Threat and Hazard Identification 

and Risk Assessment Guide

Comprehensive Preparedness Guide (CPG) 201

Second Edition

August 2013

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Table of Contents

Forward.......................................................................................................................... 1

Overview ........................................................................................................................ 1

THIRA Process.........................................................................................................................1

Relationship to Other Risk Assessments................................................................................2

Core Capabilities ......................................................................................................................2

National Preparedness System................................................................................................3

Whole Community Involvement .............................................................................................4

Updating Previous THIRAs ....................................................................................................5

Step 1: Identify the Threats and Hazards of Concern ................................................ 5

Types of Threats and Hazards ................................................................................................5

Sources of Threat and Hazard Information ..........................................................................6

Factors for Selecting Threats and Hazards ...........................................................................7

Step 1 Output............................................................................................................................8

Step 2: Give the Threats and Hazards Context........................................................... 9

Context Description: Factors to Consider .............................................................................9

Examples of Context Descriptions ........................................................................................10

Step 2 Output..........................................................................................................................10

Step 3: Establish Capability Targets ......................................................................... 10

Impacts and Desired Outcomes ............................................................................................11

Developing Capability Targets .............................................................................................12

Example Capability Target ...................................................................................................14

Step 3 Output..........................................................................................................................14

Step 4: Apply the Results ........................................................................................... 14

Capability Estimation ............................................................................................................15

Resource Typing.....................................................................................................................16

Example of a Completed THIRA .........................................................................................18

 i 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Applying the THIRA Results to Resource Allocation Decisions and Preparedness 

Activities..................................................................................................................................18

Step 4 Output..........................................................................................................................20

Conclusion................................................................................................................... 20

Appendix A: THIRA Template .................................................................................. A-1

Appendix B: Glossary............................................................................................... B-1

ii
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Forward

Comprehensive Preparedness Guide (CPG) 201, Second Edition provides communities 

additional guidance for conducting a Threat and Hazard Identification and Risk Assessment 

(THIRA). The First Edition of this Guide (April 2012) presented the basic steps of the THIRA 

process. Specifically, the First Edition described a standard process for identifying communityspecific threats and hazards and setting capability targets for each core capability identified in the 

National Preparedness Goal as required in Presidential Policy Directive (PPD) 8: National 

Preparedness.1

This Second Edition expands the THIRA process to include estimation of resources needed to 

meet the capability targets. The Second Edition also reflects other changes to the THIRA process 

based on stakeholder feedback, such as streamlining the number of steps to conduct a THIRA 

and providing additional examples. Where appropriate, this Guide highlights key changes from 

the First Edition of CPG 201. This Second Edition supersedes the First Edition of CPG 201. 

Overview

Every community should understand the risks it faces. By understanding its risks, a community 

can make smart decisions about how to manage risk, including developing needed capabilities. 

Risk is the potential for an unwanted outcome resulting from an incident, event, or occurrence, as 

determined by its likelihood and the associated consequences.2 By considering changes to these 

elements, a community can understand how to best manage and plan for its greatest risks across 

the full range of the threats and hazards it faces. The THIRA process helps communities identify 

capability targets and resource requirements necessary to address anticipated and unanticipated 

risks.

THIRA Process

This Guide describes a four-step process for developing a THIRA:

1. Identify the Threats and Hazards of Concern. Based on a combination of experience, 

forecasting, subject matter expertise, and other available resources, identify a list of the 

threats and hazards of primary concern to the community. 

2. Give the Threats and Hazards Context. Describe the threats and hazards of concern, 

showing how they may affect the community. 

3. Establish Capability Targets. Assess each threat and hazard in context to develop a specific 

capability target for each core capability identified in the National Preparedness Goal. The 

capability target defines success for the capability.

4. Apply the Results. For each core capability, estimate the resources required to achieve the 

capability targets through the use of community assets and mutual aid, while also considering 

preparedness activities, including mitigation opportunities. 

1 For additional information on the National Preparedness Goal please visit http://www.fema.gov/nationalpreparedness. 2 DHS Risk Lexicon, June 2013.

1 

 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

The THIRA process is flexible and scalable and will work for communities of all sizes.

Communities can adapt these four steps, illustrated in Figure 1, to meet their specific needs and 

resources.

Figure 1: The THIRA Process

Relationship to Other Risk Assessments

The THIRA process standardizes the risk analysis process that emergency managers and 

homeland security professionals use every day through the normal course of their work. The 

THIRA process builds on existing local, state, tribal, territorial Hazard Identification and Risk 

Assessments (HIRAs) by:

 Broadening the threats and hazards considered to include human-caused threats and 

technological hazards

 Incorporating the whole community into the planning process, including individuals; 

families; businesses; faith-based and community organizations; nonprofit groups; schools 

and academia; media outlets; and all levels of government, including local, state, tribal, 

territorial, and Federal partners

 Providing increased flexibility to account for community-specific factors.

Core Capabilities

Communities use the core capabilities described in the National Preparedness Goal to organize 

their capability targets in the THIRA process (see Table 1). The core capabilities provide a 

common language for preparedness across the whole community. The core capabilities are 

relevant to all five preparedness mission areas:

 Prevention: Prevent, avoid, or stop an imminent, threatened, or actual act of terrorism.

