12.2 Continuity of Operations Planning (COOP) & Alternate Facilities

12.2 Continuity of Operations Planning (COOP) & Alternate Facilities

Quick Answer: A Continuity of Operations Plan (COOP) ensures an Emergency Communications Center maintains continuous execution of its Primary Mission Essential Functions (PMEFs)—emergency call intake, caller location extraction, field unit dispatching, and tactical field communications—during catastrophic primary facility loss or evacuation. Disaster recovery architectures rely on tiered backup facilities: Hot Sites (fully equipped, live mirrored data, activation < 15 min), Warm Sites (equipped hardware requiring telecom cutover and staff deployment, activation in 30–60 min), Cold Sites (empty powered shells unsuitable for immediate emergency operations), and Virtual / Cloud PSAPs (zero-trust remote soft-consoles). Telecommunications failover executes via legacy Selective Router Alternate Routing or Next Generation 9-1-1 (NG911) Emergency Service Routing Proxy (ESRP) Policy Routing Functions (PRF). Many agencies target full operation at a warm alternate site within 30 to 60 minutes of an evacuation order, with calls rolled to a partner PSAP in the meantime.

---

1. Foundations of PSAP Continuity of Operations (COOP)

In standard municipal administration, continuity planning focuses on maintaining administrative services, payroll, and civic licensing over days or weeks. In an Emergency Communications Center (ECC), operations cannot pause for even a single minute. A Continuity of Operations Plan (COOP) is a formal, documented operational strategy designed to ensure that the 9-1-1 authority can execute its Primary Mission Essential Functions (PMEFs) under all hazards.

The 4 Non-Negotiable PMEFs of a 9-1-1 Center:

1. Emergency Call Intake: Receiving incoming 9-1-1 voice calls, Text-to-911, and Real-Time Text (RTT) from the public.
2. Location & Incident Extraction: Interrogating callers and extracting accurate caller geolocation, civic addresses, and critical incident parameters.
3. Field Unit Dispatching: Alerting and dispatching appropriate law enforcement, fire protection, and emergency medical service (EMS) resources.
4. Tactical Communications: Maintaining continuous two-way tactical voice and data communications with deployed field units.

Primary Evacuation Triggers

Evacuating an ECC requires moving personnel while maintaining or rapidly redirecting high-volume telecommunications traffic. Primary triggers include:

┌──────────────────────────────┬────────────────────────────────────────────────────────┐
│ Evacuation Category          │ Specific Physical & Environmental Triggers             │
├──────────────────────────────┼────────────────────────────────────────────────────────┤
│ Structural & Seismic Impact  │ Direct structural collapse, earthquake, tornado strike, │
│                              │ roof breach, or external blast shockwave.              │
├──────────────────────────────┼────────────────────────────────────────────────────────┤
│ Hazardous Materials (HAZMAT) │ Airborne toxic chemical plume, industrial gas release, │
│ Infiltration                 │ train derailment, or carbon monoxide entering HVAC.    │
├──────────────────────────────┼────────────────────────────────────────────────────────┤
│ Fire & Suppression Discharge │ Internal electrical fire or clean-agent gaseous fire   │
│                              │ suppression discharge (FM-200 / Novec 1230).          │
├──────────────────────────────┼────────────────────────────────────────────────────────┤
│ Environmental HVAC Failure   │ Catastrophic cooling collapse causing server room      │
│                              │ thermal runaway (> 100°F / 38°C equipment shutdown).   │
├──────────────────────────────┼────────────────────────────────────────────────────────┤
│ Civil Unrest & Active Threat │ Hostile intruder breaching perimeter or armed unrest   │
│                              │ compromising physical facility integrity.              │
└──────────────────────────────┴────────────────────────────────────────────────────────┘

Core Pillars of FEMA Continuity Guidance Circular (CGC)

Following FEMA continuity guidance, a comprehensive public safety COOP plan should establish:

• Orders of Succession: A legally vetted, pre-defined line of administrative succession at least three positions deep (e.g., Executive Director $\rightarrow$ Operations Deputy Director $\rightarrow$ Shift Watch Commander) ensuring unbroken command authority if primary executives are incapacitated.
• Delegations of Authority: Pre-authorized legal documentation explicitly defining the statutory limits and operational conditions under which designated successors can execute emergency contracts, activate mutual aid pacts, or expend emergency contingency funds.
• Vital Records & Database Protection: Secure, redundant access to electronic GIS boundary files, CAD geodatabases, logging recorder archives, personnel emergency rosters, and standard operating guidelines (SOGs).
• The Tactical PSAP "Go-Kit": A physical, watertight, hardened transport case positioned in an accessible secure area. The Go-Kit contains tactical portable radios, spare batteries, cellular Wi-Fi hotspots, backup headset amplifiers, hardware multi-factor authentication (MFA) tokens, building access master fobs, administrative credential matrices, printed operational checklists, and critical interagency phone directories.

