Mainstreaming System Resilience Concepts into Transportation Agencies: A Guide (2021)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

27   Assess Current Practice (Step 1) The first step in the self-assessment tool is understanding the current state-of-practice in your agency as it relates to resilience. Resilience-related efforts to date in most transportation agencies have focused on emergency response and incident management, undoubt- edly very important program responsibilities. As noted in Chapter 2, however, enhancing transportation system resilience involves all units within a transportation agency, including efforts in policy direction, planning, project development/design, construction, operations, maintenance, asset management, and communications. Before identifying where your agency should focus on enhancing its resilience-related capabilities, you must first under- stand where you are starting. The concept of examining an organization’s capability or effectiveness from the perspective of its structure, processes, procedures, information flows, and level of collaboration is not new. Indeed, such an assessment has been the basis of most systematic efforts to change an organiza- tion or to foster innovative practices. This assessment can be done internally through formal (usually management-led) efforts having a mandate to improve agency effectiveness or produc- tivity. Alternately, it can be done with external third-party participation to lend an unbiased perspective on the assessment. The assessment includes understanding the mandate of each unit in the agency, an analysis of what that unit has done to achieve the goals associated with that mandate, and an examination of the types of plans and strategies unit managers can use to achieve these goals in the future. Capability Factors and Levels of Maturity Factor 1.1: Has your agency conducted and documented a self-assessment of what it can do to better integrate concerns for transportation system resilience into agency functions? This factor focuses on the level of attention agency management has given to identifying and implementing actions to improve the agency’s capabilities with respect to transportation system resilience. • Level 1: We are using this self-assessment tool/process to identify where our agency could implement changes to enhance our resilience activities. • Level 2: We have already used and documented a self-assessment tool/process to identify where our agency could implement changes to enhance our resilience activities. • Level 3: We have used and documented a self-assessment tool/process to identify where our agency could implement changes to enhance our resilience activities. Such changes have been implemented. The self-assessment tool/process is used at least every 3 years to identify further enhancements to our resilience efforts. C H A P T E R   3

28 Mainstreaming System Resilience Concepts into Transportation Agencies: A Guide Factor 1.2: As part of your self-assessment process, have you examined best practices from other agencies and organizations? Identifying best practices from peer organizations is one of the most common strategies for identifying possible actions to improve many aspects of your agency’s performance. This is particularly true when the focus of the self-assessment is on a topic that is relatively new to an organization such as resilience. The distinction in the levels of maturity for this factor reflects the level of effort your agency is making to seek examples of resilience best practices from other agencies. • Level 1: We identify best practices primarily from the literature and from what we hear at conferences and meetings. • Level 2: We have proactively identified function-specific best practices from other organiza- tions and have used them as indicators to measure our progress in specific functional areas. • Level 3: We have proactively identified best agency-wide practices from other organizations and used them as benchmarks to measure our own progress. Agency leadership is involved in this comparison and identification of improvements to the agency. Factor 1.3: FHWA has developed self-assessment tools for transportation system operations areas aimed at improving the performance and reliability of the road system. Have you used any of these tools to improve the system operations capabilities of your agency? This factor recognizes that other function- or topic-specific self-assessment tools have been developed and offered for use in transportation agencies. FHWA has developed several such tools for very specific, resilience-related topics, including: • Road Weather Management • Planned Special Events • Traffic Incident Management • Traffic Management • Traffic Signal Management • Work Zone Management Given the agency capabilities reflected in the FHWA tools relate in a broad sense to trans- portation system resilience, the different levels of maturity for this factor are defined by the level to which the FHWA self-assessment tools have been used in your agency. Note that the users of this guide could add tools to this list that have been developed since the publication of this guide (or others that they are aware of) that relate to transportation system resilience. • Level 1: We have used one such tool. • Level 2: We have used two or three such tools. • Level 3: We have used all of the FHWA self-assessment tools. Factor 1.4: Have you used the Cybersecurity Evaluation Tool (CSET) or an equivalent tool to improve the cybersecurity performance of your agency’s enterprise and industrial control systems (ICS)? Cybersecurity has become an ever more important concern for transportation agencies as traffic operations and management systems increasingly rely on electronic and internet resources for command and control. In addition, many of an agency’s administrative and financial pro- cesses work off of connected computers. Several disruptive cyberattacks against transportation

