Background The Vast and Constantly Evolving Biological Threats Cultivating a strong biological defense requires an understanding of a multitude of biological threats. The nature of these threats can be intentional, naturally occurring, or accidental and can be exacerbated by changes in behavior and environment. The vast and evolving biological threat landscape includes threats of biological warfare, bioterrorism, infectious disease threats to humans and animals, crop failure, and safety and security lapses at facilities that house biological threat agents. The use of biological weapons or their proliferation by state or non-state actors presents a significant challenge to our national security, our population, our agriculture, the economy, and the environment. Despite ratification of the Biological Weapons Convention in 1975 and the end of the Cold War decades later, the threat of biological warfare persists today. For example, the State Department reported in 2019 that China, Iran, North Korea, Russia, and Syria continue to engage in dual-use or biological weapons-specific activities. Additionally, the biotechnology revolution presents opportunities to advance the life sciences, yet that same technology in the wrong hands could be used to catastrophic effect. For example, synthetic biology may lead to advances in public health, such as the development of biosensors that can permanently reside in the body to detect and treat abnormalities such as cancer. However, if used to create and combine agents to create biological weapons, synthetic biology poses a significant threat. Finally, non-state actors such as terrorist organizations, domestic militia groups, and “lone wolves” have both the interest and, in some cases, the limited capacity to develop biological weapons. Biological threats can be unpredictable, as humans, animals, and plants are vulnerable to a variety of naturally occurring infectious disease and pest threats. Urbanization, habitat encroachment, and increased and faster travel, coupled with weak health systems, increase the risk of infectious diseases to spread rapidly across the globe. Pandemic influenza presents a constant threat to global public health and exemplifies the susceptibility of humans to diseases with animal origins. For example, in 2009 when an H1N1 influenza virus emerged with a new combination of genes from swine, avian, and human influenza viruses, it demonstrated how the genetic compositions of some viruses naturally change, meaning most people have little or no immunity to the new virus. In 2009, this led to a global pandemic with a novel H1N1 influenza virus (see fig.1). Other examples of zoonotic disease threats—infectious diseases that are transmissible from animals to humans—include Ebola, Zika, and Eastern Equine Encephalitis. Biological threats may also arise from changes in human behaviors. Habitat loss and human encroachment on rural and wildlife environments are bringing populations of humans and animals into closer and more frequent contact. These changing relationships with animals increase the risk of disease transmission among people, pets, livestock, and wildlife. Other changes in human behavior—such as vaccine hesitancy, mass migration, and conflict—put stress on health care systems around the world. In an ever increasing interconnected world, building biological defenses globally can help maintain health security domestically, because a disease threat anywhere is a disease threat everywhere. Biodefense capabilities are also needed to address changes in the environment which have the potential to negatively affect human health and the agriculture industry. As we reported in October 2015, climate change may contribute to the spread of vector-borne diseases that are transmitted to humans by animals, including invertebrate animals such as mosquitoes and ticks. Additionally, extreme climate conditions, such as sustained drought and heat waves can affect crops and livestock, and excess precipitation can also increase flooding events and erosion, and decrease soil quality. Losses of livestock and crops from the biological threats of disease, pests, or extreme climate conditions could have devastating effects on trade and the national economy. Finally, in many countries around the world, pathogens are stored in laboratories that lack appropriate biosecurity measures where they could be diverted by actors who wish to do harm. Advances in science and technology bring revolutionary cures and progress, but they also have the potential to facilitate intentional misuse. As we reported in 2016, some laboratories do not have appropriate biocontainment or biosafety protocols. These shortfalls could lead to outbreaks through laboratory acquired infections or pathogens accidently being released into the environment. GAO’s Prior Work on Biodefense-Related Challenges and Enterprise Risk Management We have previously reported on a wide range of biodefense-related efforts carried out by multiple federal departments and agencies. Since 2009, we have identified broad, cross-cutting issues in leadership, coordination, and collaboration that arise from fragmentation throughout the complex interagency, intergovernmental, and intersectoral biodefense enterprise. For example, our past work has identified a number of key challenges related to the nation’s ability to detect and respond to biological incidents that transcend what any one agency can address on its own. They include: (1) assessing enterprise-wide threats, (2) determining optimal biodetection technologies, (3) building and maintaining emerging infectious disease surveillance, (4) establishing situational awareness and data integration, and (5) enhancing biological laboratory safety and security. (Additional detail on these challenges and our related reports is presented in appendix II.) The complexity and fragmentation of roles and responsibilities across numerous federal and nonfederal entities presents challenges to ensuring efficiency and effectiveness across the entire biodefense enterprise. We called for a national biodefense strategy and focused leadership because addressing these issues is a difficult and complex challenge that crosses mission areas, federal departments, and sectors. Additionally, we have reported on enterprise risk management principles that can support enterprise-wide decision-making under complex and uncertain conditions. Enterprise risk management is a strategy for helping policymakers make decisions about assessing risks, allocating resources, and taking actions under conditions of uncertainty. While often applied at an agency level, we have also recognized that the size and complexity of certain issues, such as homeland security, involves multiple partners which can add another degree of difficulty to enterprise risk management. For certain areas, like biodefense, where activities cut across multiple federal and nonfederal entities, applying enterprise risk management principles becomes more challenging, but equally important to help ensure the responsible parties can make decisions that help to ensure effectiveness and maximize opportunities to better manage risk. Enterprise risk management in the larger interagency and intergovernmental context does not replace what each agency needs to do to pursue its own core missions. Rather, it allows agency decision makers to consider their missions and the alternatives they have to meet them from an enterprise-wide perspective. In this manner, decision makers can consider the risk-reduction contributions their actions make to the larger enterprise—for example by selecting alternatives that meet their immediate needs and provide collateral benefits to some other part of the enterprise—as one of many factors in individual agency decision- making. National Biodefense Strategy and National Security Presidential Memorandum-14 On September 18, 2018, the White House released the National Biodefense Strategy and characterized it as a new direction to protect the nation against biological threats and that its implementation would promote a more efficient, coordinated, and accountable biodefense enterprise. The Strategy’s five high-level goals are to help enable the efficient assessment, prevention, preparation, response, and recovery from natural, accidental, or deliberate biological threats. When the National Biodefense Strategy was released, the White House issued NSPM-14: Presidential Memorandum on the Support for National Biodefense. According to the Strategy, NSPM-14 “creates a dedicated mechanism, housed within the U.S. Department of Health and Human Services, to coordinate federal biodefense activities and assess the effectiveness with which the National Biodefense Strategy’s goals and objectives are being met.” NSPM-14 details a governance structure and implementation process to achieve the Strategy’s goals. The governance structure includes the creation of a Biodefense Steering Committee chaired by the Secretary of HHS, and includes seven other agency heads as members: the Attorney General, the Secretaries from the Departments of State and VA, DOD, USDA, and DHS, and the Administrator of the EPA. Additionally, NSPM- 14 required the formation of a Biodefense Coordination Team to assist the Biodefense Steering Committee in carrying out its responsibilities. Administratively located within HHS, the Biodefense Coordination Team consists of staff from multiple agencies with biodefense responsibilities and is designed to assist the Biodefense Steering Committee in monitoring and coordinating implementation of the Strategy (see fig.2). The Biodefense Coordination Team may convene working groups and maintain awareness of biodefense activities across the biodefense enterprise and has responsibility for establishing policies, processes, and procedures to govern its activities, subject to the approval from the Biodefense Steering Committee. NSPM-14 also establishes that the Assistant to the President for National Security Affairs will serve as the lead for policy coordination and review, providing strategic input and policy integration for federal biodefense efforts. NSPM-14 also outlines an implementation process, which sets requirements and deadlines for the interagency group to achieve the Strategy’s goals and also requires the heads of agencies identified by the Biodefense Steering Committee as having responsibilities pertaining to biodefense to review the Strategy every 2 years, and revise as appropriate. Strategy-Related Efforts Are Designed to Support an Enterprise-Wide Approach, but Implementation Challenges Could Limit Long-term Success The National Biodefense Strategy and associated