Disaster Risk: Improvements Needed to Enhance FEMA’s National Risk Index

TL;DR

The GAO found that FEMA partially followed leading practices when developing, operating, and maintaining the National Risk Index (NRI). Key weaknesses include insufficient guidance for users on how to apply NRI results in decision-making, limited use and disclosure of sensitivity analyses to validate model outputs, and no established mechanism to systematically collect and apply ongoing user feedback. These gaps undermine the NRI’s perceived utility for emergency managers and other risk-planning stakeholders and could limit effective hazard mitigation planning. Contractors in Risk Assessment and Management, Emergency Management, Data Analytics and Modeling, GIS, Management Consulting, IT Services, and Scientific & Technical Consulting should expect increased interest in services that address user-facing product design, sensitivity analysis, model validation, and feedback systems. Immediate implications: monitor DHS (Department of Homeland Security)/FEMA activity, prepare capture strategies for relevant contract vehicles, and position offerings to help FEMA operationalize stronger user guidance, sensitivity testing, and continuous feedback loops.

Key Points

• What happened: GAO reviewed FEMA’s National Risk Index and found FEMA partially followed leading practices for defining purpose, ensuring information quality, and stakeholder engagement; GAO identified gaps in user guidance, sensitivity analysis use/disclosure, and systematic user feedback collection.
• Who is affected: Market segments named in the segmentation (Risk Assessment and Management; Emergency Management; Data Analytics and Modeling; Disaster Preparedness; Geographic Information Systems (GIS); Management Consulting; IT Services; Scientific and Technical Consulting), NAICS codes in segmentation, and agencies listed in segmentation (DHS, FEMA). Relevant contract vehicles in segmentation are also implicated.
• Timeline: Timeline TBD pending source review
• What contractors should do NOW: Immediately inventory capabilities that map to NRI gaps (user-centric decision guidance, sensitivity analysis and model validation, ongoing user feedback systems); prepare or update capture pipelines targeting DHS/FEMA opportunities on the listed contract vehicles; ensure offerings align with the compliance surfaces in segmentation; and monitor for GAO recommendations or FEMA follow-on actions.

Who Is Affected

• Affected market segments: Risk Assessment and Management; Emergency Management; Data Analytics and Modeling; Disaster Preparedness; Geographic Information Systems (GIS); Management Consulting; IT Services; Scientific and Technical Consulting.
• Specific NAICS codes, agencies, and contract vehicles:
• NAICS: 541620, 541690, 541990, 541611, 541370, 541512, 541330, 541715
• Agencies: DHS, FEMA
• Contract vehicles: DHS EAGLE II, OASIS+, 8(a) STARS III
• Compliance regimes: NIST 800-171 (NIST Special Publication 800-171), FedRAMP (Federal Risk and Authorization Management Program), DHS 4300A

Frequently Asked Questions

Q: What were GAO’s main findings about FEMA’s National Risk Index?

GAO found FEMA partially followed leading practices for risk assessment and information quality. FEMA provided purpose/scope and methodological details but did not define how users should apply NRI results in decision-making, did not consistently use or disclose sensitivity analyses, and lacks a systematic mechanism to collect and use ongoing user feedback.

Q: Will FEMA be required to change the NRI based on this report?

Pending source review. The Summary documents GAO’s findings but does not specify required actions, directives, or a timeline for FEMA to implement changes.

Q: How should contractors prioritize opportunity development given this report?

Prioritize capabilities that directly address GAO-identified gaps: user-focused guidance and decision frameworks for NRI outputs; rigorous sensitivity analysis, verification, and disclosure practices; and platforms or processes to collect and operationalize user feedback. Target capture efforts to DHS/FEMA vehicles listed in segmentation and verify compliance readiness for NIST 800-171, FedRAMP, and DHS 4300A.

Definitions

• National Risk Index (NRI): FEMA’s national-level index that combines disaster loss with social vulnerability and community resilience measures to score risk (as described in the Summary).
• FEMA: Federal Emergency Management Agency, a component of DHS responsible for disaster mitigation and response (as named in the Summary).
• GAO: Government Accountability Office, the audit and evaluation arm that reviewed FEMA’s use of leading practices in developing the NRI (as named in the Summary).

Intelligence Response

• Cabrillo Signals War Room — Already detected this event and delivered this briefing. Continuously monitors regulatory changes, contract vehicles, and policy shifts.
• Cabrillo Signals Match Engine — Automatically rescores opportunity pipelines when events like this shift the competitive landscape.
• Cabrillo Signals Intelligence Hub — Tracks affected agencies, NAICS codes, and contract vehicles. Saved searches alert when follow-on solicitations appear on SAM.gov (System for Award Management).
• Proposal Studio (Proposal OS) — AI-powered proposal automation with compliance matrices, win theme library, and bid/no-bid decision engine.
• Proposal Studio Workflow Tracker — 9-gate capture management with automated compliance routing and audit-ready documentation.

Recommended product use and notifications

• Leverage Cabrillo Signals War Room, Match Engine, and Intelligence Hub to ingest the GAO finding, rescore and reprioritize DHS/FEMA opportunities, and activate saved searches for follow-on solicitations.
• Use Proposal Studio + Workflow Tracker to execute capture and proposal tasks against identified opportunities and compliance requirements.
• Notify: BD Director (capture posture & resourcing), Capture Lead (vehicle targeting), Proposal Manager (proposal sequencing), Technical Lead (sensitivity analysis/modeling capability), Security/Compliance Lead (NIST/FedRAMP/DHS 4300A alignment).

First 48-hour playbook

• Hour 0–4: Confirm receipt of this briefing via Cabrillo Signals War Room; create saved searches in Cabrillo Signals Intelligence Hub for DHS/FEMA NRI-related solicitations; alert internal notification chain.
• Hour 4–12: Run Match Engine rescore of active DHS/FEMA opportunities and flag high-priority vehicles (DHS EAGLE II, OASIS+, 8(a) STARS III); start Proposal Studio bid/no-bid assessment.
• Hour 12–24: Assign capture lead and technical lead; inventory analytic, GIS, and user-engagement capabilities; map gaps to compliance surfaces (NIST 800-171, FedRAMP, DHS 4300A) using Proposal Studio compliance matrices.
• Hour 24–48: Draft capture plan and win themes in Proposal Studio; schedule first capture review in Proposal Studio Workflow Tracker; initiate outreach plan for teaming/subcontracting as needed.

Related Cabrillo guidance:

• Winning Federal Contracts Guide (/insights/winning-federal-contracts)
• CMMC (Cybersecurity Maturity Model Certification) Compliance Guide (/insights/cmmc-compliance-guide)
• CUI (Controlled Unclassified Information)-Safe CRM Guide (/insights/cui-safe-crm-guide)