Assess Current Practice (Step 1) 29   agencies have occurred in recent years. This factor reflects the actions your agency has taken to assess your cybersecurity status. It relates the self-assessment of this threat to the use of tools that have been developed by the Department of Homeland Security (DHS) or other equivalent tools. The major distinction among the maturity levels is the level of protection your agency has provided based on the cybersecurity assessments that have been conducted. Note: Given the importance of cybersecurity to many functional responsibilities in a transportation agency, cybersecurity factors will also be found in many of the other steps in this guide. • Level 1: We have cybersecurity controls in place and are familiar with cybersecurity principles; however, we have not used a specific industry standard-backed self-assessment tool. • Level 2: We have completed the self-assessment for all agency ICS and IT systems. We are in the intermediate stages of coordinating our ICS and IT system security with other relevant agencies in our jurisdiction. • Level 3: We have fully assessed the cybersecurity of our ICS and IT systems. The information has been used to coordinate effectively the cybersecurity of all such systems in partner agencies (e.g., all state agencies). Factor 1.5: Do you continually review and update your agency’s resilience-oriented operations plans? Responding to system disruptions is one of the traditional transportation agency respon- sibilities in transportation system resilience. Most transportation agencies have developed emergency operations plans and protocols for dealing with such disruptions—from responding to crashes on the road network to large-scale network disruptions due to natural and human- caused disasters. The assumption in this factor is that emergency operations plans do exist. The distinction in the levels of maturity in this factor reflects the level of effort to review and update these plans periodically. Note that a similar factor is found in Step 8B: Identify Enhancements to Operations and Main- tenance Activities. In that case, the review and updates are targeting specific plans, e.g., incident response plans or disaster recovery plans. The factor in this step relates to your agency’s efforts in general to update all operations plans that focus on enhancing system resilience. • Level 1: We review operations plans on an ad hoc basis, primarily when the manager respon- sible for a relevant area decides it is time to do so. The updates are thus focused on a particular resilience functional responsibility and are not agency-wide. • Level 2: We have adopted standard operating procedures for updating operations plans on a set cycle. These updates are done for all resilience-oriented operation plans in our agency. • Level 3: We have achieved Maturity Level 2. In addition, our plan update process is done in collaboration with external partners who will be working with our agency’s staff in responding to emergency events. External input is proactively sought in critiquing our procedures and processes to provide an outside perspective on where we can improve our operations. Factor 1.6: Are after-action reports created after major incidents and disruptions? Effective institutional learning relies partly on reviewing agency efforts immediately after an incident or organizational change to take advantage of staff memories of what happened and why. These are called “after-action” reports, or if no written document exists, debriefings. Many agencies often develop after-action reports as part of traffic crashes and incidents. However, this

30 Mainstreaming System Resilience Concepts into Transportation Agencies: A Guide factor relates to all types of network or system disruptions. The distinction among the different levels of maturity reflects the degree to which such after-action reports are formalized within agency procedures. • Level 1: We do not have standard operating procedures for after-action reports, although some sections or functional areas do so on an ad hoc basis. We often have formal debriefings after major disruptions but no written documentation is produced that reflects the actions taken in response to the recommendations surfacing from these debriefings. • Level 2: We have developed standard operating procedures for producing after-action reports for transportation system disruptions, where such reports must be produced within a relatively short period of time (e.g., 1 week) after the incident or disruption. These reports are internally focused, often target the functional units involved in the response, and are undertaken by agency staff. • Level 3: We have reached Maturity Level 2. In addition, reports are collaboratively produced by all the organizations involved with the incident or disruption. This is undertaken only for disruptions that reach a threshold level of magnitude or extent. The after-action reports not only examine how our agency’s actions could be improved but also how the collaboration with our partner agencies could be enhanced. Factor 1.7: Are after-action reports reviewed systematically and analyzed for prospective corrective actions? The focus of this factor is on the degree to which after-action reports influence the identifi- cation and implementation of corrective actions. Preceding actual action, however, is the need for agency management and leadership to review the reports. The different levels of maturity are thus defined in this factor by the extent to which after-action reports are reviewed by agency