 Protection: Protect our citizens, residents, visitors, and assets against the greatest threats and 

hazards in a manner that allows our interests, aspirations, and way of life to thrive. 

 Mitigation: Reduce the loss of life and property by lessening the impact of future disasters. 

 Response: Respond quickly to save lives; protect property and the environment; and meet 

basic human needs in the aftermath of a catastrophic incident. 

2 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

 Recovery: Recover through a focus on the timely restoration, strengthening, and 

revitalization of infrastructure, housing, and a sustainable economy, as well as the health, 

social, cultural, historic, and environmental fabric of communities affected by a catastrophic 

incident. 

Table 1: Core Capabilities by Mission Area3

Prevention Protection Mitigation Response Recovery

Planning

Public Information and Warning

Operational Coordination

Forensics and 

Attribution

Intelligence and 

Information 

Sharing

Interdiction and 

Disruption

Screening, Search, 

and Detection

Access Control 

and Identity 

Verification

Cybersecurity

Intelligence and 

Information 

Sharing

Interdiction and 

Disruption

Physical 

Protective 

Measures

Risk Management 

for Protection 

Programs and 

Activities

Screening, 

Search, and 

Detection

Supply Chain 

Integrity and 

Security

Community 

Resilience

Long-term 

Vulnerability 

Reduction

Risk and Disaster 

Resilience 

Assessment

Threats and 

Hazard 

Identification

Critical Transportation

Environmental 

Response/

Health and Safety

Fatality Management 

Services

Infrastructure 

Systems

Mass Care Services

Mass Search and 

Rescue Operations

On-scene Security 

and Protection

Operational 

Communications

Public and Private 

Services and 

Resources

Public Health and 

Medical Services

Situational 

Assessment

Economic 

Recovery

Health and Social 

Services

Housing

Infrastructure 

Systems

Natural and 

Cultural Resources

National Preparedness System

The National Preparedness System is the instrument the Nation employs to build, sustain, and 

deliver the core capabilities in order to achieve the goal of a secure and resilient Nation. Figure 2 

illustrates the six components of the National Preparedness System.

4

3 Planning, Public Information and Warning, and Operational Coordination are core capabilities common to all 

mission areas.

4 For additional information on the National Preparedness System please visit http://www.fema.gov/nationalpreparedness. 

3 

 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Figure 2: Components of the National Preparedness System

The THIRA process supports the first two components of the National Preparedness System: 

1. Identifying and Assessing Risk

2. Estimating Capability Requirements.

The THIRA process helps communities answer the following questions:

 What does the community need to prepare for? 

 What resources are required in order to be prepared?

 What actions (e.g., mitigation activities) could be employed to lessen or eliminate the threat 

or hazard?

 What impacts need to be incorporated into the community’s recovery preparedness planning? 

The results of the THIRA process form the foundation for subsequent National Preparedness 

System activities.

Whole Community Involvement

Developing an effective THIRA requires active involvement from the whole community. 

Recognizing that preparedness is a shared responsibility, the National Preparedness System calls 

for the involvement of everyone—not just government agencies—in preparedness efforts. When 

developing and updating THIRAs, jurisdictions should ensure their assessment and planning 

effort includes representatives and perspectives of the whole community. An informed public is 

the best advocate for building and sustaining required capabilities and creating a secure and 

resilient community.

Experience from the first year of THIRA implementation shows the importance of whole 

community involvement. THIRAs developed with whole community involvement are more 

comprehensive and measurable.

4 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Updating Previous THIRAs 

When reviewing, revising, or updating an existing THIRA, jurisdictions should examine the 

success and/or limitations of previous whole community engagement. In particular, jurisdictions 

should assess whether partners representing the five preparedness mission areas and 31 core 

capabilities participated. Communities are encouraged to engage representatives from different 

homeland security and public safety disciplines and from outside government. 

For each subsequent THIRA update, communities should also review how the threat and hazard 

landscape has changed. In particular, consider the inclusion of new or emerging threats and 

hazards, to include future risks (Step 1); updating threat and hazard context descriptions based on 

demographic factors (Step 2); and revising capability targets based on current capability levels 

(Step 3). Communities should refine resource requirements (Step 4) based on changes made in 

previous steps and review how successful preparedness measures, such as protection or 

mitigation efforts, affect their THIRAs.

Step 1: Identify the Threats and Hazards of 

Concern

In Step 1 of the THIRA process, communities develop a list of community-specific threats and 

hazards. This section: 

 Defines the types of threats and hazards that communities should consider 

 Introduces sources of threat and hazard information

 Describes factors to consider when selecting threats and hazards for inclusion in the 

THIRA

 Provides guidance on updating previous THIRA submissions. 

Figure 3: Step 1 of the THIRA Process

Types of Threats and Hazards

Communities face a variety of threats and hazards. The three types of threats and hazards are:

 Natural hazards, which result from acts of nature, such as hurricanes, earthquakes, 

tornadoes, animal disease outbreak, pandemics, or epidemics. 

