Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

Unit V (C) 

COURSE TITLE Building Design for Homeland Security for Continuity of Operations 
(COOP) Train-the-Trainer 
TIME 45 minutes 
UNIT TITLE Risk Assessment / Risk Management 

OBJECTIVES 1. Explain what constitutes risk. 

2. Provide a numerical rating for risk and justify the basis for the 
rating. 
3. Evaluate risk using the Risk (Threat-Vulnerability) Matrix to capture 
assessment information. 
4. Identify top risks for asset-threat/hazard pairs of interest that should 
receive measures to mitigate vulnerabilities and reduce risk. 
SCOPE The following topics will be covered in this unit: 

1. Definition of risk and the various components to determine a risk 
rating. 
2. The FEMA 426 approach to determining risk. 
3. A rating scale and how to use it to determine a risk rating. One or 
more specific examples will be used to focus students on the 
following activity. 
4. The relationships between high risk, the need for mitigation 
measures, and the need to identify a Design Basis Threat and Level 
of Protection. 
5. Activity: Determine the risk rating for the asset-threat/hazard pairs 
of interest. Identify the high risk ratings for the Case Study. 
REFERENCES 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist 
Attacks Against Buildings, pages 1-35 to 1-44 

2. FEMA 452, Risk Assessment: A How-To Guide to Mitigate 
Potential Terrorist Attacks Against Buildings, pages 4-1 to 4-9 
3. Case Study – Appendix C: COOP, Cooperville Information / 
Business Center 
4. Student Manual, Unit V(C) (info only – not listed in SM) 
5. Unit V (C) visuals (info only – not listed in SM) 
IG V-C-1 



Unit V (C) 

REQUIREMENTS 1. FEMA 426, Reference Manual to Mitigate Potential Terrorist 
Attacks Against Buildings (one per student) 

2. FEMA 452, Risk Assessment: A How-To Guide to Mitigate 
Potential Terrorist Attacks Against Buildings (one per student) 
3. Instructor Guide, Unit V (C) 
4. Student Manual, COOP Case Study (C) (one per student) 
5. Overhead projector or computer display unit 
6. Unit V (C) visuals 
7. Risk Matrix poster and box of dry-erase markers (one per team) 
8. Chart paper, easel, and markers (one per team) 
UNIT V (C) OUTLINE Time Page 

V. Risk Assessment / Risk Management 45 minutes IG V-C-1 
1. Introduction and Unit Overview 5 minutes IG V-C-5 
2. Risk and Rating Approach 7 minutes IG V-C-7 
3. Selecting Mitigation Measures 5 minutes IG V-C-10 
4. Process Review/Summary/Transition 3 minutes IG V-C-12 
5. Activity: Risk Rating 25 minutes IG V-C-15 
(Version (C) COOP) 
[15 minutes for students, 10 minutes for review] 
PREPARING TO TEACH THIS UNIT 

• Tailoring Content to the Local Area: This is a generic instruction unit that does not have 
any specific capability for linking to the Local Area. 
• Optional Activity: There are no optional activities in this unit. 
• Activity: The student activity is primarily a math exercise in multiplying the asset value, 
threat, and vulnerability ratings to determine the risk rating and then compare it against the 
risk rating scale. The top three risks should receive additional emphasis during an actual 
assessment to focus attention on specific vulnerabilities as an input to select mitigation 
measures. 
• Refer students to their Student Manuals for worksheets and activities. 
IG V-C-2 



Unit V (C) 

• Direct students to the appropriate page (Unit #) in the Student Manual. 
• Instruct the students to read the activity instructions found in the Student Manual. 
• Explain that the risk ratings determined by the team must be transferred to the Risk Matrix 
poster. 
• Tell students how long they have to work on the requirements. 
• While students are working, all instructors should closely observe the groups’ process and 
progress. If any groups are struggling, immediately assist them by clarifying the assignment 
and providing as much help as is necessary for the groups to complete the requirement in the 
allotted time. Also, monitor each group for full participation of all members. For example, 
ask any student who is not fully engaged a question that requires his/her viewpoint to be 
presented to the group. 
• At the end of the working period, reconvene the class. 
• After the students have completed the assignment, “walk through” the activity with the 
students during the plenary session. Call on different teams to provide the answer(s) for each 
question. Then simply ask if anyone disagrees. If the answer is correct and no one disagrees, 
state that the answer is correct and move on to the next requirement. If there is disagreement, 
allow some discussion of rationale, provide the “school solution” and move on. 
• If time is short, simply provide the “school solution” and ask for questions. Do not end the 
activity without ensuring that students know if their answers are correct or at least on the 
right track. 
• Ask for and answer questions. 
Editor Note: Two methods have been used in Instructor Guides to ensure the slide designation 
and slide thumbnail in the left column aligns with the Content/Activity in the right 
column. 