staff and top management. As in the above factor, this review could be categorized by level and scale of disruption. For example, traffic safety managers would be the primary reviewers of after-action reports for traffic incidents. For major system disruptions, the responsibility for reviewing after-action reports might be the top leadership of the agency. • Level 1: After-action reports are reviewed by front-line staff who are the primary responders to an incident or disruption. Typically, no formal actions are taken. • Level 2: After-action reports are reviewed by front-line staff and the leadership of the relevant functional units. Formal action is taken by the unit managers to improve that unit’s abilities in future incident or disruption responses. • Level 3: We have achieved Maturity Level 2. In addition, reports are provided to top manage- ment on desired corrective actions across the agency. Factor 1.8: Are maintenance data reviewed to identify assets with previous impacts/repeat failures? The maintenance function in a transportation agency provides an important contribution to a transportation system’s condition and performance. Although the different elements of maintaining the condition and performance of transportation assets will often be found in different units among transportation agencies, the data collected as part of the maintenance program can provide important input on where potential failures do and could occur. For example, experience with road failures during heavy precipitation events has shown that keeping culverts clear of debris is an important strategy for minimizing culvert washouts. Expeditious removal of downed trees and other debris, replacing signs, and bringing signals back into operation after a major storm are critical steps in returning the road network and

Assess Current Practice (Step 1) 31   individual assets back to pre-event operational levels. For those agencies using a maintenance management system (MMS), the database provides potentially insightful information on where potential asset failures might occur in the future and could also provide input into the transportation asset management process and plan development. Federal requirements for reporting repeatedly damaged facilities on the NHS are an important consideration in this factor. Repeatedly damaged facilities are defined as “roads, highways, and bridges that have required repair and reconstruction activities on two or more occasions due to natural disasters or catastrophic failures resulting in emergencies declared by the Governor of the State or the President . . . a catastrophic failure is a sudden failure of a major element or segment of a road, highway, or bridge due to an external cause . . . the failure must not be primarily attributable to gradual and progressive deterioration or lack of proper maintenance” (FHWA 2018). The distinction in the different levels of maturity in this factor is defined by the degree to which maintenance data and information are used to identify priority actions to remove or mitigate the risk of future asset failures. • Level 1: We use maintenance data to schedule maintenance efforts. The only system resilience use of maintenance data is in tracking repeat failure and maintenance events as part of federal reporting requirements for declared emergencies. • Level 2: We use a maintenance management system for all state highways and use this information to schedule maintenance actions. If those collecting the data find poor asset conditions or potential risks to asset performance, the findings are reported to other agency units or to the Chief Engineer. We do not use this information to identify priority mainte- nance actions. • Level 3: We systematically collect “asset-at-risk” data as part of our maintenance data collection efforts for all state highways. We review this maintenance data and use it as an input into decision-making. We track all repeat failures or maintenance efforts and consider them in prioritizing maintenance actions. Factor 1.9: Have you examined human/physical threats, natural hazards, and cyber threats as potential sources of vulnerabilities to your transportation system? One of the major themes of the guide is that a transportation agency concerned about transportation system resilience needs to examine the range of potential threats against the system (Step 5 discusses how this can be done). Such threats can come from many sources. Most transportation agencies have considerable experience in responding to traffic crashes, storm-related impacts, and other such disruptions. There is less experience with cyber threats and with other human-caused sources of system disruptions (e.g., terrorist attacks or pandemics). In some cases, transportation agencies do not play a lead role in the response. For example, terrorist attacks immediately fall into the realm of national security and enforcement agencies. In many states, the security of the cyber network is the responsibility of some other state agency. However, even in these two examples, the transportation system can be the target of such attacks, and thus transportation agencies need to make efforts to protect against, minimize disruptions associated with, and recover quickly from such disruptions. The distinction in the different levels of maturity in this factor is defined as the extent to which your agency has examined different sources of threats to system operations. • Level 1: We have systematically examined one of these sources of disruption (human/physical threats, natural hazards, and cyber threats) with respect to its impacts on agency activities. • Level 2: We have systematically examined two of these sources of disruption with respect to their impacts on agency activities.

