Vulnerability

Any weakness that can be exploited by an aggressor or, in a 
non-terrorist threat environment, make an asset susceptible 
to hazard damage


Unit Objectives

Explainwhat constitutes a vulnerability.

Identifyvulnerabilities using the Building Vulnerability 
Assessment Checklist.

Understandthat an identified vulnerability may indicate that 
an asset: 

..is vulnerable to more than one threat or hazard; 
..and that mitigation measures may reduce vulnerability to one or 
more threats or hazards.


Providea numerical rating for the vulnerability and justify 
the basis for the rating.


Vulnerability Assessment

Identifysite and building systems design issues

Evaluatedesign issues against type and level of threat

Determinelevel of protection sought for each mitigation 
measure against each threat


Assessment Flow Chart

AssetValueAssessment(Section 1.1)
VulnerabilityAssessment(Section 1.3)
Risk Assessment(Section 1.4)
IdentifyMitigation Options(Chapters 2 and 3)
Threat/HazardAssessment(Section 1.2)
Cost AnalysisDecision(Risk Management)
(Section 1.5)
Analyze how mitigationoptions affect asset criticalityand ultimately riskAnalyze how mitigationoptions change vulnerabilityand ultimately risk
Text Box: FEMA 426, Figure 1-3: The Assessment Process Model, p. 1-5 
Identifying Vulnerabilities

Multidisciplinary Team

..Engineers
..Architects
..Security specialists
..Subject matter experts
..Outside experts if necessary



Vulnerability Assessment Preparation

Coordinate with the building stakeholders:

..Site and Building Plans
..Utilities
..Emergency Plans (shelter, evacuation)
..Interview schedules
..Escorts for building access



Assessment GIS Portfolio

10-Mile Radius

Regional Transportation

Metro Center Imagery

Site Emergency Response

Site Public and Government Buildings

Site HazMat

Site Local Transportation Network

Site Principal Buildings by Use

Site Perimeter Imagery

Site Truck BombNominal Large Truck Bomb

Site Car BombNominal Car Bomb

Apply “Vulnerability 
Checklist”

Review Prints and

Specs; Check with

Systems Experts

On-site Inspections

Threat Spectrum Evaluation

Survivability Options

Records

Options to Reduce Vulnerability

Text Box: 1) Define Site Functions 
FEMA 426, Figure 1-8: Facility System Interactions, p. 1-23 

Facility System Interactions

FEMA 426, Figure 1-9: Common System Vulnerabilities, p. 1-35

Single-Point Vulnerabilities

FEMA 426, Figure 1-10: Non-Redundant Critical Functions

Collocated Near Loading Dock, p. 1-41

The trash dumpster and emergency generator are located adjacent to the loading dockThe telecom switch and computer data center are adjacent to the warehouseThe mailroom is located within the interior and not on exterior wall or separate HVAC systemThe loading dock and warehouse provide single point of entry to the interiorStandard 1Standard 1Standard 13 
and 17Standard 11Functional 
Analysis 
SPVs

Air Intakes 

Drive Through

Telecom Service

Infrastructure SPVs

FEMA 426, Figure 1-11: Vulnerability Examples, p. 1-42


Electrical Service

Building Vulnerability Assessment Checklist

Compiles best practices from many sources

Includes questions that determine if critical systems will 
continue to function during an emergency or threat event

Organized into 13 sections

..Each section should be assigned to a 
knowledgeable individual
..Results of all sections should be integrated into a 
master vulnerability assessment
..Compatible with CSI Master Format standard to 
facilitate cost estimates



Site

Architectural

Structural Systems

Building Envelope

Utility Systems

Mechanical Systems 

(HVAC and CBR)

Plumbing and Gas 
Systems

Electrical Systems

Fire Alarm Systems

Communications and IT 
Systems

Equipment Operations 
and Maintenance

Security Systems

Security Master Plan

Building Vulnerability Assessment Checklist


Building Vulnerability Assessment Checklist

Text Box: Is roof access limited to authorized personnel by means of locking mechanisms?
Is access to mechanical areas similarly controlled? 

FEMA 426, Adapted from Table 1-22: Building Vulnerability Assessment 
Checklist, p. 1-46 to 1-92

BuildingVulnerability 
Assessment 
Checklist
Text Box: Is the window system design on the exterior façade balanced to mitigate the hazardous effects of flying glazing following an explosive event? (glazing, frames, anchorage to supporting walls, etc.)?
FEMA 426, Adapted from Table 1-22: Building Vulnerability Assessment 
Checklist, p. 1-46 to 1-92

BuildingVulnerability 
Assessment 
Checklist
Text Box: Does adjacent surface parking on site maintain a minimum stand-off distance? For initial screening consider using 25 meters (82 feet) as a minimum with more distance needed for unreinforced masonry or wooden walls. Reference: GSA PBS-P100 
FEMA 426, Adapted from Table 1-22: Building Vulnerability Assessment 
Checklist, p. 1-46 to 1-92


Text Box: What type of construction?
What type of concrete and reinforcing steel?
What type of steel?
What type of foundation? Text Box: Building Vulnerability Assessment Checklist
Building

Vulnerability 

Assessment 

Checklist

FEMA 426, Adapted from Table 1-22: Building Vulnerability Assessment 
Checklist, p. 1-46 to 1-92


Text Box: Does the fire alarm system require communication with external sources?
By what method is the alarm signal sent to the responding agency: telephone, radio, etc.?
Is there an intermediary alarm monitoring center? 
FEMA 452, Table 3-4: Vulnerability Rating, p. 3-16

Vulnerability RatingKey elementsKey elements
....Number of weaknessesNumber of weaknesses
....Aggressor potential Aggressor potential 
accessibilityaccessibility
....Level of redundancies Level of redundancies 
/physical protection/physical protection
....Time frame for building Time frame for building 
to become operational to become operational 
againagain

FEMA 452, Table 3-4: Vulnerability Rating, p. 3-16

Vulnerability Rating (continued)
Key elementsKey elements
....Number of weaknessesNumber of weaknesses
....Aggressor potential Aggressor potential 
accessibilityaccessibility
....Level of redundancies Level of redundancies 
/physical protection/physical protection
....Time frame for building Time frame for building 
to become operational to become operational 
againagain

Critical Functions

FEMA 426, Adaptation of Table 1-20: Site Functional Pre-Assessment 
Screening Matrix, p. 1-38

Text Box: 9
Critical Infrastructure

FEMA 426, Adaptation of Table 1-21: Site Infrastructure Systems Pre-
Assessment Screening Matrix, p. 1-39

Text Box: 1
Summary

Step-by-Step Analysis Process:

..Expertly performed by experienced personnel
..Determines critical systems
..Identifies vulnerabilities
..Focuses survivability mitigation measures on critical 
areas
..Essential component of Critical Infrastructure and 
Critical Function Matrices



Unit IV Case Study Activity

Vulnerability Rating

Background

Vulnerability: any weakness that can be exploited by an aggressor or, 
in a non-terrorist threat environment, make an asset susceptible to 
hazard damage

Requirements: Vulnerability Rating Approach

Use rating scale of 1 (very low or no weakness) to 

10 (one or major weaknesses)

Answer selected initial Vulnerability Assessment Checklist questions

Refer to Case Study and rate the vulnerability of asset-threat/hazard 
pairs:

..Critical Functions
..Critical Infrastructure