plans bring together all the key elements of federal biodefense capabilities, which presents an opportunity to identify gaps and consider enterprise-wide risk and resources for investment trade-off decisions. However, challenges with planning to manage change, limited guidance and methods for analyzing capabilities, and lack of clarity about decision-making processes, roles, and responsibilities while adapting to a new enterprise-wide approach could limit the success of the Strategy’s implementation. The Strategy and Associated Plans Create a Framework to Assess Enterprise-Wide National Biodefense Capabilities for the First Time The National Biodefense Strategy and its associated plans bring together the efforts of federal agencies with significant biodefense roles, responsibilities, and resources to address intentional, accidental, and naturally-occurring threats. The Strategy and plans also provide processes for collecting and analyzing comprehensive information across the enterprise, an important step toward the kind of enterprise-wide strategic decision-making we have called for. For example, our prior work identified the need for a strategy to help ensure efficiency and effectiveness across the entire biodefense enterprise by connecting strategic approaches and investment decisions across disparate but interrelated functions within the biodefense enterprise. These functions are (1) understanding and defining threats, (2) taking action to prevent and protect against attacks and significant national and international infectious disease outbreaks, (3) employing new and existing techniques and technologies to more quickly detect biological events, and (4) preparing to respond and recover. Consistent with characteristics of national strategies and leading practices for interagency collaboration, the National Biodefense Strategy clearly articulates the purpose of the Strategy and the scope of the problem, as well as high-level goals and objectives to guide implementation. As shown in Figure 3, the Strategy’s five high-level goals comprise a new framework that incorporates the distinct biodefense functional areas and includes the different sources of biological threat—accidental, intentional, and naturally occurring. It is within this framework that national biodefense capabilities will be assessed across the enterprise. According to the Strategy, its aim is to bring together a single, coordinated effort to orchestrate activities across the United States Government to protect the American people from biological threats. The Strategy defines the term “biothreat” broadly to include all sources of major catastrophic risk, including naturally occurring biological threats, the accidental release of pathogens, and the deliberate use of biological weapons. Officials from three of the eight participating agencies that we interviewed noted that this is the first time that the federal government has identified activities across the whole biodefense enterprise and assessed resources and gaps to address multiple sources of threat regardless of source (naturally occurring, accidental, or intentional). The Strategy also established common terminology, giving the agencies a shared basis for identifying biodefense-related programs and activities, which is consistent with our national strategy criteria and our leading collaboration practices. Developing common terminology can help to bridge organizational cultures when multiple agencies with varying missions work together for a common purpose. The Strategy also contains goals, objectives, and over 240 separate activities that cover the range of actions that comprise national biodefense capabilities, which provides a high-level framework to begin to guide agencies toward a shared vision for outcomes. NSPM-14 Established Processes to Help Agencies Identify Gaps and Set Budget Priorities While the Strategy outlined high-level goals and objectives to help define priorities, NSPM-14 established a structure and process by which the federal agencies can assess enterprise-wide biodefense capabilities and needs, and subsequently develop guidance to help inform agency budget submissions. NSPM-14 lays out, in broad strokes, a process to identify biodefense efforts and assess how current resources support the Strategy, how existing programs and resources could better align with the Strategy, and how additional resources, if available, could be applied to support the goals of the Strategy. As shown in figure 4, this process begins through a data call with participating agencies documenting all biodefense programs, projects, and activities within their purview in a biodefense memorandum. As part of this process, NSPM-14 calls for the Biodefense Coordination Team, in coordination with NSC staff through the NSPM-4 process, to develop and collectively agree on metrics, milestones, and end-states and roles and responsibilities. For each of the objectives within the Strategy where agencies have roles and responsibilities, HHS directed participating agencies, as part of a data call, to identify any resource, authority, policy, science and technology, or coordination gaps against those end states and propose solutions where needed. As outlined in NSPM-14, the Biodefense Coordination Team is then to use the information submitted by the individual agencies to identify gaps, shortfalls, redundancies, and challenges across the enterprise. Finally, NSPM-14 directs officials with biodefense responsibilities to create joint policy guidance in coordination with the Assistant to the President for National Security Affairs through the NSPM-4 process—to be updated on an annual basis—that can help guide individual agency budget submissions. The process outlined in NSPM-14 is intended to lead to a cross- government assessment of federal biodefense capabilities and is consistent with our past calls for a strategy that can guide investment across the whole enterprise and with leading practices for interagency collaboration and enterprise risk management. We have previously reported that defining shared outcomes—and processes by which to achieve them—and developing mechanisms to monitor and evaluate results can reinforce accountability for collaborative efforts. Working together to develop a set of draft metrics, milestones, and end-states requires interagency participants to establish a shared vision for outcomes, and metrics and milestones serve as accountability mechanisms. NSPM-14 describes how agencies will consider the agreed upon joint policy guidance developed by agencies with biodefense responsibilities and the White House when developing their budgets. Specifically, according to NSPM-14, these agencies shall include in their respective annual budget requests to OMB information on the programs within the budget requests that support the implementation of the Strategy and conform to budget formulation requirements established by OMB, including specified funding levels. Establishing goals, objectives, and desired end states that cut across the federal government also create a foundation for effective enterprise risk management. As we have previously reported, a shared understanding of the scope of the risks enables leaders across the enterprise to align agency goals and objectives and consider their own missions and purposes within a more expansive and comprehensive understanding of threats and opportunities. In our interviews, officials from participating agencies stated that the NSPM-14 processes constitute a new approach to identifying gaps and setting budget priorities for biodefense, and that they viewed the approach as generally well designed. Specifically, officials from six of the eight participating agencies said that the process for identifying gaps was somewhat well-designed. Officials from the other two participating agencies said that this process was very well-designed. Agency officials provided several reasons for optimism about the Strategy and the processes outlined in NSPM-14, including that: They provide a holistic picture of current biodefense programs and activities, which creates government-wide visibility so that gaps can be identified. They create a forum to discuss potential gaps and biodefense responsibilities, which has not existed previously. They contain a strong overarching architecture to map existing efforts, identify gaps, and inform future revisions (as necessary). Additionally, agency officials said that the assessment and joint policy guidance development process outlined in NSPM-14 offered some promise for helping agencies identify the resources necessary to achieve the Strategy’s goals, which is consistent with our national strategy criteria. Specifically, officials from five of the eight agencies said the process is somewhat well-designed to accomplish these goals. Officials from the other three agencies said the process is very well-designed to ensure the appropriate identification of resources and investments necessary to achieve the goals outlined in the Strategy. For example, officials from three agencies said it would help the implementation of the Strategy succeed where previous efforts failed because it is designed to allow the Strategy’s priorities to drive budget decisions. However, officials from all of the agencies we interviewed, even those with the most optimistic views on the leadership and governance structure design, tempered their responses with the caveat that implementation is in such early stages that it remains to be seen how effective these structures will actually be once tested. Implementation Challenges Could Hinder Enterprise-Wide Biodefense Efforts Although the Strategy and associated plans establish the foundation for enterprise risk management, in particular by bringing together all of the functional biodefense areas across different sources of threat, we and biodefense agency officials identified multiple challenges that could affect the Strategy’s implementation. These include challenges individual agencies faced during the initial data collection process as well as a lack of planning and guidance to support an enterprise-wide approach. In our analyses and interviews, we found that parts of the process in the first year were underdeveloped, raising questions about (1) the plans to support change management practices and ensure that early- implementation limitations do not become institutionalized in future years’ efforts; (2) guidance and methods for meaningfully analyzing the data; and (3) the clarity of decision-making processes, roles, and responsibilities. Challenges with Adapting to New Processes May Have Led to Incomplete Data Collection During our interviews, agency