32 Mainstreaming System Resilience Concepts into Transportation Agencies: A Guide • Level 3: We have systematically examined each of these sources of disruption with respect to their impacts on agency activities. Natural hazards have been evaluated with respect to future climate changes in addition to considering today’s conditions. Factor 1.10: Have you reviewed your agency’s design criteria to assess their adequacy for enhancing system resilience? One aspect of preparing for future threats to transportation system resilience is making sure that projects are designed to provide the best possible chances of surviving extreme environ- mental and human-caused threats. For example, most design standards have traditionally been based on historical data. However, future environmental conditions in the case of climate change will likely be very different than what has occurred in the past. This has led to an interest in the transportation profession in adaptive project design. In addition, design criteria reflect a range of concerns and interests in project design such as providing safe movement of people and goods, assuring material durability over time given weather and vehicle use of a facility, promoting aesthetically pleasing project characteristics in areas where such are desired, minimizing environmental impacts on nearby communities and environmentally sensitive areas, and the like. This factor focuses on the extent to which system or facility resilience is a concern when a project is designed (note that Step 8C provides more discussion on adaptive design). The distinction in the different levels of maturity in this factor is defined as the extent to which your agency’s design criteria have been examined from the perspective of how they result in a project that is more resilient to disruptions. • Level 1: We have examined design criteria relating only to specific types of disruptions (e.g., flooding, extreme heat, and cyberattacks). • Level 2: We have examined all relevant design criteria from an all-hazards perspective for their adequacy to recently observed events. • Level 3: We have examined all relevant design criteria from an all-hazards perspective for their adequacy to recent events and future projected changes due to climate change. Factor 1.11: Have you reviewed staff roles and responsibilities to identify how they relate to enhancing system resilience? An effective organizational structure for carrying out the programs aimed at enhancing transportation system resilience is an important ingredient to agency success. As part of orga- nizational structure, staff members who understand what they are supposed to do and how it relates to agency goals become a critical foundation for successful agency efforts. This factor examines your agency’s efforts at incorporating transportation system resilience into staff job descriptions or talent profiles. For example, one state DOT noted at a recent conference that every job description in the agency has an element related to emergency/disaster response. Workforce resilience means preparing your agency for future challenges and having agency staff who are aware of and prepared for these challenges. Training and development are important opportunities for doing this. With respect to agency managers, such knowledge and awareness need to be incorporated into succession planning. Workforce resilience could also include examining how long-term exposure to stressors could affect staff physical and mental well-being. This has been a particular concern for security, emergency response, and public safety agencies. The distinction in the different levels of maturity in this factor is defined as the level of effort your agency has taken to incorporate system resilience efforts into staff responsibilities and formal job descriptions. • Level 1: We have conducted a review of staff roles and responsibilities agency-wide for one-third of the staff directly involved in resilience-oriented activities.

Assess Current Practice (Step 1) 33   • Level 2: We have conducted a review of staff roles and responsibilities agency-wide for two- thirds of the staff directly involved in resilience-oriented activities. • Level 3: We have conducted a review of staff roles and responsibilities agency-wide for all staff positions directly involved in resilience-oriented activities. This review has led to changes in our succession plan. Factor 1.12: Have you examined your training/professional development programs for their coverage of resilience? One of the traditional ways an agency enhances organizational capacity for achieving its goals is to provide training and professional development opportunities for its staff. In this way, an agency exposes the staff to new policy requirements, new tools and analysis methods, processes and procedures, and the latest technologies. In the context of system resilience, this could entail introductions to key concepts in system resilience, an overview of the latest policy and planning requirements, descriptions of the tools and analysis methods used to assess vulnerability and risks, assessment of the different types of actions a transportation agency could take to enhance system resilience, and exposure to institutional strategies for fostering collaboration and partnerships in delivering system resilience actions. The distinction in the different levels of maturity in this factor is defined as the level of effort your agency has taken to incorporate system resilience concepts into its training and professional development efforts. • Level 1: We have asked course instructors or module developers of all our courses to assess their individual course material to identify opportunities for incorporating resilience topics into participant learning. • Level 2: We have conducted a systematic assessment of those courses most directly related to transportation system resilience (e.g., system operations, asset management, or performance management) and have developed modules on how system resilience fits into the course material. • Level 3: We have conducted a systematic assessment of all our courses and have developed modules on how system resilience fits into course material. Table 5 summarizes the factors that are included in the self-assessment tool for Step 1. The maturity levels for each factor are presented in the descriptions of each factor. The total score for this step is found by summing the number of points given for each factor. Recommended Actions to Maintain the Highest Level of Agency Resilience Capability The highest level of capability for Step 1: Assess Current Practice focuses on continual improve- ment in agency capability and actions leading to a more resilient transportation system. If your agency has reached a Level 3 maturity level, the steps that can be taken to maintain this level include: • Periodically reassess the capability of your agency’s units with respect to their role in trans- portation system resilience. This could be done in-house or by bringing in a third-party evaluator to conduct the assessment. • Continue to monitor the resilience of the transportation system and consider changes in performance when making changes in the agency to enhance your current capability. • Participate in and/or lead meetings with partner agencies and groups to reinforce the importance of collaboration and coordination in enhancing system resilience. • Reinforce the resilience mindset among your staff by conducting role-play exercises that involve participants from a range of internal and external stakeholders, including community and system user representatives.