5 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

 Technological hazards, which result from accidents or the failures of systems and 

structures, such as hazardous materials spills or dam failures.

 Human-caused incidents, which result from the intentional actions of an adversary, such as 

a threatened or actual chemical attack, biological attack, or cyber incident.

Table 2 provides examples of each type of threats and hazards. 

Table 2: Example Threats and Hazards

Natural Technological Human-caused

 Avalanche

 Animal disease outbreak

 Drought

 Earthquake

 Epidemic

 Flood

 Hurricane

 Landslide

 Pandemic

 Tornado

 Tsunami

 Volcanic eruption

 Wildfire

 Winter storm

 Airplane crash

 Dam failure

 Levee failure

 Mine accident

 Hazardous materials 

release

 Power failure

 Radiological release

 Train derailment

 Urban conflagration

 Biological attack

 Chemical attack

 Cyber incident

 Explosives attack

 Radiological attack

 Sabotage

 School and workplace 

violence

Sources of Threat and Hazard Information

Communities should consult a number of sources to identify threats and hazards during the 

THIRA process. These sources may include: 

 State and local homeland security and emergency management laws, plans, policies, and 

procedures 

 Existing threat and hazard assessments (e.g., HIRAs) 

 Records from previous incidents, including historical data 

 Local, regional, and neighboring community THIRAs 

 Analysis of critical infrastructure interdependencies, including disruptions and failures that 

may originate elsewhere but produce cascading effects experienced locally (e.g., an electrical 

power disruption that spreads both geographically and across sectors)

 Intelligence fusion center bulletins and assessments 

 Whole community partners, such as: 

• Emergency management/homeland security agencies

• Local and state hazard mitigation offices

• Local or Regional National Weather Service offices

6 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

• Tribal governments 

• Federal Emergency Management Agency (FEMA) Regional Offices

• Private-sector partners

• Local/state fire, police, emergency medical services, and health departments

• Major urban area and state fusion centers 

• Infrastructure owners and operators

• U.S. Department of Homeland Security (DHS) Protective Security Advisors 

• DHS Regional Cyber Security Analysts

• Volunteer Organizations Active in Disasters

• Colleges/universities, and other research organizations. 

Additional Online Sources of Threat and Hazard Information

 National Oceanic and Atmospheric Administration (NOAA) Areal Locations of Hazardous 

Atmospheres (http://response.restoration.noaa.gov/aloha) 

 DHS OneView (https://gii.dhs.gov/OneView) 

 FEMA Hazus-MH (http://www.fema.gov/hazus) 

 FEMA Hurrevac (http://www.hurrevac.com) 

 U.S. Department of Energy LandScan (http://web.ornl.gov/sci/landscan) 

 National Weather Service Sea, Lake and Overland Surges from Hurricanes

(http://www.nhc.noaa.gov/surge/slosh.php) 

 NOAA Sea Level Rise and Coastal Flooding Viewer (http://csc.noaa.gov/digitalcoast/tools/slrviewer) 

 U.S. Army Corps of Engineers Debris Model

(http://eportal.usace.army.mil/sites/ENGLink/DebrisManagement/default.aspx) 

 FEMA Full-Spectrum Risk Knowledgebase (https://riskknowledge.fema.gov) 

 FEMA Lessons Learned Information Sharing (https://www.llis.dhs.gov) 

Factors for Selecting Threats and Hazards

Communities should include only those threats and hazards of significant concern in their 

THIRA. To identify threats and hazards of significant concern, consider two key factors: 

likelihood of incident and significance of threat/hazard effects. 

Factor #1: Likelihood of Incident

Likelihood is the chance of something happening, whether defined, measured, or estimated 

objectively or subjectively. Communities should consider only those threats and hazards 

that could plausibly occur.

As a starting point, communities should consider the threats and hazards that have historically 

affected them, as well as those threats and hazards that exist regardless of historical occurrence 

(e.g., earthquakes, industrial accidents, or intelligence-driven assessments of potential terrorist 

attacks). This should include analyzing after-action reports and information about the root causes 

of threats and hazards (e.g., major floods caused by inadequate levees), as well as consultation 

7 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

with scientists and appropriate subject matter experts. Communities may also consider looking at 

historical archives (e.g., at the local library) for reports of disasters in the community. 

For threats and hazards for which it is difficult to estimate the likelihood of an incident (e.g., 

terrorism), communities should consider available intelligence data to determine inclusion in the 

THIRA. Engaging state/local law enforcement or a major urban area or state fusion center can 

provide the necessary insight into these types of events in order to focus on plausible threats. 

Local public health and medical personnel can also offer insight about health-related concerns 

such as pandemics.

Communities should take care to not over-rely on historical averages or patterns that may give a 

false sense of likelihood. For example, many severe natural hazards (such as earthquakes or 

floods) occur with such low frequency that relying on historical records alone may be 

misleading. High-magnitude earthquakes, though rare, can have severe consequences and 

therefore should be considered if the community is at risk for earthquake damage. Communities 

should also consider the threats and hazards that similar communities include in their planning 

processes or have recently responded to. 

