, (3) employing  new and existing techniques and technologies to more quickly detect  biological events, and (4) preparing to respond and recover.

Consistent with characteristics of national strategies and leading practices  for interagency collaboration, the National Biodefense Strategy clearly  articulates the purpose of the Strategy and the scope of the problem, as  well as high-level goals and objectives to guide implementation. As  shown in Figure 3, the Strategy’s five high-level goals comprise a new  framework that incorporates the distinct biodefense functional areas and  includes the different sources of biological threat—accidental, intentional,  and naturally occurring. It is within this framework that national  biodefense capabilities will be assessed across the enterprise.

According to the Strategy, its aim is to bring together a single,  coordinated effort to orchestrate activities across the United States  Government to protect the American people from biological threats. The  Strategy defines the term “biothreat” broadly to include all sources of  major catastrophic risk, including naturally occurring biological threats, the  accidental release of pathogens, and the deliberate use of biological  weapons. Officials from three of the eight participating agencies that we  interviewed noted that this is the first time that the federal government  has identified activities across the whole biodefense enterprise and  assessed resources and gaps to address multiple sources of threat  regardless of source (naturally occurring, accidental, or intentional).

The Strategy also established common terminology, giving the agencies a  shared basis for identifying biodefense-related programs and activities,  which is consistent with our national strategy criteria and our leading  collaboration practices. Developing common terminology can help to  bridge organizational cultures when multiple agencies with varying  missions work together for a common purpose. The Strategy also  contains goals, objectives, and over 240 separate activities that cover the  range of actions that comprise national biodefense capabilities, which  provides a high-level framework to begin to guide agencies toward a  shared vision for outcomes.

NSPM-14 Established Processes to Help Agencies Identify Gaps and Set Budget Priorities

While the Strategy outlined high-level goals and objectives to help define  priorities, NSPM-14 established a structure and process by which the  federal agencies can assess enterprise-wide biodefense capabilities and  needs, and subsequently develop guidance to help inform agency budget  submissions. NSPM-14 lays out, in broad strokes, a process to identify  biodefense efforts and assess how current resources support the  Strategy, how existing programs and resources could better align with the  Strategy, and how additional resources, if available, could be applied to  support the goals of the Strategy. As shown in figure 4, this process  begins through a data call with participating agencies documenting all  biodefense programs, projects, and activities within their purview in a  biodefense memorandum.

As part of this process, NSPM-14 calls for the Biodefense Coordination  Team, in coordination with NSC staff through the NSPM-4 process, to  develop and collectively agree on metrics, milestones, and end-states  and roles and responsibilities. For each of the objectives within the  Strategy where agencies have roles and responsibilities, HHS directed  participating agencies, as part of a data call, to identify any resource,  authority, policy, science and technology, or coordination gaps against  those end states and propose solutions where needed. As outlined in  NSPM-14, the Biodefense Coordination Team is then to use the  information submitted by the individual agencies to identify gaps, shortfalls, redundancies, and challenges across the enterprise. Finally,  NSPM-14 directs officials with biodefense responsibilities to create joint  policy guidance in coordination with the Assistant to the President for  National Security Affairs through the NSPM-4 process—to be updated on  an annual basis—that can help guide individual agency budget  submissions.

The process outlined in NSPM-14 is intended to lead to a cross- government assessment of federal biodefense capabilities and is  consistent with our past calls for a strategy that can guide investment  across the whole enterprise and with leading practices for interagency  collaboration and enterprise risk management. We have previously  reported that defining shared outcomes—and processes by which to  achieve them—and developing mechanisms to monitor and evaluate  results can reinforce accountability for collaborative efforts. Working  together to develop a set of draft metrics, milestones, and end-states  requires interagency participants to establish a shared vision for  outcomes, and metrics and milestones serve as accountability  mechanisms.

NSPM-14 describes how agencies will consider the agreed upon joint  policy guidance developed by agencies with biodefense responsibilities  and the White House when developing their budgets. Specifically,  according to NSPM-14, these agencies shall include in their respective  annual budget requests to OMB information on the programs within the  budget requests that support the implementation of the Strategy and  conform to budget formulation requirements established by OMB,  including specified funding levels.

Establishing goals, objectives, and desired end states that cut across the  federal government also create a foundation for effective enterprise risk  management. As we have previously reported, a shared understanding of  the scope of the risks enables leaders across the enterprise to align  agency goals and objectives and consider their own missions and  purposes within a more expansive and comprehensive understanding of  threats and opportunities.

In our interviews, officials from participating agencies stated that the  NSPM-14 processes constitute a new approach to identifying gaps and  setting budget priorities for biodefense, and that they viewed the  approach as generally well designed. Specifically, officials from six of the  eight participating agencies said that the process for identifying gaps was  somewhat well-designed. Officials from the other two participating  agencies said that this process was very well-designed. Agency officials  provided several reasons for optimism about the Strategy and the  processes outlined in NSPM-14, including that:

They provide a holistic picture of current biodefense programs and  activities, which creates government-wide visibility so that gaps can  be identified.

They create a forum to discuss potential gaps and biodefense  responsibilities, which has not existed previously.

They contain a strong overarching architecture to map existing efforts,  identify gaps, and inform future revisions (as necessary).

Additionally, agency officials said that the assessment and joint policy  guidance development process outlined in NSPM-14 offered some  promise for helping agencies identify the resources necessary to achieve  the Strategy’s goals, which is consistent with our national strategy criteria.  Specifically, officials from five of the eight agencies said the process is  somewhat well-designed to accomplish these goals. Officials from the  other three agencies said the process is very well-designed to ensure the  appropriate identification of resources and investments necessary to  achieve the goals outlined in the Strategy. For example, officials from  three agencies said it would help the implementation of the Strategy  succeed where previous efforts failed because it is designed to allow the  Strategy’s priorities to drive budget decisions.

However, officials from all of the agencies we interviewed, even those  with the most optimistic views on the leadership and governance structure  design, tempered their responses with the caveat that implementation is  in such early stages that it remains to be seen how effective these  structures will actually be once tested.

Implementation Challenges Could Hinder Enterprise-Wide Biodefense Efforts

Although the Strategy and associated plans establish the foundation for  enterprise risk management, in particular by bringing together all of the  functional biodefense areas across different sources of threat, we and  biodefense agency officials identified multiple challenges that could affect  the Strategy’s implementation. These include challenges individual  agencies faced during the initial data collection process as well as a lack  of planning and guidance to support an enterprise-wide approach. In our  analyses and interviews, we found that parts of the process in the first  year were underdeveloped, raising questions about (1) the plans to  support change management practices and ensure that early- implementation limitations do not become institutionalized in future years’  efforts; (2) guidance and methods for meaningfully analyzing the data;  and (3) the clarity of decision-making processes, roles, and  responsibilities.