(1) Highlight row by placing cursor in left column until arrow shifts to right, Tab 
<Insert>, <Break>, <select Page Break>, <OK> 
(2) Highlight row as in (1), right click on highlighted row for menu, <Table Properties>, 
Tab <Row>, remove check in box <Allow row to break across pages> 
(3) Alternate for (2), highlight row, click on <Table> at top of screen, <Table 
Properties> and continue like (2) 
IG V-C-3 



Unit V (C) 

This page intentionally left blank 

IG V-C-4 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

INSTRUCTOR NOTES CONTENT/ACTIVITY 

VISUAL V-C-1 


BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T 

Unit V
Risk Assessment /
Risk Management



VISUAL V-C-2 


Unit Objectives 

Explain what constitutes risk. 

Provide a numerical rating for risk and justify the basis for 
the rating. 

Evaluate risk using the Risk (Threat-Vulnerability) Matrix 
to capture assessment information. 

Identify top risks for asset-threat/hazard pairs that should 
receive measures to mitigate vulnerabilities and reduce 
risk. 


BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-2 

Introduction and Unit Overview 

This is Unit V Risk Assessment / Risk 
Management. The unit will provide a 
definition of risk and the various 
components to determine a risk rating, 
review various approaches to determine risk, 
review a rating scale, and demonstrate how 
to use the scale to determine a risk rating. 

Unit Objectives 

At the end of this unit, the students should 
be able to: 

1. Explain what constitutes risk. 
2. Provide a numerical rating for risk and 
justify the basis for the rating. 
3. Evaluate risk using the Risk Matrix 
poster (Threat-Vulnerability Matrix) to 
capture assessment information. 
4. Identify top risks for asset-threat/hazard 
pairs of interest that should receive 
measures to mitigate vulnerabilities and 
reduce risk. 
IG V-C--5 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

INSTRUCTOR NOTES CONTENT/ACTIVITY 

VISUAL V-C-3 


Risk Management 

Risk management is the deliberate process of 
understanding “risk” – the likelihood that a threat will 
harm an asset with some severity of consequences – and 
deciding on and implementing actions to reduce it. 

GAO/NSIAD-98-74: Combating Terrorism – Threat and 
Risk Assessments Can Help Prioritize and Target 
Program Investments, April 1998 


BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-3 

VISUAL V-C-4 


BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-4 
Assessment Flow Chart 
cti . ) 
ti .) rs ) 
ti 
l i 
i ent) 
cti . 
l i 
ti f t t iti it 
lti t l i 
l i 
ti l lit 
l i 
FEMA 426, Figure 1-3: The Assessment Process Model, p. 1-5 
Risk Management 

Risk management incorporates an 
understanding of the vulnerability of assets 
to the consequences of threats and hazards. 

The objective is to reduce the vulnerability 
of assets through mitigation actions. 
Reducing vulnerabilities is the most 
straightforward approach to reducing risk. 

However, realize that risk reduction has two 
other components, albeit not applicable to 
building design: 

• Reduce asset value (Devalue the asset) 
• Reduce threat (intelligence and law 
enforcement team to arrest terrorists 
before an attack can be carried out) 
Assessment Flow Chart 

Reviewing the Assessment Flow Chart, the 
determination of quantitative risk values is 
the next step in the risk assessment process. 

IG V-C-6 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

INSTRUCTOR NOTES CONTENT/ACTIVITY 

VISUAL V-C-5 


Definition of Risk 

Risk is a combination of: 

. The probability that an event will occur, and 
. The consequences of its occurrence 
FEMA 426, Table 1-19: Total Risk Color Code, p. 1-38 

BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-5 

VISUAL V-C-6 


Quantifying Risk 

Risk Assessment 

Determine Asset Value 
Determine Threat Rating Value 
Determine Vulnerability Rating Value 
Determine relative risk for each threat against each asset 

Select mitigation measures that have the greatest 
benefit/cost for reducing risk 


BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-6 

Risk 

Risk can be defined as the potential for a 
loss or damage to an asset to occur. It takes 
into account the value of an asset, the 
threats or hazards that potentially impact 
the asset, and the vulnerability of the asset 
to the threat or hazard. 