The scale and severity of disasters are growing and will likely pose systemic threats. Increasing 

changes in demographic trends and technology are making the effects of disasters more complex 

to manage. Population shifts to vulnerable areas and other demographic changes will affect 

future disaster management activities and should be considered when selecting threats and 

hazards.

Factor #2: Significance of Threat/Hazard Effects

The threat/hazard effects represent the overall impacts to the community. Communities should 

consider only those threats and hazards that would have a significant effect on them. 

Consider that different incidents present different types of challenges. In some cases the sheer 

magnitude of the incident may be substantial; others may involve coordination complexities, 

political sensitivities, or economic and social challenges.

Communities should not limit their THIRA to threats and hazards that they would be able to 

manage, but should also consider threats and hazards resulting in large-scale disasters or 

catastrophic incidents. Conversely, communities should exclude from the THIRA threats and 

hazards with only minor impacts, regardless of likelihood. 

Although incidents may have wider regional or national effects, communities should focus 

strictly on the impacts within their jurisdiction. In some cases, it may be useful to include threats 

and hazards that occur in other locations if they trigger local effects. For example, an industrial 

accident at a chemical plant located in one particular community could affect people in another 

community who are downwind from the accident.

Step 1 Output

The output of Step 1 is a list of the community’s threats and hazards of concern. These threats 

and hazards will serve as the basis for Step 2. 

8 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Step 2: Give the Threats and Hazards Context

In Step 2 of the THIRA, communities add context descriptions to each threat and hazard 

identified in Step 1. Context descriptions outline the conditions, including time and location, 

under which a threat or hazard might occur. This section: 

 Identifies factors to consider when developing context descriptions 

 Provides examples of a completed threat/hazard context description. 

Figure 4: Step 2 of the THIRA Process

Context Description: Factors to Consider

To develop threat and hazard context descriptions, communities should take into account the 

time, place, and conditions in which threats or hazards might occur. Communities can use 

expert judgment or analysis of probability and statistics to inform the descriptions of the different 

threat and hazard conditions. Consider the following types of questions when developing context 

for each threat and hazard: 

 How would the timing of an incident affect the community’s ability to manage it? What time 

of day and what season would be most likely or have the greatest impacts? 

 How would the location of an incident affect the community’s ability to manage it? Which 

locations would be most likely or have the greatest impacts? Populated areas? Coastal zones? 

Industrial or residential areas?

 What other conditions or circumstances make the threat or hazard of particular concern? 

Atmospheric conditions (e.g., wind speed/direction, relative humidity)? Multiple events 

occurring at the same time?

Threats and hazards can have different impacts depending on the time, place, and conditions in 

which they occur. As such, communities may need to develop more than one context description 

for a threat or hazard. For example, a hurricane-prone community may need multiple context 

descriptions to account for varying storm intensities, landfall locations, and landfall times.

For any given community, there are countless combinations of threat and hazard conditions that 

lead to slightly different contexts. Communities need not consider every combination; rather they 

should include those details that affect what the community needs to be prepared for. For 

example, a jurisdiction identified an Enhanced-Fujita Scale 3 tornado as a hazard in Step 1. The 

9 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

jurisdiction should consider the time of day and the path of the tornado when developing the 

context statement because the effects and resulting impacts may be different during the day than 

at night. Effective context descriptions should provide an overall sense of scale for the impacts of 

a threat or hazard.

Communities should recognize that past experience with threats and hazards may differ from the 

future threat and hazard environment. Factors such as demographics, climate, and the built 

environment are subject to change. Communities should consider these factors when developing 

threat and hazard context descriptions. 

Examples of Context Descriptions

Table 3 provides two examples of context descriptions for a community. The community 

included the following two threats and hazards in its THIRA: an earthquake (natural) and a 

terrorist attack using an improvised explosive device (human-caused). Each of these threats and 

hazards includes a context description outlining the conditions, including time and location, that

are most relevant to the community. These two threats and hazards are for example purposes 

only; a community may elect to analyze any number of threats and hazards of significant 

concern.

Table 3: Example Context Descriptions

Threat/Hazard Earthquake Terrorism

Context 

Description

A magnitude 7.8 earthquake along the 

Mainline Fault occurring at 

approximately 2:00 PM on a weekday 

with ground shaking and damage 

expected in 19 counties, extending from 

Alpha County in the south to Tau 

County in the north, and into the Zeta 

Valley.

A potential threat exists from a 

domestic group with a history of using 

small IEDs in furtherance of hate 

crimes. There are a number of large 

festivals planned during the summer at 

open air venues that focus on various 

ethnic and religious groups. These 

events draw on average 10,000 

attendees daily.

Step 2 Output

The output of Step 2 is context descriptions for each threat and hazard identified in Step 1. These 

context descriptions will be used to develop impacts and desired outcomes for Step 3. 

Step 3: Establish Capability Targets

In Step 3, communities establish capability targets for each core capability. Capability targets 

define success for each core capability based on the threat and hazard contexts developed in Step 

2. Communities apply the capability targets from Step 3 to generate resource requirements and 

consider preparedness activities, including opportunities for mitigation in Step 4. This section:

 Describes impacts and desired outcomes and how they support development of capability 

targets

 Provides guidance on how to develop capability targets

 Provides examples of completed capability targets.

