FEMA

Risk Management Series

Handbook for Rapid Visual

Screening of Buildings to

Evaluate Terrorism Risks 

FEMA 455 / March 2009 

Handbook for Rapid Visual 

Screening of Buildings to 

Evaluate Terrorism Risks

RISK MANAGEMENT SERIES

 FEMA 455/ March 2009

FOREWORD AND ACKNOWLEDGEMENTS iii 

 FOREWORD AND ACKNOWLEDGEMENTS 

his rapid visual screening procedure has been developed for use 

in assessing risk of terrorist attack on standard commercial 

buildings in urban or semi-urban areas, but it is also intended to 

be applicable nationwide for all conventional building types. It can be 

used to identify the level of risk for a single building, or the relative risk 

among buildings in a portfolio, community, or region as a prioritization 

tool for further risk management activities. The information gathered 

as part of this screening procedure can also be used to support and 

facilitate higher level assessments by expert investigators performing 

building-specific evaluations of threat, consequences, and vulnerability. 

ACKNOWLEDGEMENTS 

The Applied Technology Council completed this publication under 

contract HSFEHQ-04-D-0651. 

Principal Authors 

Eve Hinman, Hinman Consulting Engineers, Inc., Applied 

Technology Council Project Technical Director 

Christopher Arnold, Building Systems Development 

Mohammed Ettouney, Weidlinger Associates, Inc. 

Milagros Kennett-Reston, FEMA, Project Officer, Risk Management 

Series Publications 

Stephanie King, Weidlinger Associates, Inc. 

Terrence Ryan, Raytheon UTD, Inc. 

Contributors 

William Blewett, Battelle 

Sharon Gallant, Hinman Consulting Engineers, Inc. 

David Hattis, Building Technology, Inc. 

Jon A. Heintz, Applied Technology Council 

Stephen Hollowell, Cerberus Security Services 

Eric Letvin, URS 

Arturo Mendez, New York Police Department 

Christopher Rojahn, Applied Technology Council 

Pilot Study Participants 

Amy Baker, URS 

Bruce Botkin, Las Vegas Metropolitan Police Department 

Ed Carubis, ESRI Professional Services 

Ernest Chambers, Las Vegas Police Department 

T
iv FOREWORD AND ACKNOWLEDGEMENTS 

John Chirillo, New York Police Department 

Gonzalo Cordova, Department of Homeland Security 

Jason DeVilbiss, Las Vegas Metropolitan Police Department 

Charles Famulari, New York Police Department 

Keith Foisey, New York Police Department 

Scott Gregory, ESRI Professional Services 

Robert Hall, ESRI Professional Services 

Robert Hoyle, Las Vegas Metropolitan Police Department 

Mary Ellen Hynes, Department of Homeland Security 

Al Iglesias, New York Police Department 

Dave Kehrlein, ESRI Professional Services 

Ari Maas, New York Police Department 

Patrick O’Neill, New York Police Department 

Mary Raymond, Department of Homeland Security 

Andrea T. Schultz, Department of Homeland Security 

Dave Shepherd, Readiness Resource Group 

Cindy Stimpfel, New York Police Department 

Joe Tadrick, Department of Homeland Security 

Arturo Willis, New York Police Department 

Advisory Participants 

Robert Chapman, NIST 

Cathy Crowley, Department of Homeland Security 

Doug Hall, Smithsonian Institution 

Mark Harvey, Department of Homeland Security 

Mike Kaminskas, Raytheon UTD 

Fred Krimgold, Virginia Tech 

Ken Mead, Centers for Disease Control and Prevention/National 

Institute for Occupational Safety and Health 

Elizabeth Miller, National Capital Planning Commission 

Matt Nichols, Department of Homeland Security 

Robert Smilowitz, Weidlinger Associates, Inc. 

Frank Tabert, New York State Office of Homeland Security 

Pax Williams, Battelle 

Report Production 

Peter Mork, Applied Technology Council 
TABLE OF CONTENTS v 

 TABLE OF CONTENTS 

FOREWORD AND ACKNOWLEDGEMENTS ................................................................... iii 

LIST OF FIGURES............................................................................................................... ix 

LIST OF TABLES ................................................................................................................. xi 

INTRODUCTION 

Background ...................................................................................................................... 1 

Objectives and Scope ........................................................................................................... 1 

Limitations....................................................................................................................... 2 

Intended Audience .............................................................................................................. 3 

Content and Organization ..................................................................................................... 3 

PERFORMING A RAPID VISUAL SCREENING 

Overview ........................................................................................................................ 5 

Rapid Visual Screening Procedure Overview ................................................................................ 5 

Understanding the Rapid Screening Framework ............................................................................ 6 

Assembling the Assessment Team ............................................................................................ 7 

Understanding the Risk Scoring Procedure .................................................................................. 8 

Organizing and Mobilizing Necessary Resources ......................................................................... 10 

Collecting and Recording Assessment Data ................................................................................ 11 

Scoring When a Building Characteristic is Unknown or Not Applicable ................................................. 16 

Completing the Risk Scoring Worksheet ................................................................................... 17 

Use of Screening Results .................................................................................................... 18 

CONSEQUENCES ASSESSMENT 

Overview ...................................................................................................................... 21 

Consequences ................................................................................................................. 21 

Conducting the Field Assessment ........................................................................................... 23 

THREAT ASSESSMENT 

Overview ...................................................................................................................... 31 

Threat Rating ................................................................................................................. 31 

Threat Types .................................................................................................................. 32 
vi TABLE OF CONTENTS 

Zone Definitions.............................................................................................................. 32 

Threat Scenarios ............................................................................................................. 34 

Conducting the Field Assessment........................................................................................... 35 

VULNERABILITY ASSESSMENT 

Overview ..................................................................................................................... 43 

Determining the Vulnerability Rating...................................................................................... 43 

Conducting the Field Assessment........................................................................................... 44 

Site ............................................................................................................................ 45 

Architecture................................................................................................................... 50 

Building Envelope ............................................................................................................ 59 

Structural Components and Systems....................................................................................... 73 

Mechanical/Electrical/Plumbing (MEP) ................................................................................... 90 

Security ....................................................................................................................... 94 

RISK ASSESSMENT RATING 

Overview ................................................................................................................... 103 

Determining the Risk Rating.............................................................................................. 103 

Weighted Building Characteristics........................................................................................ 105 

Evaluating the Risk for Multiple Buildings in a Localized Area ....................................................... 106 

Evaluating the Risk for Interconnected Buildings ....................................................................... 106 

Interpretation of the Risk Assessment Rating.......................................................................... 107 

CONCEPT MITIGATION OPTIONS 

Overview ................................................................................................................... 109 

