DUE DILIGENCE: ESTIMATING VULNERABILITY

FUNDAMENTAL CHANGES 
Vulnerability assessment methodologies developed by DoD and other federal agencies 
are currently the best available resources for terrorism risk assessment. In order for 
these resources to be feasible and relevant in commercial buildings, they must be 
significantly simplified and civilianized. 
Bringing government experience and expertise regarding terrorism risk and 
building security to the commercial sector will involve two fundamental changes in 
the way buildings are designed, managed, and operated, and in the way that due 
diligence is used to evaluate existing buildings for acquisition or refinancing. 
First, businesses will need to carefully evaluate functional aspects of their operations 
in order to prioritize security requirements. Second, tradeoffs will be required in the 
level of security provided to ensure continued viability of business operations. 
Reducing vulnerability to terrorist threat will involve both physical measures to 
modify a facility and operational changes. Mitigation will consist mainly of measures 
to thwart tactics that terrorists might use in attacking organizations and facilities.


DUE DILIGENCE ASSESSMENT OF VULNERABILITY TO TERRORIST ATTACK 
Due diligence procedures are employed to assess valuations for property acquisition or 
financing and to identify risks related to the deal. Such procedures may also be used 
as part of insurance underwriting. Due diligence often includes both detailed property 
inspection and rigorous audits of available financial and construction documentation. 
At the same time, due diligence is a highly specialized field requiring both expertise 
and extensive prior experience to render sound judgments and recommendations to 
decision makers. 
A Property Condition Assessment (PCA) is used (at levels of detail and rigor 
appropriate to the investment being considered) as part of due diligence to help make 
prudent investment decisions. The assessment consists of analysis and assessment of 
physical conditions of a property by an on-site inspection and review of available 
construction and operations documentation. Investigators use professional judgment 
to identify items needing further expert investigation and those that can be readily 
evaluated by inspection. 
Vulnerability to terrorist attack should become a distinct element of due diligence 
condition assessments in the future. Professionals conducting property condition 
assessments of vulnerability to terrorist attack must have competency in building 
systems, operations, and security disciplines. 
For terrorism risk and security concerns, a due diligence assessment should also 
include a property condition assessment investigation of operational procedures 
and the vulnerability of those procedures to terrorist attack.


MITIGATION OF VULNERABILITY 
Strategies for reducing exposure to terrorism risk may be in the form of operational 
actions or construction projects (either new or existing building renovation). They 
could include reorganization of land uses, reorientation of roadways, security 
improvements to site entries, and improvements to the facility, including the existing 
structure and surrounding site area. For some strategies, the process may include the 
identification of multiple scenarios, or alternatives, for achieving the desired goal.


PROCESS MODEL FOR TERRORISM RISK REDUCTION USED IN 
FEDERAL FACILITIES 
United States military services and government agencies have long been involved in 
assessing vulnerabilities and protecting facilities, especially for off-shore installations. 
Terrorism and terrorist attack have been a part of the assessment of threat and 
vulnerability of government facilities for several decades. 
While each government agency has used its own procedures, the general approach has 
been elaborated and presented in FEMA 426, Reference Manual to Mitigate Potential 
Terrorist Attacks Against Buildings. 
Figure 5-1: The Terrorism Risk Reduction Process Model 
The terrorism risk reduction process starts with establishment of protection priorities 
and proceeds to assessment of threats, both providing information to a vulnerability 
assessment. The vulnerability assessment in turn leads to identification of mitigation 
options and risk management decisions based on a comparative evaluation of risk, 
liabilities, and mitigation costs and benefits.


PROTECTION PRIORITY 
The first step of the process to assess risk to terrorist attack is to identify the relative 
importance of the people, business activities, goods, and facilities involved in order to 
prioritize security actions. This applies to both new and existing facilities. Three 
actions are recommended in accordance with FEMA 426: 
_	Define and understand the core functions and processes of
the business or institutional entity.

 ._	Identify critical business infrastructure: 
. _	Critical components (people, functions, and facilities) 
. _	Critical information systems and data 
. _	Life safety systems and safe haven areas 
. _	Security systems 
 ._	Assign a relative protection priority, as simple as high, medium, or low, to the 
occupants, business functions, or physical components of the facility (note that FEMA 
426 describes a 9-step scale of values for describing asset values; the 3-step variation 
presented here is a simplified process): 
. _	High Priority. Loss or damage of the facility would have grave 
consequences, such as loss of life, severe injuries, loss of primary services, or major loss 
of core processes and functions for an extended period of time. 
. _	Medium Priority. Loss or damage of the facility would have moderate to 
serious consequences, such as injuries, or impairment of core functions and processes. 
. _	Low Priority. Loss or damage of the facility would have minor 
consequences or impact, such as a slight impact on core functions and processes for a 
short period of time. 