Maturity Factor Level 1 (1 point) Level 2 (2 points) Level 3 (3 points) 1.1 Has your agency conducted and documented a self-assessment of what it can do to better integrate concerns for transportation system resilience into agency functions? We have used and documented a self-assessment tool/process to identify where our agency could implement changes to enhance our resilience activities. Such changes have been implemented. The self-assessment tool/process is used at least every 3 years to identify further enhancements to our resilience efforts. 1.2 As part of your self-assessment process, have you examined best practices from other agencies and organizations? We have proactively identified best agency-wide practices from other organizations and used them as benchmarks to measure our own progress. Agency leadership is involved in this comparison and identification of improvements to the agency. 1.3 FHWA has developed self- assessment tools for transportation system operations areas aimed at improving the performance and reliability of the road system. Have you used any of these tools to improve the system operations capabilities of your agency? We have used one such tool. We have used two or three such tools. We have used all the FHWA self-assessment tools. 1.4 Have you used the Cybersecurity Evaluation Tool (CSET) or an equivalent tool to improve the cybersecurity performance of your agency’s enterprise and industrial control systems (ICS)? We have cybersecurity controls in place and are familiar with cybersecurity principles; however, we have not used a specific industry standard-backed self- assessment tool. We have completed the self- assessment for all agency ICS and IT systems. We are in the intermediate stages of coordinating our ICS and IT system security with other relevant agencies in our jurisdiction. We have fully assessed the cybersecurity of our ICS and IT systems. The information has been used to coordinate effectively the cybersecurity of all such systems in partner agencies (e.g., all state agencies). can improve our operations. 1.5 Do you continually review and update your agency’s resilience- oriented operations plans? We have adopted standard operating procedures for updating operations plans on a set cycle. These updates are done for all resilience-oriented operation plans in our agency. We have achieved Maturity Level 2. In addition, our plan update process is done in collaboration with external partners who will be working with our agency’s staff in responding to emergency events. External input is proactively sought in critiquing our procedures and processes to provide an outside perspective on where we We are using this self-assessment tool/process to identify where our agency could implement changes to enhance our resilience activities. We identify best practices primarily from the literature and from what we hear at conferences and meetings. We review operations plans on an ad hoc basis, primarily when the manager responsible for a relevant area decides it is time to do so. The updates are thus focused on a particular resilience functional responsibility and are not agency-wide. We have already used and documented a self-assessment tool/process to identify where our agency could implement changes to enhance our resilience activities. We have proactively identified function-specific best practices from other organizations and have used them as indicators to measure our progress in specific functional areas. Table 5. Assessment table for Step 1: Assess Current Practice.