Values can be assigned to these three 
components of risk to provide a risk rating. 

Quantifying Risk 

There are at least four steps or required 
tasks in the risk assessment process. A 
determination of the Asset Value, Threat 
Rating Value, Vulnerability Rating Value, 

and identifying or recommending 
appropriate mitigation measures to reduce 
the risk. 

Determining the relative risk of threat 
against asset justifies the use of limited 
resources to reduce the greatest risk and 
focuses the mitigation measures needed. 

IG V-C--7 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

INSTRUCTOR NOTES CONTENT/ACTIVITY 

VISUAL V-C-7 


BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-7 
An Approach to Quantifying Risk 
Risk =Risk = Asset Value x 
Threat Rating x 
Vulnerability Rating 
FEMA 426, p. 1-38 
VISUAL V-C-8 


Critical Functions 

Function Cyber attack Armed attack 
(single gunman) 
Vehicle 
bomb CBR attack 
Administration 280 140 135 90 
Asset Value 5 5 5 5 
Threat Rating 8 4 3 2 
Vulnerability Rating 7 7 9 9 
Engineering 128 160 384 144 
Asset Value 8 8 8 8 
Threat Rating 8 5 6 2 
Vulnerability Rating 2 4 8 9 


FEMA 426, Adaptation of Table 1-20: Site Functional Pre-Assessment 
Screening Matrix, p. 1-38 

BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-8 

An Approach to Quantifying Risk 

The risk assessment analyzes the threat, 
asset value, and vulnerability to ascertain the 
level of risk for each critical asset against 
each applicable threat. 

An understanding of risk levels enables the 
owner of assets to prioritize and implement 
appropriate mitigation measures, paying 
particular attention to high consequence 
threats, to achieve the desired level of 
protection. 

A simplified approach to quantifying risk is 
shown here. Values can be assigned to asset 
value/criticality, the threat or hazard, and 
vulnerability of the asset to the threats, and 
numerical scores can be determined that 
depict relative risk of these assets to 
manmade hazards. (FEMA 426 Chapter 1, 
FEMA 452 Steps 1, 2, 3, and 4.) 

Critical Functions Matrix 

This analysis completes the Critical 
Functions and the Critical Infrastructure 
Matrices that we saw in Units II, III, and IV. 

The risk formula is applied and the numeric 
values color coded as discussed on the 
previous slide. The color code helps 
visualize the functions and infrastructure 
that are vulnerable and the scale helps to 
identify those areas for in-depth mitigation 
measures analysis. 

The risk ratings under the Administration 
and Engineering Functions are highlighted. 
The numeric values result in Medium and 
High risk ratings for the Functions asset-
threat/hazard pairs. 

IG V-C-8 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

INSTRUCTOR NOTES CONTENT/ACTIVITY 

VISUAL V-C-9 


Critical Infrastructure 

Infrastructure Cyber attack Armed attack 
(single gunman) 
Vehicle 
bomb CBR attack 
Site 48 80 108 72 
Asset Value 4 4 4 4 
Threat Rating 4 4 3 2 
Vulnerability Rating 3 5 9 9 
Structural Systems 48 128 192 144 
Asset Value 8 8 8 8 
Threat Rating 3 4 3 2 
Vulnerability Rating 2 4 8 9 


FEMA 426, Adaptation of Table 1-21: Site Infrastructure Systems Pre-
Assessment Screening Matrix, p. 1-39 

BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-9 

VISUAL V-C-10 


Risk 
Assessment 
Results 


FEMA 426, Table 1-20: Site Functional Pre-Assessment Screening Matrix, 

p. 1-38 
BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-10 

Critical Infrastructure Matrix 

The risk ratings under the Site and Structural 
Systems are highlighted. The numeric values 
result in Low to Medium risk ratings for the 
Infrastructure asset-threat/hazard pairs, 
except for Structural Systems – Vehicle 
Bomb which has a High risk rating. 

Risk Assessment Results 

The process is continued for all the asset-
threat/hazard pairs of interest. This is a 
nominal example of a completed risk table. 

The risk assessment results in a prioritized 
list of risks (i.e., asset – threat / hazard / 
vulnerability combinations) that can be used 
to select safeguards to reduce vulnerabilities 
(and risk) and to achieve a certain level of 
protection. 