THREAT ASSESSMENT 
Military experience indicates that the terrorist threat is from people with the intent to do harm, who are known to exist, have the 
capability for hostile action, and have expressed the intent to take hostile action. 
Threat assessment is a continual process of compiling and examining information concerning potential threats. Information 
should be gathered from all reliable sources. The assessment process consists of: 
_	Defining threats 
_	Identifying likely threat event profiles and tactics 
Defining Threats 
Defining threats involves analysis of information regarding terrorist existence, capability, history, intention, and targeting: 
. _	Existence is the assessment of who is hostile to the organization, or community of concern. 
. _	Capability is the assessment of what weapons have been used in carrying out past attacks. 
. _	History is the assessment of what the potential terrorist has done in the past and how many times. 
. _	Intention is the assessment of what the potential terrorist
hopes to achieve.

. _	Targeting is the assessment of the likelihood a terrorist (the specific one may not be known) is performing 
surveillance on the particular facility, nearby facilities, or facilities that have much in common with the particular organization. 

The Homeland Security Advisory System is a color-coded hierarchy of threat conditions. The threat level for a specific business 
facility could be similarly developed in coordination with local law enforcement, intelligence, and civil authorities. 
Table 5-1: 
Homeland 
Security 
Advisory 
System 
Related to 
Threat 
Analysis 
Factors sn o i 
t i dn o C ta e 
rhT 

s rot caF s is y lanAta e rh T 


ecn e t s 
i x E 
y t i l 
ibapaC 
y r o t s 
iH 
no itn e 
tn I 
gni t 
egraT 
e r ev e S 
)deR( 
 
 
 
 
 
hgiH 
)egnarO( 
 
 
 
 
_ 
d e tave l E 
)wolleY( 
 
 
 
_ 

d ed rauG 
)eulB( 
 
 
_ 


w
o
 
L
 
)
n
e
e
r
G
(
 
 
_ 





LEGEND:  = Factor must be present.    
_
= Factor may or may not be present. 
Adapted from the Commonwealth of Kentucky Office of Homeland Security. 
Identifying Likely Threat Event Profiles and Tactics 
Identifying the likelihood of specific threats and tactics involves evaluation of attack intentions, hazard 
event profiles, and the expected effects of an attack on the facility and organization. Table 5-2, based 
on FEMA 426, presents general event profiles for a range of possible forms of terrorism attack. The 
profiles describe the mode, duration, and extent of the effects of an attack, as well as mitigating and 
exacerbating conditions that may exist. These and more specific descriptions can be used to identify 
threats of concern to individual organizations. (Potential threats are listed in alphabetical order in the 
table.) 
Table 5-2: Event 
Profiles For 
Terrorism and 
Technological 
Hazards ta erh T/d 
raza H 
edo M n oitacilppA 
n o itaru D d raza H 
;stceff E f o tnetx E 
cima ny D/citat S 
dna gnitag itiM s n 
oit idn oC gnitabr 
ecax E 
m sirorr et irgA 
tr ev oc ylla r eneg 
,tc eriD d o of f o n 
oita nimatnoc 
. s htn om ot sya D 
f o epyt yb s e iraV 
.tn edic nd o o F i 
nac ytiruc es etauq 
edan I f o noita r 
etluda etatilicaf 

n oitcudo rtniro 
seilppu s e sae s id 
r o/dna st sep f o d 
na sporc ot stn ega 
. kc ots evil 

stn ev e n oitan 
imat n oc ot 
detimileb ya m , 
setis noitubirt s id 
ete rc s id d na sts 
ep sa er e h w da e 
rp s yam s e sae s 
id on y ll.ya r en 
eG lediw tliub n o 
stceff e 
fo n oitcudo rtnid 
na d oof stn ega e 
sa esid dna st s ep . 
kcots evild na 
sporc ot 



.tn e mnorivn e 

kcattA d emrA 
r o tluas sa lacitcaT 
ot setunim ylla 
rene G 
eht n opu de sab ,s 
e iraV 
nac ytiruc es etauq 
edan I 
)smra llams (scit s 
illaB -
et om e r m o rf 
gnipin s 
. syad 
' srotart ep r ep dna 
tn etni 
ot s secca y sa e 
wolla 
s n opa ew ff o -dnat 
S -
. n oitac ol 