1.6 Are after-action reports created after major incidents and disruptions? We do not have standard operating procedures for after- action reports, although some sections or functional areas do so on an ad hoc basis. We often have formal debriefings after major disruptions but no written documentation is produced that reflects the actions taken in response to the recommendations surfacing from these debriefings. We have developed standard operating procedures for producing after-action reports for transportation system disruptions, where such reports must be produced within a relatively short period of time (e.g., 1 week) after the incident or disruption. These reports are internally focused, often target the functional units involved in the response, and are undertaken by agency staff. We have reached Maturity Level 2. In addition, reports are collaboratively produced by all the organizations involved with the incident or disruption. This is undertaken only for disruptions that reach a threshold level of magnitude or extent. The after-action reports not only examine how our agency’s actions could be improved but also how the collaboration with our partner agencies could be enhanced. 1.7 After-action reports are reviewed by front-line staff who are the primary responders to an incident or disruption. Typically, no formal actions are taken. After-action reports are reviewed by front-line staff and the leadership of the relevant functional units. Formal action is taken by the unit managers to improve that unit’s abilities in future incident or disruption responses. We have achieved Maturity Level 2. In addition, reports are provided to top management on desired corrective actions across the agency. 1.8 Are maintenance data reviewed to identify assets with previous impacts/repeat failures? We use maintenance data to schedule maintenance efforts. The only system resilience use of maintenance data is in tracking repeat failure and maintenance events as part of federal reporting requirements for declared emergencies. We use a maintenance management system for all state highways and use this information to schedule maintenance actions. If those collecting the data find poor asset conditions or potential risks to asset performance, the findings are reported to other agency units or to the Chief Engineer. We do not use this information to identify priority maintenance actions. We systematically collect “asset-at- risk” data as part of our maintenance data collection efforts for all state highways. We review this maintenance data and use it as an input into decision-making. We track all repeat failures or maintenance efforts and consider them in prioritizing maintenance actions. 1.9 We have systematically examined one of these sources of disruption (human/physical threats, natural hazards, and cyber threats) with respect to its impacts on agency activities. 1.10 Have you reviewed your agency’s design criteria to assess their adequacy for enhancing system resilience? We have examined design criteria relating only to specific types of disruptions (e.g., flooding, extreme heat, and cyberattacks). We have systematically examined each of these sources of disruption with respect to their impacts on agency activities. Natural hazards have been evaluated with respect to future climate changes in addition to considering today’s conditions. We have examined all relevant design criteria from an all-hazards perspective for their adequacy to recent events and future projected changes due to climate change. Are after-action reports reviewed systematically and analyzed for prospective corrective actions? Have you examined human/physical threats, natural hazards, and cyber threats as potential sources of vulnerabilities to your transportation system? We have systematically examined two of these sources of disruption with respect to their impacts on agency activities. We have examined all relevant design criteria from an all-hazards perspective for their adequacy to recently observed events. (continued on next page)

Score Range Description of Agency Maturity in Assessing Current Practice 0 to 16 Your agency is emerging into this area and has taken initial steps to grow awareness and understanding of the types of strategies it can implement to assess current practice. 17 to 31 Your agency has implemented several strategies to assess current practice, not so much as part of an agency-wide strategy but rather at the initiativeof agency staff. 32 to 36 Your agency has reached a very high level of maturity in assessing current practice and implementing an “assessing current practice” strategy. The major focus should be on maintaining and enhancing existing efforts when appropriate and taking advantage of new opportunities as they become available. Maturity Factor Level 1 (1 point) Level 2 (2 points) Level 3 (3 points) 1.11 Have you reviewed staff roles and responsibilities to identify how they relate to enhancing system resilience? We have conducted a review of staff roles and responsibilities agency-wide for one-third of the staff directly involved in resilience- oriented activities. We have conducted a review of staff roles and responsibilities agency-wide for all staff positions directly involved in resilience-oriented activities. This review has led to changes in our succession plan. 1.12 Have you examined your training/professional development programs for their coverage of resilience? We have asked course instructors or module developers of all our courses to assess their individual course material to identify opportunities for incorporating resilience topics into participant learning. We have conducted an assessment of those courses most directly related to transportation system resilience (e.g., system operations, asset management, or performance management) and have developed modules on how system resilience fits into the course material. We have conducted a review of staff roles and responsibilities agency-wide for two-thirds of the staff directly involved in resilience-oriented activities. We have conducted a systematic assessment of all our courses and have developed modules on how system resilience fits into course material. Table 5. (Continued).