officials reported challenges they faced in the first-year’s data collection effort with (1) staffing and organizational resources within individual agencies, (2) quantifying biodefense activities, and (3) technology glitches. These challenges may have led to incomplete data collection, but are not wholly unexpected given they occurred in the context of adapting to cultural change that this kind of enterprise-wide approach to managing risk represents, while implementing new processes and procedures. We have previously reported that leaders of successful transformations seek to learn from best practices and create a set of systems and processes that are tailored to the specific needs and circumstances of the new organization. However, the agencies involved in implementing the Strategy do not have a plan that includes change management practices that can help prevent these challenges from being carried forward into future efforts, and help reinforce enterprise-wide approaches, among other things. Staffing and organizational resources. During our interviews, one challenge that arose involved having the personnel and expertise needed to complete the initial effort to document biodefense programs, projects, and activities. For example, officials from one agency told us that this data collection effort was especially challenging because policy and program managers were responsible for determining both programmatic and budgetary information, which exceeded their expertise. This agency ultimately had to bring in non-biodefense personnel—including from the comptroller’s office—to identify programs and resources to complete the information request. Officials from three of the eight agencies stated that staffing and organizational resource limitations also posed a challenge to the data collection process. For example, officials from one agency said that the agency does not have full-time staff assigned to the effort. Instead, it was seen as a collateral duty competing with regular priorities, which reduced the time devoted to identifying the necessary information. Quantifying biodefense activities. Officials we interviewed also highlighted the challenge of quantifying biodefense-related activities. Specifically, officials from four agencies noted that agencies without specific biodefense line items in their budgets have had difficulty fully quantifying how much their agency invests in biodefense-related activities. To help agencies attempt to capture and quantify this information in a consistent way, the Biodefense Coordination Team developed guidance to assist agencies in estimating the percentage of their chemical-biological-radiological-nuclear (CBRN) defense, all- hazards preparedness, and agriculture programs and activities, among others, that are specifically related to biodefense. Nevertheless, officials from two agencies said that distinguishing the biodefense-specific activities within their CBRN defense or all-hazards activities and budgets was inherently challenging, which in turn required officials to invest additional staff and time into the effort. Technology glitches. Officials we interviewed also cited challenges with the technology used to collect data. For example, officials from two agencies said that they had experienced glitches with the OMB Max Information System, which the Biodefense Coordination Team guidance directed them to use for the data collection effort. They stated that the technology issues prevented them from entering biodefense budget numbers in a timely manner. Officials noted that an integrated platform dedicated to biodefense enterprise needs would enhance their collaboration, which is consistent with our work on interagency collaboration that states technology is one means of establishing compatible processes for working across interagency boundaries. HHS officials are aware of the technology challenges and said they are collecting feedback and identifying ways to improve the data collection and analytical tool for future data collection efforts. These challenges with resources, identification of budget activities, and technology occurred in the context of the individual agencies and officials adapting to new procedures and a broader cultural shift from how they have approached their biodefense missions in the past. Officials told us that because of the learning involved the first time through the process and the 2018 government shutdown, coupled with the tight time frames set forth in NSPM-14, agencies may not have submitted complete or detailed information about their biodefense programs. For example, officials at one large agency told us they treated the first year as a learning experience and that in the coming years, when agencies have sufficient time to respond to the data call, the quality of the data submitted should improve. Some officials we interviewed voiced concern that this first-year effort could set a poor precedent for these activities in future years if the challenges are not acknowledged and addressed. For example, an official noted that committing to the first-year’s results as the “baseline” for future years of the Strategy’s implementation could compound or institutionalize the issues encountered in the first year. Officials cautioned against a “garbage in, garbage out” situation, meaning the output of any analysis would only be as good as the quality of the data fed into that analysis. As agency officials described their data collection efforts, it was clear to them that the focus was on meeting the time frames established in NSPM-14 to identify existing biodefense efforts in this first year and that not all processes had been fully developed prior to the data collection effort. OMB staff acknowledged that there were challenges in the first year’s data collection effort, and said data quality would likely improve in future years as agencies adjust their internal structures to suit the demands of the NSPM-14 process. Officials from HHS and OMB staff stressed that this process will be iterative, with the first year being primarily about outlining the existing biodefense landscape. Our prior work on organizational transformations states that incorporating change management practices improves the likelihood of successful reforms and notes that it is important to recognize agency cultural factors that can either help or inhibit reform efforts. We have also reported that identifying cultural features of the originating components, prior to, or early on, in the transformation process, can help leadership gain a better understanding of their beliefs and values. Incorporating this type of change management practice can help educate agencies to better understand the varying missions and how those missions support the broader enterprise-wide effort. We have also noted the importance of communication and obtaining feedback from participants to help promote ownership for the transformation. This type of approach to managing risk across a multi-agency, multi-sectoral enterprise like biodefense is complex and novel. During our interviews, agency officials recognized a need for change management practices to support this effort in future years. Agency officials we interviewed noted that the process for the identification of biodefense resources and activities across the federal government outlined by NSPM-14 could be “transformational” for the biodefense enterprise and approached the data collection process in good faith, but said that it will take time to get right. The biodefense agencies are currently assessing the activities and challenges of the first year of implementation, and they plan to develop an after action report on lessons learned. HHS has conducted a survey and interviews to collect information and the material is being analyzed, but the lessons learned document is not yet final. HHS has not worked with the other biodefense agencies, however, to undertake an intentional effort to manage key cultural aspects of the enterprise-wide approach—such as communication and education mechanisms to help bridge organizational cultures, promote ownership of the transformation, and emphasize awareness of joint national security responsibilities. Further, HHS has not worked with the other biodefense agencies to establish feedback and monitoring mechanisms or processes, that can help identify implementation challenges and develop solutions to address those challenges, particularly early implementation issues that might threaten the efficacy of the effort if they are institutionalized going forward. A systematically developed plan for managing change could help ensure effective planning to sustain and advance transformation in the early years. Such a plan could address (1) institutionalizing learning and feedback mechanisms that allow for corrective action and ensure that issues that arise in early implementation—for example, incomplete or unreliable data—do not become entrenched in a way that plagues the future years’ efforts; and (2) establishing a communication and education strategy to reinforce collaborative behaviors, enterprise-wide approaches, and to emphasize accountability for shared national security missions, outcomes, and procedures. The Strategy Implementation Efforts Lack Clear Methods Guidance, and Lack Plans to Help Ensure the Ability to Perform Meaningful Analysis We found a lack of clear procedures and planning to help ensure that the Biodefense Coordination Team is prepared to analyze the data, once it has been collected, in a way that that leads to recognition of meaningful opportunities to leverage resources in efforts to maintain and advance national biodefence capabilities. In particular, HHS (1) has not documented guidance and methods for analyzing the data, including but not limited to methods and guidance for how to account for the contribution of nonfederal capabilities; and (2) does not have a resource plan for staffing and sustaining ongoing efforts. Methods and guidance for analyzing data. We found that the processes for the Biodefense Coordination Team to analyze the results of all the individual agency data submissions and identify priorities to guide resource allocation were not agreed upon or documented prior to the agency efforts and continue to lack specificity and transparency. At the time of our interviews, agency officials were in the midst of compiling and assigning budget numbers to their programs, projects, and activities. Officials we spoke with expressed uncertainty about how the information would be used. For example, officials from four agencies said they were uncertain about fundamental elements of the implementation process, including how information