Using the Rapid Visual Screening Procedure to Evaluate Mitigation Options ....................................... 109 

Practical Considerations for Evaluating Mitigation Options ........................................................... 111 

Mitigation Protection Levels .............................................................................................. 112 

Next Steps.................................................................................................................. 113 

APPENDIX A: DATA COLLECTION FORM AND RISK 

SCORING WORKSHEET...................................................................... 115 

APPENDIX B: DATA COLLECTION FORM (FIELD VERSION)................................. 127 

APPENDIX C: RISK SCORING METHODOLOGY ..................................................... 135 
TABLE OF CONTENTS vii 

APPENDIX D: INFRASTRUCTURE TAXONOMY ........................................................ 143 

APPENDIX E: SCREENER’S GUIDE TO ELECTRONIC VERSION 

OF PROCEDURE ................................................................................... 151 

REFERENCES ............................................................................................................... 159 

LIST OF FIGURES ix 

 LIST OF FIGURES 

Figure 1 Page 1 of Data Collection Form................................................................................................................................... 14 

Figure 2 Pages 2 through 9 of Data Collection Form .................................................................................................................. 15 

Figure 3 Risk Scoring Worksheet .............................................................................................................................................. 18 

Figure 4 Pages 2 and 3 of Data Collection Form, Consequences ................................................................................................. 22 

Figure 5 Page 4 of Data Collection Form, Threats ...................................................................................................................... 33 

Figure 6 Zone Definitions ........................................................................................................................................................ 34 

Figure 7 Page 5 of Data Collection Form, Vulnerability Assessment (Part I), Site and Architecture Characteristics 

Contributing to Vulnerability Rating ............................................................................................................................ 45 

Figure 8 Page 6 of Data Collection Form, Vulnerability Assessment (Part II), Architecture and Building Envelope 

Characteristics ........................................................................................................................................................... 54 

Figure 9 Page 7 of Data Collection Form, Vulnerability Assessment (Part III), Building Envelope and Structural 

 Components and Systems Contributing to Vulnerability Rating ..................................................................................... 71 

Figure 10 Page 8 of Data Collection Form, Vulnerability Assessment (Part IV), Mechanical/Electrical/Plumbing 

Systems Contributing to Vulnerability Rating ............................................................................................................... 90 

Figure 11 Page 9 of Data Collection Form, Vulnerability Assessment (Part V), Security Characteristics Contributing 

to Vulnerability Rating ............................................................................................................................................... 94 

Figure 12 Security System Effectiveness Matrix ........................................................................................................................... 99 

Figure 13 Risk Rating Example ................................................................................................................................................ 104 

LIST OF TABLES xi 

 LIST OF TABLES 

Table 1 Summary of FEMA 452 Tiered Assessment Levels ........................................................................................................... 6 

Table 2 Variables Considered in the Risk Scoring Procedure ........................................................................................................ 9 

Table 3 Rapid Visual Screening Activities ................................................................................................................................. 11 

Table 4 Key Personnel and Relevant Building Documentation ................................................................................................... 12 

Table 5 Risk Scoring Methods ................................................................................................................................................. 13 

Table 6 Guidance on Consequences Assessment: 1. Consequences ............................................................................................. 23 

Table 7 Threat Scenarios and Threat Types .............................................................................................................................. 34 

Table 8 Guidance on Threat Assessment: 2. Threat ................................................................................................................... 35 

Table 9 Guidance on Vulnerability Assessment: 3. Site .............................................................................................................. 46 

Table 10 Guidance on Vulnerability Assessment: 4. Architecture ................................................................................................. 50 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope ......................................................................................... 59 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems .............................................................. 75 

Table 13 Guidance on Vulnerability Assessment: 7. Mechanical/Electrical/Plumbing Systems ....................................................... 91 

Table 14 Building Security Detection Systems and Desired Attributes .......................................................................................... 96 

Table 15 Examples of Building Security System Effectiveness Criteria .......................................................................................... 99 

Table 16 Guidance on Vulnerability Assessment: 8. Security ..................................................................................................... 100 

Table 17 Examples of Protection Levels for a Hypothetical Building .......................................................................................... 113 

INTRODUCTION 1 

 INTRODUCTION 

BACKGROUND 

mplementation of FEMA 452, Risk Assessment, A How-to 

Guide to Mitigate Potential Terrorist Attacks Against Buildings, 

has demonstrated the need for a preliminary procedure 

to assess the risk of terrorist attack that is quick and simple to 

use. It has also shown that such a procedure needs to be 

usable by screeners who are knowledgeable about building 

systems, but not necessarily experts in anti-terrorism or 

structural design. This will reserve the use of experts for 

higher risk buildings requiring more detailed assessment 

when resources are limited. 

In this document, the concepts for rapid visual screening are 

combined with a risk-based procedure for manmade threats defined in 

FEMA 426, Reference Manual to Mitigate Potential Terrorist Attacks Against 

Buildings, and FEMA 452, Risk Assessment, A How-to Guide to Mitigate 

Potential Terrorist Attacks Against Buildings, from the FEMA Risk 

Management Series of publications. 

OBJECTIVES AND SCOPE 

his handbook outlines a rapid visual screening procedure that 

quantifies the risk to a building due to a terrorist attack that is 

capable of causing catastrophic losses in terms of fatalities, 

injuries, damage, or business interruption. The primary purpose of 

this screening procedure is to prioritize the relative risk among a group 

of buildings in a portfolio or community but it can also be used to 

develop building-specific risk information. It is intended to be the first 

step in a tiered assessment process that includes successively more 

refined analyses when more detailed information is needed. 

Three generic types of terrorist threat are considered in this 

procedure. These include intrusion into the building, a vehicle borne 

improvised explosive device (VBIED), and a chemical, biological or 

radiological (CBR) release. 

Quantification of relative risk is based on the methodology outlined in 

FEMA 426, in which risk is characterized as the product of three 

factors: consequences, threat, and vulnerability. In this rapid visual 

screening procedure, these three factors are evaluated using a Data 

Collection Form based on checklists and worksheets contained in 

I 

T Terrorism is an unlawful act 

of force or violence against 

persons or property with the 

intent to intimidate or coerce 

a government or civilian 

population in furtherance of 

political or social objectives. 

In the context of this report, 

terrorism can take the form 

of armed intrusion, explosive 

attack, or chemical, biological, 

or radiological release. 
2 INTRODUCTION 

FEMA 426 and FEMA 452. To make the screening procedure rapid, 

the assessment is limited to the most dominant features governing the 

overall risk to a building given a terrorist attack. In this procedure 

there is an emphasis on the vulnerability factor, due in part to the 

relatively significant level of control that the owner has with respect to 

this factor for a given building compared with the other two factors: 

threat and consequences. 