Challenges with Adapting to New Processes May Have Led to Incomplete Data Collection

During our interviews, agency officials reported challenges they faced in  the first-year’s data collection effort with (1) staffing and organizational  resources within individual agencies, (2) quantifying biodefense activities,  and (3) technology glitches. These challenges may have led to  incomplete data collection, but are not wholly unexpected given they  occurred in the context of adapting to cultural change that this kind of  enterprise-wide approach to managing risk represents, while  implementing new processes and procedures. We have previously  reported that leaders of successful transformations seek to learn from  best practices and create a set of systems and processes that are tailored  to the specific needs and circumstances of the new organization.  However, the agencies involved in implementing the Strategy do not have  a plan that includes change management practices that can help prevent  these challenges from being carried forward into future efforts, and help  reinforce enterprise-wide approaches, among other things.

Staffing and organizational resources. During our interviews, one  challenge that arose involved having the personnel and expertise needed  to complete the initial effort to document biodefense programs, projects,  and activities. For example, officials from one agency told us that this  data collection effort was especially challenging because policy and  program managers were responsible for determining both programmatic  and budgetary information, which exceeded their expertise. This agency  ultimately had to bring in non-biodefense personnel—including from the  comptroller’s office—to identify programs and resources to complete the  information request. Officials from three of the eight agencies stated that  staffing and organizational resource limitations also posed a challenge to  the data collection process. For example, officials from one agency said  that the agency does not have full-time staff assigned to the effort.

Instead, it was seen as a collateral duty competing with regular priorities,  which reduced the time devoted to identifying the necessary information.

Quantifying biodefense activities. Officials we interviewed also  highlighted the challenge of quantifying biodefense-related activities.  Specifically, officials from four agencies noted that agencies without  specific biodefense line items in their budgets have had difficulty fully  quantifying how much their agency invests in biodefense-related  activities. To help agencies attempt to capture and quantify this  information in a consistent way, the Biodefense Coordination Team  developed guidance to assist agencies in estimating the percentage of  their chemical-biological-radiological-nuclear (CBRN) defense, all- hazards preparedness, and agriculture programs and activities, among  others, that are specifically related to biodefense. Nevertheless, officials  from two agencies said that distinguishing the biodefense-specific  activities within their CBRN defense or all-hazards activities and budgets  was inherently challenging, which in turn required officials to invest  additional staff and time into the effort.

Technology glitches. Officials we interviewed also cited challenges with  the technology used to collect data. For example, officials from two  agencies said that they had experienced glitches with the OMB Max  Information System, which the Biodefense Coordination Team guidance  directed them to use for the data collection effort. They stated that the  technology issues prevented them from entering biodefense budget  numbers in a timely manner. Officials noted that an integrated platform  dedicated to biodefense enterprise needs would enhance their  collaboration, which is consistent with our work on interagency  collaboration that states technology is one means of establishing  compatible processes for working across interagency boundaries. HHS  officials are aware of the technology challenges and said they are  collecting feedback and identifying ways to improve the data collection  and analytical tool for future data collection efforts.

These challenges with resources, identification of budget activities, and  technology occurred in the context of the individual agencies and officials  adapting to new procedures and a broader cultural shift from how they  have approached their biodefense missions in the past. Officials told us  that because of the learning involved the first time through the process  and the 2018 government shutdown, coupled with the tight time frames  set forth in NSPM-14, agencies may not have submitted complete or  detailed information about their biodefense programs. For example,  officials at one large agency told us they treated the first year as a  learning experience and that in the coming years, when agencies have  sufficient time to respond to the data call, the quality of the data submitted  should improve.

Some officials we interviewed voiced concern that this first-year effort  could set a poor precedent for these activities in future years if the  challenges are not acknowledged and addressed. For example, an official  noted that committing to the first-year’s results as the “baseline” for future  years of the Strategy’s implementation could compound or institutionalize  the issues encountered in the first year. Officials cautioned against a  “garbage in, garbage out” situation, meaning the output of any analysis  would only be as good as the quality of the data fed into that analysis. As  agency officials described their data collection efforts, it was clear to them  that the focus was on meeting the time frames established in NSPM-14 to  identify existing biodefense efforts in this first year and that not all  processes had been fully developed prior to the data collection effort.  OMB staff acknowledged that there were challenges in the first year’s  data collection effort, and said data quality would likely improve in future  years as agencies adjust their internal structures to suit the demands of  the NSPM-14 process. Officials from HHS and OMB staff stressed that  this process will be iterative, with the first year being primarily about  outlining the existing biodefense landscape.

Our prior work on organizational transformations states that incorporating  change management practices improves the likelihood of successful  reforms and notes that it is important to recognize agency cultural factors  that can either help or inhibit reform efforts. We have also reported that  identifying cultural features of the originating components, prior to, or  early on, in the transformation process, can help leadership gain a better  understanding of their beliefs and values. Incorporating this type of  change management practice can help educate agencies to better  understand the varying missions and how those missions support the  broader enterprise-wide effort. We have also noted the importance of  communication and obtaining feedback from participants to help promote  ownership for the transformation. This type of approach to managing  risk across a multi-agency, multi-sectoral enterprise like biodefense is  complex and novel. During our interviews, agency officials recognized a  need for change management practices to support this effort in future  years. Agency officials we interviewed noted that the process for the  identification of biodefense resources and activities across the federal  government outlined by NSPM-14 could be “transformational” for the  biodefense enterprise and approached the data collection process in  good faith, but said that it will take time to get right.

The biodefense agencies are currently assessing the activities and  challenges of the first year of implementation, and they plan to develop an  after action report on lessons learned. HHS has conducted a survey and  interviews to collect information and the material is being analyzed, but  the lessons learned document is not yet final. HHS has not worked with  the other biodefense agencies, however, to undertake an intentional effort  to manage key cultural aspects of the enterprise-wide approach—such as  communication and education mechanisms to help bridge organizational  cultures, promote ownership of the transformation, and emphasize  awareness of joint national security responsibilities. Further, HHS has not  worked with the other biodefense agencies to establish feedback and  monitoring mechanisms or processes, that can help identify  implementation challenges and develop solutions to address those  challenges, particularly early implementation issues that might threaten  the efficacy of the effort if they are institutionalized going forward.

A systematically developed plan for managing change could help ensure  effective planning to sustain and advance transformation in the early  years. Such a plan could address (1) institutionalizing learning and  feedback mechanisms that allow for corrective action and ensure that  issues that arise in early implementation—for example, incomplete or  unreliable data—do not become entrenched in a way that plagues the  future years’ efforts; and (2) establishing a communication and education  strategy to reinforce collaborative behaviors, enterprise-wide approaches,  and to emphasize accountability for shared national security missions,  outcomes, and procedures.

The Strategy Implementation Efforts Lack Clear Methods Guidance, and Lack Plans to Help Ensure the Ability to Perform Meaningful Analysis

We found a lack of clear procedures and planning to help ensure that the  Biodefense Coordination Team is prepared to analyze the data, once it  has been collected, in a way that that leads to recognition of meaningful  opportunities to leverage resources in efforts to maintain and advance  national biodefence capabilities. In particular, HHS (1) has not  documented guidance and methods for analyzing the data, including but  not limited to methods and guidance for how to account for the  contribution of nonfederal capabilities; and (2) does not have a resource  plan for staffing and sustaining ongoing efforts.