As stated previously, this subjective process 
is best applied to small organizations with 
few decision makers / decision levels. 
This subjective risk assessment process will 
probably not result in hard numbers that can 
be compared across different assessment 
teams, but the relative ranking of the asset-
threat/hazard pairs on each team will have 
great correlation if both teams have 
consistent perspectives. Thus, the highest 
and lowest identified risks may not have the 
same rating numbers, but the same asset-
thread/hazard pairs by the two teams will be 
close to identical. Divergence will occur if 
one team is concentrating on terrorism and 
the other team is concentrating on continuity 

IG V-C--9 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

INSTRUCTOR NOTES CONTENT/ACTIVITY 

VISUAL V-C-11 


BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-11 
Selecting Mitigation Measures 
Three Options: 
Do nothing and accept 
the risk. 
Perform a risk assessment 
and manage the risk by 
installing reasonable 
mitigation measures. 
Harden the building against all 
threats to achieve the least 
amount of risk. 
FEMA 426, Figure 1-13: Risk Management Choices, p. 1-44 
of business operations. 

Large organizations require a more objective 
approach where the results of different 
assessment teams working independently 
can be compared by decision makers at 
many levels. These risk ratings will then be 
comparable across teams as to their numeric 
value, which is needed in a large 
organization. 

In either case, the goal is to find where the 
application of limited resources will have 
the greatest benefit to reducing risk at the 
least cost. 

Selecting Mitigation Measures 

In every design and renovation project, the 
owner ultimately has three choices when 
addressing the risk posed by terrorism. They 
can: 

1. Do nothing and accept the risk (no cost). 
2. Perform a risk assessment and manage the 
risk by installing reasonable mitigation 
measures (some cost). 
3. Harden the building against all threats to 
achieve the least amount of risk (but at 
greatest cost). 
IG V-C-10 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

INSTRUCTOR NOTES CONTENT/ACTIVITY 

BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-12 
• 
• 
• 
• Regulatory measures 
• Rehabilitation of existing structures 
• Protective and control structures 
Mitigation Measures 
A mitigation measure is an action, device, or system used 
to reduce risk by affecting an asset, threat, or 
vulnerability. 
VISUAL V-C-12 


VISUAL V-C-13 


Mitigation Measures 

After determining how specific threats 
potentially impact an asset (and occupants), 
the architect and building engineer can work 
with security and risk specialists to identify 
mitigation measures to reduce risk. Because 
it is not possible to completely eliminate 
risk, it is important to determine what level 
of protection is desirable, and the options for 
achieving this level through risk 
management. 

Measures to Reduce Risk 

Higher risk hazards require mitigation 
measures to reduce risk. Mitigation 
measures are conceived by the design 
professional and are best incorporated into 
the building architecture, building systems, 
and operational parameters, with 
consideration for life-cycle costs. 

There are many factors that impact what 
mitigation measures can be implemented at 
low, medium, and high levels of difficulty. 

In some cases, mitigation measures to 
enhance security may be in conflict with 
other design intentions, building codes, 
planning board master plans, etc. 

BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-13 
Mitigation Measures 
• Political Support 
• Community Acceptance 
• Cost and Benefit 
• Financial Resources 
• Legal Authority 
• Adversely Affected Population 
• Adverse Effects on Built Environment 
• Environmental Impact 
• Technical Capacity 
• Maintenance and Operations 
• Ease and Speed of Implementation 
• Timeframe and Urgency 
• Short-term and Long-Term Solutions 
• Estimated Cost 
• • Mitigation measures 
can be evaluated 
against the following 
parameters 
IG V-C--11 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

INSTRUCTOR NOTES CONTENT/ACTIVITY 

VISUAL V-C-14 


Achieving Building Security: 
Planning Factors 

Building security integrates multiple concepts 
and practices. 

Objective is to achieve a balanced approach 
that combines aesthetics, enhanced security, 
and use of non-structural measures. 


BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-14 

VISUAL V-C-15 


Process Review 

Calculate the relative risk for each threat 
against each asset 
Identify the high risk areas 
Identify Mitigation Options to reduce risk 


Achieving Building Security 

The assessment process provides concepts 
for integrating land use planning, landscape 
architecture, site planning, and other 
strategies to mitigate the Design Basis 
Threats as identified in the risk assessment. 