LIMITATIONS 

his rapid visual screening procedure was developed based on 

assessing the risk of terrorist attack for office buildings in urban 

or semi-urban areas. The following limitations apply to the use 

of this procedure: 

P The unique characteristics of non-building structures such as 

tunnels, bridges, transmission towers, dams, and monuments are 

not considered. 

P The exceptionally high risk associated with one of a kind iconic 

buildings of symbolic value is not considered, such as the White 

House or the Pentagon. Risk to this class of buildings should be 

evaluated using more detailed assessment procedures. 

P Second order collateral effects such as loss of functionality (e.g., 

loss of power) due to separate targeting of remote utility 

infrastructure systems is not considered. 

P The design of mitigation measures to reduce the risk of terrorist 

attack is not addressed in this procedure. (However, a discussion of 

some basic mitigation concepts has been included). 

P The threat rating defined in this report provides an indication of 

the buildings threat attractiveness rather than the probability of 

attack. 

Rapid visual screening is designed to be performed using limited 

information from the visual inspection of the building exterior and 

public areas. Interior inspections or interviews with key stakeholders 

are highly desirable but not always practical. Consequently, conditions 

contributing to increased vulnerability will not always be visible, and 

high-risk buildings may not be identified as such. Conversely, 

buildings initially identified as high risk may prove to be otherwise 

based on additional information. 

T 
INTRODUCTION 3 

Also note that some of the building characteristics will require pre-field 

information gathering to obtain an accurate scoring. If such research is 

not performed, the quality of the risk assessment may not be 

completely accurate. 

For buildings identified as having unacceptable levels of potential risk 

using this approach, additional study is warranted using a more refined 

assessment method. 

INTENDED AUDIENCE 

his handbook is intended for use by both technical and 

stakeholder audiences. Technical audiences include potential 

screeners and trained personnel knowledgeable about building 

systems, but not necessarily experts in anti-terrorism design. 

Stakeholder audiences include building owners/operators/decision 

makers involved with the planning, construction, and maintenance of 

the built environment. It is expected that interested technical and 

stakeholder groups would include the following: 

P City, County and State Officials 

P Emergency Managers 

P Law Enforcement Agencies 

P Lenders 

P Insurers 

P Facility Managers 

P Security Consultants 

P Engineers, Architects and other design professionals. 

The procedure is primarily intended for office, commercial and 

government buildings, but also can be used for schools, hospitals, 

industrial buildings, and other types of buildings. 

CONTENT AND ORGANIZATION 

his handbook provides the information needed to rate a 

building or group of buildings that have been selected for rapid 

visual screening of their potential risk to terrorist attack. 

Screeners are guided through the details of how to evaluate and score 

key features contributing to the overall risk to the building, and how to 

develop an overall risk assessment rating based on three factors: 

T 

T 
4 INTRODUCTION 

consequences, threat rating, and vulnerability rating. Stakeholders are 

provided guidance on how to use and interpret the results. 

The information is arranged in chapters in the following order: 

P Performing a Rapid Visual Screening. An overview of the screening 

procedure and its application, with discussion of screener 

qualifications, and an introduction to the Data Collection Form 

and Risk Scoring Worksheet. 

P Consequences Assessment. Guidance on how to complete Section 

1 of the Data Collection Form, which is used to evaluate building 

characteristics that affect consequences. 

P Threat Assessment. Guidance on how to complete Section 2 of the 

Data Collection Form, which is used to evaluate building 

characteristics related to threat rating. 

P Vulnerability Assessment. Guidance on how to complete Sections 3 

through 8 of the Data Collection Form, which are used to evaluate 

the vulnerability of the building. 

P Risk Assessment Rating. Guidance on how to complete the Risk 

Scoring Worksheet and how to interpret the risk rating scores. 

P Mitigation Options. Outlines some mitigation design strategies that 

may be used to lower the risk. 

In addition there are five appendices. Appendix A contains the Data 

Collection Form and Risk Scoring Worksheet. Appendix B contains a 

field version of the Data Collection Form to be used during the site 

inspection. Appendix C contains a description of the numerical 

derivation of the risk scoring procedure. Appendix D contains an 

abbreviated version of the taxonomy used by the Department of 

Homeland Security to define facility types. Appendix E contains 

guidance on the use of an electronic version of the procedure. A list of 

references follows. 
PERFORMING A RAPID VISUAL SCREENING 5 

 PERFORMING A RAPID VISUAL SCREENING

OVERVIEW

his rapid visual screening procedure is intended to be a first step in 

a tiered assessment process, as outlined in FEMA 452, Risk 

Assessment, A How-to Guide to Mitigate Potential Terrorist Attacks Against 

Buildings. In a tiered approach, a series of successively more refined 

analyses are performed, and additional effort is expended, when more 

detailed information is needed. This trade-off between level of effort and 

level of refinement allows an assessment to meet a variety of benefit/cost 

considerations for different buildings. 

As a first step in an overall process, rapid visual screening is intended to be 

a quick and simple tool for obtaining an initial risk assessment rating for a 

building or group of buildings. As such, there are practical limitations on 

how much information can be considered in performing the rapid 

assessment, accompanied with a corresponding level of uncertainty in the 

results. In general, rapid visual screening procedures are most often used 

to obtain a basic understanding of the risk, and to prioritize more detailed 

assessments over the entire inventory of buildings considered. More 

detailed assessments, such as FEMA 452 Tier 1, Tier 2 or Tier 3 

assessments, are usually needed to confirm results on any one building, 

although some building-specific vulnerability information can be obtained 

using this screening procedure. In this context the rapid visual screening 

procedure is a Pre-Tier 1 tool for assessment. 

The information gathered as part of this screening procedure is designed 

to support and facilitate higher level assessments by expert investigators 

performing building-specific evaluations of consequences, threat, and 

vulnerability using FEMA 452, or other similar risk assessment 

methodology. 

This chapter gives an overview of the screening procedure. Subsequent 

chapters provide detailed information on evaluating a building to 

determine the risk score. 

RAPID VISUAL SCREENING PROCEDURE 

OVERVIEW 

he rapid visual screening procedure involves the following 

sequence of activities: 

P Understand the rapid screening framework; 

T

T
6 PERFORMING A RAPID VISUAL SCREENING 

P Assemble the assessment team; 

P Understand the risk scoring procedure; 

P Organize and mobilize necessary resources ; 

P Collect and record assessment data 

(i.e., assess Consequences, Threat Rating and Vulnerability); 

P Complete the Risk Scoring Worksheet; and 

P Interpret and use results. 

Each of these activities is described in the sections below. 

UNDERSTANDING THE RAPID SCREENING 

FRAMEWORK 

EMA 452 identifies three tiers of assessment, which are summarized 

in Table 1. 