Methods and guidance for analyzing data. We found that the  processes for the Biodefense Coordination Team to analyze the results of  all the individual agency data submissions and identify priorities to guide  resource allocation were not agreed upon or documented prior to the  agency efforts and continue to lack specificity and transparency. At the  time of our interviews, agency officials were in the midst of compiling and  assigning budget numbers to their programs, projects, and activities.  Officials we spoke with expressed uncertainty about how the information  would be used. For example, officials from four agencies said they were  uncertain about fundamental elements of the implementation process,  including how information gathered will be used to identify gaps and set  priorities.

The overarching purpose of the analysis described in NSPM-14 is  identification of gaps, shortfalls, and redundancies to support the goals  and objectives of the Strategy. However, NSPM-14 does not specifically  articulate what is meant by these terms. In response to our question  about how the analysis was to be conducted, the Office of the Assistant  Secretary for Preparedness and Response—the HHS office responsible  for leading the Biodefense Coordination Team—described a general  process that reflects the high-level description laid out in NSPM-14. HHS  officials also stated that the Biodefense Coordination Team had consulted  with experts in budget, planning, and evaluation while developing the  methodology. However, HHS has not documented specific guidance and  methodologies to help ensure transparency and accountability across the  interagency and consistency in the Biodefense Coordination Team’s  analysis.

Additionally, the initial effort to collect information on all programs,  projects, and activities focused on existing federal activities did not  include a complete assessment of biodefense capabilities at the  nonfederal level. Processes for soliciting nonfederal capabilities that  contribute to the biodefense enterprise and are necessary to support the  Strategy’s implementation are not articulated in NSPM-14. Moreover,  the guidance document that agencies used for the data call stated that  the Biodefense Coordination Team—in coordination with National  Security Council and OMB staff—was to, among other things, use the  information provided by the agencies to analyze the extent to which  current U.S. Government resources support the goals and objectives of  the Strategy. Officials from two agencies also said that not gathering  information from the private sector and other existing biodefense working  groups was a limitation in the information gathering process for this first  year. Officials said these entities provide valuable subject matter  expertise and including input from them in the future could help identify  gaps across the biodefense enterprise.

Some agencies included information about their work to support  nonfederal stakeholders in their data collection effort, for example, by  listing their grant programs or cooperative agreements. In addition, during  our interviews, officials from all eight agencies described efforts to involve  nonfederal partners when developing the Strategy and many described  outreach efforts to obtain information since the Strategy’s release. For  example, HHS issued a notice in the Federal Register and the Biodefense  Coordination Team held a summit related to the implementation of the  National Biodefense Strategy to engage nonfederal stakeholders.  However, the Biodefense Coordination Team was not explicitly required  to analyze nonfederal resources and there was no guidance that would  help ensure agencies consistently and systematically included the  contributions of nonfederal capabilities.

In 2011, we reported that few of the resources required to support  national biosurveillance capabilities are wholly owned by the federal  government. Effective response to significant national biological  incidents also relies heavily on nonfederal resources and capabilities.  Because nonfederal entities own many of the resources and capabilities  needed to achieve the goals and objectives outlined in the Strategy,  assessing the baseline and identifying investment needs for a national  biodefense capability necessarily involves assessing nonfederal entities’  ability to support a national capability. Officials from one of the agencies  initially tasked with developing the biodefense strategy said the  Biodefense Coordination Team needs to develop engagement structures  with nonfederal partners, because currently, there is not a system in place  to get everyone’s views or learn of what is going on outside the federal  government.

Our enterprise risk management work calls for agencies to identify and  assess risks to be able to select among risk reduction alternatives.  Enterprise risk management requires good information and analysis to  enable officials to make informed trade off decisions across alternatives.  Although the NSPM-14 process is designed to enable this kind of  assessment and selection, it will not be as effective without complete  information at the risk identification stage. Effective enterprise risk  management implementation starts with agencies establishing a  customized program that fits their specific organizational mission, culture,  operating environment, and business processes. In our guide for  designing evaluations, we called for plans to analyze data in ways that  allow for valid conclusions to be drawn.

Although the NSPM-14 guidance provides a high-level process that  serves as a solid foundation for an effort as complex as managing risk  across the entire biodefense enterprise, it does not provide the kind of  specific guidance that can help all the involved agencies ensure they are  operating off a common set of procedures that fits the particular needs of  this effort. Furthermore, an analysis that cannot consistently account for  the contribution of nonfederal capabilities does not reflect the true  enterprise operating environment and limits the selection of alternatives  available for managing risk.

Clear and specific documentation of methodologies and procedures for  analysis—including guidance on the methods to account for nonfederal  capabilities—would provide better guidance for agencies that submit  information for the assessment, assurance of more complete information  to assess the state of national capabilities, and better overall  transparency, accountability, and consistency.

Staffing, supporting, and sustaining ongoing efforts. Officials we  interviewed expressed concern about the resources that the Biodefense  Coordination Team had available to it, both in the first year and on an  ongoing basis. According to officials from five of the eight agencies, in  order for the team to be most successful, it would need to be staffed by  detailees from the participating agencies. However, officials we spoke  with told us that not all agencies were able to provide a full-time detailee  to help support the office. Without a dedicated liaison to the Biodefense  Coordination Team, agencies may have less access to information and  more limited influence over the iterative process. We have previously  reported that agencies need to identify how interagency groups will be  funded and staffed. HHS, which serves a leadership role on the  Biodefense Steering Committee, identified in its fiscal year 2020 budget  request $5 million for the resources necessary to help carry out its  administrative functions for implementing the National Biodefense  Strategy. However, HHS appropriations for fiscal year 2020 did not  include the $5 million HHS requested.

In addition, in our work on leading practices for agency reform efforts we  stated that having a dedicated implementation team that has the  capacity—including staffing and resources—can help ensure successful  transformation. However, officials from multiple agencies reported that the  initial planning for the staffing and responsibilities for the Biodefense  Coordination Team had not been finalized. Without a plan to help ensure  resources and mitigate resource challenges for ongoing efforts, the  Biodefense Coordination Team risks not having the capacity it needs to  conduct meaningful analysis, which would undermine the vision created  by the Strategy and NSPM-14.

Processes and Roles and Responsibilities for Making Joint Decisions Lack Clarity and Are Not Fully Developed

The governing bodies overseeing the National Biodefense Strategy’s  implementation—the Biodefense Steering Committee and Biodefense  Coordination Team—did not clearly document key components of the  assessment process and roles and responsibilities for joint decision- making in the first year of NSPM-14 implementation. This raises  questions about how these bodies will move from an effort to catalog all  existing activities to decision-making that accounts for enterprise-wide  needs and opportunities. For example, officials from multiple agencies  were not certain how the group would make joint decisions regarding  priority setting and the allocation of resources, how the group would  assign new biodefense responsibilities if gaps were identified, and to what  extent the Biodefense Steering Committee could enforce budgetary  priorities, if at all.