---

2. Alternate PSAP Operational Models

When a primary communications center becomes untenable, operations must migrate to an alternate facility. Public safety disaster planning categorizes backup facilities into four primary operational models:

┌────────────────────────┬───────────────────┬───────────────────┬──────────────────────┐
│ Operational Metric     │ Hot Site          │ Warm Site         │ Cold Site            │
├────────────────────────┼───────────────────┼───────────────────┼──────────────────────┤
│ Facility Architecture  │ Fully hardened;   │ Dedicated facility│ Powered building     │
│                        │ HVAC/Gen active   │ or mobile trailer │ shell; space/cooling │
├────────────────────────┼───────────────────┼───────────────────┼──────────────────────┤
│ Workstation Consoles   │ 100% provisioned; │ Pre-wired positions;│ Empty floor space;   │
│                        │ live consoles     │ hardware standby  │ no IT equipment      │
├────────────────────────┼───────────────────┼───────────────────┼──────────────────────┤
│ Data Synchronization   │ Real-time active  │ Periodic or warm  │ None on-site; manual │
│                        │ mirroring (RPO=0) │ replication       │ tape/cloud restore   │
├────────────────────────┼───────────────────┼───────────────────┼──────────────────────┤
│ Telecommunications Cut │ Immediate split / │ Pre-configured;   │ Must order new       │
│                        │ automated routing │ 15–30 min cutover │ telco circuits (days)│
├────────────────────────┼───────────────────┼───────────────────┼──────────────────────┤
│ Time to Full Operation │ < 15 minutes      │ 30 to 60 minutes  │ Days to Weeks        │
│ Ongoing Capital Cost   │ High (Duplicative)│ Moderate          │ Low                  │
└────────────────────────┴───────────────────┴───────────────────┴──────────────────────┘

1. Hot Site: A fully operational duplicate of the primary center. Telephony lines, CAD server clusters, and radio console positions are continuously powered, networked, and updated via real-time data replication. When telecommunicators arrive, they plug in headsets, log in, and assume operational authority immediately. Hot sites achieve operational readiness in under 15 minutes, but require significant ongoing capital and software licensing investments.
2. Warm Site: A dedicated facility equipped with dispatch furniture, network cabling, radio network links, and computer workstations maintained in a warm standby state. Database updates are synced periodically. Activating a warm site requires telecommunications trunk redirection, software initialization, and staff transit. Properly engineered warm sites achieve operational readiness within 30 to 60 minutes, meeting common agency recovery targets at a fraction of a hot site's cost.
3. Cold Site: An environmentally controlled building space with electrical power, HVAC, and basic telco entrance facilities, but lacking workstations, servers, CAD software, or radio consoles. Setting up a cold site requires hauling in hardware, loading software, and provisioning communications circuits—a process taking days to weeks. Cold sites are unacceptable for immediate 9-1-1 call handling continuity.
4. Virtual / Cloud-Native PSAP: Leverages cloud-hosted CAD and NG911 soft-turrets accessible via secure Zero Trust Network Access (ZTNA). Telecommunicators can log in using encrypted thin clients or laptops from mobile command trailers, regional Emergency Operations Centers (EOCs), or hardened secondary administrative sites, decoupling public safety dispatching from physical building footprints.

Regional Co-Located Backup Centers & Reciprocal Mutual Aid

To balance operational resiliency with fiscal constraints, neighboring jurisdictions frequently establish reciprocal mutual aid agreements or joint regional backup facilities:

• Interlocal Agreements (ILAs): Legally binding pacts between distinct political subdivisions specifying how facilities, consoles, and operational costs will be shared during an emergency.
• Technical Harmonization: Reciprocal sharing requires standardizing CAD schemas, CAD-to-CAD interfaces, compatible P25 trunked radio talkgroups, and interoperable call-handling software profiles. Telecommunicators must cross-train annually on neighboring agency dispatch protocols.

---

3. Telecommunications Rollover & Activation Mechanics

When a primary PSAP is evacuated or loses connectivity, incoming emergency traffic must be redirected instantly to prevent callers from receiving ring-no-answer or fast-busy signals.

LEGACY E9-1-1 CIRCUIT ROLLOVER
[Class 5 Central Office] ──► [E9-1-1 Selective Router]
                                   │
            ┌──────────────────────┴──────────────────────┐
            ▼                                             ▼
  [Primary PSAP Trunks]                         [Alternate PSAP Trunks]
  (Monitored for All Trunks Busy / ATB)         (Diverted via Alternate Routing)

NG911 IP ESINET POLICY ROLLOVER
[Emergency Call / Originating Network] ──► [ESInet / Border Control Function]
                                                  │
                                                  ▼
                                  [Emergency Service Routing Proxy (ESRP)]
                                                  │
            ┌─────────────────────────────────────┴─────────────────────────────────────┐
            ▼                                                                           ▼
  [Primary PSAP Queue]                                                        [Alternate PSAP Queue]
  (SIP OPTIONS Heartbeat Ping Fails) ──► [Policy Routing Function (PRF) Fires] ──► (Instant SIP INVITE Reroute)