gathered will be used to identify gaps and set priorities. The overarching purpose of the analysis described in NSPM-14 is identification of gaps, shortfalls, and redundancies to support the goals and objectives of the Strategy. However, NSPM-14 does not specifically articulate what is meant by these terms. In response to our question about how the analysis was to be conducted, the Office of the Assistant Secretary for Preparedness and Response—the HHS office responsible for leading the Biodefense Coordination Team—described a general process that reflects the high-level description laid out in NSPM-14. HHS officials also stated that the Biodefense Coordination Team had consulted with experts in budget, planning, and evaluation while developing the methodology. However, HHS has not documented specific guidance and methodologies to help ensure transparency and accountability across the interagency and consistency in the Biodefense Coordination Team’s analysis. Additionally, the initial effort to collect information on all programs, projects, and activities focused on existing federal activities did not include a complete assessment of biodefense capabilities at the nonfederal level. Processes for soliciting nonfederal capabilities that contribute to the biodefense enterprise and are necessary to support the Strategy’s implementation are not articulated in NSPM-14. Moreover, the guidance document that agencies used for the data call stated that the Biodefense Coordination Team—in coordination with National Security Council and OMB staff—was to, among other things, use the information provided by the agencies to analyze the extent to which current U.S. Government resources support the goals and objectives of the Strategy. Officials from two agencies also said that not gathering information from the private sector and other existing biodefense working groups was a limitation in the information gathering process for this first year. Officials said these entities provide valuable subject matter expertise and including input from them in the future could help identify gaps across the biodefense enterprise. Some agencies included information about their work to support nonfederal stakeholders in their data collection effort, for example, by listing their grant programs or cooperative agreements. In addition, during our interviews, officials from all eight agencies described efforts to involve nonfederal partners when developing the Strategy and many described outreach efforts to obtain information since the Strategy’s release. For example, HHS issued a notice in the Federal Register and the Biodefense Coordination Team held a summit related to the implementation of the National Biodefense Strategy to engage nonfederal stakeholders. However, the Biodefense Coordination Team was not explicitly required to analyze nonfederal resources and there was no guidance that would help ensure agencies consistently and systematically included the contributions of nonfederal capabilities. In 2011, we reported that few of the resources required to support national biosurveillance capabilities are wholly owned by the federal government. Effective response to significant national biological incidents also relies heavily on nonfederal resources and capabilities. Because nonfederal entities own many of the resources and capabilities needed to achieve the goals and objectives outlined in the Strategy, assessing the baseline and identifying investment needs for a national biodefense capability necessarily involves assessing nonfederal entities’ ability to support a national capability. Officials from one of the agencies initially tasked with developing the biodefense strategy said the Biodefense Coordination Team needs to develop engagement structures with nonfederal partners, because currently, there is not a system in place to get everyone’s views or learn of what is going on outside the federal government. Our enterprise risk management work calls for agencies to identify and assess risks to be able to select among risk reduction alternatives. Enterprise risk management requires good information and analysis to enable officials to make informed trade off decisions across alternatives. Although the NSPM-14 process is designed to enable this kind of assessment and selection, it will not be as effective without complete information at the risk identification stage. Effective enterprise risk management implementation starts with agencies establishing a customized program that fits their specific organizational mission, culture, operating environment, and business processes. In our guide for designing evaluations, we called for plans to analyze data in ways that allow for valid conclusions to be drawn. Although the NSPM-14 guidance provides a high-level process that serves as a solid foundation for an effort as complex as managing risk across the entire biodefense enterprise, it does not provide the kind of specific guidance that can help all the involved agencies ensure they are operating off a common set of procedures that fits the particular needs of this effort. Furthermore, an analysis that cannot consistently account for the contribution of nonfederal capabilities does not reflect the true enterprise operating environment and limits the selection of alternatives available for managing risk. Clear and specific documentation of methodologies and procedures for analysis—including guidance on the methods to account for nonfederal capabilities—would provide better guidance for agencies that submit information for the assessment, assurance of more complete information to assess the state of national capabilities, and better overall transparency, accountability, and consistency. Staffing, supporting, and sustaining ongoing efforts. Officials we interviewed expressed concern about the resources that the Biodefense Coordination Team had available to it, both in the first year and on an ongoing basis. According to officials from five of the eight agencies, in order for the team to be most successful, it would need to be staffed by detailees from the participating agencies. However, officials we spoke with told us that not all agencies were able to provide a full-time detailee to help support the office. Without a dedicated liaison to the Biodefense Coordination Team, agencies may have less access to information and more limited influence over the iterative process. We have previously reported that agencies need to identify how interagency groups will be funded and staffed. HHS, which serves a leadership role on the Biodefense Steering Committee, identified in its fiscal year 2020 budget request $5 million for the resources necessary to help carry out its administrative functions for implementing the National Biodefense Strategy. However, HHS appropriations for fiscal year 2020 did not include the $5 million HHS requested. In addition, in our work on leading practices for agency reform efforts we stated that having a dedicated implementation team that has the capacity—including staffing and resources—can help ensure successful transformation. However, officials from multiple agencies reported that the initial planning for the staffing and responsibilities for the Biodefense Coordination Team had not been finalized. Without a plan to help ensure resources and mitigate resource challenges for ongoing efforts, the Biodefense Coordination Team risks not having the capacity it needs to conduct meaningful analysis, which would undermine the vision created by the Strategy and NSPM-14. Processes and Roles and Responsibilities for Making Joint Decisions Lack Clarity and Are Not Fully Developed The governing bodies overseeing the National Biodefense Strategy’s implementation—the Biodefense Steering Committee and Biodefense Coordination Team—did not clearly document key components of the assessment process and roles and responsibilities for joint decision- making in the first year of NSPM-14 implementation. This raises questions about how these bodies will move from an effort to catalog all existing activities to decision-making that accounts for enterprise-wide needs and opportunities. For example, officials from multiple agencies were not certain how the group would make joint decisions regarding priority setting and the allocation of resources, how the group would assign new biodefense responsibilities if gaps were identified, and to what extent the Biodefense Steering Committee could enforce budgetary priorities, if at all. Process for leveraging or directing resources. We found a lack of shared understanding and agreement about how the interagency process would work to align resources toward any identified gaps and reconfigure resources for any identified redundancies or inefficiencies. To address needs for new appropriations, NSPM-14 lays out a process to identify the need for additional resources to support the goals of the Strategy and how agencies will consider the joint policy guidance in their budget requests to Congress, but this coordination process also remains ambiguous and untested. OMB staff said the 2022 budget cycle would be the first year that agencies consider the joint policy guidance to inform their budget submissions, as envisioned by the Strategy and NSPM-14 process, as that guidance is still being developed. Officials from four agencies expressed reluctance to redirect resources away from their core missions to better support any enterprise-wide identified needs. When asked about the process outlined in NSPM-14, officials from only one of the eight agencies we interviewed said that the governing bodies were well-positioned to assign new responsibilities in response to identified gaps. Further, officials we interviewed noted that new responsibilities or activities may be difficult to implement without additional appropriations or authorities approved by Congress, or they would compete with an agency’s other priorities. When discussing their understanding of the process for prioritization and determining which agencies require what resources to help implement the Strategy, officials from four agencies referenced the NSPM-4 process (within the White House) to help guide this process. NSPM-14 also references NSPM-4, as noted above, and states the Biodefense Steering Committee seeks to reach consensus on decisions, and should any disagreements arise, the issue will be addressed through the NSPM-4 process. Through this process, the Assistant to the President for National Security Affairs serves as the lead for policy coordination and review to provide strategic input and facilitate policy integration for federal biodefense efforts. When we asked HHS officials for