Process for leveraging or directing resources. We found a lack of  shared understanding and agreement about how the interagency process  would work to align resources toward any identified gaps and reconfigure  resources for any identified redundancies or inefficiencies. To address  needs for new appropriations, NSPM-14 lays out a process to identify the  need for additional resources to support the goals of the Strategy and  how agencies will consider the joint policy guidance in their budget  requests to Congress, but this coordination process also remains  ambiguous and untested. OMB staff said the 2022 budget cycle would be  the first year that agencies consider the joint policy guidance to inform  their budget submissions, as envisioned by the Strategy and NSPM-14  process, as that guidance is still being developed.

Officials from four agencies expressed reluctance to redirect resources  away from their core missions to better support any enterprise-wide  identified needs. When asked about the process outlined in NSPM-14,  officials from only one of the eight agencies we interviewed said that the  governing bodies were well-positioned to assign new responsibilities in  response to identified gaps. Further, officials we interviewed noted that  new responsibilities or activities may be difficult to implement without  additional appropriations or authorities approved by Congress, or they  would compete with an agency’s other priorities.

When discussing their understanding of the process for prioritization and  determining which agencies require what resources to help implement the  Strategy, officials from four agencies referenced the NSPM-4 process  (within the White House) to help guide this process. NSPM-14 also  references NSPM-4, as noted above, and states the Biodefense Steering  Committee seeks to reach consensus on decisions, and should any  disagreements arise, the issue will be addressed through the NSPM-4  process. Through this process, the Assistant to the President for National  Security Affairs serves as the lead for policy coordination and review to  provide strategic input and facilitate policy integration for federal  biodefense efforts. When we asked HHS officials for more specific  decision-making guidance, they continued to cite the existing processes  and directives for interagency decision-making.

However, we found that neither of these Presidential memorandums  detailed specific decision-making principles or steps for reaching  consensus or even for raising decision points about how to best leverage  or direct resources across the enterprise in response to gaps and  inefficiencies. Similarly, agency officials we interviewed were not clear  how this process would work, how decisions would be made, or how  agencies would agree to take on new responsibilities to bridge gaps to  achieve the Strategy’s goals.

Roles and responsibilities. Similarly, the governing bodies have not  fully defined the roles and responsibilities for making enterprise-wide  decisions that affect individual agency budgets and for enforcing  enterprise-wide budget priorities. NSPM-14 directs the heads of agencies  to monitor, evaluate, and hold accountable their agencies for  implementation of the Strategy, and describes how agencies will develop  their budgets with consideration of the agreed upon joint policy guidance  developed by the agencies and the White House.

However, as with other parts of the NSPM-14 implementation process,  the details regarding specific roles and responsibilities for directing and  enforcing budget decisions lack detail and specificity. Additionally,  officials from four agencies stated that the charter for the Biodefense  Coordination Team has not been finalized, further delaying the  articulation of roles and responsibilities and the ability to establish a  shared agenda and common operating picture. As a result, some officials  remain skeptical of the effectiveness of any decisions made. For  example, officials from four agencies said the Biodefense Steering  Committee does not have the authority to decide how individual agencies  in the broader biodefense enterprise should allocate resources or  prioritize programs.

Officials we spoke with also provided examples of how this part of the  implementation process requires attention and will from stakeholders  outside the Biodefense Steering Committee, including the National  Security Council staff, OMB, and the Congress. For example, officials  from two agencies said turnover within the National Security Council staff  had contributed to a lack of consistent leadership from the White House,  which created a “lapse in momentum” and disrupted the implementation  process. Additionally, officials said that key parts of the implementation  process, such as the finalization of metrics, milestones and end states, as  well as agreement on the federal agency roles and responsibilities for the  biodefense activities articulated in the Strategy, had not been approved  by the National Security Council staff. As of January 2020, these  documents had not received National Security Council staff approval as  the process for the development of metrics, milestones and end states is  considered ongoing, which could lead to inefficiencies and delay effective  implementation of the Strategy’s goals.

Finally, officials we interviewed also discussed Congress’s key role as  part of the regular federal budget process in determining agency  appropriations. For example, officials from two agencies said it will be  hard to predict whether the budget component expressed in NSPM-14 to  assess and prioritize biodefense programs and activities will achieve its  intended outcome. Some agency officials also believed the process to  use joint policy guidance to inform annual budget submissions would not  be entirely dissimilar to the annual budgetary process, as agencies will  continue to submit their proposed budgets and wait for Congress to make  appropriation decisions. However, we have previously reported that  sustained congressional attention helps ensure that agencies continue to  achieve progress resolving complex issues.

We previously reported that determining the sources and types of  resources needed and where those resources should be targeted are key  decisions that effective national strategies should support. We also  reported that effective national strategies should help clarify implementing  organizations’ relationships in terms of leading, supporting, and  partnering—in the context of the Strategy, that includes how enterprise- wide decisions about leveraging or directing resources to fill gaps and  reduce inefficiency will be made and by whom. These could include  gaps in policy, programming, or funding. Similarly, our previous work has  found that articulating and agreeing to a process for making and enforcing  decisions can improve the clarity surrounding a shared outcome, and that  articulating these agreements in formal documents can strengthen  agency commitment to working collaboratively and provide the overall  framework for accountability and oversight.

Moreover, a key aspect of enterprise risk management is creating a  foundation that will enable participants to consider and prioritize  alternatives. This prioritization can be based on a number of factors, such  as the degree of risk reduction alternatives afford and the cost and  difficulty to implement them. However, to do this at the enterprise level,  the interagency participants need to agree on processes, roles, and  responsibilities for enterprise-wide decision-making. This is particularly  important in the context of enhancing efficiency and effectiveness in a  broad mission space like biodefense where there is a wide array of  threats and the threat landscape continually evolves.

Uncertainty around the mechanisms to identify enterprise-wide priorities  along with the lack of clearly documented and agreed upon processes,  roles, and responsibilities for joint decision-making jeopardize the  Strategy’s ability to enhance efficiency and effectiveness of the nation’s  biodefense capabilities. In the absence of clearly articulated and agreed  upon processes and procedures for joint decision-making to leverage or  direct resources across agency boundaries in order to enhance  efficiencies, agencies run the risk of continuing to work in stovepiped  mission spaces and collecting information that does not serve its intended  purpose. Full development and documentation of the processes, roles,  and responsibilities for leveraging or directing resources across the  enterprise in response to identified gaps and inefficiencies would enhance  transparency and clarity for future year’s efforts and help establish a  common operating picture that enables trade-offs across agency  missions.

The National Biodefense Strategy, released in September 2018, and the  establishment of interagency governance and budgeting mechanisms to  help implement the Strategy constitute a promising new approach to  establishing a transformational enterprise-wide endeavor that  meaningfully enhances the effectiveness and efficiency of government- wide biodefense efforts. These efforts include establishing a framework to  collect and compare biodefense programs, projects, and activities across  the federal government, which could facilitate enterprise-wide decision- making and budget tradeoff decisions to help ensure the most efficient  use of the nation’s biodefense resources. However, these efforts  represent a start to a process and a cultural shift that may take years to  fully develop. During the first year of implementation, agencies have  faced numerous challenges that must be overcome to ensure long-term  implementation success.