Integrating security measures into design 
and/or maintenance of buildings presents the 
asset owner with multiple opportunities of 
achieving a balance among many objectives 
such as reducing risk; facilitating proper 
building function; aesthetics and matching 
architecture; hardening of physical 
structures beyond required building codes 
and standards; and maximizing use of non-
structural systems. 
[The last point tries to illustrate that the 
balanced approach to building security tries 
not to place everything into hardening the 
structure to deny the consequences to the 
terrorist’s tactics. Thus, non-structural 
systems, especially in renovation projects, 
may provide a level of risk reduction 
comparable to structural hardening, but at a 
must reduced cost or at a more timely 
implementation.] 

Process Review 

• Calculate the relative risk for each threat 
against each asset 
• Identify the high risk areas 
• Identify Mitigation Options to reduce the 
risk 
To get the maximum benefit from limited 
resources, realize that certain mitigation 
measures can reduce risk for multiple, high-
risk asset – threat / hazard pairs. 

BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-15 

IG V-C-12 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

INSTRUCTOR NOTES CONTENT/ACTIVITY 

VISUAL V-C-16 


Summary 

Risk Definition 

Critical Functions and Critical Infrastructure 
Matrices 
Numerical and color-coded risk scale 
Identify Mitigation Options 


BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-16 

VISUAL V-C-17 


Unit V Case Study Activity 

Risk Rating 

Background 

Formula for determining a numeric value risk for each asset-
threat/hazard pair: 

Risk = Asset Value x Threat Rating x Vulnerability Rating 

Requirements: Vulnerability Rating Approach

Use worksheet tables / Risk Matrix poster to summarize Case Study 
asset, threat, and vulnerability ratings determined in previous activities 

Use the risk formula to determine the risk rating for each asset-
threat/hazard pair for: 

. Critical Functions 
. Critical Infrastructure 
BUILDING DESIGN FOR HOMELAND SECURITY COOP T-t-T Unit V-C-17 

Refer participants to the Unit V Case Study 
activity in the Student Manual. 

Members of the instructor staff should be 
available to answer questions and assist groups 
as needed. 

At the end of 15 minutes, reconvene the class 
and facilitate group reporting (plenary group 
will take about 10 minutes). 

Summary 

• Risk Definition 
• Critical Function and Critical 
Infrastructure Matrices 
• Numerical and Color-coded Risk Scale 
• Identify Mitigation Options 
Student Activity 

One approach to conducting a risk 
assessment is to assemble the results of the 
asset value assessment, the threat 
assessment, and the vulnerability 
assessment, and determine a numeric value 
of risk for each asset-threat/hazard pair 
using the following formula: 

Risk = Asset Value Rating x
Threat Rating x
Vulnerability Rating 


Activity Requirements 

Working with your team, use the worksheet 
tables or Risk Matrix poster to summarize 
the asset, threat, and vulnerability 
assessment ratings determined in the 
previous three unit student activities for the 
selected Case Study. 

Ensure the answers are a team consensus. 

Then use the risk formula to determine the 
risk rating for each asset-threat/hazard pair 
identified under Critical Functions and 
under Critical Infrastructure. 

IG V-C--13 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

INSTRUCTOR NOTES CONTENT/ACTIVITY 

Circle all High risk ratings using a RED
whiteboard marker. 
Take 15 minutes to complete this activity. 
Solutions will be reviewed in plenary group. 


Transition 

Unit VI tomorrow morning will provide an 
alternate to performing this risk assessment 
process manually as you have done today in 
your student activities. 

IG V-C-14 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

UNIT V (C) CASE STUDY ACTIVITY: 

RISK RATINGS 

(COOP Version) 

One approach to conducting a risk assessment is to assemble the results of the asset value 
assessment, the threat/hazard assessment, and the vulnerability assessment, and determine a 
numeric value of risk for each asset-threat/hazard pair of interest using the following formula: 

Risk Rating = Asset Value Rating x Threat Rating x Vulnerability Rating 

Requirements 

1. Use the following worksheet tables or the Risk Matrix poster to summarize the CI/BC asset 
value, threat/hazard, and vulnerability assessment ratings conducted in the previous three unit 
activities. Reach team consensus on answers. 
2. Use the formula above to determine the risk rating for each asset-threat/hazard pair identified 
under Critical Functions and under Critical Infrastructure. 
3. Transfer the ratings to the Risk Matrix poster and circle all high risk ratings in RED using a 
whiteboard marker. 
CI/BC Critical Functions Risk Ratings 