Assess Current Practice (Step 1) 37   • Update staff professional development and training opportunities to include the latest think- ing and concepts in system resilience. Incorporate these concepts into agency succession planning. • Maintain situational awareness of rapidly changing cybersecurity and physical security exposures that impact agency resilience. If you did not score a 36 in the assessment (a perfect score in Level 3 efforts), identify those factors that were rated lower and identify a strategy or action steps to improve these particular components of Step 1. Recommended Actions to Achieve Higher Levels of Resilience Capability If you scored at Level 1 or 2, you can take steps to continue your evolution toward a more resilience-oriented agency. In such cases, agency managers should identify which of the factors in Table 5 were most lacking and determine priorities for improving your agency’s organiza- tion. Table 6 is offered as a template to determine which steps your agency can take to improve resilience through self-assessment efforts, who should be responsible, the timeframe for the implementation, and expected outcomes. Let’s do this. (check) Action Re sp on si bi lit y? Ti m ef ra m e? Ex pe ct ed ou tc om es ? Conduct a self-assessment of your agency’s current resilience efforts. Conduct self-assessments of specific agency functions that are particularly relevant to system resilience—for example, using the FHWA capability maturity assessment tools described earlier. Incorporate transportation system resilience into agency plans and policy statements in order to institutionalize a resilience mindset into agency staff. Establish a formal process for reviewing and updating the emergency operations plan. Develop a process for conducting after-action and after-event reports that are used to identify corrective actions. Develop a process for reviewing maintenance data to identify chronic disruptions to different assets. Review threat/hazard exposure and/or vulnerability/risk studies to understand potential disruptions to your transportation system and possible demands on your agency. Review staff roles and responsibilities to identify how they relate to enhancing system resilience. Develop a strategy for institutionalizing system resilience into staff roles. Table 6. Actions to achieve higher maturity for Step 1: Assess Current Practice. (continued on next page)

38 Mainstreaming System Resilience Concepts into Transportation Agencies: A Guide Chapter 3 Reference FHWA. 2018. Questions and Answers Regarding Implementation of 23 CFR Part 667: Periodic Evaluation of Facilities Repeatedly Requiring Repair and Reconstruction Due to Emergency Events. Website. Retrieved June 20, 2020, from https://www.fhwa.dot.gov/programadmin/23cfr667_qa.cfm Useful Resources Federal Emergency Management Agency (FEMA). 2018. Various documents and guidelines on National Incident Management System (NIMS). Retrieved June 15, 2020, from https://www.fema.gov/nims-doctrine- supporting-guides-tools FHWA. 2016. Transportation Performance Management Capability Maturity Model. Office of Transportation Performance Management. Retrieved June 15, 2020, from https://www.tpmtools.org/wp-content/uploads/ 2016/09/tpm-cmm.pdf FHWA. Various years. FHWA has developed agency self-assessment tools for six state DOT areas that are relevant to system resilience, 1) Traffic Management, 2) Traffic Incident Management, 3) Road Weather Management, 4) Planned Special Events, 5) Work Zone Management and 6) Traffic Signal Management. Retrieved June 15, 2020, from https://ops.fhwa.dot.gov/tsmoframeworktool/index.htm Institute of Medicine. 2012. Building a Resilient Workforce: Opportunities for the Department of Homeland Security: Workshop Summary. Washington, DC: The National Academies Press. Retrieved June 15, 2020, from https://www.ncbi.nlm.nih.gov/books/NBK201577/ Parsons Brinckerhoff et al. 2011. SHRP 2 Report S2-L06-RR-2: Guide to Improving Capability for Systems Operations and Management. Transportation Research Board of the National Academies, Washington, DC. Retrieved June 15, 2020, from https://doi.org/10.17226/14513 Let’s do this. (check) Action Re sp on si bi lit y? Ti m ef ra m e? Ex pe ct ed ou tc om es ? Review the performance of your agency’s project design standards and begin the process of making design criteria more adaptive to expected future hazards and threats. Develop a human resource development and succession plan that focuses on preparing the current and future agency staff for resilience-oriented activities. Assess training/professional development programs and incorporate concepts relating to transportation system resilience into course materials. Begin the process of undertaking (or at least examining) some of the subsequent steps in this guide and determine if your agency has the capability to undertake such efforts. Where necessary, identify strategies to provide such capability. Possible actions for Step 4: Implement Early Wins Table 6. (Continued).