While agencies remain optimistic about the potential benefits of this new  approach, it is imperative that additional steps be taken to ensure the  challenges experienced early on are not institutionalized and that there is  an intentional communication, education, and feedback effort to reinforce  collaborative behaviors and enterprise-wide accountability for national  security missions. A plan that includes change management practices to  help bridge agency cultures and missions, such as efforts to reinforce  collaborative behaviors and enterprise-wide approaches, can help ensure  agencies continue to refine their interagency efforts and adapt to changes  and respond effectively to challenges along the way.

In addition, without clear methods and guidance that articulate how all  relevant information should be analyzed, including ensuring nonfederal  roles, responsibilities, and resources are accounted for in the  assessment, the Biodefense Coordination Team’s ability to effectively use  the information to support enterprise risk management will be limited.  Moreover, without a plan to help ensure resources for sustaining ongoing  institutional support, the Biodefense Coordination Team risks not having  the capacity it needs to conduct meaningful analysis and decision making  processes.

Finally, without the development and documentation of the processes,  roles, and responsibilities for joint decision making regarding the  identification of priorities and for raising decisions about resource  alignment across agencies, it will be difficult to sustain an enterprise-wide  approach to managing risk across the biodefense enterprise. These  actions could help guide agencies towards a common operating picture  and shared understanding of the efforts needed beyond their individual  missions. The intersection of human, animal, plant, and environmental  health, as well as the nexus to the national security and economic  sectors, represent challenges that no single agency can address alone.  The National Biodefense Strategy was written to help link these efforts  and additional planning and guidance would help enable the agencies to  achieve the Strategy’s goals.

We are making the following four recommendations to the Secretary of  HHS:  The Secretary of HHS should direct the Biodefense Coordination Team to  establish a plan that includes change management practices—such as  strategies for feedback, communication, and education—to reinforce  collaborative behaviors and enterprise-wide approaches and to help  prevent early implementation challenges from becoming institutionalized.  (Recommendation 1)

The Secretary of HHS should direct the Biodefense Coordination Team to  clearly document guidance and methods for analyzing the data collected  from the agencies, including ensuring that nonfederal resources and  capabilities are accounted for in the analysis. (Recommendation 2)

The Secretary of HHS should direct the Biodefense Coordination Team to  establish a resource plan to staff, support, and sustain its ongoing efforts.  (Recommendation 3)

The Secretary of HHS should direct the Biodefense Coordination Team to  clearly document agreed upon processes, roles, and responsibilities for  making and enforcing enterprise-wide decisions. (Recommendation 4)

We provided a draft of this report to HHS, USDA, DOD, DHS, State, VA,  Justice, EPA, the National Security Council staff, and OMB for review and  comment. In its written comments, which are reproduced in appendix III,  HHS concurred with our four recommendations and provided additional  information on the steps the agency has taken or plans to take to address  our recommendations. To address recommendation 1 for the Biodefense  Coordination Team to establish a plan that includes change management  practices, HHS reported that it had implemented change management  practices to include strategies for feedback, communication, and  education. Specifically, the letter describes plans to institutionalize an  after-action survey following the interagency data collection effort each  year and a communications and outreach plan that was informed by  multiple sources of stakeholder input. In technical comments, officials  also described meetings across different components of the participating  agencies that the Biodefense Coordination Team has held to help bridge  organizational cultures and promote ownership. These actions, if  implemented effectively, are important steps toward addressing the intent  of our recommendation.

At the same time, it is important to recognize the extent to which the  enterprise-wide approach—making resource decisions in the context not  only of each agency’s separate mission and authorities, but also to further  a shared national security mission—represents a cultural shift. In  technical comments, HHS officials acknowledged that opportunities exist  to continue to enhance cultural aspects of the enterprise-wide approach  and noted that the participation of all the agencies will be important.

In addition VA, State, and EPA—in technical comments and written  responses—commented on the ability of the Biodefense Steering  Committee and Biodefense Coordination Team to drive enterprise-wide  decision-making. They noted challenges like the limitations in these  bodies’ authority to direct action and the difficulty of achieving consensus  across so many actors. (See Department of Veterans Affairs’ letter  reproduced in appendix IV.)

HHS also concurred with recommendation 2 about clear documentation  of guidance and methods for analyzing the data collected from the  agencies, including ensuring that nonfederal resources and capabilities  are accounted for in the analysis. However, in its written response, HHS  reiterated the assessment steps it already described during our review,  but it did not provide additional documentation containing more concrete  and detailed methods for the analysis. HHS noted the Biodefense  Coordination Team’s limited responsibilities to address nonfederal  resources in the annual assessment, as described in NSPM-14. HHS also  expressed  in its technical comments that NSPM-14 does not charge the  Biodefense Coordination Team with analyzing or accounting for  nonfederal capabilities in any formal or specific way. We recognize the  challenges involved with assessing nonfederal capabilities, but disagree  with HHS’s characterization of the Biodefense Coordination Team’s  responsibilities. According to NSPM-14, the foundation for the United  States Government’s role in the biodefense enterprise is the National  Biodefense Strategy and its implementation plan. The memorandum  further states that agency biodefense activities shall be conducted  consistent with the National Defense Authorization Act for Fiscal Year  2017 (NDAA), which provides that the strategy is to include an articulation  of related whole-of-government activities required to support the strategy.  We have previously reported that parts of the biodefense enterprise, such  as the resources that support surveillance capabilities, are heavily reliant  on nonfederal resources. Moreover, the National Biodefense Strategy  states that it is broader than a federal government strategy, rather a call  to action for various nonfederal entities. Therefore, to fully address our  recommendation, we continue to believe that NSPM-14 notwithstanding,  HHS should develop and document clear guidance for the data collection  and analytical methods that will support the NDAA’s call for articulation of  the capabilities that support national biodefense and recommendations  for strengthening those capabilities.

Regarding recommendation 3 for the Biodefense Coordination Team to  establish a resource plan to staff, support, and sustain its ongoing efforts,  HHS concurred, and said it requested $5 million in no-year funding in its  fiscal year 2020 budget request to support the administrative  management of the National Biodefense Strategy. However, as we  reported, the HHS appropriations for fiscal year 2020 did not include the  $5 million HHS requested and officials from multiple agencies reported  that the initial planning for the staffing and responsibilities for the  Biodefense Coordination Team had not been finalized. To fully address  our recommendations, HHS will need to establish a resource plan that  would describe how the Biodefense Coordination Team plans to staff,  support, and sustain its efforts.