more specific decision-making guidance, they continued to cite the existing processes and directives for interagency decision-making. However, we found that neither of these Presidential memorandums detailed specific decision-making principles or steps for reaching consensus or even for raising decision points about how to best leverage or direct resources across the enterprise in response to gaps and inefficiencies. Similarly, agency officials we interviewed were not clear how this process would work, how decisions would be made, or how agencies would agree to take on new responsibilities to bridge gaps to achieve the Strategy’s goals. Roles and responsibilities. Similarly, the governing bodies have not fully defined the roles and responsibilities for making enterprise-wide decisions that affect individual agency budgets and for enforcing enterprise-wide budget priorities. NSPM-14 directs the heads of agencies to monitor, evaluate, and hold accountable their agencies for implementation of the Strategy, and describes how agencies will develop their budgets with consideration of the agreed upon joint policy guidance developed by the agencies and the White House. However, as with other parts of the NSPM-14 implementation process, the details regarding specific roles and responsibilities for directing and enforcing budget decisions lack detail and specificity. Additionally, officials from four agencies stated that the charter for the Biodefense Coordination Team has not been finalized, further delaying the articulation of roles and responsibilities and the ability to establish a shared agenda and common operating picture. As a result, some officials remain skeptical of the effectiveness of any decisions made. For example, officials from four agencies said the Biodefense Steering Committee does not have the authority to decide how individual agencies in the broader biodefense enterprise should allocate resources or prioritize programs. Officials we spoke with also provided examples of how this part of the implementation process requires attention and will from stakeholders outside the Biodefense Steering Committee, including the National Security Council staff, OMB, and the Congress. For example, officials from two agencies said turnover within the National Security Council staff had contributed to a lack of consistent leadership from the White House, which created a “lapse in momentum” and disrupted the implementation process. Additionally, officials said that key parts of the implementation process, such as the finalization of metrics, milestones and end states, as well as agreement on the federal agency roles and responsibilities for the biodefense activities articulated in the Strategy, had not been approved by the National Security Council staff. As of January 2020, these documents had not received National Security Council staff approval as the process for the development of metrics, milestones and end states is considered ongoing, which could lead to inefficiencies and delay effective implementation of the Strategy’s goals. Finally, officials we interviewed also discussed Congress’s key role as part of the regular federal budget process in determining agency appropriations. For example, officials from two agencies said it will be hard to predict whether the budget component expressed in NSPM-14 to assess and prioritize biodefense programs and activities will achieve its intended outcome. Some agency officials also believed the process to use joint policy guidance to inform annual budget submissions would not be entirely dissimilar to the annual budgetary process, as agencies will continue to submit their proposed budgets and wait for Congress to make appropriation decisions. However, we have previously reported that sustained congressional attention helps ensure that agencies continue to achieve progress resolving complex issues. We previously reported that determining the sources and types of resources needed and where those resources should be targeted are key decisions that effective national strategies should support. We also reported that effective national strategies should help clarify implementing organizations’ relationships in terms of leading, supporting, and partnering—in the context of the Strategy, that includes how enterprise- wide decisions about leveraging or directing resources to fill gaps and reduce inefficiency will be made and by whom. These could include gaps in policy, programming, or funding. Similarly, our previous work has found that articulating and agreeing to a process for making and enforcing decisions can improve the clarity surrounding a shared outcome, and that articulating these agreements in formal documents can strengthen agency commitment to working collaboratively and provide the overall framework for accountability and oversight. Moreover, a key aspect of enterprise risk management is creating a foundation that will enable participants to consider and prioritize alternatives. This prioritization can be based on a number of factors, such as the degree of risk reduction alternatives afford and the cost and difficulty to implement them. However, to do this at the enterprise level, the interagency participants need to agree on processes, roles, and responsibilities for enterprise-wide decision-making. This is particularly important in the context of enhancing efficiency and effectiveness in a broad mission space like biodefense where there is a wide array of threats and the threat landscape continually evolves. Uncertainty around the mechanisms to identify enterprise-wide priorities along with the lack of clearly documented and agreed upon processes, roles, and responsibilities for joint decision-making jeopardize the Strategy’s ability to enhance efficiency and effectiveness of the nation’s biodefense capabilities. In the absence of clearly articulated and agreed upon processes and procedures for joint decision-making to leverage or direct resources across agency boundaries in order to enhance efficiencies, agencies run the risk of continuing to work in stovepiped mission spaces and collecting information that does not serve its intended purpose. Full development and documentation of the processes, roles, and responsibilities for leveraging or directing resources across the enterprise in response to identified gaps and inefficiencies would enhance transparency and clarity for future year’s efforts and help establish a common operating picture that enables trade-offs across agency missions. Conclusions The National Biodefense Strategy, released in September 2018, and the establishment of interagency governance and budgeting mechanisms to help implement the Strategy constitute a promising new approach to establishing a transformational enterprise-wide endeavor that meaningfully enhances the effectiveness and efficiency of government- wide biodefense efforts. These efforts include establishing a framework to collect and compare biodefense programs, projects, and activities across the federal government, which could facilitate enterprise-wide decision- making and budget tradeoff decisions to help ensure the most efficient use of the nation’s biodefense resources. However, these efforts represent a start to a process and a cultural shift that may take years to fully develop. During the first year of implementation, agencies have faced numerous challenges that must be overcome to ensure long-term implementation success. While agencies remain optimistic about the potential benefits of this new approach, it is imperative that additional steps be taken to ensure the challenges experienced early on are not institutionalized and that there is an intentional communication, education, and feedback effort to reinforce collaborative behaviors and enterprise-wide accountability for national security missions. A plan that includes change management practices to help bridge agency cultures and missions, such as efforts to reinforce collaborative behaviors and enterprise-wide approaches, can help ensure agencies continue to refine their interagency efforts and adapt to changes and respond effectively to challenges along the way. In addition, without clear methods and guidance that articulate how all relevant information should be analyzed, including ensuring nonfederal roles, responsibilities, and resources are accounted for in the assessment, the Biodefense Coordination Team’s ability to effectively use the information to support enterprise risk management will be limited. Moreover, without a plan to help ensure resources for sustaining ongoing institutional support, the Biodefense Coordination Team risks not having the capacity it needs to conduct meaningful analysis and decision making processes. Finally, without the development and documentation of the processes, roles, and responsibilities for joint decision making regarding the identification of priorities and for raising decisions about resource alignment across agencies, it will be difficult to sustain an enterprise-wide approach to managing risk across the biodefense enterprise. These actions could help guide agencies towards a common operating picture and shared understanding of the efforts needed beyond their individual missions. The intersection of human, animal, plant, and environmental health, as well as the nexus to the national security and economic sectors, represent challenges that no single agency can address alone. The National Biodefense Strategy was written to help link these efforts and additional planning and guidance would help enable the agencies to achieve the Strategy’s goals. Recommendations for Executive Action We are making the following four recommendations to the Secretary of HHS: The Secretary of HHS should direct the Biodefense Coordination Team to establish a plan that includes change management practices—such as strategies for feedback, communication, and education—to reinforce collaborative behaviors and enterprise-wide approaches and to help prevent early implementation challenges from becoming institutionalized. (Recommendation 1) The Secretary of HHS should direct the Biodefense Coordination Team to clearly document guidance and methods for analyzing the data collected from the agencies, including ensuring that nonfederal resources and capabilities are accounted for in the analysis. (Recommendation 2) The Secretary of HHS should direct the Biodefense Coordination Team to establish a resource plan to staff, support, and sustain its ongoing efforts. (Recommendation 3) The Secretary of HHS should direct the Biodefense Coordination Team to clearly document agreed upon processes, roles, and responsibilities for making and enforcing