.s e itilibapac 
t n emla ecn oc y 
sa e ,t egrat 
d ellep o rp t ekc o r ( 



dna ,sn opae w fo 
)s rat r o m ,s eda n 
erg 



f o n oitaitinidetc 
et edn u 




.kcatta na 

taerhT/drazaH 
edoM noita 
cilppA 
noitaruD draza H 
;stceff E fo 
tnetxE ciman y D 
/c itatS 
dna gnitagitiM 
snoitidnoC 
gnitabrecaxE 
kca ttA yraidnecn I 
/nosr A 
ro erif fo n o 
itaitinI raen ro no 
nois o lpxe tcatn 
o c tcerid aiv 
tegrat aiv 
yletomer ro 
.elitcejorp 
o t setunim y 
llareneG .sru oh 
siegamad f o tne 
txE dna epy t yb 
denimreted ecived 
fo ytitnauq 
slaireta m dna 
tnarelecca / raen 
ro ta tneserp 
yll.tegrat areneg 
stceff E naht reht 
o citats 
,secneuqesnoc 
gnidacsac larut 
cur ts latnemercni 
.cte ,eruliaf 
edulcnisrotcaf 
noitagitiM n oitceted 
erif ni-tliub smetsys n 
o it cetorp dna 
evitsiser-erif dna . 
seuqinhcet noitcurt 
snoc nac ytiruces 
etauqedan I ot ssecca y 
sae wolla tnemlaecnoc 
ysae ,tegrat ecived 
yraidnecnina fo noita 
itinidet cetednu dna 




.er-no N if a fo 




dna erif ht iw e cnailp 
moc sa llew sa sedoc 
gnidliub niatniam ot 
eruliaf 




noitcetorp erif 
gnitsixe yllaitnatsbus 
nac smetsys 
ssenevitceffe eht 
esaercni 




.nopaew erif a fo 
s tnegA lacigoloiB 
dilos ro diuqiL 
yam stnega 
lacigoloiB 
tnega eht no 
gnidnepeD 
ev oba esaeler f o edu 
titlA 
xarhtn A -
eb nac s 
tnanimatn o c 
rof staerht 
elbaiv e sop 
eht dna desu 
tce ffa nac dnu org 
msilutoB -
gnisu desrepsid 
,sraey ot sru oh 
hcih w htiw 
ssenevitceffe 
sithgilnus ;noisrepsid 
sisollecurB -
losorea/sreyarps 
tnega eht no 
gnidneped 
,deyolped siti 
ynam ot evitcurtsed 
eugalP-
tniop yb ro sro 
tareneg 
nisnoitidn oc 
eht dna 
eb nac noitanima 
tn oc 
;se suriv dna airetcab 
xopllamS -
sa hcus secruos 
enilro 
.s tsixe tih cihw 
dna dniw aiv 
daerps 
sdniw etared o m ot 
thgil 
aimeraluT -
trevoc ,snoitinum 

.reta w eb nac 
noitcefn I 
tub stnega e 
srepsidlliw 
cigahrro meh lariV-
gnivom dna ,st 
isoped 

r o namuh aiv 
daerps 
kaerb nac sdniw 
rehgih 
srevef 
. sreyarps 

.srotcev lam ina 
eht ;sdu o lclosorea pu 
snixoT -



lacigoloroetem-orcim 
,munilu toB( 



dna sgnidliub fo 
stceffe 
lacc o colyhpatS 
,niciR 



ecneulfni nac niarret 
2-T ,B nixotore tnE 



levart dna 
noitazilosorea 
)snixotocyM 



.stnega fo 

taerhT/drazaH 
edoM noitacilppA 
noitaruD dra zaH 
;stce ffE f o tnetx 
E cimanyD /citat S 
dna gnitagitiM 
snoitidnoC 
gnitabrecaxE 
s tneg A lacimehC 
retsi lB -doo lB -yran 
om lup 
/gnul/gnikohC -
gnitaticapa cnI -e 
vreN -sag raet 
/lortnoc toiR -
gnitimoV -
l osorea/diuqiL eb 
nac stnan imatnoc 
sreyarps gnisu 
desrepsid losorea 
rehto ro sdiuq il 
;srotareneg /se 
lddup mor f gni 
ziropav .snoit 
inum ro 
;sreniatnoc 
yam stnega 
slacimehC r of 
staerht elbaiv esop 
,s keew o t sruoh 
tnega eh t no 
gnidneped ni 
snoitidnoc eht dna 
.s ts ixe ti h cihw 
eb nac 
noitanimatnoC 
laitini eh t f o tu o 
de irrac ,snosrep 
yb aera tegrat dna 
,retaw ,selcihev 
.dni w eb yam 
slacimehC e 
siwrehto ro 
evisorroc fi emit 
rev o gn iga mad 
.detaidemer ton 
nac erutarepmet ri 
A fo noi taropave 
tceffa .slo sorea 
dnu orG stceffa 
erutarepmet 
.sdiuqil f o 
noitaropave 
egralne nac 
ytidimuH 
,selcitrap losorea 
noitalahni 
gnicuder .drazah 
nac noitatipicerP 
esrepsid dna etulid 
daerps nac tub 
,stnega .noi 
tanimatnoc nac 
dniW 




os la tub , sropav 
esrepsid eb o t era 
tegrat esuac 
.cimanyd -orcim 
ehT fo stceffe la 
cig oloroetem na c 
niarret dna 
sgnidliub n oitarud 
dna levart re tla 