Finally, HHS concurred with recommendation 4, for the Biodefense  Coordination Team to clearly document agreed upon processes, roles,  and responsibilities for making and enforcing enterprise-wide decisions.  In its response, HHS points to the authority NSPM-14 gives the  Biodefense Coordination Team to establish governance, policies, and  procedures, subject to the approval of the Biodefense Steering  Committee. HHS stated that the Biodefense Coordination Team had  developed charters and guidance to govern its activities, but said that  these documents were still pending the approval of the Biodefense  Steering Committee. We will continue to evaluate these actions to  determine the extent to which they fully address our recommendation. To  fully address our recommendation, HHS in partnership with other  participating federal agencies should agree upon and document clear  guidance, roles, and responsibilities for addressing shared national  security concerns with interagency resources and solutions that  transcend the mission and capabilities of the individual agencies.  Irrespective of NSPM-14, clarifying decision making processes should  help the agencies identify the recommendations for improved capabilities,  authorities, command structures, and interagency coordination called for  by the NDAA and make incremental progress over time toward  implementing those recommendations.

We are sending copies of this report to the appropriate congressional  committees; the Secretaries of the Departments of Health and Human  Services, Agriculture, Defense, Homeland Security, State, and Veterans  Affairs; the Attorney General; the Administrator of the Environmental  Protection Agency; and the Director of the Office of Management and  Budget. In addition, the report is available at no charge on the GAO  website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact  Chris Currie at (404) 679-1875 or CurrieC@gao.gov, and Mary Denigan- Macauley at (202) 512-7114 or DeniganMacauleyM@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. Key contributors to this report are  listed in appendix III.

Appendix I: Analysis of the National Biodefense Strategy and Its Associated Plans against Elements Listed in Statute

The National Defense Authorization Act for Fiscal Year 2017 (NDAA)  articulated eight elements to include in the required National Biodefense  Strategy (Strategy). The NDAA also included a provision that we review  the Strategy. As part of our analysis, we assessed the extent to which the  Strategy and its associated plans incorporated the elements listed in the  NDAA. On March 14, 2019, we briefed the committees of concern (as  identified in the NDAA) on our findings, which we present here.

To determine the extent to which the National Biodefense Strategy  incorporated the elements established in the NDAA, three analysts and  an attorney independently evaluated the Strategy and NSPM-14 against  each NDAA element, recording scores on separate matrices. The  reviewers used the following descriptors to assess the extent to which the  Strategy included an element:

Great Extent – explicitly cites all elements, even if specificity and  detail is lacking and thus could be improved upon;

Some Extent – explicitly cites some, but not all, elements;

No Extent – does not explicitly cite or discuss any elements, or any  implicit references are either too vague or general.

The analysts and attorney then convened as a panel to reconcile any  differences in scoring to reach consensus. We also interviewed officials  from the agencies which comprise the Biodefense Steering Committee to  gain contextual information regarding the Strategy’s development as well  to help identify any challenges that agencies faced in addressing any of  the statutory elements during the development process.

As of the date of our briefing in March 2019, the National Biodefense  Strategy and associated plans generally addressed most of the elements  in the NDAA, and agencies continued to develop additional key  components. Specifically, for five of the eight NDAA elements, the  Strategy and associated plans addressed the major parts of the elements  with few or no omissions. For the other three NDAA elements, some parts  were still under development.

As of March 2019, the National Biodefense Strategy and Associated Plans Generally Addressed Five of Eight Elements in the NDAA

We found in March 2019 that the National Biodefense Strategy and its  associated plans generally addressed five out of eight elements listed in  the NDAA, even if some of these elements lack specificity and detail. For  example, where we determined the Strategy and associated plans  included an element to a great extent, we recognize that these  documents reflect the intent of the required element, even if improvement  could be made in future revisions. Figure 5 identifies the eight elements  required by the NDAA and our assessment on the extent to which those  elements were included in the Strategy and associated plans.

Specifically, the Strategy and related documents include a description of  biological threats and the capabilities necessary to address threats, as  well as recommendations for improving current biodefense capabilities,  authorities, structures and interagency coordination.

Description of biological threats. The NDAA provides that one element  to be addressed in the strategy is a description of various biological  threats. The Strategy includes a description of biological threats, as well  as additional contextual information about those threats and their place  within the overall threat environment. For example, the Strategy describes  biological warfare, bioterrorism, naturally occurring infectious diseases,  and accidental exposures as significant threats.

Articulation of necessary capabilities. One element listed in the NDAA  is an articulation of related or required interagency capabilities and whole- of-Government activities required to support the Strategy’s priorities. The  Strategy provides a list of five goals, with associated objectives and  activities that articulate the capabilities necessary to fulfill the aims of the  Strategy, such as the need to improve interagency capabilities. For  example, one such activity describes the need to improve state, local,  tribal, territorial, private sector, federal, regional, and international  surveillance systems and networks to contain, control and respond to  biological incidents. Another activity involves strengthening the ability to  detect zoonotic diseases and incorporating forecasting into intelligence  collection by federal agencies. This articulation of necessary capabilities  addresses the NDAA element to a great extent, even though we noted  that additional steps to include nonfederal capabilities in the annual  assessment of programs, projects, and activities would enhance  implementation efforts.

Recommendations for improving current biodefense capabilities.  Another element listed in the NDAA is to identify recommendations for  strengthening and improving current biodefense capabilities, authorities,  and command structures. The Strategy contains descriptions of activities  necessary to improve upon current biodefense efforts and to help  agencies establish new means to fulfill the goals of the Strategy. NSPM- 14 establishes a new governance structure (command structure) to help  implement the Strategy and also includes a mechanism for continual  revision of the Strategy, including recommendations for strengthening  biodefense activities, based on identified needs.

Recommendations for interagency coordination. The NDAA also  provided that the Strategy include recommendations for improving and  formalizing interagency coordination and support mechanisms with  respect to a strong national biodefense. The Strategy and associated  plans address this element by establishing collaborative interagency  structures—the Biodefense Steering Committee and the Biodefense  Coordination Team—intended to work continually on improving  biodefense. NSPM-14 also identifies a focal point for coordination among  agencies—the Secretary of HHS.

Other matters identified by agencies. The final element is to include  any other matters deemed necessary by the secretaries of Defense,  Health and Human Services, Homeland Security, and Agriculture.  According to officials from all eight agencies, the agencies originally  tasked with authoring the Strategy opened the process up to all agencies  with a stake in the biodefense enterprise because they recognized those  four agencies could not develop a comprehensive biodefense strategy if  all partners were not included. Officials from all of the agencies on the  Biodefense Steering Committee cited the inclusive nature of the drafting  process as contributing to a conceptually robust Strategy. Additionally,  NSPM-14 includes a requirement for the development of metrics,  milestones, and end states for implementing the Strategy, and officials  from all eight agencies we interviewed said the interagency group drafted  them and officials from 6 of the 8 agencies said they are under review by  the National Security Council staff.

Agencies Continued to Implement Key Elements of the Strategy and Associated Plans

As of March 2019, three of 8 elements listed in the NDAA were only  included to some extent because agencies implicitly addressed the  element through their work, or have started addressing parts of the  elements but not yet completed them. The main body of the report  discusses some of the ongoing challenges related to the Strategy’s  implementation.