enterprise-wide decisions. (Recommendation 4) Agency Comments We provided a draft of this report to HHS, USDA, DOD, DHS, State, VA, Justice, EPA, the National Security Council staff, and OMB for review and comment. In its written comments, which are reproduced in appendix III, HHS concurred with our four recommendations and provided additional information on the steps the agency has taken or plans to take to address our recommendations. To address recommendation 1 for the Biodefense Coordination Team to establish a plan that includes change management practices, HHS reported that it had implemented change management practices to include strategies for feedback, communication, and education. Specifically, the letter describes plans to institutionalize an after-action survey following the interagency data collection effort each year and a communications and outreach plan that was informed by multiple sources of stakeholder input. In technical comments, officials also described meetings across different components of the participating agencies that the Biodefense Coordination Team has held to help bridge organizational cultures and promote ownership. These actions, if implemented effectively, are important steps toward addressing the intent of our recommendation. At the same time, it is important to recognize the extent to which the enterprise-wide approach—making resource decisions in the context not only of each agency’s separate mission and authorities, but also to further a shared national security mission—represents a cultural shift. In technical comments, HHS officials acknowledged that opportunities exist to continue to enhance cultural aspects of the enterprise-wide approach and noted that the participation of all the agencies will be important. In addition VA, State, and EPA—in technical comments and written responses—commented on the ability of the Biodefense Steering Committee and Biodefense Coordination Team to drive enterprise-wide decision-making. They noted challenges like the limitations in these bodies’ authority to direct action and the difficulty of achieving consensus across so many actors. (See Department of Veterans Affairs’ letter reproduced in appendix IV.) HHS also concurred with recommendation 2 about clear documentation of guidance and methods for analyzing the data collected from the agencies, including ensuring that nonfederal resources and capabilities are accounted for in the analysis. However, in its written response, HHS reiterated the assessment steps it already described during our review, but it did not provide additional documentation containing more concrete and detailed methods for the analysis. HHS noted the Biodefense Coordination Team’s limited responsibilities to address nonfederal resources in the annual assessment, as described in NSPM-14. HHS also expressed in its technical comments that NSPM-14 does not charge the Biodefense Coordination Team with analyzing or accounting for nonfederal capabilities in any formal or specific way. We recognize the challenges involved with assessing nonfederal capabilities, but disagree with HHS’s characterization of the Biodefense Coordination Team’s responsibilities. According to NSPM-14, the foundation for the United States Government’s role in the biodefense enterprise is the National Biodefense Strategy and its implementation plan. The memorandum further states that agency biodefense activities shall be conducted consistent with the National Defense Authorization Act for Fiscal Year 2017 (NDAA), which provides that the strategy is to include an articulation of related whole-of-government activities required to support the strategy. We have previously reported that parts of the biodefense enterprise, such as the resources that support surveillance capabilities, are heavily reliant on nonfederal resources. Moreover, the National Biodefense Strategy states that it is broader than a federal government strategy, rather a call to action for various nonfederal entities. Therefore, to fully address our recommendation, we continue to believe that NSPM-14 notwithstanding, HHS should develop and document clear guidance for the data collection and analytical methods that will support the NDAA’s call for articulation of the capabilities that support national biodefense and recommendations for strengthening those capabilities. Regarding recommendation 3 for the Biodefense Coordination Team to establish a resource plan to staff, support, and sustain its ongoing efforts, HHS concurred, and said it requested $5 million in no-year funding in its fiscal year 2020 budget request to support the administrative management of the National Biodefense Strategy. However, as we reported, the HHS appropriations for fiscal year 2020 did not include the $5 million HHS requested and officials from multiple agencies reported that the initial planning for the staffing and responsibilities for the Biodefense Coordination Team had not been finalized. To fully address our recommendations, HHS will need to establish a resource plan that would describe how the Biodefense Coordination Team plans to staff, support, and sustain its efforts. Finally, HHS concurred with recommendation 4, for the Biodefense Coordination Team to clearly document agreed upon processes, roles, and responsibilities for making and enforcing enterprise-wide decisions. In its response, HHS points to the authority NSPM-14 gives the Biodefense Coordination Team to establish governance, policies, and procedures, subject to the approval of the Biodefense Steering Committee. HHS stated that the Biodefense Coordination Team had developed charters and guidance to govern its activities, but said that these documents were still pending the approval of the Biodefense Steering Committee. We will continue to evaluate these actions to determine the extent to which they fully address our recommendation. To fully address our recommendation, HHS in partnership with other participating federal agencies should agree upon and document clear guidance, roles, and responsibilities for addressing shared national security concerns with interagency resources and solutions that transcend the mission and capabilities of the individual agencies. Irrespective of NSPM-14, clarifying decision making processes should help the agencies identify the recommendations for improved capabilities, authorities, command structures, and interagency coordination called for by the NDAA and make incremental progress over time toward implementing those recommendations. We are sending copies of this report to the appropriate congressional committees; the Secretaries of the Departments of Health and Human Services, Agriculture, Defense, Homeland Security, State, and Veterans Affairs; the Attorney General; the Administrator of the Environmental Protection Agency; and the Director of the Office of Management and Budget. In addition, the report is available at no charge on the GAO website at https://www.gao.gov. If you or your staff have any questions about this report, please contact Chris Currie at (404) 679-1875 or CurrieC@gao.gov, and Mary Denigan- Macauley at (202) 512-7114 or DeniganMacauleyM@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III. Appendix I: Analysis of the National Biodefense Strategy and Its Associated Plans against Elements Listed in Statute The National Defense Authorization Act for Fiscal Year 2017 (NDAA) articulated eight elements to include in the required National Biodefense Strategy (Strategy). The NDAA also included a provision that we review the Strategy. As part of our analysis, we assessed the extent to which the Strategy and its associated plans incorporated the elements listed in the NDAA. On March 14, 2019, we briefed the committees of concern (as identified in the NDAA) on our findings, which we present here. To determine the extent to which the National Biodefense Strategy incorporated the elements established in the NDAA, three analysts and an attorney independently evaluated the Strategy and NSPM-14 against each NDAA element, recording scores on separate matrices. The reviewers used the following descriptors to assess the extent to which the Strategy included an element: Great Extent – explicitly cites all elements, even if specificity and detail is lacking and thus could be improved upon; Some Extent – explicitly cites some, but not all, elements; No Extent – does not explicitly cite or discuss any elements, or any implicit references are either too vague or general. The analysts and attorney then convened as a panel to reconcile any differences in scoring to reach consensus. We also interviewed officials from the agencies which comprise the Biodefense Steering Committee to gain contextual information regarding the Strategy’s development as well to help identify any challenges that agencies faced in addressing any of the statutory elements during the development process. As of the date of our briefing in March 2019, the National Biodefense Strategy and associated plans generally addressed most of the elements in the NDAA, and agencies continued to develop additional key components. Specifically, for five of the eight NDAA elements, the Strategy and associated plans addressed the major parts of the elements with few or no omissions. For the other three NDAA elements, some parts were still under development. As of March 2019, the National Biodefense Strategy and Associated Plans Generally Addressed Five of Eight Elements in the NDAA We found in March 2019 that the National Biodefense Strategy and its associated plans generally addressed five out of eight elements listed in the NDAA, even if some of these elements lack specificity and detail. For example, where we determined the Strategy and associated plans included an element to a great extent, we recognize that these documents reflect the intent of the required element, even if improvement could be made in future revisions. Figure 5 identifies the eight elements required by the NDAA and our assessment on the extent to which those elements were included in the Strategy and associated plans. Specifically, the Strategy and related documents include a description of biological threats and the capabilities necessary to address threats, as well as recommendations for improving current biodefense capabilities, authorities, structures and interagency coordination. Description of biological threats. The NDAA provides that one element to be addressed in the strategy is a description of various biological threats. The Strategy includes a description of biological threats, as well as additional contextual information about those threats and their place within the overall threat environment. For