.stnega fo n i 
gnidle ih S ni 
gniretlehs fo mr of 
eht elpoep tce torp 
nac ecalp mor f y 
treporp dna .st 
ceffe lufmrah 
bmoB lanoitnevnoC 
e lcihev yrano ita t S 
-elcihev gnivoM -
liaM -ylppu S -
nworhT -decalP -
lennosreP -
evisolpxe fo 
noitanote D ;tegrat 
raen ro no ecived 
ro ,elcihev ,nosrep 
ai v .elitcejorp 
lano itidda 
;suoenatnatsnI 
yam secived yradn 
oces eht 
gninehtgnel ,desu 
eb eht fo noitarud 
emit k catta eht 
litnu drazah eb ot 
denimreted si etis 
.rael c 
si egamad fo tne 
txE dna epyt yb 
deni mreted .eviso 
lpxe fo yti tnauq 
cita ts yllareneg 
stceffE gnidacsac 
naht reht o , 
secneuqesnoc 
larutcurts 
latnemercn i .c te 
,eruliaf 
sesaerced ygrenE a 
sa yllacimht iragol 
morf ecnatsid fo 
noitcnuf . tsalb fo 
taes ,niarreT , 
serutcurts 
,noitatserof edi 
vorp nac ,.cte 
gnibrosba yb 
gnidleihs ygrene 
gni tce lfed r o/dna 
.sirbed dna 
gnitabrecax E esae 
edulcn i snoi 
tidnoc 




kcal ;tegra t ot s 
secca fo 
;gnidleihs/sre 
irrab fo 















dna ;noitcurtsnoc r 
oop 




fo tnemlaecnoc fo 
e sae 




.eci ved 
msirorretrebyC 
gnisu kcatta cin 
ortcelE 
.syad ot setuniM 
tcerid on yllarene 
G 
na c y tiruces 
etauqedan I 

metsys retup mo c 
eno .rehtona tsn 
iaga 

tliub no s tceffe 
.tnemnorivne 
laci tirc ot ssecca 
eta tilicaf ,s 
metsys retupmoc 




eb o t meht 
gniwolla 




.s kcatta tcudnoc o 
t desu 

taerhT/draza H 
edoM noitacilpp A 
noitaru D drazaH 
;stceffE fo tnetxE 
cimanyD /citatS 
dna gnitagitiM 
snoitidnoC 
gnitabrecaxE 
lairetaM suodra zaH r 
o ytilicaf de xif( esae 
leR )noitatropsnart -
lairtsudn I cixoT dna 
slacimehC cinagrO( 
slairetaM 
;enaxeholcyc 
:sropav ,snegonayc 
:sesag dicA negord 
yh ,enirolhc :sesag e 
saB ;edif lus laicep S 
;ain omma 
,enegsohp :sesac )ed 
yhedla mrof 
ro /dna ,d 
iuqil,diloS 
stnanimatnoc 
suoesag morf 
desaeler eb yam 
elibom ro de xif 
.sreniatnoc 
.syad o t sruoH 
eb yam s lacimehC 
esiwrehto ro evis 
orroc .emit revo 
gnigamad erif ro 
/dna noiso lpx E 
.tneuqesbus eb 
yam eb yam 
noitanimatnoC 
eht fo tuo deirrac 
,sn osrep yb aera 
tnedicni dna ,retaw 
,selcihev .dniw 
lacimehc htiw s A 
rehtaew ,snopaew 
yltceridlliw sn 
oitidnoc dra zah 
eht woh t ceffa 
.spoleved -orcim 
ehT f o s tceffe lac 
igoloroetem nac 
niarret dna sgnid 
liub noitarud dna 
levart retla nign 
idlei.stnega fo hS 
nigniretlehs fo 
mrof eht elpoep 
tcet orp nac ecalp 
morf ytreporp dna 
. stceffe -noN luf 
mrah dna erif h tiw 
ecnailpmoc sa llew 
sa sedoc gnidliub 
niatniam ot eruliaf 