Function Cyber 
Attack 
Armed 
Attack 
Vehicle 
Bomb 
CBR 
Attack 
1. Administration 
Risk Rating 128 96 192 128 
Asset Value Rating 4 4 4 4 
Threat Rating 8 3 6 4 
Vulnerability Rating 4 8 8 8 
2. Engineering/IT 
Technicians 
Risk Rating 
256 144 384 256 
Asset Value Rating 8 8 8 8 
Threat Rating 8 3 6 4 
Vulnerability Rating 4 6 8 8 
3. Loading Dock/ Warehouse 
Risk Rating 64 96 192 128 
Asset Value Rating 4 4 4 4 
Threat Rating 8 3 6 4 
Vulnerability Rating 2 8 8 8 

IG V-C - 15 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

Function Cyber 
Attack 
Armed 
Attack 
Vehicle 
Bomb 
CBR 
Attack 
4. Data Center 
Risk Rating 240 90 480 320 
Asset Value Rating 10 10 10 10 
Threat Rating 8 3 6 4 
Vulnerability Rating 3 3 8 8 
5. Communications 
Risk Rating 576 81 432 288 
Asset Value Rating 9 9 9 9 
Threat Rating 8 3 6 4 
Vulnerability Rating 8 3 8 8 
6. Security 
Risk Rating 224 126 336 224 
Asset Value Rating 7 7 7 7 
Threat Rating 8 3 6 4 
Vulnerability Rating 4 6 8 8 
7. Housekeeping 
Risk Rating 8 6 48 24 
Asset Value Rating 1 1 1 1 
Threat Rating 8 3 6 4 
Vulnerability Rating 1 2 8 8 

CI/BC Critical Infrastructure Risk Ratings 

Infrastructure Cyber 
Attack 
Armed 
Attack 
Vehicle 
Bomb 
CBR 
Attack 
1. Site 
Risk Rating 4 96 192 128 
Asset Value Rating 4 4 4 4 
Threat Rating 1 3 6 4 
Vulnerability Rating 1 8 8 8 
2. Architectural 
Risk Rating 5 120 240 20 
Asset Value Rating 5 5 5 5 
Threat Rating 1 3 6 4 
Vulnerability Rating 1 8 8 1 
3. Structural Systems 
Risk Rating 4 96 384 16 
Asset Value Rating 4 4 8 4 
Threat Rating 1 3 6 4 
Vulnerability Rating 1 8 8 1 

IG V-C-16 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

Infrastructure Cyber 
Attack 
Armed 
Attack 
Vehicle 
Bomb 
CBR 
Attack 
4. Envelope Systems 
Risk Rating 5 120 240 20 
Asset Value Rating 5 5 5 5 
Threat Rating 1 3 6 4 
Vulnerability Rating 1 8 8 1 
5. Utility Systems 
Risk Rating 125 175 180 40 
Asset Value Rating 5 5 5 5 
Threat Rating 5 5 6 4 
Vulnerability Rating 5 7 6 2 
6. Mechanical Systems 
Risk Rating 200 200 384 256 
Asset Value Rating 8 8 8 8 
Threat Rating 5 5 6 4 
Vulnerability Rating 5 5 8 8 
7. Plumbing and Gas 
Systems 
Risk Rating 
6 36 288 24 
Asset Value Rating 6 6 6 6 
Threat Rating 1 3 6 4 
Vulnerability Rating 1 2 8 1 
8. Electrical Systems 
Risk Rating 200 48 384 24 
Asset Value Rating 8 8 8 8 
Threat Rating 5 3 6 4 
Vulnerability Rating 5 2 8 1 
9. Fire Alarm Systems 
Risk Rating 20 30 240 20 
Asset Value Rating 5 5 5 5 
Threat Rating 2 3 6 4 
Vulnerability Rating 2 2 8 1 
10. IT/Communications 
Systems 
Risk Rating 
630 54 432 288 
Asset Value Rating 9 9 9 9 
Threat Rating 10 3 6 4 
Vulnerability Rating 7 2 8 8 

IG V-C - 17 



Course Title: Building Design for Homeland Security COOP T-t-T 

Unit V (C): Risk Assessment/Risk Management 

During plenary session ask the assessment teams what they have identified as their highest risks. 
Using the school solutions presented in previous student activities, the top three risks are as 
follows: 

Risk #1: Cyber Attack upon IT/Communications (630 / 576) 

Risk #2: Vehicle Bomb upon Data Center and Communications (480 / 432), but all Functions 
and Infrastructure is High Risk 

Risk #3: CBR Attack upon Data Center, Communications, Engineering/IT Technicians, and 
Mechanical Systems (320 / 288 / 256) 

IG V-C-18