example, the Strategy describes biological warfare, bioterrorism, naturally occurring infectious diseases, and accidental exposures as significant threats. Articulation of necessary capabilities. One element listed in the NDAA is an articulation of related or required interagency capabilities and whole- of-Government activities required to support the Strategy’s priorities. The Strategy provides a list of five goals, with associated objectives and activities that articulate the capabilities necessary to fulfill the aims of the Strategy, such as the need to improve interagency capabilities. For example, one such activity describes the need to improve state, local, tribal, territorial, private sector, federal, regional, and international surveillance systems and networks to contain, control and respond to biological incidents. Another activity involves strengthening the ability to detect zoonotic diseases and incorporating forecasting into intelligence collection by federal agencies. This articulation of necessary capabilities addresses the NDAA element to a great extent, even though we noted that additional steps to include nonfederal capabilities in the annual assessment of programs, projects, and activities would enhance implementation efforts. Recommendations for improving current biodefense capabilities. Another element listed in the NDAA is to identify recommendations for strengthening and improving current biodefense capabilities, authorities, and command structures. The Strategy contains descriptions of activities necessary to improve upon current biodefense efforts and to help agencies establish new means to fulfill the goals of the Strategy. NSPM- 14 establishes a new governance structure (command structure) to help implement the Strategy and also includes a mechanism for continual revision of the Strategy, including recommendations for strengthening biodefense activities, based on identified needs. Recommendations for interagency coordination. The NDAA also provided that the Strategy include recommendations for improving and formalizing interagency coordination and support mechanisms with respect to a strong national biodefense. The Strategy and associated plans address this element by establishing collaborative interagency structures—the Biodefense Steering Committee and the Biodefense Coordination Team—intended to work continually on improving biodefense. NSPM-14 also identifies a focal point for coordination among agencies—the Secretary of HHS. Other matters identified by agencies. The final element is to include any other matters deemed necessary by the secretaries of Defense, Health and Human Services, Homeland Security, and Agriculture. According to officials from all eight agencies, the agencies originally tasked with authoring the Strategy opened the process up to all agencies with a stake in the biodefense enterprise because they recognized those four agencies could not develop a comprehensive biodefense strategy if all partners were not included. Officials from all of the agencies on the Biodefense Steering Committee cited the inclusive nature of the drafting process as contributing to a conceptually robust Strategy. Additionally, NSPM-14 includes a requirement for the development of metrics, milestones, and end states for implementing the Strategy, and officials from all eight agencies we interviewed said the interagency group drafted them and officials from 6 of the 8 agencies said they are under review by the National Security Council staff. Agencies Continued to Implement Key Elements of the Strategy and Associated Plans As of March 2019, three of 8 elements listed in the NDAA were only included to some extent because agencies implicitly addressed the element through their work, or have started addressing parts of the elements but not yet completed them. The main body of the report discusses some of the ongoing challenges related to the Strategy’s implementation. Inventory and assessment of doctrine. To some extent, the Strategy addresses the element related to an inventory and assessment of all existing strategies, plans, policies, laws, and interagency agreements related to biodefense. The agencies implicitly addressed this element by incorporating existing doctrine in the process of drafting the Strategy. For example, officials at a majority of the 8 agencies said that agencies deliberately wrote the Strategy in a way that reflects their ongoing priorities in the area of biodefense or takes into account existing agency policies or strategies. The Strategy and NSPM-14 explicitly reference some existing executive orders, presidential directives, and international treaties related to biodefense, though it excludes reference to many relevant agency-level strategies, plans, policies, laws, and interagency agreements. For example, the Strategy reinforces obligations under the Convention on the Prohibition of the Development, Production, and Stockpiling of Bacteriological and Toxin Weapons and on their Destruction (Biological Weapons Convention) (1975), but does not mention the HHS’s National Health Security Strategy, which informs a number of HHS programs that contribute to the biodefense enterprise. According to HHS officials, an inventory of doctrine was completed and submitted to Congress along with the transmittal of the Strategy, when it was released. However, not all officials we spoke to believe this work is fully completed, and officials from several agencies said they are currently evaluating their internal policies and strategies to determine how they align with the new Strategy. Catalogue of current activities. The NDAA also included an element related to a description of the current programs, projects, or activities of the United States Government with respect to biodefense. While the Strategy itself does not include a catalogue of such activities, the NSPM- 14 process requires agencies to create this catalogue, and efforts to do so are described in the body of this report. NSPM-14 requires the Chair of the Biodefense Steering Committee to send written requests for information to agencies with biodefense responsibilities, including 17 agencies mentioned in the NSPM. According to HHS officials agencies completed this collection of information in June 2019. NSPM-14 directs the Biodefense Coordination Team to use the information gathered to produce an overall assessment of federal biodefense programs and coordinate the assessment with National Security Council staff and OMB prior to its finalization and approval by the Biodefense Steering Committee. Under NSPM-14, this process will occur annually as part of the budget cycle. We characterized this element as included to some extent because efforts to complete it were underway at the time of our briefing in March 2019. Additionally, as we describe in the body of the report, we identified areas of this process to be clarified for future years’ efforts. Agency roles and responsibilities. The Strategy and associated plans did not include a description of the roles and responsibilities of the Executive Agencies, including internal and external coordination procedures, in identifying and sharing information, as described in the NDAA. The Strategy’s implementation plan includes over 240 activities, but it does not assign roles and responsibilities for performing those activities. However, NSPM-14 includes a requirement to establish these roles and responsibilities, and officials from all of the 8 agencies said agencies drafted a document assigning roles and responsibilities to each agency. This document was submitted for review to the National Security Council staff. Agency officials also discussed their engagement with nonfederal partners on the Strategy, as they play a vital role in the Strategy’s implementation. However, as we describe in the body of the report, more can be done to articulate the nonfederal role in implementing the Strategy. Additionally, NSPM-14 describes a governance structure and initial responsibilities for executive agencies, such as identification of a senior-level official as the focal point for all federal biodefense efforts. However, as described in the body of this report, additional clarity is needed on specific roles and responsibilities regarding decision-making and leadership. Therefore, we consider this element addressed to some extent. As of October 2019, the agencies took additional steps to address the elements listed in the NDAA. For example, the data collection of the programs, projects, and activities was complete, and the assessment of those data submissions was in draft form. Additionally, the agencies drafted metrics, milestones, and end states, as well as roles and responsibilities for the over 240 activities outlined in the Strategy’s Implementation Plan. However, both of these documents had not received final approval from the National Security Council staff, and the charter outlining roles and responsibilities for the Biodefense Coordination Team had not been finalized. Appendix II: Descriptions of Long-standing Biodefense Challenges Previously Reported Since 2009, we have identified broad, cross-cutting issues in leadership, coordination, and collaboration that arise from fragmentation throughout the complex interagency, intergovernmental, and intersectoral biodefense enterprise. The biodefense enterprise is the whole combination of systems at every level of government and the private sector that contribute to protecting the nation and its citizens. It is composed of a complex collection of federal, state, local, tribal, territorial, and private resources, programs, and initiatives designed for different purposes and dedicated to mitigating both natural and intentional risk. In June 2019, we testified before the Subcommittee on National Security, Committee on Oversight and Reform, House of Representatives on our past work, which has identified a number of key challenges related to the nation’s ability to detect and respond to biological incidents that transcend what any one agency can address on its own. They include: (1) enterprise-wide threat determination, (2) biodetection technologies, (3) emerging infectious disease surveillance, (4) situational awareness and data integration, and (5) biological laboratory safety and security. Agencies have taken steps to address many of the recommendations we and others have made in these areas, and we continue to monitor ongoing efforts. Enterprise-Wide Threat Determination Needed to Help Leverage Resources and Inform Resource Tradeoffs. We reported in October 2017 that opportunities remain to enhance threat awareness across the entire biodefense enterprise, leverage shared