noitce torp erif 
gnits ixe 















tnemniatn oc dna 




yllaitnatsbus nac 
serutaef 




egamad eht esaer 
cni 















suodrazah a m orf 




.e saeler slairetam 
eciveD raelcuN 
raelcun fo 
noitanote D ta 
,dnuorgrednu 
ecived ro ria eht 
ni,ecafrus eh t 
.edutitla hgih ta 
dna hsa lf 
taeh/thgiL rof 
tsale vaw kcohs 
/tsalb raelcun 
;sdnoces tuo llaf 
dna noitaidar r of 
tsisrep na c 
sdrazah .sraey 
eslup c 
itengamortcelE 
edutitla-hgih a 
morf rof 
stsalnoitanoted 
ylno stceffa dna 
sdn oces cinort 
cele detcetorpnu 
.smetsys 
dna taeh ,thgil la 
itinI a f o st ceffe 
tsalb ria ro dnuorg 
,eca frusbus era 
dna citats era tsrub 
eht yb denimreted 
scitsiret carahc s 
'ecived tu ollaf 
;tnemyolpme dna 
evitcaoidar fo eb 
yam s 
tnanimatnoc no 
gnidneped 
,cimanyd 
lacigoloroetem 
.snoitidnoc 
fo stceffe luf mraH 
decuder eb na c n 
oitaidar emit eht 
gniziminim yb , 
taeh 
,thgi.erusopxe fo 
L ygrene tsalb dna 
yllacimhtirag 
olesaerced ecnatsid 
fo noit cnu f a sa 
.tsalb f o taes m 
orf ,noitatserof 
,niarreT nac ,.cte 
,serutcurts yb 
gnidleihs edivorp 
ro/dna gnibrosba 
dna n oitaidar gnit 
celfed 
.stnanimatnoc 
evitcaoidar 
stneg A lacigoloidaR 
ahplA-a teB -a m 
maG -
s tnanimatnoc 
evitcaoidaR gnisu 
desrepsid eb nac 
losorea/ sre yarps 
tniop yb ro 
,srotareneg sa hcus 
secruos enilr o 
trevoc ,snoitinum 
gnivo m dna ,stis 
oped .sre yarps 
ya m stnanima 
tnoC r of 
suodrazah niamer 
,sraey ot sdn oces 
lairetam no 
gnidneped .de su 
eb lliw stceffe la 
itinI fo etis o t de 
zilacol no 
gnidneped ;kcatta 
lacigoloroetem 
tneuqe sbus 
,snoitidnoc 
evitcaoidar fo r 
oivaheb eb yam s 
tnanimatnoc 
.cimanyd 
,erusopxe fo no 
itaru D f o ecruos 
morf ecnatsid eht 
dna ,n oitaidar 
gnidleihs f o tnuo 
ma dna ecruo s 
neewteb enimreted 
tegrat .noita idar 
ot erusopxe 

taerhT/draza H 
edoM noitacilpp A 
noitaru D drazaH 
;stceffE fo tnetxE 
cimanyD /citatS 
dna gnitagitiM 
snoitidnoC 
gnitabrecaxE 
ecnallievruS -cit 
suoc A cinor tcelE-
fo noitcelloc ffo -
dnatS gnisu 
noitamrofnilausiv 
hgih ro saremac 
.shtnom yllausU 
eh t yllausu si sihT na 
fo ssoleht o t edulerp 
tsi.tessa rorret A 
,ngised gnid liuB 
senil gnikcolb 
ylla icepse gn iru 
sne dna thgis fo 
gn ippordsevae 
lausiV -
citsu oca ,scitpo 
derewop gnisu 
noitamrofni 
senohporcim 
lanoitcerid dna 
,sresaldna 

sdneps mae t 
ecnallievrus rof 
gnikool emit hcum 
scitcat dna se 
itilibarenluv 
.lufsseccus eb lliw taht 
dna sllaw roiretxe 
eht wolla ton od s 
wodniw ro 
noissimsnart 
dnuos nac 
,noitcelloc cit su 
oca 

n oitamrofnicinort 
cele llec 
,sretupmoc morf 
dleh-dnah dna 
,senohp noitcelloc 
decal.soPidar ec 
ived a gnittup yb f 
o tni"gub" op eht 
ta 

doirep emit eht s isihT 
tseb eh t sedivorp taht 
sa taerht fo tnemsses sa 
fo gnitegrat setacidni ti 
.ytilica f eht 
.drazah siht etag 
itim 

