- Achieving Sustainable Site Design through Low Impact Development Practices
- Aesthetic Challenges
- Aesthetic Opportunities
- Air Barrier Systems in Buildings
- Air Decontamination
- Balancing Security/Safety and Sustainability Objectives
- Blast Safety of the Building Envelope
- Building Integrated Photovoltaics (BIPV)
- Chemical / Biological / Radiation (CBR) Safety of the Building Envelope
- Cost Impact of the ISC Security Criteria
- Designing Buildings to Resist Explosive Threats
- Distributed Energy Resources (DER)
- Electrical Safety
- Evaluating and Selecting Green Products
- Facility Performance Evaluation (FPE)
- Flood Resistance of the Building Envelope
- Fuel Cells and Renewable Hydrogen
- Glazing Hazard Mitigation
- Hangar Pavement Design
- HVAC Integration of the Building Envelope
- Life-Cycle Cost Analysis (LCCA)
- Low Impact Development Technologies
- Natural Ventilation
- Passive Solar Heating
- Psychosocial Value of Space
- Retrofitting Existing Buildings to Resist Explosive Threats
- Security and Safety in Laboratories
- Seismic Design Principles
- Seismic Safety of the Building Envelope
- Solar Water Heating
- Sun Control and Shading Devices
- Sustainable O&M Practices
- UFC/ISC Security Design Criteria Overview and Comparison
- Water Conservation
- Wind Safety of the Building Envelope
- Windows and Glazing
Threat/Vulnerability Assessments and Risk Analysis
Last updated: 10-19-2011
Within This Page
All facilities face a certain level of risk associated with various threats. These threats may be the result of natural events, accidents, or intentional acts to cause harm. Regardless of the nature of the threat, facility owners have a responsibility to limit or manage risks from these threats to the extent possible. The federal government has implemented the Interagency Security Committee (ISC) Security Design Criteria. The ISC Security Design Criteria states,
"The application of the Security Design Criteria is based on a project-specific risk assessment that looks at threat, vulnerability, and consequences, three important components of risk ... The building's specific security requirements should be based on a risk assessment—done at the earliest stages of programming ..."
Facility owners, particularly owners of public facilities, should adhere to similar security design criteria as those put forth in the ISC Security Design Criteria. Landlords who desire to lease space to federal government agencies must implement the ISC Security Design Criteria in the design of new facilities and/or the renovation of existing facilities.
A. Threat Assessment
The first step in a risk management program is a threat assessment. A threat assessment considers the full spectrum of threats (i.e., natural, criminal, terrorist, accidental, etc.) for a given facility/location. The assessment should examine supporting information to evaluate the likelihood of occurrence for each threat. For natural threats, historical data concerning frequency of occurrence for given natural disasters such as tornadoes, hurricanes, floods, fire, or earthquakes can be used to determine the credibility of the given threat. For criminal threats, the crime rates in the surrounding area provide a good indicator of the type of criminal activity that may threaten the facility. In addition, the type of assets and/or activity located in the facility may also increase the target attractiveness in the eyes of the aggressor. The type of assets and/or activity located in the facility will also relate directly to the likelihood of various types of accidents. For example, a facility that utilizes heavy industrial machinery will be at higher risk for serious or life-threatening job related accidents than a typical office building.
Fig. 1. The tornado damaged Cash America Building - Fort Worth, TX
For terrorist threats, the attractiveness of the facility as a target is a primary consideration. In addition, the type of terrorist act may vary based on the potential adversary and the method of attack most likely to be successful for a given scenario. For example, a terrorist wishing to strike against the federal government may be more likely to attack a large federal building than to attack a multi-tenant office building containing a large number of commercial tenants and a few government tenants. However, if security at the large federal building makes mounting a successful attack too difficult, the terrorist may be diverted to a nearby facility that may not be as attractive from an occupancy perspective, but has a higher probability of success due to the absence of adequate security. In general, the likelihood of terrorist attacks cannot be quantified statistically since terrorism is, by its very nature, random. Hence, when considering terrorist threats, the concept of developing credible threat packages is important.
B. Vulnerability Assessment
Once the credible threats are identified, a vulnerability assessment must be performed. The vulnerability assessment considers the potential impact of loss from a successful attack as well as the vulnerability of the facility/location to an attack. Impact of loss is the degree to which the mission of the agency is impaired by a successful attack from the given threat. A key component of the vulnerability assessment is properly defining the ratings for impact of loss and vulnerability. These definitions may vary greatly from facility to facility. For example, the amount of time that mission capability is impaired is an important part of impact of loss. If the facility being assessed is an Air Route Traffic Control Tower, a downtime of a few minutes may be a serious impact of loss, while for a Social Security office a downtime of a few minutes would be minor. A sample set of definitions for impact of loss is provided below. These definitions are for an organization that generates revenue by serving the public.