Table 1 Summary of FEMA 452 Tiered Assessment Levels 

Tier Description No. of Screeners Duration Building Types 

1 Screening 

Evaluation 

1-2 Up to 2 days Majority of standard commercial 

office buildings and other noncritical facilities and 

infrastructure 

2 Full On-Site 

Evaluation 

3-5 3-5 days Most high-risk buildings, iconic 

commercial buildings, 

government facilities, schools, 

hospitals and other designated 

high value infrastructure assets 

3 Detailed Evaluation 8-12 Several days to 

weeks 

High value or critical 

infrastructure assets. 

In FEMA 452, Tier 1 is characterized as a screening phase that identifies 

primary building vulnerabilities and involves a "quick look" at the site 

perimeter, building, core functions, infrastructure, drawings, and plans. 

The approximate level of effort consists of one-to-two experienced 

professionals for up to two days. A FEMA 452 Tier 1 assessment is usually 

considered a sufficient level of assessment for most commercial buildings 

and other non-critical facilities. 

Buildings identified as having an unacceptable level of risk based on a 

Tier 1 assessment will require more detailed evaluation in a FEMA 452 

Tier 2 assessment. This type of assessment requires more detailed 

information about building characteristics and security features, and will 

require a multi-disciplinary team of experts to execute. A FEMA 452 Tier 2 

F
PERFORMING A RAPID VISUAL SCREENING 7 

assessment is usually considered a sufficient level of assessment for most 

moderate-risk facilities. 

If additional information is needed, quantitative engineering analysis is 

performed in a FEMA 452 Tier 3 assessment of potential damage and 

casualties. This type of assessment requires a still larger group of experts 

and more time to execute, and is typically reserved for high-value or 

critical facilities. 

This rapid visual screening procedure in the context of FEMA 452 is 

effectively a “Pre-Tier 1” assessment. Similar to a Tier 1 assessment it is 

designed to be conducted by one or two screeners, and depending on the 

level of effort, can be completed in 1-to-5 hours per building, depending 

on the level of desired accuracy and access to building information. 

Buildings identified as having an unacceptable level of risk using this rapid 

visual screening procedure can be reassigned directly to FEMA 452 Tier 2 

assessment. 

Reliability and confidence in the rapid visual screening results can be 

increased if structural, mechanical, and security features can be verified 

with further information from: (1) interior inspections with knowledgeable 

building representatives; (2) interviews with building security and other 

key personnel; and (3) review of additional building documentation, such 

as available building drawings and security operations manuals. If detailed 

interviews and substantial background materials are reviewed, this 

procedure can take up to two days per building. The more information 

that is considered during rapid visual screening, the more accurate the risk 

scoring process will be. To facilitate the process, it is strongly 

recommended that authorities, and building owners and operators be 

contacted prior to the commencement of assessment. 

Successively fewer buildings are generally considered for each subsequent 

tier of evaluation. Note that for highly iconic one of-a-kind buildings (e.g., 

the Pentagon, White House), the rapid visual screening procedure is not 

appropriate, and a FEMA 452 Tier 2 or Tier 3 assessment is required. 

ASSEMBLING THE ASSESSMENT TEAM 

he rapid visual screening approach facilitates the prioritization of 

resources in the screening process, reserving the use of experts for 

the highest risk buildings that require more detailed assessment. 

It is recommended that teams include members who are comfortable with 

building sciences and security concepts. In some cases, stakeholders may 

decide to provide training for the screeners or to have an expert in 

T
8 PERFORMING A RAPID VISUAL SCREENING 

antiterrorism oversee the assessment process. In general, the more 

knowledgeable the screener is with the concepts presented in this 

document, the more accurate the assessment and potentially the better the 

reliability of the score. 

Discussions about the rapid visual screening methodology with the team 

prior to implementation may help ensure consistency among assessments, 

high quality of collected data, and uniformity of decisions among 

screeners. Discussions should address building systems, including site 

design, architectural, mechanical, electrical, plumbing, and security 

systems. Other pertinent topics include: how buildings behave when 

subjected to extreme events; how to use the Data Collection Form, and the 

electronic database version; what to look for in the field; what to bring to 

the field; and how to account for uncertainty. 

Teams can simultaneously consider and rate buildings of several different 

types and compare results early in the assessment process. This will serve as 

a “calibration” for the screeners and improve consistency of results. 

UNDERSTANDING THE RISK SCORING 

PROCEDURE 

he risk scoring procedure used in rapid visual screening is based on 

the risk assessment equation in FEMA 426, Reference Manual to 

Mitigate Potential Terrorist Attacks Against Buildings, and FEMA 452, 

Risk Assessment, A How-to Guide to Mitigate Potential Terrorist Attacks Against 

Buildings. As shown in Equation 1, risk is defined as the product of three 

factors for a given threat scenario: 

R = ×× CTV (1) 

where: 

C = Consequences Rating 

T = Threat Rating 

V = Vulnerability Rating

Consequences is defined as a degree of debilitating impact that would be 

caused by the incapacity or destruction of an asset. To put this into the 

context of other risk assessment methodologies, sometimes consequences 

is referred to as “asset value”. Assets refer not only to monetary value but 

also value to the community. 

Threat is defined as any indication, circumstance, or event with the 

potential to cause loss of, or damage to, an asset. 

Vulnerability is defined as any weakness that can be exploited by an 

aggressor to make an asset susceptible to damage. 

T
PERFORMING A RAPID VISUAL SCREENING 9 

The risk scoring procedure considers the variables listed in Table 2. Each 

of the three risk factors is evaluated through the collection of building 

data, considering key individual building characteristics across all building 

systems. 

Table 2 Variables Considered in the Risk Scoring Procedure 

Threat Types a. Internal Attack 

b. External Large Scale Vehicle Borne Improvised Explosive Device 

c. External Large Scale Chemical Biological or Radiological (CBR) release using airborne contaminants 

