This is the second of two articles submitted to CERM Insights at about the same time. This one deals with the Community Disaster Resilience Zone Act passed by the United States Congress on December 22, 2022. The other deals with the National Institute of Standards and Technology’s (NIST) Cyber Security Framework 2.0. Together they form a mosaic of the Biden Administration’s Risk Management push.
The latter emphasizes cybersecurity risk management, supply chain cyber security and the integration of both into an organization’s enterprise risk management process. Its application is a mandate for United States federal agencies. However, it is likely that contractors and suppliers to federal agencies will also be expected to comply with the framework. It should be noted that the framework is designed to be used by any organization large or small, regardless of economic activity.
The Community Disaster Resilience Zone Act, on the other hand, stresses the identification of census tracks at risk of natural hazards. Its target audience is state and local government and Indian tribal governments who can be eligible for federal for disaster resilience grants.
While the private sector is going to be impacted by NIST Cybersecurity Framework 2.0 because they contract with or supply federal agencies, state, local and tribal governments will be impact more, because they also receive federal funds and are the target audience of the Community Disaster Resilience Zone Act. Consequently, they will end up placing greater emphasis on risk management, be it cybersecurity or natural hazards.
Public Law 117-255
On December 20, 2022, the United States Congress passed Public Law 117-255, the Community Disaster Resilience Zones Act. (1) This act amends the Robert T. Stafford Disaster Relief Emergency Assistance Act. It requires the Federal Emergency Management Agency (FEMA) to utilize a natural hazard risk assessment index to identify census tracks which are most at risk of natural hazards and climate change. The purpose is to improve the climate and natural hazard resilience of vulnerable communities.
The entities covered under this act are 1. a state, 2. an Indian tribal government or 3 a local government.
The product FEMA is to provide are to be available to the public and define natural hazard risk across the United States. The risk definition shall include rating and data for 1. loss exposure, including population equivalence, buildings, and agriculture, 2. social vulnerability and 3. community resilience.
Risk Ratings
The risks ratings shall reflect high levels of individual hazard risk ratings based on several criteria, 1. “An assessment of the intersection of a. loss to population equivalence, b. building value, and c agriculture value.” 2. High social vulnerability ratings and low community resilience ratings and 3. Any other elements determined by the President.
Geographic Balance
There is to be a geographic balance in the identification of the census tracts. FEMA is to use data from the American Community Survey of the Bureau of Census.
Hazard Mitigation and Resilience Projects
Eligible projects shall receive up to 90% federal funding for up to 5 years. A project submitted by eligible entities will be evaluated to determine whether the resilience or mitigation project:
- Is designed to reduce injuries, loss of life, and damage and destruction of property, such as damage to critical service and facilities, and
- Substantially reduces the risk of, or increases resilience to future damage, hardship, loss, or suffering.
Projects which meet the above criteria shall be certified as eligible for federal funding.
Projects Causing Displacement
The entity performing certified resilience or mitigation projects which involve the displacement of a resident from any occupied housing unit, shall:
- Provide, at the option of the resident, a suitable and habitable housing unit that is, with respect to the housing united from which the resident is displaced.
- Of a comparable size.
- Located in the same local community or a community with reduced hazard risk. and
- Offered under similar costs, conditions, and terms.
- Ensure that property acquisitions resulting from the displacement and made in connection with the resilience or mitigation projects.
- Are deed restricted in perpetuity to preclude future property uses not relating to mitigation or resilience, and
- Are the result of a voluntary decision by the resident.
- Plan for robust public participation in the resilience or mitigation project.
FEMA Actions
In 2023 FEMA announced the first 483 Community Disaster Resilience Zones in the 50 states and the District of Columbia. This designation will help communities create resilience zones and allow the federal government to focus financial and technical assistance on these zones.
As with any allocation or designation, the devil is in the details. Thus, it is worth looking at the criteria FEMA used to develop the Community Disaster Resilience Zones. As noted in the law the basic criteria are Risk and Expected Annual Loss, Social Vulnerability and Community Resilience.
Natural Hazards
FEMA lists fifteen natural hazards. Among them are: Costal Flooding, Cold Wave, Drought, Heat Wave, Hurricane, Ice Storm, Tornado, Tsunami, and Volcanic Activity. As can be seen, not all hazards are applicable to every community. Thus, to develop an index of risk and financial impact, statistical analysis is used to group communities with similar natural hazards vulnerabilities. (2)
Risk Index
The National Risk Index is an equation which takes the Expected Annual Loss, which is the average economic loss in dollars resulting from natural hazards each year and multiplies it by the Community Risk Factor, which is a scaling factor that incorporates Social Vulnerability and Community, to determine a ranking of communities which are at risk.
Social Vulnerability
Social Vulnerability is defined as the consequence enhancing risk component and community risk factor that represents the susceptibility of social groups to the adverse impact of natural disasters.
Community Resilience
Community Resilience represents the ability of a community to prepare for anticipated natural hazards, adapt to changing conditions and with stand and recover rapidly from disruptions.
The governing bodies in the 483 Community Disaster Resilience Zones are eligible to apply for federal funds. The applications must demonstrate that they meet the following criteria.
- Is designed to reduce injuries, loss of life, and damage and destruction of property, such as damage to critical service and facilities, and
- Substantially reduces the risk of, or increases resilience to future damage, hardship, loss, or suffering.
Conclusion
The Community Disaster Resilience Zones Act requires the Federal Emergency Management Agency (FEMA) to utilize a natural hazard risk assessment index to identify census tracks which are most at risk of natural hazards and climate change. Communities designated Community Disaster Resilience Zones are eligible for federal grants up to 90% of the application costs for up to five years.
Communities applying for such grants must demonstrate that their projects will reduce injuries, loss of life, and damage and destruction of property, such as damage to critical service and facilities, and substantially reduces the risk of, or increases resilience to future damage, hardship, loss, or suffering.
Given the nature of natural hazards and climate change risks, most will be capital projects dealing with physical infrastructure. Thus, many will be engineering related. Engineering departments in most state and local governments conduct risk analysis on capital projects. Consequently, risk assessment and mitigation are not a new practice. What will be new is the designation of specific census tracts as Disaster Resilience Zones and FEMA’s more proactive approach to natural hazard and climate risk assessment and mitigation efforts.
When combined with NIST’s Cybersecurity Framework 2.0, you have two federal agencies pushing risk assessment and mitigation actions to state, tribal and local governments. With Framework 2.0 specifically pushing Enterprise Risk Management.
Endnotes
- United States Congress, 2022, Community Disaster Resilience Zones Act, December 20, https://www.congress.gov/117/plaws/pubs1255/PLLAW-117pubi255.pdf
- Federal Emergency Management Agency, 2023, Community Disaster Resilience Zones, https://www.fema.gov/partnerships/community-disaster-resilience-zones.
BIO
James J. Kline has worked for federal, state, and local government. He has over ten years of supervisory and managerial experience in both the public and private sector. He has consulted on economic, quality and workforce development issues for state and local governments. He has authored numerous articles on quality and risk management. His book “Enterprise Risk Management in Government: Implementing ISO 31000:2018” is available on Amazon. He is the editor of “Quality Disrupted’ which is available on Amazon.