resources, and inform budgetary tradeoffs among various threats and agency programs. Key biodefense agencies, including DHS, DOD, HHS, USDA, and EPA carry out activities within their own mission spaces to better understand threats and help make decisions about biodefense investments. Additionally, federal agencies in our October 2017 review had mechanisms to support specific federal activities and individual programs, or in response to specific biological incidents after they begin to unfold. However, there was no existing mechanism that could leverage threat awareness information to direct resources and set budgetary priorities across all agencies for biodefense. Without a mechanism that is able to assess the relative risk from biological threats across all sources and domains, we found that the nation may be limited in its ability to prioritize resources, defenses, and countermeasures against the most pressing threats. In June 2019, we said implementation of the National Biodefense Strategy offers the potential for the nation to progress toward more integrated and enterprise-wide threat awareness and to use that information to identify opportunities to leverage resources, but this will take time and entails a change in the way participating agencies have traditionally operated. Challenges Determining Optimal Biodetection Technology Solutions. We have previously reported on the challenges of determining and then implementing technologies capable of identifying biological threats in the environment. Since 2012 we have reported that DHS has faced challenges in clearly justifying the need for the BioWatch program and its ability to reliably fulfill its primary task of detecting aerosolized biological attacks. According to DHS officials, DHS is in the early stages of Biodefense 21 (BD21), a multi-year acquisition effort. DHS plans to develop requirements based on collected environmental data and input from first responders, public health officials, and other partners determine what the replacement to BioWatch needs to be. As part of the early acquisition cycle for BD21, DHS is currently conducting a technology demonstration for trigger and sensor technology; therefore we cannot yet determine how it will be implemented in the future or what decisions DHS will ultimately make regarding the existing BioWatch system. Additionally, in August 2017 we reported that from a homeland security and public health perspective, threats of bioterrorism, such as anthrax attacks, and high-profile disease outbreaks, such as Ebola and emerging viruses like dengue, chikungunya, and Zika, highlight the continued need for diagnostic tests that provide early detection and warning about biological threats to humans. One option being explored is multiplex point-of-care technologies which can simultaneously test (in minutes to a few hours) for more than one type of human infectious disease pathogen from a single patient sample (such as blood, urine, or sputum) in one run at or near the site of a patient. These technologies may be used for diagnosing different diseases, including more common diseases such as influenza, emerging infectious diseases, or diseases caused by weaponized biological agents. Advances in biological detection technologies present opportunities to provide early detection and warning of catastrophic biological incidents, and in June 2019 we said the agencies responsible for implementing the National Biodefense Strategy will need to engage on this issue in a way that helps to drive informed investment tradeoff decisions about technology alternatives. We also recognized that the National Biodefense Strategy and its interagency governing leadership offer the potential for the nation to better define the role of detection technologies in a layered national biodefense capability to help those that pursue these technologies better articulate the mission needs and align requirements and concepts of operation accordingly. Challenges Building and Maintaining Emerging Infectious Disease Surveillance. We have reported that establishing and sustaining biosurveillance capabilities can be difficult for a myriad of reasons. For example, maintaining expertise in a rapidly changing field is difficult, as is the challenge of accurately recognizing the signs and symptoms of rare or emerging diseases. We reported in October 2011 that funding targeted for specific diseases does not allow for focus on a broad range of causes of morbidity and mortality, and federal officials have said that the disease- specific nature of funding is a challenge to states’ ability to invest in core biosurveillance capabilities. According to federal, state, and local officials, early detection of potentially serious disease indications nearly always occurs first at the local level, making the personnel, training, systems, and equipment that support detection at the state and local level a cornerstone of our nation’s biodefense posture. In May 2018, we reported that officials from HHS told us that their grant awards funded by annual appropriations are intended to establish and strengthen emergency preparedness and capacity building, but may not fully support the need for surge capacity that states and other jurisdictions require to respond to an infectious disease threat. Further, we reported in May 2018 that although the awards funded by supplemental appropriations have allowed state and local public health departments, laboratories, and hospitals to surge during a threat—for example, the H1N1influenza and Zika virus outbreaks—most of the 10 non-federal stakeholders we interviewed, as well as HHS officials said that the timing of these awards can result in challenges to carrying out preparedness and response activities during infectious disease threats. In June 2019, we reported that how and to what extent implementation of the National Biodefense Strategy is able to efficiently leverage and effectively sustain capacity across both nonfederal and federal stakeholders will affect how prepared the nation is to more quickly gear up for whatever challenges emerge when outbreaks of previously non- endemic diseases threaten the nation. We also noted that the Strategy and its interagency governance structure offer the opportunity to design new approaches to identifying and building a core set of surveillance and response capabilities for emerging infectious diseases. Ongoing Challenges to Fulfill Enhanced Situational Awareness and Data Integration Requirements. Our prior work has identified challenges at DHS and HHS related to the sharing, collecting, and integration of data from various federal and nonfederal agencies for their public health situational awareness and data integration efforts. We have reported that DHS’s National Biosurveillance Integration Center (NBIC), which was created to integrate data across the federal government with the aim of enhancing detection and situational awareness of biological incidents, has suffered from long-standing issues related to its clarity of purpose. Since 2009, we have reported that NBIC was not fully equipped to carry out its mission because it lacked key resources—data and personnel— from its partner agencies, which may have been at least partially the result of collaboration challenges it faced. In September 2015, we reported that despite implementing our prior recommendations and NBIC’s efforts to collaborate with interagency partners to create and issue a strategic plan that would clarify its mission and efforts, a variety of challenges remained. In October 2019, officials acknowledged that situational awareness and data integration are still very challenging problems to solve, but overall the relationships between NBIC and partner agencies are improving. Similarly, in 2017, we reported on long-standing challenges faced by HHS—such as planning and implementation shortfalls—to create a public health situational awareness network, not unlike that envisioned for DHS. In June 2019 we observed that because the National Biodefense Strategy identified biosurveillance data integration among several information sharing activities that need to be enhanced, its implementation offers the potential for the nation to better define what kind of integrated situational awareness is possible, what it will take to effectively and efficiently achieve it, and what value it has. Continued Oversight Needed to Enhance Biological Safety and Security. We—along with congressional committees—have, for many years, identified challenges and areas for improvement related to the safety, security, and oversight of high-containment laboratories. For example, in response to reported lapses in laboratory safety at HHS and DOD in 2014 and 2015, we examined how federal departments oversee their high-containment laboratories and found that most of the 8 departments and 15 agencies that we reviewed had policies that were not comprehensive or were not up to date. Additionally, we found that while the departments and agencies we reviewed primarily used inspections to oversee their high-containment laboratories, some of them were not routinely reporting inspection results, laboratory incidents, and other oversight activities to senior officials. In October 2017, we found that the Federal Select Agent Program—jointly managed by HHS and USDA—oversees laboratories’ handling of certain hazardous pathogens known as select agents and toxins, but the program does not fully meet all key elements of effective oversight. For example, the Federal Select Agent Program was not independent from all laboratories it oversees, and it had not assessed risks posed by its current structure or the effectiveness of its mechanisms to reduce organizational conflicts of interest. In June 2019, we said the National Biodefense Strategy highlights the need for continuous improvement of biosafety and biosecurity for laboratories and other facilities, creating an opportunity for interagency partners to develop additional oversight or other practices to mitigate the risk of bioincidents at high containment laboratories. Appendix III: Comments from the Department of Health and Human Services Appendix IV: Comments from the Department of Veterans Affairs Appendix V: GAO Contact and Staff Acknowledgments GAO Contact Chris P. Currie at (404) 679-1875 or CurrieC@gao.gov Mary Denigan-Macauley at (202) 512-7114 or DeniganMacauleyM@gao.gov. Staff Acknowledgments In addition to the contacts named above, Kathryn Godfrey (Assistant Director); Nick Bartine and Susanna Kuebler (Analysts-in-Charge); Jeff Cirillo; Michele Fejfar; Eric Hauswirth; Tracey King; Jan Montgomery; Matt Ray; and Adam Vogt made key contributions to this report.