Assessing Vulnerabilities - Principles of Emergency Management - page 179

Table 8.2

General Vulnerability Assessment Process

Step Description Considerations

1 Identify critical assets

and the impacts of
their loss

• Identify the critical functions of the facility.
• Determine which assets perform or
support the critical functions.
• Evaluate the consequences or impacts to
the critical functions of the facility from the
disruption or loss of each of these critical
assets.

2 Identify what

protects and
supports the critical
assets

• Identify the components of the physical
security system (e.g., perimeter barriers,
building barriers, intrusion detection,
access controls, and security forces) that
protect each asset.
• Identify the critical internal and external
infrastructures (e.g., electric power,
petroleum fuels, natural gas,
telecommunications, transportation, water,
emergency services, computer systems, air
handling systems, fire systems, and SCADA
systems) that support the critical operations
of each asset (interdependencies).
• Identify sensitive information about the
facility and its operation that must be
protected.

3 Identify and

characterize the
threat

• Gather threat information and identify
threat categories and potential adversaries.
• Identify the types of threat-related
undesirable events or incidents that might
be initiated by each threat or adversary.
• Estimate the frequency or likelihood of
each threat-related undesirable event or
incident based on historical information.
• Estimate the degree of threat to each
critical asset for each threat-related
undesirable event or incident.

( continued )