10
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Figure 5: Step 3 of the THIRA Process

Changes from the First Edition of CPG 201

Step 3 combines two steps from the First Edition of CPG 201: Step 3 (Examine the Core Capabilities 

Using the Threats and Hazards) and Step 4 (Set Capability Targets). Communities still produce one 

capability target per core capability in Step 3.

Impacts and Desired Outcomes

Capability targets should be specific and measurable. To develop specific and measurable 

targets, communities should consider impacts and desired outcomes for each threat and hazard.

Impacts

Impacts describe how a threat or hazard might affect a core capability. Impacts are linked to 

the size and complexity of threats and hazards. Larger, more complex threats and hazards might 

cause larger, more complex impacts.

 For the Response and Recovery mission areas, impacts often describe actions that a 

community would take to manage an incident after it has occurred (e.g., rescue 500 people; 

provide food and shelter for 1,000 evacuees; provide long-term housing for 200 displaced 

families).

 For the Prevention, Protection, and Mitigation mission areas, impacts often describe 

actions a community would take prior to an incident to stop it from occurring or to reduce its 

effects (e.g., screen 80,000 event attendees for weapons; receive situation reports from four 

partner agencies).

Impacts should be specific and include quantitative descriptions as much as possible to allow 

jurisdictions to gain an understanding of what is needed to manage risk. Communities may seek 

to express impacts using the following types of categories:

 Size of geographic area affected

 Number of displaced households 

 Number of fatalities

 Number of injuries or illnesses 

 Disruption to critical infrastructure

11
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

 Intelligence requirements and needs

 Amount of direct economic impacts

 Economic effects of supply chain disruption. 

Communities can use a range of inputs, including expert judgment and advanced modeling, to 

consider impacts. Given the breadth of preparedness mission areas and core capabilities, 

communities should work with the full range of whole community partners to develop, review, 

and validate impacts.

Desired Outcomes

Desired outcomes describe the timeframe or level of effort needed to successfully deliver 

core capabilities. Capabilities are only useful if communities can deliver them in a timely and 

effective manner. For example, success in the Response and Recovery mission areas often 

requires communities to deliver capabilities within a certain timeframe (e.g., complete search 

and rescue operations within 72 hours). Other mission areas may be better presented in terms of 

percentages (e.g., ensure 100% verification of identity to authorize, grant, or deny physical and 

cyber access to specific locations).

When considering desired outcomes, communities should not be constrained by current ability to 

meet timeframes or other conditions of success. Communities should consider various types of 

time-based desired outcomes as shown in Table 5. 

Table 4: Example Time-based Desired Outcomes

Outcome Type Example Outcome Description

Completing operations Complete evacuation of neighborhood within four hours

Establishing services Establish feeding and sheltering operations for displaced populations 

within 24 hours

Service duration Maintain behavioral screening checks for affected population for one 

month

Combination Establish feeding and sheltering operations within 24 hours and maintain 

services for a period of two weeks

Developing Capability Targets

Capability targets define success and describe what the community wants to achieve for each 

core capability. Communities should combine quantitative details from impacts and desired 

outcomes to develop capability targets.

Straightforward Example

For some core capabilities, forming the capability target may be as simple as combining the 

largest impacts with corresponding desired outcomes. As an example, consider a community 

developing a capability target for the Fatality Management Services core capability (see Figure 

6).

12
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Figure 6: Straightforward Example of Developing Capability Targets

Complex Example

For some capabilities, developing capability targets may be more complicated. Different threats 

and hazards may stress different facets of a core capability. As an example, consider a 

community developing capability targets for the Critical Transportation core capability (see 

Figure 7).

 The community reviews its Critical Transportation impacts and desired outcomes: 

• A fire threatens a chemical plant which could release toxic gases, thereby requiring the 

community to evacuate several city blocks in the direction that the toxic cloud is 

estimated to disperse. The affected area is over three square miles, and houses 20,000 

residents who must be evacuated in three hours. 

• An earthquake requires the delivery of vital response personnel, equipment, and services 

within 12 hours. 150 miles of major highway need to be assessed and repaired. 

Figure 7: Complex Example of Developing Capability Targets

By developing capability targets that account for the range of impacts and desired outcomes 

associated with their different threats and hazards, communities will develop a “meta-scenario.” 

13
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

A meta-scenario combines the context statements developed in Step 2 and includes the most 

stressing aspects of each threat and hazard. This approach leads to capability targets that increase 

at each level of government, specifically: a state needs to prepare for the worst impacts across 

multiple counties and a region needs to prepare for the worst impacts across multiple states.

Example Capability Target

Table 5 provides an example of a capability target for the Mass Search and Rescue Operations 

core capability for a community. The capability target includes the following impacts: the 

numbers of buildings to be searched, people to be rescued, and families to be sheltered. The 

target also describes the desired outcomes: completing collapse search and rescue within 72 

hours. Communities should produce such a table for each core capability. 