Inventory and assessment of doctrine. To some extent, the Strategy  addresses the element related to an inventory and assessment of all  existing strategies, plans, policies, laws, and interagency agreements  related to biodefense. The agencies implicitly addressed this element by  incorporating existing doctrine in the process of drafting the Strategy. For  example, officials at a majority of the 8 agencies said that agencies  deliberately wrote the Strategy in a way that reflects their ongoing  priorities in the area of biodefense or takes into account existing agency  policies or strategies. The Strategy and NSPM-14 explicitly reference  some existing executive orders, presidential directives, and international  treaties related to biodefense, though it excludes reference to many  relevant agency-level strategies, plans, policies, laws, and interagency  agreements. For example, the Strategy reinforces obligations under the  Convention on the Prohibition of the Development, Production, and  Stockpiling of Bacteriological and Toxin Weapons and on their  Destruction (Biological Weapons Convention) (1975), but does not  mention the HHS’s National Health Security Strategy, which informs a  number of HHS programs that contribute to the biodefense enterprise.  According to HHS officials, an inventory of doctrine was completed and  submitted to Congress along with the transmittal of the Strategy, when it  was released. However, not all officials we spoke to believe this work is  fully completed, and officials from several agencies said they are currently  evaluating their internal policies and strategies to determine how they  align with the new Strategy.

Catalogue of current activities. The NDAA also included an element  related to a description of the current programs, projects, or activities of  the United States Government with respect to biodefense. While the  Strategy itself does not include a catalogue of such activities, the NSPM- 14 process requires agencies to create this catalogue, and efforts to do  so are described in the body of this report. NSPM-14 requires the Chair of  the Biodefense Steering Committee to send written requests for  information to agencies with biodefense responsibilities, including 17  agencies mentioned in the NSPM. According to HHS officials agencies  completed this collection of information in June 2019. NSPM-14 directs  the Biodefense Coordination Team to use the information gathered to  produce an overall assessment of federal biodefense programs and  coordinate the assessment with National Security Council staff and OMB  prior to its finalization and approval by the Biodefense Steering  Committee. Under NSPM-14, this process will occur annually as part of  the budget cycle. We characterized this element as included to some  extent because efforts to complete it were underway at the time of our  briefing in March 2019. Additionally, as we describe in the body of the  report, we identified areas of this process to be clarified for future years’  efforts.

Agency roles and responsibilities. The Strategy and associated plans  did not include a description of the roles and responsibilities of the  Executive Agencies, including internal and external coordination  procedures, in identifying and sharing information, as described in the  NDAA. The Strategy’s implementation plan includes over 240 activities,  but it does not assign roles and responsibilities for performing those  activities. However, NSPM-14 includes a requirement to establish these  roles and responsibilities, and officials from all of the 8 agencies said  agencies drafted a document assigning roles and responsibilities to each  agency. This document was submitted for review to the National Security  Council staff. Agency officials also discussed their engagement with  nonfederal partners on the Strategy, as they play a vital role in the  Strategy’s implementation. However, as we describe in the body of the  report, more can be done to articulate the nonfederal role in implementing  the Strategy. Additionally, NSPM-14 describes a governance structure  and initial responsibilities for executive agencies, such as identification of  a senior-level official as the focal point for all federal biodefense efforts.  However, as described in the body of this report, additional clarity is  needed on specific roles and responsibilities regarding decision-making  and leadership. Therefore, we consider this element addressed to some  extent.

As of October 2019, the agencies took additional steps to address the  elements listed in the NDAA. For example, the data collection of the  programs, projects, and activities was complete, and the assessment of  those data submissions was in draft form. Additionally, the agencies  drafted metrics, milestones, and end states, as well as roles and  responsibilities for the over 240 activities outlined in the Strategy’s  Implementation Plan. However, both of these documents had not  received final approval from the National Security Council staff, and the  charter outlining roles and responsibilities for the Biodefense Coordination  Team had not been finalized.

Appendix II: Descriptions of Long-standing Biodefense Challenges Previously Reported

Since 2009, we have identified broad, cross-cutting issues in leadership,  coordination, and collaboration that arise from fragmentation throughout  the complex interagency, intergovernmental, and intersectoral biodefense  enterprise. The biodefense enterprise is the whole combination of  systems at every level of government and the private sector that  contribute to protecting the nation and its citizens. It is composed of a  complex collection of federal, state, local, tribal, territorial, and private  resources, programs, and initiatives designed for different purposes and  dedicated to mitigating both natural and intentional risk.

In June 2019, we testified before the Subcommittee on National Security,  Committee on Oversight and Reform, House of Representatives on our  past work, which has identified a number of key challenges related to the  nation’s ability to detect and respond to biological incidents that transcend  what any one agency can address on its own. They include: (1)  enterprise-wide threat determination, (2) biodetection technologies, (3)  emerging infectious disease surveillance, (4) situational awareness and  data integration, and (5) biological laboratory safety and security.  Agencies have taken steps to address many of the recommendations we  and others have made in these areas, and we continue to monitor  ongoing efforts.

Enterprise-Wide Threat Determination Needed to Help Leverage  Resources and Inform Resource Tradeoffs. We reported in October  2017 that opportunities remain to enhance threat awareness across the entire biodefense enterprise, leverage shared resources, and inform  budgetary tradeoffs among various threats and agency programs. Key  biodefense agencies, including DHS, DOD, HHS, USDA, and EPA carry  out activities within their own mission spaces to better understand threats  and help make decisions about biodefense investments. Additionally,  federal agencies in our October 2017 review had mechanisms to support  specific federal activities and individual programs, or in response to  specific biological incidents after they begin to unfold. However, there was  no existing mechanism that could leverage threat awareness information  to direct resources and set budgetary priorities across all agencies for  biodefense. Without a mechanism that is able to assess the relative risk  from biological threats across all sources and domains, we found that the  nation may be limited in its ability to prioritize resources, defenses, and  countermeasures against the most pressing threats. In June 2019, we  said implementation of the National Biodefense Strategy offers the  potential for the nation to progress toward more integrated and  enterprise-wide threat awareness and to use that information to identify  opportunities to leverage resources, but this will take time and entails a  change in the way participating agencies have traditionally operated.

Challenges Determining Optimal Biodetection Technology  Solutions. We have previously reported on the challenges of determining  and then implementing technologies capable of identifying biological  threats in the environment. Since 2012 we have reported that DHS has  faced challenges in clearly justifying the need for the BioWatch program  and its ability to reliably fulfill its primary task of detecting aerosolized  biological attacks. According to DHS officials, DHS is in the early stages  of Biodefense 21 (BD21), a multi-year acquisition effort. DHS plans to  develop requirements based on collected environmental data and input  from first responders, public health officials, and other partners determine  what the replacement to BioWatch needs to be. As part of the early  acquisition cycle for BD21, DHS is currently conducting a technology  demonstration for trigger and sensor technology; therefore we cannot yet  determine how it will be implemented in the future or what decisions DHS  will ultimately make regarding the existing BioWatch system.