Legacy E9-1-1 Rollover: Alternate Routing

In legacy circuit-switched architectures, call redirection is handled by the E9-1-1 Selective Router (Tandem Switch):

• Alternate Routing: The Selective Router continuously monitors dedicated CAMA or PRI trunks terminating at the primary PSAP. If all trunks become saturated (All Trunks Busy - ATB) or if electrical loop current is broken due to a severed cable or facility outage, the switch automatically diverts calls to a pre-designated secondary trunk group terminating at an alternate PSAP.
• Manual Telco Rerouting (Night Service): If the primary center must evacuate while trunks remain electrically intact, a supervisor must contact the local exchange carrier's 9-1-1 Network Operations Center (NOC) or enter a secure web portal to manually execute a "Night Service" or emergency transfer order, which can take 15 to 45 minutes to implement.

NG911 Rollover: ESRP Policy Routing Functions (PRF)

Next Generation 9-1-1 (NENA i3) replaces rigid central office trunk translations with dynamic, policy-driven software routing:

• Emergency Service Routing Proxy (ESRP): The core NG911 routing engine evaluates incoming SIP INVITE messages and queries the Policy Routing Function (PRF).
• Automated Health Telemetry: The ESRP continuously transmits SIP OPTIONS heartbeat pings to the PSAP's Session Border Controller (SBC) and call-taking queue. If the primary PSAP fails to respond within a programmed threshold (e.g., three consecutive dropped heartbeats over 6 seconds), the PRF automatically detects primary queue failure.
• Dynamic Policy Execution: The PRF immediately redirects incoming emergency calls to alternate ESInet Uniform Resource Identifiers (URIs) mapped to the backup PSAP, a regional mutual aid queue, or cloud-hosted soft-consoles. Call diversion occurs in milliseconds, with zero lost calls.

---

4. Activation Timelines, Benchmarks & Mobile Command Deployments

Public safety regulatory standards establish strict, time-phased benchmarks for restoring emergency call processing following an evacuation command:

[Evacuation Order Issued]
         │
         ├──────► 0 to 5 Minutes: Immediate Life Safety & Automated Call Rollover
         │        - Shift supervisor triggers emergency transfer macro / PRF.
         │        - Telecommunicators grab Go-Kits, tactical radios, and evacuate.
         │
         ├──────► 5 to 30 Minutes: Transit & Mutual Aid Absorption
         │        - Neighboring mutual aid PSAP absorbs initial call rollover.
         │        - Tactical Dispatch Team (TDT) transits to backup facility.
         │
         └──────► 30 to 60 Minutes: Full Operational Restoration at Alternate Site
                  - Workstations initialized; CAD and radio consoles logged in.
                  - Primary operational authority resumed at backup facility.

Agency Recovery Target: 30 to 60 Minutes

There is no single national NENA time limit. Many agencies set a target of being fully operational at the alternate facility, answering 9-1-1 calls and dispatching field units, within 30 to 60 minutes of the evacuation order, and document that target in the COOP plan. Deployments to hot sites typically achieve full operational status in under 15 minutes, whereas warm site activations require the full 30 to 60 minute window.

Mobile PSAP / Tactical Command Vehicles

For extended disaster operations where fixed backup facilities are inaccessible or damaged, agencies deploy Mobile PSAP / Tactical Command Vehicles:

• Self-Contained Infrastructure: Heavy-duty commercial vehicle chassis equipped with on-board diesel generators, redundant HVAC, satellite communications antennas (VSAT / Starlink), high-gain cellular multi-carrier routers (FirstNet Band 14), and telescopic pneumatic masts.
• Console Capabilities: Typically outfitted with two to six fully functional dispatch positions, integrated CAD laptops, P25 mobile radio base stations, and localized VoIP telephone soft-turrets.
• Deployment Role: Functions as an on-scene Tactical Dispatch Post for major hazmat scenes, wildfire incident bases, or as an interim mobile answering point while a fixed facility undergoes remediation.

---

5. Operational Traps & ENP Exam Watch

• Cold Sites Are Not Viable for 9-1-1: A common exam distractor suggests utilizing an empty municipal building (cold site) for rapid backup. Cold sites take days or weeks to equip and are fundamentally unacceptable for emergency call continuity.
• PMEF Prioritization: During a COOP activation, non-essential administrative tasks (records requests, alarm permits, public education, non-emergency administrative calls) are suspended. Operations must focus exclusively on the four core PMEFs.
• Automated Rollover vs. Staff Transit: Evacuating a primary center does not mean 9-1-1 calls go unanswered while staff drive to the backup site. The COOP plan must configure automated call rollover to an immediate mutual aid partner or secondary queue to bridge the 30-to-60-minute staff transit window.
• Testing Frequency: A COOP plan that is not exercised is a plan that will fail. Best practice is to exercise relocation at least annually, with telecommunicators physically moving to the alternate facility and handling live traffic when it is safe to do so.