Table 5: Example Capability Target Statement

Threat/Hazard Earthquake Terrorism

Context 

Description

A magnitude 7.8 earthquake along the 

Mainline Fault occurring at 

approximately 2:00 PM on a weekday 

with ground shaking and damage 

expected in 19 counties, extending from 

Alpha County in the south to Tau 

County in the north, and into the Zeta 

Valley.

A potential threat exists from a 

domestic group with a history of using 

small IEDs in furtherance of hate 

crimes. There are a number of large 

festivals planned during the summer at 

open air venues that focus on various 

ethnic and religious groups. These 

events draw on average 10,000 

attendees daily.

Core Capability: Mass Search and Rescue Operations

Capability 

Target

Within 72 hours, rescue:

 5,000 people in 1,000 completely collapsed buildings

 10,000 people in 2,000 non-collapsed buildings

 20,000 people in 5,000 buildings

 1,000 people from collapsed light structures.

Step 3 Output

The output of Step 3 is a minimum of one capability target for each core capability listed in the 

National Preparedness Goal. These capability targets will be used to identify resource 

requirements in Step 4. Additionally, communities can begin to identify preparedness activities 

to reduce future resource requirements. 

Step 4: Apply the Results

In Step 4, communities apply the results of the THIRA by estimating the resources required to 

meet capability targets. Communities express resource requirements as a list of resources needed 

to successfully manage their threats and hazards. Communities can also use resource 

14
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

requirements to support resource allocation decisions, operations planning, and mitigation 

activities.5 This section: 

 Introduces capability estimation

 Discusses resource typing, including National Incident Management System (NIMS)-

typed resources and other standardized resource types

 Provides an example of a completed resource requirement list

 Identifies how communities may apply these results to resource allocation decisions and 

mitigation activities. 

Figure 8: Step 4 of the THIRA Process

Changes from the First Edition of this Guide

Step 4 retains the activities from the First Edition of CPG 201 and adds capability estimation to establish 

resource requirements lists.

Capability Estimation

To estimate resource requirements, communities should consider the resources needed to achieve 

the capability targets from Step 3. As a first step, communities can identify the major actions 

needed to achieve their capability targets. Communities should avoid developing very detailed, 

tactical-level task lists. Rather, communities should strive to identify mission-critical activities. 

Communities can draw mission-critical activities from current community-level plans, as well as 

from the National Planning Frameworks.

6

Communities should consider the quantity and types of resources needed to complete each 

mission-critical activity in support of the capability targets. To identify quantity and types of 

resources, communities can use existing tools and information sources, such as: 

 Strategic, operational, and/or tactical plans

 Resource typing data, including standardized resource characteristics

 Existing capacity analysis and capability calculators

5 CPG 101, Version 2, Developing and Maintaining Emergency Operations Plans discusses how to incorporate 

resource requirements and capability estimates into emergency operations planning. For more information, please 

see http://www.fema.gov/pdf/about/divisions/npd/CPG_101_V2.pdf. 6 For more information, please visit http://www.fema.gov/national-planning-frameworks. 

15

 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

 Data regarding resources frequently requested through mutual aid. 

Through this process, communities should identify the resources from across the whole 

community needed to meet capability targets.

Each community should decide which combination of resources is most appropriate to achieve 

its capability targets. While any number of combinations may achieve success, communities 

should consider costs, benefits the resources provide, and the ability to manage the risks 

associated with each potential solution. Different solutions may fit best within different 

communities’ political and economic frameworks.

Resource Typing

Resource typing is categorizing, by capability, the resources requested, deployed, and used in 

incidents. Resource typing helps communities request and deploy needed resources through the 

use of common terminology. Communities should develop resource requirements expressed as a 

list of NIMS-typed resources or other standardized resources. 

Tier I NIMS-Typed Resources

FEMA categorizes and describes several types of standardized, deployable resources. 

Measurable standards identifying resource capabilities and performance levels serve as the basis 

for these categories. These NIMS-typed resource definitions include the composition and 

capabilities of teams, personnel, equipment, and supplies commonly deployed in incidents. 

FEMA refers to NIMS-typed resources as Tier I resources. The complete list of Tier I resource 

types can be found at http://www.fema.gov/resource-management. 

Step 4 of the THIRA process enables communities to estimate how many resources—

including FEMA’s Tier I NIMS-typed resources—are needed to achieve capability targets.

As FEMA and the emergency management community continue to define additional Tier I 

NIMS-typed resources, the THIRA process will provide a more accurate and complete picture of 

community-level resource needs.

Tier II Resources and Other Standardized Resources

Communities should also consider resources standardized by entities other than FEMA when 

developing their resource requirements. For example, state, tribal, and local governments 

sometimes establish standardized definitions of deployable resources. FEMA refers to these 

state, tribal, and local-typed resources as Tier II-typed resources. Tier II-typed resources refer to 

resources defined and inventoried by local, state, tribal, and territorial jurisdictions that are 

specific and limited to intrastate mutual aid requests and regional mutual aid assistance. FEMA 

does not play a role in defining these local types or standards, unlike NIMS-typed resources 

(Tier I resources).

