National Preparedness Goal: Mission Areas and Core Capabilities

The National Preparedness Goal organizes the country’s readiness around five mission areas and 32 core capabilities. The mission areas are Prevention, Protection, Mitigation, Response, and Recovery, and each core capability sits within one or more of them. FEMA defines the Goal as “a secure and resilient nation with the capabilities required across the whole community to prevent, protect against, mitigate, respond to, and recover from the threats and hazards that pose the greatest risk.”¹ Originally mandated by Presidential Policy Directive 8 in March 2011, the Goal was updated in a Second Edition released in May 2025, which kept the same five mission areas and 32 capabilities.²

The Five Mission Areas

The five mission areas cover different phases of the emergency management cycle. In practice they overlap; communities often respond to a disaster and start recovering from it at the same time.

Prevention covers the capabilities aimed at stopping a threatened or actual act of terrorism. It is the only mission area focused exclusively on adversarial threats rather than all hazards, and it includes intelligence gathering, investigation, and disrupting plots before they succeed.²

Protection safeguards people, critical infrastructure, and essential services against terrorism, natural disasters, and other threats. Where prevention tries to stop an attack from happening, protection hardens potential targets and reduces vulnerability.

Mitigation covers long-term strategies that reduce loss of life and property before a disaster strikes. Flood mapping, modern building codes, and land-use planning all fall here. The National Institute of Building Sciences reports that federal mitigation grants since 1995 have saved roughly $6 for every $1 invested, and certain categories of mitigation can return as much as $13 per dollar spent.³

Response covers the actions taken immediately after an incident to save lives, protect property, and meet basic human needs. This includes fire suppression, emergency medical care, and mass sheltering for displaced residents.

Recovery restores a community’s housing, economy, health services, and infrastructure after an incident. FEMA’s National Disaster Recovery Framework emphasizes that recovery is not sequential; response and rebuilding often happen simultaneously.⁴

The Three Cross-Cutting Capabilities

Three of the 32 core capabilities appear in every mission area because they are essential regardless of the type of incident.⁵

Planning develops the operational and strategic approaches a community needs before anything goes wrong. Good plans get tested through exercises and revised when they fail.
Public Information and Warning delivers coordinated, timely, and reliable messages to the public during a crisis, using accessible and culturally appropriate methods.
Operational Coordination establishes unified command structures so multiple agencies and organizations can work together instead of tripping over each other.

These three are the connective tissue of the framework. An excellent search-and-rescue team is far less effective if no one coordinates where it deploys, and the best warning system is useless without a plan for what happens after the alert goes out.

Capabilities Under Prevention and Protection

Prevention and Protection share several capabilities in addition to the cross-cutting three. Intelligence and Information Sharing moves threat information between local, state, tribal, and federal agencies so suspicious activity reaches the right analysts quickly. Interdiction and Disruption covers the operational side of stopping threats in progress. Screening, Search, and Detection involves identifying people, cargo, or materials that pose a risk.⁵

Prevention has one unique capability: Forensics and Attribution, which connects an incident to its perpetrators.

Protection adds five of its own. Cybersecurity safeguards electronic communications and data from unauthorized access, damage, or exploitation. Access Control and Identity Verification, Physical Protective Measures, Risk Management for Protection Programs, and Supply Chain Integrity and Security round out the protection toolkit.

Capabilities Under Mitigation

Mitigation adds four capabilities to the cross-cutting three: Community Resilience, Long-term Vulnerability Reduction, Risk and Disaster Resilience Assessment, and Threats and Hazards Identification. These focus on understanding which risks a community faces, measuring exposure, and making structural or policy changes to shrink that exposure over time.²

The return-on-investment case is strong, but adoption lags. As of 2023, 35 states still received FEMA’s lowest ranking for adopting hazard-resistant building codes, a gap that directly increases disaster losses.⁶

Capabilities Under Response

Response holds the largest concentration of capabilities because the immediate aftermath of a disaster demands the widest range of coordinated action.⁵