Additionally, in August 2017 we reported that from a homeland security  and public health perspective, threats of bioterrorism, such as anthrax  attacks, and high-profile disease outbreaks, such as Ebola and emerging  viruses like dengue, chikungunya, and Zika, highlight the continued need  for diagnostic tests that provide early detection and warning about  biological threats to humans. One option being explored is multiplex  point-of-care technologies which can simultaneously test (in minutes to a  few hours) for more than one type of human infectious disease pathogen  from a single patient sample (such as blood, urine, or sputum) in one run  at or near the site of a patient. These technologies may be used for  diagnosing different diseases, including more common diseases such as  influenza, emerging infectious diseases, or diseases caused by  weaponized biological agents. Advances in biological detection  technologies present opportunities to provide early detection and warning  of catastrophic biological incidents, and in June 2019 we said the  agencies responsible for implementing the National Biodefense Strategy  will need to engage on this issue in a way that helps to drive informed  investment tradeoff decisions about technology alternatives. We also  recognized that the National Biodefense Strategy and its interagency  governing leadership offer the potential for the nation to better define the  role of detection technologies in a layered national biodefense capability  to help those that pursue these technologies better articulate the mission  needs and align requirements and concepts of operation accordingly.

Challenges Building and Maintaining Emerging Infectious Disease  Surveillance. We have reported that establishing and sustaining  biosurveillance capabilities can be difficult for a myriad of reasons. For  example, maintaining expertise in a rapidly changing field is difficult, as is  the challenge of accurately recognizing the signs and symptoms of rare or  emerging diseases. We reported in October 2011 that funding targeted  for specific diseases does not allow for focus on a broad range of causes  of morbidity and mortality, and federal officials have said that the disease- specific nature of funding is a challenge to states’ ability to invest in core  biosurveillance capabilities. According to federal, state, and local  officials, early detection of potentially serious disease indications nearly  always occurs first at the local level, making the personnel, training,  systems, and equipment that support detection at the state and local level  a cornerstone of our nation’s biodefense posture.

In May 2018, we reported that officials from HHS told us that their grant  awards funded by annual appropriations are intended to establish and  strengthen emergency preparedness and capacity building, but may not  fully support the need for surge capacity that states and other jurisdictions  require to respond to an infectious disease threat. Further, we reported  in May 2018 that although the awards funded by supplemental  appropriations have allowed state and local public health departments,  laboratories, and hospitals to surge during a threat—for example, the  H1N1influenza and Zika virus outbreaks—most of the 10 non-federal  stakeholders we interviewed, as well as HHS officials said that the timing  of these awards can result in challenges to carrying out preparedness  and response activities during infectious disease threats.

In June 2019, we reported that how and to what extent implementation of  the National Biodefense Strategy is able to efficiently leverage and  effectively sustain capacity across both nonfederal and federal  stakeholders will affect how prepared the nation is to more quickly gear  up for whatever challenges emerge when outbreaks of previously non- endemic diseases threaten the nation. We also noted that the Strategy  and its interagency governance structure offer the opportunity to design  new approaches to identifying and building a core set of surveillance and  response capabilities for emerging infectious diseases.

Ongoing Challenges to Fulfill Enhanced Situational Awareness and  Data Integration Requirements. Our prior work has identified challenges  at DHS and HHS related to the sharing, collecting, and integration of data  from various federal and nonfederal agencies for their public health  situational awareness and data integration efforts. We have reported that  DHS’s National Biosurveillance Integration Center (NBIC), which was  created to integrate data across the federal government with the aim of  enhancing detection and situational awareness of biological incidents,  has suffered from long-standing issues related to its clarity of purpose.  Since 2009, we have reported that NBIC was not fully equipped to carry  out its mission because it lacked key resources—data and personnel— from its partner agencies, which may have been at least partially the  result of collaboration challenges it faced.  In September 2015, we  reported that despite implementing our prior recommendations and  NBIC’s efforts to collaborate with interagency partners to create and issue  a strategic plan that would clarify its mission and efforts, a variety of  challenges remained. In October 2019, officials acknowledged that  situational awareness and data integration are still very challenging  problems to solve, but overall the relationships between NBIC and partner  agencies are improving.

Similarly, in 2017, we reported on long-standing challenges faced by  HHS—such as planning and implementation shortfalls—to create a public  health situational awareness network, not unlike that envisioned for  DHS. In June 2019 we observed that because the National Biodefense  Strategy identified biosurveillance data integration among several  information sharing activities that need to be enhanced, its  implementation offers the potential for the nation to better define what  kind of integrated situational awareness is possible, what it will take to  effectively and efficiently achieve it, and what value it has.

Continued Oversight Needed to Enhance Biological Safety and  Security. We—along with congressional committees—have, for many  years, identified challenges and areas for improvement related to the  safety, security, and oversight of high-containment laboratories. For  example, in response to reported lapses in laboratory safety at HHS and  DOD in 2014 and 2015, we examined how federal departments oversee  their high-containment laboratories and found that most of the 8  departments and 15 agencies that we reviewed had policies that were not  comprehensive or were not up to date. Additionally, we found that while  the departments and agencies we reviewed primarily used inspections to  oversee their high-containment laboratories, some of them were not  routinely reporting inspection results, laboratory incidents, and other  oversight activities to senior officials.

In October 2017, we found that the Federal Select Agent Program—jointly  managed by HHS and USDA—oversees laboratories’ handling of certain  hazardous pathogens known as select agents and toxins, but the  program does not fully meet all key elements of effective oversight. For  example, the Federal Select Agent Program was not independent from all  laboratories it oversees, and it had not assessed risks posed by its  current structure or the effectiveness of its mechanisms to reduce  organizational conflicts of interest. In June 2019, we said the National  Biodefense Strategy highlights the need for continuous improvement of  biosafety and biosecurity for laboratories and other facilities, creating an  opportunity for interagency partners to develop additional oversight or  other practices to mitigate the risk of bioincidents at high containment  laboratories.

Appendix III: Comments from the Department of Health and Human Services

Appendix IV: Comments from the Department of Veterans Affairs

Appendix V: GAO Contact and Staff Acknowledgments

Chris P. Currie at (404) 679-1875 or CurrieC@gao.gov  Mary Denigan-Macauley at (202) 512-7114 or  DeniganMacauleyM@gao.gov.

In addition to the contacts named above, Kathryn Godfrey (Assistant  Director); Nick Bartine and Susanna Kuebler (Analysts-in-Charge); Jeff  Cirillo; Michele Fejfar; Eric Hauswirth; Tracey King; Jan Montgomery;  Matt Ray; and Adam Vogt made key contributions to this report.

Biological threats range from naturally occurring diseases to deliberately created biological weapons. The National Biodefense Strategy, issued in 2018 along with guidance on how to implement it, spells out the nation’s plan to address these threats. Among other things, it calls for a joint effort by multiple agencies as well as private sector partners.

We reviewed how well the strategy has worked so far. We found there are no clear processes, roles, or responsibilities for joint decision making. We made 4 recommendations, including that Health and Human Services (the lead agency for the strategy) clearly document these factors.