High Value Target Types 

(in the proximity of the 

building) 

a. Agricultural/Food Processing

b. Banking and Finance 

c. Chemical Processing 

d. Commercial Key Assets 

e. Critical Manufacturing 

f. Dams 

g. Defense Industrial Base 

h. Emergency Services 

i. Energy 

j. Governmental 

k. Information and Telecommunications 

l. National Monuments 

m. Nuclear 

n. Postal and Shipping 

o. Public Health 

p. Transportation Systems 

q. Water Supply 

Target Zones a. Zone I – less than 100 feet from the building 

b. Zone II – more than or equal to 100 feet and less than 300 feet from the 

building 

c. Zone III – more than or equal to 300 feet and less than or equal to 1000 feet 

from the building

Threat Scenarios 

(in terms of threat type and 

target zone) 

a. Internal Explosive Attack

b. Internal CBR Release 

c. Other Internal Attack (Intrusion) 

d. External Zone I Explosive Attack 

e. External Zone II Explosive Attack 

f. External Zone III Explosive Attack 

g. External Zone I CBR Release 

h. External Zone II CBR Release 

i. External Zone III CBR Release 

Occupancy Types a. Group I – low risk 

b. Group II – moderate risk 

c. Group III – high risk 

Building Systems a. General 

b. Site 

c. Architectural 

d. Building Envelope 

e. Structural Systems 

f. Mechanical/Electrical/Plumbing Systems 

g. Security Systems 
10 PERFORMING A RAPID VISUAL SCREENING 

Building information is recorded on a Data Collection Form and building 

characteristics are scored using a discrete numerical scoring system, where 

the lowest value represents the lowest contribution of the building 

characteristic to risk, and the highest value represents the highest 

contribution. Results from the Data Collection Form are entered in the 

risk scoring worksheets to calculate the risk assessment score for the 

building (or calculated internally if the electronic database version of the 

Data Collection Form is used). 

A numerical value is assigned for each of the 3-to-5 building attributes 

describing a building characteristic included on the Data Collection Form. 

Consistent with FEMA 452, the sum of the numerical values for the 

building characteristics that contribute to each risk factor and threat 

scenario range from 1 for the lowest risk contribution to 10 for the highest 

risk contribution. 

A detailed description of the development of the risk scoring procedure is 

provided in Appendix C. 

ORGANIZING AND MOBILIZING 

NECESSARY RESOURCES 

apid visual screening of a building requires the collection and 

review of building and security data from a number of different 

resources. Efficient execution of a rapid visual screening requires 

a systematic and organized approach to data collection and field 

verification of information. 

A summary of rapid visual screening activities, and when they should be 

performed in the rapid visual screening process, are provided in Table 3. 

As noted in the table, certain activities indicate elements of a more refined 

screening that would increase the anticipated level of effort and duration 

of the assessment. All other activities represent the minimum that is 

required for a rapid visual screening. 

At a minimum, building information is obtained through publicly available 

sources and visual observation of the exterior. For more detailed 

screening, data for rapid visual screening may be obtained from private 

(building owner) resources, available building documentation, interviews 

with key personnel, visual observation of publicly accessible areas or a tour 

of selected interior areas. A sample list of key personnel to interview and 

relevant building documentation to review is provided in Table 4. 

R
PERFORMING A RAPID VISUAL SCREENING 11 

Table 3 Rapid Visual Screening Activities 

Pre-field Activities a. Identify key objectives of the screening from building stakeholders

b. Select inventory of buildings to be included in study 

c. Identify screeners and discuss methodology (and provide training if needed) 

d. Complete the pre-field information on page 1 of the Data Collection Form as 

completely as possible including gathering publicly available information on 

buildings and potential high value targets in the vicinity 

e. Obtain and review available materials obtained from the building owner, 

including operations and security procedures, policies, and construction 

drawings (*) 

f. Make arrangements for access to the buildings 

Field Visit a. Take this Handbook to the field to refer to guidance on evaluating the various 

building characteristics 

b. Use the “Field Version” of the Data Collection Form to collect data at the site, 

as provided in Appendix B 

b. Verify information already obtained 

c. Tour exterior and publicly accessible areas of the building filling in Data 

Collection Form and photographing building characteristics. 

d. Interview stakeholders (*) 

e. Tour critical internal areas (*) 

Post-field Activities a. Transfer data from the Field Version of the form to the long form, or the 

electronic data base (preferred format) 

b. Calculate the risk score for each of the building, using the Risk Scoring 

Worksheet (this process is automated when using the electronic database 

version of the Data Collection Form) 

c. Review ratings and make appropriate adjustments based on additional 

materials reviewed and interviews performed (*) 

d. Interpret scoring 

e. Identify buildings requiring further analysis 

f. Prepare a written report summarizing findings 

* Elements of a more refined screening that would increase the anticipated level of effort and duration of the 

assessment (see Table 4). 

COLLECTING AND RECORDING ASSESSMENT 

DATA 

he Data Collection Form has been developed to assist in gathering, 

recording, and scoring information on building features relevant to 

the risk assessment. Information gathered prior to and during the 

field visit to the building can be documented using the abbreviated Field 

Version of the Data Collection Form (Appendix B), which has been 

designed for use during the field visit to be later transferred to the long 

version of the form (Appendix A) or the electronic database version of the 

Data Collection Form ( discussed in detail in Appendix E). The first page 

of the Data Collection Form is intended to document basic building 

identification and target density information, and is to be filled in prior to 

the on-site evaluation. The next 8 pages of the form (long-form version 

containing scores for the various attribute options) identify information to 

T
12 PERFORMING A RAPID VISUAL SCREENING 

Table 4 Key Personnel and Relevant Building Documentation 

Key Personnel a. Building Owner

b. Building Manager 

c. Chief of Engineering 

d. Chief of Information Technology 

e. Emergency Manager 

f. Security Director 

g. Major tenant representatives 

h. Local law enforcement, fire and emergency medical services representatives 

i. State or county representatives 

j. Local utility, telecommunications and other service representatives 

k. Critical function representatives 

Relevant Building 

Documentation

a. Security assessments

b. Emergency response and disaster recovery plans 

c. Security inspection results 

d. Hazmat plans 

e. Policy and legal requirements 

f. Federal, state, and local law enforcement threat assessments 

g. Drawings for original design and any implemented modifications 

h. Historical reports 

i. Local zoning ordinances 

j. Information on the facility systems operations capability 

k. Information on agreements with the surrounding community and federal 

agencies 

l. Population statistics 

m. Manpower surveys 

n. Emergency notification 

o. Emergency evacuation 

p. First responder access and routing 

q. Shelter-in-place strategies 

r. Designated shelter capacities and travel routes 

s. Off-site rally point and roll call 

t. Emergency engineering systems shutdown 

u. Portable protective equipment 

v. Personal protective equipment 

w. Exercise of plans 

be gathered during the on-site or field evaluation, beginning with features 

visible from the exterior, transitioning to features observable in publicly 

accessible internal areas, and finally other internal areas that may only be 

accessible with permission or an escort (the 6-page abbreviated Field Version 

of the form identifies the same building characteristics and attribute options 

as the long form, but excludes the scores for each attribute option). 

When using the long-form version of the form, the Risk Scoring Worksheet 

(Appendix A) is used to determine risk ratings. 