Critical Transportation keeps roads, bridges, and transit systems functional enough to move people and supplies.
Logistics and Supply Chain Management gets food, water, medical supplies, and emergency power to areas that need them.
Mass Care Services shelters displaced residents, feeds people, and reunifies separated families.
Mass Search and Rescue Operations locates and extracts people who are trapped or in distress.
Public Health, Healthcare, and Emergency Medical Services provides lifesaving treatment and prevents secondary disease outbreaks.
Fatality Management Services recovers and identifies the deceased, provides temporary mortuary support, and helps families through that process.
Fire Management and Suppression controls structural and wildland fires.
Operational Communications ensures first responders can talk to each other across agencies and jurisdictions.
On-scene Security, Protection, and Law Enforcement maintains public safety at incident sites.
Environmental Response/Health and Safety contains hazardous materials and protects responder health.
Situational Assessment gathers and analyzes real-time data so decision-makers know what is actually happening on the ground.
Infrastructure Systems stabilizes critical facilities like power plants and water treatment centers.

Infrastructure Systems appears in both response and recovery. In response, the focus is stabilization; in recovery, it shifts to full restoration.

Capabilities Under Recovery

Recovery adds four capabilities beyond those shared with response: Economic Recovery, Health and Social Services, Housing, and Natural and Cultural Resources. Housing consistently ranks as one of the weakest capabilities nationwide. The 2024 National Preparedness Report found that long-term housing, resource restoration, and reopening businesses had the lowest target achievement across all reporting jurisdictions, and Mass Care Services averaged just 59 percent target achievement.⁶

How Communities Measure Themselves Against the Capabilities

A framework built on capabilities only works if communities can tell where they stand against them. Two connected processes handle that.

The Threat and Hazard Identification and Risk Assessment (THIRA) is a three-step process where state, tribal, and territorial governments identify their most challenging threats, estimate potential impacts, and set target capability levels they aim to reach. Prevention, protection, response, and recovery targets are updated every three years; mitigation targets, which involve longer timelines, are updated every six.⁷

The Stakeholder Preparedness Review (SPR) follows the THIRA annually. Jurisdictions assess their current capabilities against the targets they set, identify gaps, and describe how they plan to close them. Both are required for jurisdictions receiving federal preparedness grants, and grant recipients must address all 32 core capabilities in their assessments.⁸

Whole Community and All-Hazards Scope

Two assumptions shape how the capabilities get applied. The first is that no single agency can handle a serious disaster alone. The Whole Community concept distributes responsibility across individuals and families, businesses, faith-based and community organizations, schools, media outlets, and government at every level. Ready.gov recommends households maintain enough food, water, and supplies to survive on their own for several days, because government resources take time to arrive.⁹

The second is that the same capabilities flex to fit any hazard. With the exception of prevention, which focuses on terrorism, every mission area is designed to work against any type of threat. A logistics capability that delivers water after a hurricane uses the same supply-chain architecture to distribute medical supplies during a disease outbreak. The hazard landscape spans natural events, biological threats, technological incidents, and cyber threats, and cyberattacks have topped the list of most frequently reported threats by communities in every THIRA cycle since 2019.⁶

Anchoring the framework to capabilities rather than specific scenarios is what keeps it usable as new threats emerge. Communities that build strong logistics, communication, and coordination capabilities are better positioned for events no one has predicted yet.

1
FEMA. National Preparedness Goal
2
Federal Emergency Management Agency. National Preparedness Goal – Second Edition
3
National Institute of Building Sciences. Mitigation Saves up to $13 per $1 Invested
4
FEMA. National Disaster Recovery Framework
5
FEMA. National Preparedness Goal: Mission Areas and Core Capabilities
6
GovInfo. 2024 National Preparedness Report
7
FEMA. Increasing Resilience Using THIRA/SPR and Mitigation Planning
8
Federal Emergency Management Agency. Preparedness Grants Manual
9
Ready.gov. Build A Kit