Recommendations 

We recommend that, in keeping with legislative requirements, the Under 

Secretary for EP&R: 

3.  Direct the EP&R CIO to complete the FEMA enterprise architecture, 

linked to the departmentwide architecture and ongoing initiatives that may 

impact EP&R operations. 

4.  Ensure cross cutting participation from headquarters, regions, and states in 

processes to develop and maintain a complete, documented set of FEMA 

business and system requirements.  Direct the EP&R CIO to analyze 

alternatives and determine the most appropriate approach to providing the 

technology needed to support these business and system requirements.  

5.  Direct the EP&R CIO to develop and maintain a testing environment that 

duplicates the real systems environment and ensures that all systems 

components are properly and thoroughly tested prior to their release.  

Additionally, direct the EP&R CIO to ensure that proper configuration 

management activities are followed and documented. 

Management Comments and OIG Evaluation 

We obtained written comments on a draft of this report from the Chief 

Information Officer (CIO), Emergency Preparedness and Response (EP&R), 

through the EP&R Under Secretary.  We have included a copy of the 

comments in their entirety at Appendix B. 

In the comments, the EP&R CIO found the draft report to be unacceptable, 

stating that it incorrectly characterized FEMA's strategic planning and IT 

activities and needed to be revised.  The EP&R CIO also said that the overall 

tone of the report was negative and did not acknowledge FEMA's  highly 

performing, well managed, and staffed IT systems,  leading the reader to 

conclude that EP&R is lacking, particularly in the areas we cover in our report 

recommendations.  The EP&R CIO invited us to meet with FEMA's strategic 

planning unit to best judge the extent to which the agency is in line with DHS 

strategic direction, as well as meet with EP&R CIO officials to clear up some 

of what the CIO called  obvious inaccuracies.  

Emergency Preparedness and Response Could Better Integrate Information Technology  

with Incident Response and Recovery 

Page 34