Every two years, the Federal Emergency Management Agency (FEMA) conducts a National Level Exercise (NLE) to evaluate the nation's progress toward preparedness for catastrophic events. These exercises have multiple components, and culminate in a large, full-scale exercise with thousands of participants from multiple federal agencies, state, local, tribal, and territorial (SLTT) governments, industry partners, and nongovernmental organizations. NLE 2026 began in April of this year and is to conclude in 2027. The exercise will focus on consequence management coordination following critical infrastructure damages caused by cyberattacks facilitated by a transnational terrorist organization.
In 1988, much federal attention was paid to the ability of the nation to respond to and recover from emergencies and major disasters. Congress passed the Robert T. Stafford Disaster Relief and Emergency Assistance Act (P.L. 100-707), and President Ronald Reagan issued Executive Order 12656, which established a national security emergency exercise program and directed FEMA to coordinate the planning, conduct, and evaluation of these activities. The order did not mandate exercises of national scope or broad participation by federal agencies.
In 1996, due to increasing concern about the proliferation of weapons of mass destruction following the collapse of the Soviet Union, Congress passed the Defense Against Weapons of Mass Destruction Act of 1996 (P.L. 104-201). The law directed the Secretary of Defense to "develop and carry out a program for testing and improving the responses of Federal, State, and local agencies to emergencies involving biological weapons and related materials and emergencies involving chemical weapons and related materials" (50 U.S.C. ยง2315). It also mandated a five-year series of annual exercises to be conducted in coordination with the Secretary of Energy, the Director of the Federal Bureau of Investigation, and the FEMA Administrator, as well as state and local officials.
Congress further addressed the need for an exercise of national scope in 1998. The Senate Committee on Appropriations, noted that "few of the top officials of agencies have ever fully participated" in ongoing preparedness exercises, and directed "that an exercise be conducted in fiscal year 1999 with the participation of all key personnel who would participate in the consequence management of ... an actual terrorist event." The result was the Top Officials (TOPOFF) exercise, the first of what became a series of four full-scale exercises conducted between 2000 and 2007. The series was held biennially to "assess the nation's crisis and consequence management capacity under extraordinary conditions" and leveraged scenarios of national scope. Each exercise focused on terrorist attacks with weapons of mass destruction.
During this time period, the September 11, 2001, attacks and anthrax attacks amplified the need for domestic preparedness. Congress passed the Homeland Security Act of 2002 (P.L. 107-296) and assigned the responsibility for exercises to various positions within the newly formed Department of Homeland Security; no additional direction was provided regarding the quantity, quality, or scope of preparedness exercises. In 2003, President George W. Bush issued Homeland Security Presidential Directive 8 (HSPD-8) which directed the Secretary of Homeland Security to "develop a multi-year national homeland security preparedness-related exercise plan" and submit it to the Homeland Security Council (HSC) for review and approval. HSPD-8 did not provide additional guidance on the nature or frequency of national level exercises.
Despite having had two TOPOFF exercises, federal agencies and other government partners were considered largely unprepared to respond to the catastrophic events of Hurricane Katrina, as documented by S.Rept. 109-322. In response, Congress passed the Post-Katrina Emergency Management Reform Act in 2006 (P.L. 109-295) and required the Administrator of FEMA "to test and evaluate the capability of federal, state, territorial, local, and tribal governments to detect, disrupt, and prevent threatened or actual catastrophic acts of terrorism, especially those involving weapons of mass destruction ... and to test and evaluate the readiness of Federal, State, territorial, local, and tribal governments to respond and recover in a coordinated and unified manner to catastrophic incidents" at least every two years. The law shifted the focus of participation from top federal officials to whole-of-nation stakeholders. In 2009, TOPOFF exercises were renamed "Tier 1 National Level Exercises" and continued under this name until 2012.
In 2011, President Barack Obama issued Presidential Policy Directive 8 (PPD-8) to further clarify the federal government's approach to preparedness. PPD-8 established that "the national preparedness system shall include guidance for planning, organization, equipment, training, and exercises to build and maintain domestic capabilities. It shall provide an all-of-Nation approach for building and sustaining a cycle of preparedness activities over time." NLEs were renamed "Capstone Exercises" to represent their placement in the broader scheme of federal and SLTT exercises. In 2018, FEMA returned to the NLE naming convention.
NLEs alternate between scenarios focused on adversaries and natural disasters every two years. Reports on the results of these exercises are not publicly available.
Congress may consider examining NLEs in the light of evolving challenges, such as weather- and technology-driven incidents such as the Texas Flash Floods and Salt Typhoon cyberattacks.
While FEMA administers NLEs on behalf of the federal government as a whole, it does not select the focus of these exercises directly. The design and development of NLEs is often guided by the strategic priorities set by the Principals Committee of the National Security Council and may build on real-world incidents. Should Congress desire to shift the focus, frequency, or scope of NLEs, it may consider more prescriptive legislative language or rulemaking.
According to guidance published by FEMA, every exercise should produce a number of lessons learned, corrective actions, and an improvement plan for the participating stakeholders. These documents provide a roadmap for closing gaps in core prevention, protection, response, recovery, and mitigation capabilities. In a May 2020 report, the Government Accountability Office (GAO) asserted that FEMA "lacks a formal mechanism to document and track best practices, lessons learned, and corrective actions." The outputs and benefits of NLEs may potentially be lost without greater accountability for recording and implementing the results. GAO recommended that DHS develop a better means of tracking exercise outputs, and DHS officials concurred, implementing a "Continuous Improvement Program" and an "Issue Resolution System" to prioritize disaster after-action reports and establish timeframes for completing them. Congress may consider oversight activities to ensure that the findings of NLEs are properly leveraged to improve national capabilities.
FEMA is not the only agency conducting nationally-scoped preparedness exercises with broad stakeholder participation. For instance, the Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response (CESER) and the Department of Health and Human Services' Office of the Assistant Secretary for Preparedness and Response (ASPR) both conduct major exercises involving multiple federal agencies, SLTT partners, private industry, and nongovernmental participation. These exercises are not required to be coordinated with the NLE and their results and recommendations may not be integrated with those from the NLE. Congress may consider mandates for better interagency coordination of nationally-scoped exercises as well as a more unified strategy for tracking outcomes. Congress may also consider to what degree these exercises might be duplicative. It may also consider mandating post-activity reporting.
According to FEMA, NLE 2026 will test the nation's preparedness to address risks to national security and support current National Security Presidential Memorandums (NSPM) and Administration priorities. Objectives include promoting cybersecurity best practices, validating the federal government's ability to coordinate, maintaining situational awareness of, and managing resources during cyber incidents, demonstrating response capabilities, and testing information sharing and public messaging practices. Participants in the exercise include the State of Colorado, FEMA Region 8, federal interagency partners, and private sector partners such as Edison Electric Institute (EEI), the trade association that represents investor-owned utilities such as Dominion Energy, the Exelon Corporation, and Consolidated Edison. For NLE 2026, Congress may consider evaluating the findings, tracking the implementation of corrective actions, and providing specific appropriations for post-exercise improvements.