When using the electronic database version of the Data Collection Form, the 

data from the Field Version of the form are transferred to the electronic 

version, where computation of the risk ratings is automated, eliminating the 

use of the Risk Scoring Worksheet. Every effort should be made to collect 
PERFORMING A RAPID VISUAL SCREENING 13 

and document the assessment information as completely and accurately as 

possible to obtain an accurate risk score. The two methods for obtaining risk 

scores are summarized in Table 5 

Table 5 Risk Scoring Methods 

Step Method 1 

(Hand Method) 

Method 2 

(Electronic Database) 

Pre-Field Fill in Page 1 of the Field Version of the Data Collection Form 

Field Complete pages 2-6 of the Field Version of the Data 

Collection Form 

Post-Field 

Transfer data to long version 

of the Data Collection Form Transfer data into the 

electronic database 

Complete Risk Scoring Sheet 

The data collection process is designed to collect and store information on 

each of seven building systems: general; site; architectural; building envelope; 

structural systems; mechanical, electrical and plumbing systems; and security 

systems (see Table 2). This grouping of systems has been distilled from the 13 

building systems contained in the FEMA 452 Vulnerability Checklist. The 

building characteristics identified for each building system cover the most 

dominant and visually observable factors governing the overall risk to a 

building given a terrorist attack. Additional information obtained from other 

sources may also be used to provide more refined scoring. The entire rapid 

visual screening procedure is designed with expert knowledge embedded into 

the scoring selected for each building attribute option so as to limit the 

information needed by the screener. 

Page 1 of the Data Collection Form is shown in Figure 1. Note that Page 1 

of the Data Collection Form is identical to Page 1 of the Field Version of 

the form. It provides space to document basic building information,

including name, address, year built, number of stories, total floor area, and 

other identifying information prior to the field visit. It also provides space 

to document target density information. Additional information may be 

attached to the form (or entered into the electronic database). Some 

useful publicly accessible websites for building information include: 

http://earth.google.com and www.emporis.com. It is important to 

ascertain and document the information identified on Page 1 of the form 

as completely as possible before visiting the facility to obtain an accurate 

scoring. Some of the information may be directly used to respond to 

specific building characteristics contained on other pages of the Data 
14 PERFORMING A RAPID VISUAL SCREENING 

Figure 1 Page 1 of Data Collection Form. 

Collection Form and some of the information on this page will enable the 

screener to make a more educated decision regarding the appropriate 

attribute option to select. All the information contained on this page of the 

Data Collection Form, should be verified in the field, if possible. 

Although the information on Page 1 of the Data Collection Form does not 

directly affect the risk rating, it is used for identification, interpretation, 

and validation of the scoring. It also provides initial information useful for 

higher level (Tier 2 or Tier 3) assessments. 

Pages 2 through 8 of the Data Collection Form (see Figure 2) address the 

three factors needed to determine the risk assessment score: consequences

rating (C), threat rating (T), and vulnerability rating (V). These portions of 

the Data Collection Form are completed by selecting the most appropriate 

response, or attribute option. When using the long-form version of the 

Data Collection Form (Figure 2 and Appendix A), the associated 

numerical value for each selected attribute option is transferred to each of 

the boxes on the right hand side of the form, which is not filled with gray; 

if an attribute is not relevant to determining the consequences, threat, or 

vulnerability rating for a particular threat scenario, the box is shaded, and 

no score is entered; in this way, the numerical values are assigned only to 

those threat scenarios that are affected by that building characteristic. 
PERFORMING A RAPID VISUAL SCREENING 15 

Space is provided at the bottom of the rating section for each factor 

(consequences, threat, and vulnerability) to summarize scores for 

characteristics that contribute to that rating factor for one or more threat 

scenarios. This information is then transferred to the Risk Scoring 

Worksheet (Appendix A) to compute risk ratings for the building, as 

described below. 

Note that the attribute scores have been omitted from the Field Version of 

the form for easy use during the field visit. Instead of scoring on the right 

hand side of the field version of the form, there is a “red flag” and a 

“comments” column. The red flag column may be checked for those items 

that require further follow-up research or verification. The comments 

Figure 2 Pages 2 through 9 of Data Collection Form. Full-sized versions of each page are provided in 

Appendix A. 
16 PERFORMING A RAPID VISUAL SCREENING 

column may be used to provide more detail regarding the building 

characteristic and/or the red flag issue that requires resolution. This 

handbook should be brought to the field as a reference guide. Of 

particular use in the field are the tables in the next three chapters, which 

provide useful information to help the screener select the most 

appropriate option. The information from these tables has also been 

included in the electronic version for use in post-field verification of 

selected options. 

The following chapters provide general guidance on how to determine the 

consequences rating, threat rating and vulnerability rating, respectively, 

using the Data Collection Form. Below is some general guidance for 

troubleshooting some overarching issues that may arise. 

SCORING WHEN A BUILDING 

CHARACTERISTIC IS UNKNOWN OR NOT 

APPLICABLE 

he correct application of the risk scoring procedure in rapid visual 

screening relies on accurate and thorough completion of the Data 

Collection Form. The risk scoring procedure uses results from 

pages 2 through 9 of the Data Collection Form (long-form version) to 

determine the overall risk rating for the building. Therefore, it is 

imperative that an attribute option be selected for each applicable building 

characteristic, and every attempt should be made to complete the form in 

its entirety. 

Lack of selection of an attribute option for one or more of the building 

characteristics can be interpreted as “unknown”, “not applicable”, “none”, 

or it may be that the issue or building characteristic has been skipped by 

mistake. The screening procedure has been designed to minimize these 

situations, but they will inevitably occur. Screeners should err on the side 

of recording too much information, making liberal use of any free space 

on the form and attaching extra sheets if necessary to document additional 

comments (and documenting this information in the electronic version, if 

used). 

Basic options for accounting for unknown information include: 

P Estimating the value based on a pre-defined correlation with other 

known information such as selecting the building envelope to be 

precast concrete based on the modular character of the exterior. 

P Making an educated guess based on engineering judgment. 

T 
PERFORMING A RAPID VISUAL SCREENING 17 

P Using a pre-determined default score, such as the average of the lowest 

and highest values assigned to that building characteristic. 

P Selecting the most common attribute for that building characteristic, 

based on knowledge of other similar buildings in the region. 

P Eliminating one or more building characteristics from consideration 

for all buildings in the study, such as for a study that only includes 

exterior observation (eliminating all building characteristics that may 

only be identified by internal inspection). 

The goal of this rapid visual screening procedure is to identify buildings as 

having either relatively high or relatively low levels of potential risk, and to 

identify those buildings that should undergo further study. The 

uncertainty inherent in the selection of an attribute option should not 

incorrectly identify buildings as having high or low risk just because the 

relevant information is not known. 