- Devastating: The facility is damaged/contaminated beyond habitable use. Most items/assets are lost, destroyed, or damaged beyond repair/restoration. The number of visitors to other facilities in the organization may be reduced by up to 75% for a limited period of time.
- Severe: The facility is partially damaged/contaminated. Examples include partial structure breach resulting in weather/water, smoke, impact, or fire damage to some areas. Some items/assets in the facility are damaged beyond repair, but the facility remains mostly intact. The entire facility may be closed for a period of up to two weeks and a portion of the facility may be closed for an extended period of time (more than one month). Some assets may need to be moved to remote locations to protect them from environmental damage. The number of visitors to the facility and others in the organization may be reduced by up to 50% for a limited period of time.
- Noticeable: The facility is temporarily closed or unable to operate, but can continue without an interruption of more than one day. A limited number of assets may be damaged, but the majority of the facility is not affected. The number of visitors to the facility and others in the organization may be reduced by up to 25% for a limited period of time.
- Minor: The facility experiences no significant impact on operations (downtime is less than four hours) and there is no loss of major assets.
Vulnerability is defined to be a combination of the attractiveness of a facility as a target and the level of deterrence and/or defense provided by the existing countermeasures. Target attractiveness is a measure of the asset or facility in the eyes of an aggressor and is influenced by the function and/or symbolic importance of the facility. Sample definitions for vulnerability ratings are as follows:
- Very High: This is a high profile facility that provides a very attractive target for potential adversaries, and the level of deterrence and/or defense provided by the existing countermeasures is inadequate.
- High: This is a high profile regional facility or a moderate profile national facility that provides an attractive target and/or the level of deterrence and/or defense provided by the existing countermeasures is inadequate.
- Moderate: This is a moderate profile facility (not well known outside the local area or region) that provides a potential target and/or the level of deterrence and/or defense provided by the existing countermeasures is marginally adequate.
- Low: This is not a high profile facility and provides a possible target and/or the level of deterrence and/or defense provided by the existing countermeasures is adequate.
The vulnerability assessment may also include detailed analysis of the potential impact of loss from an explosive, chemical, or biological attack. Professionals with specific training and experience in these areas are required to perform these detailed analyses. A sample of the type of output that can be generated by a detailed explosive analysis is shown in Figure 2. This graphic representation of the potential damage to a facility from an explosive attack allows a building owner to quickly interpret the results of the analysis, although a more fully detailed and quantitative engineering response would be required to design a retrofit upgrade. In addition, similar representations can be used to depict the response of an upgraded facility to the same explosive threat. This allows a building owner to interpret the potential benefit that can be achieved by implementing various structural upgrades to the building frame, wall, roof, and/or windows.
Fig. 2. Sample output from detailed explosive analysis: glazing hazard in existing facility (left) and glazing hazard in upgraded facility (right)
C. Risk Analysis
A combination of the impact of loss rating and the vulnerability rating can be used to evaluate the potential risk to the facility from a given threat. A sample risk matrix is depicted in Table 1. High risks are designated by the red cells, moderate risks by the yellow cells, and low risks by the green cells.
Table 1. Matrix identifying levels of risk
|Vulnerability to Threat|
|Impact of Loss||Very High||High||Moderate||Low|
The ratings in the matrix can be interpreted using the explanation shown in Table 2.
Table 2. Interpretation of the risk ratings
|These risks are high. Countermeasures recommended to mitigate these risks should be implemented as soon as possible.|
|These risks are moderate. Countermeasure implementation should be planned in the near future.|
|These risks are low. Countermeasure implementation will enhance security, but is of less urgency than the above risks.|
D. Upgrade Recommendations
Based on the findings from the risk analysis, the next step in the process is to identify countermeasure upgrades that will lower the various levels of risk. If minimum standard countermeasures for a given facility level are not currently present, these countermeasures should automatically be included in the upgrade recommendations. Additional countermeasure upgrades above the minimum standards should be recommended as necessary to address the specific threats identified for the facility. The estimated capital cost of implementing the recommended countermeasures is usually provided in the threat/vulnerability assessment report. The estimated installation and operating costs for the recommended countermeasures are also usually provided in the threat/vulnerability assessment report. All operating costs are customarily estimated on a per year basis.