Mission Ready Packages (MRPs) available through the Emergency Management Assistance 

Compact (EMAC) describe other types of standardized resources, including credentialed 

personnel. EMAC MRPs describe resources available for deployment for intrastate and interstate 

mutual aid.

Communities should identify resources at a manageable level of detail. Identifying teams or 

“packages” of people, equipment, and associated training allows for comparison across 

jurisdictions. These resources handle specific tasks within specified timeframes. The second

16
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

column in Table 7 shows a recommended level of resource detail. The “Case Management 

Team” represents a distinct resource package.

Table 6: Desired Level of Detail for Other Standardized Resources

Too Broad Recommended Too Detailed

All adequate personnel to meet 

the outcome

1 Type 3 Case Management 

Team

1 operations manager

1 team leader

1 case management supervisor

1 case manager

1 community coordination 

specialist

For some capabilities, communities can calculate resource requirements by considering: 

capability targets; the operational capacities of resources; and available time. The following 

example demonstrates this approach:

Example: Calculating Resource Requirements

Consider a community trying to estimate the number of Urban Search and Rescue (US&R) Task Forces needed for 

its Mass Search and Rescue Operations resource requirement. The community should first consider the types of 

buildings located within the affected area (e.g., high-rise buildings, non-combustible, mid-rise). This information helps 

determine the level of effort and skill required to conduct effective search and rescue. For example, if the community 

can estimate the number of buildings in each category, the average number of floors per building in each category, 

and the average area per floor in each category, the community can derive rough estimates of the number of floors 

and total square footage first responders would need to search in response to a major incident. The community’s 

firefighters, public works staff, building owners, or building inspectors can provide this information to planners.

The community is planning for mass search and rescue in its downtown area. An examination of the area’s building 

stock finds that most buildings are high-rise structures constructed of concrete and protected steel. In consideration 

of their building stock and the occupancy of the buildings, the community reaches out to its existing search and 

rescue expertise as well as that from other jurisdictions to get a recommendation of possible solutions. As a result of 

their analysis, the community determines that highly skilled Type I US&R Task Forces are needed to deal with the 

requirements while other resources can be used more efficiently and effectively to deal with less challenging search 

and rescue needs.

Specialized knowledge can be instrumental in helping to address the following types of questions that arise when 

estimating resource requirements:

 What resources are appropriate for achieving capability targets?

 What are the typical performance characteristics of those resources?

 How might performance vary depending on the local conditions?

The community could use the following calculation to estimate resource requirements.

This example calculation highlights the importance of including subject matter experts from the whole community in 

the THIRA process.

17
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Example of a Completed THIRA

Table 7 shows the progression from capability target to resource requirement for the Mass 

Search and Rescue Operations core capability. The community uses subject matter expertise, 

existing plans, and simple calculations to determine the key resources necessary to meet 

capability targets. 

Table 7: Example Completed THIRA

Threat/Hazard Earthquake Terrorism

Context 

Description

A magnitude 7.8 earthquake along the 

Mainline Fault occurring at 

approximately 2:00 PM on a weekday 

with ground shaking and damage 

expected in 19 counties, extending from 

Alpha County in the south to Tau 

County in the north, and into the Zeta 

Valley.

A potential threat exists from a 

domestic group with a history of using 

small IEDs in furtherance of hate 

crimes. There are a number of large 

festivals planned during the summer at 

open air venues that focus on various 

ethnic and religious groups. These 

events draw on average 10,000 

attendees daily.

Core Capability: Mass Search and Rescue Operations

Capability 

Target

Within 72 hours, rescue:

 5,000 people in 1,000 completely collapsed buildings

 10,000 people in 2,000 non-collapsed buildings

 20,000 people in 5,000 buildings

 1,000 people from collapsed light structures.

Resource Requirement

Resources Number Required

Type I US&R Task Forces 10

Type II US&R Task Forces 38

Collapse Search and Rescue (S&R) Type III Teams 100

Collapse S&R Type IV Teams 20

Canine S&R Type I Teams 20

Applying the THIRA Results to Resource Allocation Decisions and 

Preparedness Activities

Communities can apply their THIRA results to allocate resources and inform preparedness 

activities, including opportunities for mitigation.

18
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Resource Allocation Decisions

A community can use its THIRA results to make decisions about how to allocate limited 

resources. By establishing resource requirements, a community determines the resources needed

to achieve capability targets. 

In some cases, THIRA results may indicate a need to sustain existing capabilities. In other cases, 

results may identify resource shortfalls and capability gaps. Communities can use this 

information to guide capability investment decisions and to brief community leaders, senior 

officials, and the public on resource requirements. Communities have several options available to 

build or sustain capabilities, including: 

 In some cases, communities may rely upon the resources of other levels of government to 

achieve a capability target. Accordingly, cities, counties, states, tribes, and regions should 

work collaboratively to build and sustain capabilities. For example, if states require national 

resources to meet a capability target, they should collaborate with FEMA Regional Offices 

and other Federal agencies.

 Communities can build capabilities and fill gaps in a variety of other ways. For example, 

communities can:

• Establish mutual aid agreements with surrounding communities 

• Work with whole community partners (e.g., faith-based organizations) to augment 

capabilities

• Invest community or grant dollars 

• Request technical assistance for planning or exercises to help deploy resources more 

effectively.