.esu 



yrtnE de z 
irohtuanU decroF -
rewop ro dnah fo 
esU ro ,snopaew ,s 
loo t 
,sruoh ot 
setuniM eht 
nopu gnidneped 
ro lae ts ot silaog fI ro 
stessa lacisyhp yortsed 
lacisyhp dradna t 
S ngised gn 
idliub ytiruce s 
trevoC -
a etaerc ot 
sevisolp xe r o 
gninepo de zis -
nam ylbmessa na 
etarep o ,)rood 
dekcol a sa hcus( 
slaitnederc eslaf 
esu r o .gnidliub a 
retne o t 
.tnetni 
,n 
oitamrofniesimorpmoc 
era st ceffe laitinieht 
yam egamad tub ,kciuq 
tnetni.gn fI itsalgnoleb 
snoitarepo tpursid o t si 
eht ,segat soh eka t ro a 
rof tsa lyam stceffe 
fiyllaicepse ,emit gnol 
.srucco htaed ro yrujni 
muminim eh t eb 
dluoh s .serusaem 
noitag roF itim 
,stessa lacitirc 
erom ekil,serusae 
m lanoitidda n 
oisivelet tiucric 
des olc taht w olf 
ciffart ro tsap 
srotisiv slennahc 
ni sdia ,lortnoc 
ssecca .dra zah 
siht fo no itceted 

Assigning a Threat Rating 
The ultimate product of a threat assessment is the assignment of a threat rating to each hazard of concern to a particular organiza-
tion. The threat rating, like protection priority, is based on expert judgment and may be as simple as high, medium, or low. 
. _	High Threat. Known terrorists or hazards, capable of causing loss of or damage to a facility exist. One or more 
vulnerabilities are present and the terrorists are known or reasonably suspected of having intent to attack the facility. 
. _	Medium Threat. Known terrorists or hazards that may be capable of causing loss of or damage to a facility exist. 
One or 

more vulnerabilities may be present. However, the terrorists 
are not believed to have intent to attack the facility. 
_	Low Threat. Few or no terrorists or hazards exist. Their capability of causing damage to a particular facility is doubtful. 
An organization may reasonably be concerned only with high threat ratings in the near term, but may want to consider ad-
dressing medium threats over time. 
Alternative: Assigning a Level of Protection Against Threat 
In the absence of experience, assessing terrorist threat is the most difficult aspect of planning to resist terrorist attack. An effective 
alternative approach may be to select a level of desired protection for a business operation based on management deci-sion-
making, and then proceed to a vulnerability assessment. The Department of Defense correlates levels of protection with potential 
damage and expected injuries. The GSA and Interagency Security Committee (ISC) also use the level of protection concept, 
though the definitions differ slightly. The following levels are based on DoD definitions: 
. _	High Protection. Facility superficially damaged; no perma-
nent deformation of primary and secondary structural
members or non-structural elements. Only superficial inju-
ries are likely.

. _	Medium Protection. Damaged, but repairable. Minor deformations of non-structural elements and secondary 
structural members and no permanent deformation in primary structural members. Some minor injuries, but fatalities are 
unlikely. 
. _	Very Low Protection. Heavily damaged, onset of structural collapse. Major deformation of primary and secondary 
structural members, but progressive collapse is unlikely. Collapse of non-structural elements. Majority of personnel suffer serious 
injuries. There are likely to be a limited number (10 percent to 25 percent) of fatalities. 

Note that the very low level is not the same as doing nothing. No action could result in catastrophic building failure and high 
loss of life.


VULNERABILITY ASSESSMENT 
A terrorism vulnerability assessment evaluates any weaknesses that can be exploited 
by a terrorist. It evaluates the vulnerability of facilities across a broad range of 
identified threats/hazards and provides a basis for determining physical and 
operational mitigation measures for their protection. It applies both to new building 
programming and design and to existing building management and renovation over 
the service life of a structure. 
The useful product of a vulnerability assessment is the assignment of a vulnerability 
rating of all appropriate aspects of building operations and systems to the defined 
threats for the particular facility. As with protection priority and threat ratings, 
vulnerability can be cast as high, medium, or low. 
. _	High Vulnerability. One or more significant weaknesses have been 
identified that make the facility highly susceptible to a terrorist or hazard. 
. _	Medium Vulnerability. A weakness has been identified that makes the 
facility somewhat susceptible to a terrorist or hazard. 
. _	Low Vulnerability. A minor weakness has been identified that slightly 
increases the susceptibility of the facility to a terrorist or hazard. 

The Building Vulnerability Assessment Checklist, presented in abbreviated form in 
Appendix B, compiles a comprehensive list of questions to be addressed in assessing 
the vulnerability of facilities to terrorist attack. A subset of the checklist, discussed in 
the following section, is particularly useful in the initial screening of existing facilities 
to identify and prioritize terrorism risk reduction needs. Such an assessment can be 
integrated into a due diligence assessment associated with acquisition, refinancing, or 
insurance underwriting.