In the situation where two or more attribute options for a given building 

characteristic could be selected, the dominantly occurring attribute option 

should be used. In the case of two or more possible attribute options in 

which one is not clearly dominant, or an educated guess is not possible 

because the relevant information is not known, then the highest risk 

option (which corresponds to the largest numerical value) for the building 

characteristic under consideration should be selected. This approach may 

lead to a few buildings being incorrectly identified as high risk. The 

number of times a screener makes an assumption due to unknown 

information should be kept to a minimum. Particular care should be given 

to the option selected for building characteristics that are identified as 

being "heavily" weighted (see chapters on Threat and Vulnerability 

Assessment). For these building characteristics, guessing will significantly 

impact the risk scoring and will distort results. 

COMPLETING THE RISK SCORING 

WORKSHEET 

esults from the Data Collection Form are tabulated on the Risk 

Scoring Worksheet (Figure 3) to determine a single overall risk 

assessment score for the building, or to evaluate the risk 

contributed by each of the nine threat scenarios or three threat types (see 

Table 2). Note that the Risk Scoring Worksheet is located at the end of the 

Data Collection Form (Appendix A) 

Once the building characteristics have been recorded in the Data 

Collection Form, the risk factors are evaluated by summing the scores 

entered for each building characteristic contributing to Consequences (C), 

R
18 PERFORMING A RAPID VISUAL SCREENING 

Threat Rating (T), and Vulnerability Rating (V) for each of the nine threat 

scenarios, and entering the sums on the Risk Scoring Worksheet. The risk 

rating for each threat scenario is computed by multiplying the three 

factors C, T, and V for the given scenario. An overall total risk rating for 

the building encompassing all nine scenarios is determined by using an 

equation that considers the risk rating for each threat scenario and a 

scaling factor and power-summation formulation that controls the limit of 

the total risk rating. Details of this formulation are provided at the 

beginning of the chapter entitled, "Risk Assessment Rating." 

Use of the electronic database version of the procedure will permit 

seamless inputting of data during the on-site evaluation and automatic 

calculation of scoring. See Appendix E for more information. 

Figure 3 Risk Scoring Worksheet. 

USE OF SCREENING RESULTS 

ecause the procedure is quick and relatively simple to perform, it 

is designed to be performed routinely as part of the security 

operations of the building. It is recommended that as a baseline, 

a screening is performed during peak occupancy times, and that the 

procedure be used routinely during periods of high threat alert, when the 

facility or the facility type has been threatened. 

Results of the rapid visual screening process can be used for a wide variety 

of applications: (1) prioritization of buildings for further evaluation; (2) 

establishing building inventories that characterize a community’s risk to 

B
PERFORMING A RAPID VISUAL SCREENING 19 

terrorist attack; (3) developing emergency preparedness plans in the event 

of a high threat alert; (4) planning post-event mass evacuation, rescue, 

recovery and safety evaluation efforts; (5) prioritizing a community’s (or 

agency’s) mitigation needs; and (6) developing building-specific 

vulnerability information for purposes such as insurance rating and 

decision-making during building ownership transfers. 

The results can also be used on a building-specific basis as a prioritization 

tool for more detailed study, verification of results, and development of 

mitigation measures that will reduce the risk rating value to levels that are 

more acceptable to the building owner or other stakeholders. 

CONSEQUENCES ASSESSMENT 21 

 CONSEQUENCES ASSESSMENT 

OVERVIEW 

he basic definitions used to assess the Consequences associated with 

a terrorist attack are given in this chapter, along with detailed 

information and guidance on how to select the appropriate 

attribute options for each building characteristic related to Consequences. 

CONSEQUENCES 

he term “Consequences” refers to the criticality of the building 

in terms of the importance of the building operation to the 

owner and the locality. It can be applied to the entire building 

or significant portions of a very large building. Examples of 

important operations include emergency functions within a city, or 

core business functions of a corporation. The Consequence 

Assessment is intended to capture the impact of a terrorist event due to 

losses incurred as a result of building damages, casualties and business 

disruption. 

Consequence is a function of building characteristics that are primarily 

related to the use and occupancy of the building. To evaluate 

Consequences the following building characteristics need to be 

assessed: 

P Locality Type 

P Number of Occupants 

P Replacement Value 

P On Historic Registry 

P Business Continuity 

P Physical Loss Impact 

Information used to determine consequences typically comes from 

owner(s)/operator(s), governmental sources, those benefiting from 

the use of the facility, and publicly accessible information. Note that 

consequence is defined from the perspective of the building 

stakeholders, not the terrorists. 

Figure 4 shows the portion of the Data Collection Form used to 

evaluate the Consequences Rating 

T

T In the FEMA Risk 

Management Series, 

“Consequences” are 

defined as the results of a 

terrorist attack or other 

hazard that reflect the 

level, duration, and nature 

of the loss resulting from 

the incident. Consequences 

are divided into four main 

categories: public health 

and safety (i.e., loss of life 

and illness); economic 

(direct and indirect), 

psychological and 

governance/mission 

impacts. Consequences 

also include the degree of 

debilitating impact that 

would be caused by the 

incapacity or destruction of 

the asset. 

To put this into the context 

of other risk assessment 

methodologies, sometimes 

Consequences is referred to 

as “Asset Value.”
22 CONSEQUENCES ASSESSMENT 

Figure 4 Pages 2 and 3 of Data Collection Form, Consequences 
CONSEQUENCES ASSESSMENT 23 

CONDUCTING THE FIELD ASSESSMENT 

uring the field assessment of Consequences, the screener 

evaluates all building characteristics of interest for 

Consequences, as identified above. The abbreviated Data 

Collection Form (Field Version, as provided in Appendix B) is to be 

used to document (circle) the selected attribute option for each 

building characteristic; this information is later transferred to the long 

version of the form or the electronic database, where the risk scoring 

occurs automatically. When the long-form Data Collection Form 

containing scores is used, the score for the selected option is circled 

and inserted in the blank cell(s) to the right under one or more Threat 

Scenario columns (gray shading indicates that a score is not required); 

scores are then totaled at the bottom of the form and entered on the 

Risk Scoring Worksheet (Appendix A). 

Guidance and information to how to choose between attribute options 

for the building characteristics pertaining to Consequences are 

provided in Table 6. The information contained in this table is useful 

in the field to provide guidance. 

Table 6. Guidance on Consequences Assessment: 1. Consequences 

1 Consequences 

ID Building Characteristics Attribute Options 

1.1 Locality Type 

This attribute characterizes the general population density and 

land use in the area surrounding the building. The screener 

should determine the predominant locality type based on the 

descriptions provided to the right. 

When determining if a locality is Urban or Dense Urban, 

consider the time of day or year when the locality is at 

maximum capacity. For instance, for a business district in a city 

the highest population may occur during the morning rush hour 

when the population is best described as Dense Urban. In this 

situation, option e is to be selected rather than option d. 