Regardless of how a community chooses to make resource allocation decisions, the THIRA 

process provides a framework to establish resource requirements and monitor progress towards 

building, sustaining, and delivering capabilities.

Preparedness Activities

THIRA results can also inform preparedness activities, including mitigation opportunities that 

may reduce the amount of resources required in the future. Through the THIRA process, 

communities can identify opportunities to employ mitigation plans, projects, and insurance to 

reduce the loss of life and damage to property. In this way, communities can reduce the impacts 

they need to manage, and hence reduce the resources needed to achieve capability targets. Table 

8 shows examples of mitigation activities and associated effects and outcomes.

Using THIRA results to inform mitigation activities aligns with the traditional mitigation 

planning process of identifying hazards, assessing losses to the community, and setting 

mitigation priorities and goals for the community.

19
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Table 8: Example Mitigation Activities and Associated Effects/Outcomes

Mitigation Activity Effect Outcome

Seismic retrofitting on utility 

buildings

Increased utility resilience Key emergency services retain 

100% power during incidents

Installing safe rooms in 

residential and commercial 

buildings for areas affected by 

tornados

Increased ability for individuals to 

shelter in place during disasters

100% preservation of life safety 

for occupants taking shelter in 

safe rooms designed to FEMA

P-320/361 standards

Step 4 Output

In Step 4, communities develop a list of resource requirements (e.g., NIMS-typed resources, 

EMAC MRPs) to meet the capability targets while also considering preparedness activities that 

may reduce future resource requirements.

Conclusion

Understanding the risks faced by communities and the Nation as a whole is essential to national 

preparedness. This Guide provides a common and consistent approach for communities to 

support the first two components of the National Preparedness System: 1) Identifying and 

Assessing Risk; and 2) Estimating Capability Requirements. It expands on existing local, state, 

tribal, and territorial hazard identification and risk assessment processes. 

The THIRA is complemented by a Strategic National Risk Assessment (SNRA) that analyzes the 

greatest risks to the Nation, and contributes to a shared understanding of the full range of risks, 

including long-term trends that face our Nation.7 THIRAs and the SNRA, along with other 

specialized risk assessments, provide an integrated national risk picture, which in turn helps to 

achieve the National Preparedness Goal of “a secure and resilient Nation with the capabilities 

required across the whole community to prevent, protect against, mitigate, respond to, and 

recover from the threats and hazards that pose the greatest risk.” 

Achieving the National Preparedness Goal requires participation by the whole community. 

Consistent application of THIRAs provides an important tool for integrating whole community 

contributions toward achieving the National Preparedness Goal. Through the THIRA process, 

communities are better able to educate individuals, families, businesses, organizations, 

community leaders, and senior officials about the risks they face and their roles in and 

contributions to prevention, protection, mitigation, response, and recovery.

7 For more information, please see http://www.dhs.gov/xlibrary/assets/rma-strategic-national-risk-assessmentppd8.pdf. 

20

 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Appendix A: THIRA Template

The following table illustrates one possibility for how communities may organize the information in their THIRAs.

Threat/Hazard

Context 

Description

Core Capability

Capability 

Target

Resource Requirement

Resources Number Required

A-1 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

This page intentionally left blank.

A-2 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Appendix B: Glossary

Capability Target: Capability targets define success for each core capability and describe what 

the community wants to achieve by combining detailed impacts with basic and measurable 

desired outcomes based on the threat and hazard context statements developed in Step 2 of the 

THIRA process. 

Context: A community-specific description of an incident, including location, timing, and other 

important circumstances.

Core Capability: Defined by the National Preparedness Goal, 31 activities that address the 

greatest risks to the Nation. Each of the core capabilities is tied to a capability target.

Desired Outcome: The standard to which incidents must be managed, including the timeframes 

for conducting operations or percentage-based standards for performing security activities. 

Human-caused Hazard: A potential incident resulting from the intentional actions of an 

adversary.

Impact: How a threat or hazard might affect a core capability.

Likelihood: The chance of something happening, whether defined, measured, or estimated 

objectively or subjectively, or in terms of general descriptors (e.g., rare, unlikely, likely, almost 

certain), frequencies, or probabilities.

Natural Hazard: A potential incident resulting from acts of nature.

NIMS-typed Resource: A resource categorized, by capability, the resources requested, 

deployed and used in incidents. 

Resource Requirement: An estimate of the number of resources needed to achieve a 

community’s capability target. A list of resource requirements for each core capability is an 

output of the THIRA process. 

Technological Hazard: A potential incident resulting from accidents or failures of systems or 

structures.

Threat/Hazard Effect: The overall impacts to the community were an incident to occur. 

Whole Community: An approach to emergency management that reinforces the fact that FEMA 

is only one part of our Nation’s emergency management team. We must leverage all of the 

resources of our collective team in preparing for, protecting against, responding to, recovering 

from and mitigating against all hazards; and that collectively we must meet the needs of the 

entire community in each of these areas.

B-1 
CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

This page intentionally left blank. 

B-2