Vulnerability Self Assessment Tool: Risk and Resilience Assessment Basics

Risk and Resilience Assessment Basics Tutorial

BEFORE STARTING THE RISK AND RESILIENCE ASSESSMENT

Before starting the risk and resilience assessment, review the brief tutorial below to learn more about
this process.

How is risk determined?

VSAT Web helps you to identify the highest risks to the utility and find cost-effective measures to reduce
risk and increase resilience. The goal of a risk assessment is to target the utility’s resources to provide
the most benefit to the utility’s mission.

𝐑𝐑𝐑𝐑𝐑𝐑𝐑𝐑 = 𝐓𝐓𝐓𝐓𝐓𝐓𝐓𝐓𝐓𝐓𝐓𝐓 𝐱𝐱 𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕𝐕 𝐱𝐱 𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂𝐂

What is a threat?
A threat is any specific event that could impair the utility from achieving its mission. Threats can be
malevolent acts, such as cyber-attacks or vandalism, natural hazards, like floods or hurricanes, or critical
dependencies, such as power outages.

NATURAL: HURRICANE

MAN-MADE: CYBER ATTACK

 Vulnerability Self Assessment Tool: Risk and Resilience Assessment Basics

What is vulnerability?
Vulnerability is the likelihood that a specific threat, if it occurs, will damage or impair the operation of a
utility asset. For a malevolent threat, this value is the likelihood that an attempted attack would be
successful. For a natural hazard or critical dependency, this value is the likelihood that the threat would
impact operation of the utility’s asset.

The following questions are example considerations for estimating vulnerability:

What is the likelihood that an If a 100-year flood occurred, what is

attempted cyber-attack would the likelihood that it would impair
penetrate the utility’s the utility’s treatment systems or
information technology distribution or collection
systems? operations?

Vulnerability often depends on the risk management practices, or countermeasures, the utility has in
place.

What are consequences?

Consequences are the adverse impacts that result when a threat occurs and damages or impairs the
operation of the utility’s asset. They include the economic costs, both to the utility and the service area,
due to equipment damage and loss of water or wastewater services. Consequences also include injuries
and fatalities that could result from accidental or intentional contamination of drinking water or a
hazardous gas release.
 Vulnerability Self Assessment Tool: Risk and Resilience Assessment Basics

What are countermeasures?

Countermeasures are systems or practices that reduce the risk from a threat to the utility’s assets.
Examples of countermeasures include:

• Physical security measures such as guards and fences

• Equipment such as backup power for critical systems
• Utility practices such as training and exercises on emergency response plans

Countermeasures may reduce threats, vulnerability, or consequences. Existing countermeasures are

those currently in place at the utility. Potential countermeasures are ones that may be deployed at the
utility in the future to reduce risk.

In VSAT Web, you first assess threat, vulnerability, and consequences for an asset/threat pair
considering the utility’s existing countermeasures. You then will have the option to conduct a
Countermeasure Analysis where you re-evaluate threat, vulnerability, and consequences considering the
capabilities of potential countermeasures. This process allows you to determine the cost-effectiveness
of additional countermeasures for reducing risk and enhancing resilience at the utility.

CAMERAS

BACKFLOW PREVENTION DEVICES

FENCES
 Vulnerability Self Assessment Tool: Risk and Resilience Assessment Basics

How is resilience determined?

VSAT Web helps you to assess the utility’s resilience by calculating an all-hazards Utility Resilience Index
(URI) 1. The URI helps you to rapidly assess potential gaps in the utility’s capacity to respond and recover
quickly from an incident. It also supports decision making for allocating the utility’s resources to increase
resilience.

1
Adapted from Morley, K. M. (2012). Evaluating resilience in the water sector: Application of the Utility Resilience
Index (URI). (http://www.worldcat.org/oclc/801849602) and used with permission.