E. Re-Evaluation of Risks
The implementation of the recommended security and/or structural upgrades should have a positive effect on the impact of loss and/or the vulnerability ratings for each threat. The final step in the process is to re-evaluate these two ratings for each threat in light of the recommended upgrades. Using an exterior explosive threat as an example, the installation of window retrofits (i.e., security window film, laminated glass, etc.) will not prevent the explosive attack from occurring, but it should reduce the impact of loss/injury caused by hazardous flying glass. Therefore, the impact of loss rating for an explosive threat would improve, but the vulnerability rating would stay the same.
Fig. 3. These photos depict two windows subjected to a large explosion. The unprotected window on the left fails catastrophically. The protected window on the right retains glass fragments and poses a significantly lower hazard to occupants.
The overall threat/vulnerability and risk analysis methodology is summarized by the following flowchart.
Fig. 4. Flowchart depicting the basic risk assessment process
Threat/vulnerability assessments and risk analysis can be applied to any facility and/or organization. The federal government has been utilizing varying types of assessments and analyses for many years. Currently, the U.S. General Services Administration (GSA) and the Federal Protective Service of the Department of Homeland Security are utilizing a methodology entitled Federal Security Risk Management (FSRM). This process is basically the methodology described in this Resource Page. GSA is using the process to assess over 8,000 federally owned and/or leased facilities. The Internal Revenue Service (IRS) has also adapted this same methodology to assess over 700 facilities housing IRS employees. Other agencies that have used this process to assess some of their facilities include the U.S. Department of Agriculture and the Smithsonian Institution. The Social Security Administration has also trained over 50 of its facility managers and security specialists to apply this process. Finally, the Department of Homeland Security intends to use the FSRM process throughout the many agencies under its control.
Relevant Codes and Standards
- Executive Order 12977, "Interagency Security Committee"
- Federal Emergency Management Agency (FEMA)—FEMA 386-7 Integrating Manmade Hazards into Mitigation Planning
FEMA 452 Risk Assessment - A How-To Guide to Mitigate Potential Terrorist Attacks Against Buildings
- Interagency Security Committee (ISC) Security Design Criteria—Defines Threat/Risk classifications and resultant federal protective design requirements (Official Use Only)
- Unified Facilities Criteria (UFC)—UFC 4-010-01 DoD Minimum Anti-Terrorism Standards for Buildings—Establishes prescriptive procedures for Threat, Vulnerability and Risk assessments and security design criteria for DoD facilities (Official Use Only)
Building / Space Types
Products and System
- 03 30 00 (03300) Cast-in-Place Concrete
- 03 40 00 (03400) Precast Concrete
- 08 14 00 (08210) Wood Doors
- 08 50 00 (08500) Windows
- 31 10 00 (02230) Site Clearing
- 32 10 00 (02700) Bases, Ballasts, Paving
- 32 12 43 (02795) Porous Paving
- 32 90 00 (02900) Planting
- Federal Emergency Management Agency (FEMA) Terrorist Hazards Preparedness
- Federal Protective Service (FPS)—managed by the Department of Homeland Security, this federal law enforcement agency provides integrated security and law enforcement services to federally owned and leased buildings, facilities, properties and other assets
Design and Analysis Tools
- FSR-Manager—Proprietary software developed by Applied Research Associates, Inc. (ARA) to assist in performing threat/vulnerability assessments and risk analyses
- RAMPART™ (Risk Assessment Method—Property Analysis and Ranking Tool) (PDF 245 KB)—Developed by Sandia National Laboratories as a screening-level software program to determine the risk to a building by natural hazards, crime, and terrorism
Organizations and Associations
- American Society of Industrial Security (ASIS)—A leading non-profit association of security managers, product manufacturers, and consultants offering a variety of publications and programs including Threat and Vulnerability Assessment training
- International Association of Professional Security Consultants—An association of security consultants whose members frequently perform Vulnerability Assessments
- Are Your Tenants Safe? BOMA's Guide to Security and Emergency Planning (PDF 684 KB) by Building Owners and Managers Association. Provides a template and instructions for completing a Threat, Vulnerability and Risk Assessment on commercial and institutional properties.
- BIPS 05 Preventing Structures from Collapsing by Department of Homeland Security (DHS), 2011.
- Multi-hazard Identification and Risk Assessment (MHIRA) by Federal Emergency Management Agency (FEMA).