INITIAL VULNERABILITY ESTIMATE 
Because of the uncertainty of the threat, many insurers, lenders, and owners need a 
quick, qualitative assessment of the vulnerability of existing buildings to terrorist 
attack. As experience is gained and more robust vulnerability assessment tools are 
developed, the rigor of data collection and analysis will increase. For now, the estimate 
of vulnerability to a simple qualitative scale (high, medium, or low as defined by the 
vulnerability ratings described above) may provide useful information. 
Answering even basic questions concerning vulnerability to terrorist attack 
may involve three means of data collection: 
. _ Visual inspection 
. _ Document review 
. _ Organization and management procedures review 

Visual Inspection 
A property condition assessment of vulnerability to terrorist attack includes an onsite 
visual inspection encompassing evaluation of the site and all facility systems including 
architectural, structural, building envelope, utility, mechanical, plumbing and gas, 
electrical, fire alarm, communications and information technology systems. 
Equipment operations and maintenance procedures and records and security systems, 
planning, and procedures should also be scrutinized. The investigation may need to 
go beyond the site to vulnerability of utility and other infrastructure systems. 
Design Documents Review 
The on-site inspection team should work with the property owner to obtain plans, 
specifications and related construction documents as necessary. Equipment operation 
and maintenance procedures and records as well as security procedures should also 
be scrutinized. All documents should be reviewed assessing concerns related to 
terrorism vulnerability. 
Organization and Management Procedures Review 
Because of the transitory nature of the terrorist threat and its uncertain duration, the 
most effective approaches to terrorism risk reduction in facilities may emphasize 
reorganization of operational functions and procedures rather than modification of 
physical systems. The vulnerability assessment team must scrutinize business and 
operational practices to identify opportunities to reduce exposure to attack. This will 
involve scrutinizing both owner and tenant operations at the building site. 
Assessment of Vulnerability to Expected Methods and Means of Attack 
Each building system and business procedure should be assessed on its vulnerability 
to a range of terrorist attack methods and means. 
Based on military experience, common terrorist tactics include the use of moving or 
stationary vehicles, covert entry, and/or disguise in mail or shipping materials to 
deliver destructive weapons. 
At present, terrorist attacks might include blast effects, airborne contamination, 
waterborne contamination, or some combination of attack mechanisms. For 
additional information, see FEMA 426 and FEMA 427, Primer for Design of Commercial 
Buildings to Mitigate Terrorist Attacks.


VULNERABILITY ESTIMATE SCREENING 
The following screening tool tables provide guidance for initial vulnerability 
assessment. The intention of this assessment is to distinguish facilities of high, 
medium, or low vulnerability to terrorist attack. The implication is that high 
vulnerability facilities should receive more detailed analysis. Specific strategies for 
risk reduction should be developed. 
These quick, qualitative 'vulnerability estimate' questions were selected from the 
Building Vulnerability Assessment Checklist in FEMA 426. Each question is 
characterized by how information concerning the question will likely be collected 
(visual inspection, design documentation, and/or review of organizational/ 
management procedures), and common terrorist attack tactics (delivery by moving, 
stationary vehicles, or covert entry, disguised in the mail or in supply materials; and 
blast pressure, airborne, or waterborne attack mechanisms). 
For this initial assessment, subjective ratings by qualified professionals familiar with the 
facility are appropriate. Assigning a "high, medium, or low" vulnerability rating to the 
responses to vulnerability questions for each building system will provide a solid 
preliminary basis for estimating the overall vulnerability of a particular facility to 
terrorist attack. The answers to the questions will also indicate areas of opportunity for 
mitigation actions to reduce terrorism risk. 
Site Questions 
A vulnerability assessment of the Site will look at surrounding structures, terrain, 
perimeter controls, traffic patterns and separations, landscaping elements and 
features, lines of site, etc. 
Site questions focus primarily on visual inspection to develop ratings. The questions 
emphasize vulnerability to moving vehicle, stationary vehicle, and covert entry tactics. 
Vulnerability to blast is the primary concern addressed. 
LEGEND: _ = Determine high, medium, or low vulnerability rating.     = Applicability of factor to 
question. 
Architectural Questions 
Assessing Architectural vulnerability will investigate tenancy, services, public and 
private access, access controls, activity patterns, exposures, etc. 
Architectural questions focus equally on visual inspection and evaluation of 
organizational and management procedures to develop ratings. The questions 
emphasize vulnerability to moving vehicle, stationary vehicle, and covert entry tactics. 
Vulnerability to blast is the primary expressed concern. 
LEGEND: _ = Determine high, medium, or low vulnerability rating.  = Applicability of factor to 
question. 
Structural and Building Envelope Systems Questions 
A vulnerability assessment of Structural Systems will look at construction type, 
materials, detailing, collapse characteristics, critical elements, etc. An assessment of 
Building Envelope will involve investigating strength, fenestration, glazing 
characteristics and detailing, anchorage, etc. 
Structural and Building Envelop Systems questions rely on review of construction 
documents and visual inspection to develop ratings. Vulnerability to blast is the 
primary concern. 
LEGEND: _ = Determine high, medium, or low vulnerability rating.     = Applicability of factor to 
question. 
Utility Systems Questions 
A vulnerability assessment of Utility Systems will look at the full range of source and 
supply systems serving the facility including water, fuel, and electricity supply; fire 
alarm and suppression, communications, etc. 
Utility Systems questions rely equally on information obtained from visual inspection, 
review of construction documents, and organizational and management procedures 
to develop ratings. Vulnerability to waterborne contaminants is expressly considered. 
LEGEND: _ = Determine high, medium, or low vulnerability rating.     = Applicability of factor to 
question. 
Mechanical Systems Questions 
A vulnerability assessment of Mechanical Systems will investigate air supply and 
exhaust configurations, filtration, sensing and monitoring, system zoning and control, 
elevator management, etc. 
Mechanical Systems vulnerability questions and ratings rely primarily on information 
obtained from review of construction documents and visual inspection. Vulnerability 
to airborne contaminants is the primary consideration, including contamination from 
Chemical, Biological, and Radiological attack. 
LEGEND: _ = Determine high, medium, or low vulnerability rating.     = Applicability of factor to 
question. 
Plumbing and Gas Systems Questions 
A vulnerability assessment of Plumbing and Gas Systems will look at the liquid 
distribution systems serving the facility including water and fuel distribution, water 
heating, fuel storage, etc. 
Plumbing and Gas Systems questions rely primarily on information from review of 
construction documents to develop ratings. Vulnerability to waterborne contaminants 
is expressly considered. 
LEGEND: _ = Determine high, medium, or low vulnerability rating.     = Applicability of factor to 
question. 
Electrical Systems Questions 
A vulnerability assessment of Electrical Systems will evaluate transformer and 
switchgear security, electricity distribution and accessibility, emergency systems, etc. 
Electrical Systems questions primarily on information from visual inspection and 
review of construction documents to develop ratings. No particular attack mechanism 
is emphasized. 
LEGEND: _ = Determine high, medium, or low vulnerability rating.     = Applicability of factor to 
question. 
Fire Alarm Systems Questions 
A vulnerability assessment of Fire Alarm Systems will look at detection sensing and 
signaling, system configurations, accessibility of controls, redundancies, etc. 
Fire Alarm Systems questions rely both on information from review of construction 
documents and review of organizational and management procedures to develop 
ratings. No particular attack mechanism is emphasized. 
LEGEND: _ = Determine high, medium, or low vulnerability rating.     = Applicability of factor to 
question. 
Communications and Information Technology Systems Questions 
A vulnerability assessment of Communications and Information Technology Systems 
will evaluate distribution, power supplies, accessibility, control, notification, backups, 
etc. 
Communications and Information Technology Systems questions rely on 
information from visual inspection, review of construction documents, and review of 
organizational and management procedures to develop ratings. No particular attack 
mechanism is emphasized. 
LEGEND: _ = Determine high, medium, or low vulnerability rating.     = Applicability of factor to 
question.


ADDITIONAL SOURCES OF DETAILED FACILITY INFORMATION 
The foregoing questions provide a framework for a qualitative estimate of facility 
vulnerability to terrorist attack. A more detailed and quantitative evaluation will 
involve significantly more review of information in all areas, including additional 
information concerning 'Equipment Operations and Maintenance' (up to date 
drawings, manuals, and procedures, training, monitoring, etc.); 'Security Systems' 
(perimeter and interior sensing, monitoring, and control, security system 
documentation and training, etc.); and the 'Security Master Plan' (currency, 
responsibilities, etc.). 
Appendix B presents the complete list of detailed questions from FEMA 426 that 
should be considered in fully evaluating vulnerability to terrorist threats. The means of 
data collection that should be employed and the particular terrorist tactics and attack 
mechanisms addressed by each question are identified in the appendix so that 
specialized checklists can be created to assess vulnerability to terrorist tactics of 
particular concern to an individual organization.


VULNERABILITY REDUCTION COST INFORMATION AND ESTIMATES 
Typically, a property condition assessment for due diligence would be followed by 
consideration of the anticipated costs and timing of needed upgrades of facility 
systems. Certainly, estimates of expected costs of mitigation of system vulnerability to 
terrorist attack will become important at some point in the decision-mak-ing process. 
However, an assessment using the questions described above does not include the 
level of information needed to project costs. The qualitative analysis described simply 
determines broad preliminary options for reducing terrorism risk in a particular 
existing facility and does not give insight to expected costs of risk reduction. At some 
point in the future, fully capable due dili-gence tools for assessing vulnerability to 
terrorist attack will very likely include such information and detail. For further 
discussion of costs related to blast mitigation, see FEMA 427, Chapter 8.