Options: 

a Rural/Suburban – low ratio of inhabitants to open 

land or an outlying part of a city or town, typically 

single family residential area. 

b Semi-urban/Light Industrial – a small town or city 

with low population density or mixed use office park, 

warehouse and manufacturing. 

c Industrial – heavy manufacturing and warehouse with 

a lower population density than light industrial. 

d Urban – metropolitan area within a city or large town. 

e Dense Urban– a densely populated area within a 

major urban corridor or a major resort corridor where 

there are clusters of commercial buildings located on 

congested streets. In these situations there is a significant 

chance of collateral consequences to populations, on the 

streets and in adjacent buildings. 

D
24 CONSEQUENCES ASSESSMENT 

Table 6. Guidance on Consequences Assessment: 1. Consequences (continued) 

1 Consequences 

ID Building Characteristics Attribute Options 

1.2 Number of Occupants 

This building characteristic should have been filled in prior to the field 

visit on Page 1 of the Data Collection Form. 

There are three sets of attribute options corresponding to ‘low’, 

‘moderate or ‘high’ population levels as defined to the right. In total, 

there are 15 attribute options for this building characteristic. 

The time of peak occupancy should be considered when selecting an 

appropriate attribute option. Only the persons inside the building are 

to be considered for this building attribute. The population outside the 

building is captured in building characteristic 2.3 (Site Population). 

Also, note that this building characteristic is identical to the building 

characteristic 2.2 in the Threat Rating section because it is a factor in 

the threat attractiveness of the building. 

Some examples of load ratios for various types of buildings are given 

in the table to the right. Several examples of buildings with different 

populations are provided below. 

Low: option (a) 150 occupants 

 Moderate: option (b) 2,500 occupants 

Options: 

Low 

a Less than 200 

b More than or equal to 200, less than 400 

c More than or equal to 400, less than 600 

d More than or equal to 600, less than 800 

e More than or equal to 800, less than 1,000 

Moderate 

a More than or equal to 1,000, less than 2,000 

b More than or equal to 2,000, less than 4,000 

c More than or equal to 4,000, less than 6,000 

d More than or equal to 6,000, less than 8,000 

e More than or equal to 8,000, less than 10,000 

High

a More than or equal to 10,000, less than 20,000 

b More than or equal to 20,000, less than 40,000 

c More than or equal to 40,000, less than 60,000 

d More than or equal to 60,000, less than 80,000 

e More than or equal to 80,000 

NOTE: THIS BUILDING CHARACTERISTIC IS HEAVILY 

WEIGHTED IN THE SCORING. A MINOR CHANGE IN 

THE CHOICE OF ATTRIBUTE OPTION SELECTED MAY 

CAUSE A DISPROPORTIONATELY LARGE CHANGE IN 

THE FINAL RISK SCORE.

General Use Occupancy Load Ratio 

Assembly 1 person per 10 sf (square feet) of floor area or 

seating area 

Commercial Occupancy load varies; use 1 person per 50 to 

200 sf. 

Emergency 

Services 

Occupancy load is typically 1 person per 100 sf.

Government Occupancy load varies; use 1 person per 100 to 

200 sf. 

Industrial Occupancy load is typically 1 person per 200 sf 

except warehouse which is 1 person per 500 sf. 

Office Occupancy load varies; use 1 person per 100 to 

200 sf 

Residential Occupancy load varies; use 1 person per 300 sf 

of floor area in dwellings, 1 person per 200 sf of 

floor area in multi-unit, except 1 person per 100 

sf for dormitories. 

Educational Occupancy load varies; use 1 person per 50 to 

100 sf. 
CONSEQUENCES ASSESSMENT 25 

Table 6. Guidance on Consequences Assessment: 1. Consequences (continued) 

1 Consequences 

ID Building Characteristics Attribute Options 

1.2 

(contd) 

High: option (b) 20,000 occupants 

Photograph courtesy of J. Crocker. 

1.3 Replacement Value 

There are three sets of attribute options for this building 

characteristic depending on whether the replacement cost is ‘low’, 

‘moderate’ or ‘high’ as defined to the right. In total there are 15 

attribute options for this building characteristic. 

The replacement value of a facility is a function of the current 

market cost of construction times the gross square footage of the 

building. It refers to the replacement value of the building 

including the tenant improvements and its contents. 

The replacement value of a building will vary by the construction 

costs within a region, the community type such as downtown urban 

or outside of the urban core, building size given that a large 

building may be less expensive to build per square foot than a 

small building, and the use of the building considering premiums 

paid for tenant improvements such as finishes (e.g., 4-star vs. 2-

star hotel) and infrastructure (e.g., data center versus commercial 

office). 

Options: 

Low 

a Less than $20 million (M) 

b More than or equal to $20M, less than $40M 

c More than or equal to $40M, less than $60M 

d More than or equal to $60M, less than $80M 

e More than or equal to $80M, less than $100M 

Moderate 

a More than or equal to $100M, less than $200M 

b More than or equal to $200M, less than $400M 

c More than or equal to $400M, less than $600M 

d More than or equal to $600M, less than $800M 

e More than or equal to $800M, less than $1Billion

High

a More than $1Billion (B) or equal to, less than $2B 

b More than $2B or equal to, less than $4B 

c More than $4B or equal to, less than $6B 

d More than $6B or equal to, less than $8B 

e More than or equal to $8B 
26 CONSEQUENCES ASSESSMENT 

Table 6. Guidance on Consequences Assessment: 1. Consequences (continued) 

1 Consequences 

ID Building Characteristics Attribute Options 

1.3 

(contd)

A space has been provided for replacement value information on 

Page 1 of the Data Collection Form, which should be filled out before 

the field visit. Information is to be obtained directly from a 

knowledgeable site representative. If this is not possible, it can be 

estimated based on the approximate costs per square foot given in 

HAZUS-MH MR-3 Technical Manual for the Flood Model (FEMA, 

2007), RS Means, recent purchase or construction cost or other 

source. 

For situations where the building contains invaluable or irreplaceable 

contents, such as is found in art museums or in a rare book library, 

then the insurance coverage limits may be used to provide an 

estimate. 

NOTE: THIS BUILDING CHARACTERISTIC IS HEAVILY 

WEIGHTED IN THE SCORING. A MINOR CHANGE 

IN THE CHOICE OF ATTRIBUTE OPTION SELECTED 

MAY CAUSE A DISPROPORTIONATELY LARGE 

CHANGE IN THE FINAL RISK SCORE. 

 Example Cost Ranges 

Primary Building Function Range of Cost

(per sq.ft.) 

Commercial Office $135 to $220

Light Industrial $40 - $100

Research $200 - $225

Emergency Services $150 - $200

Governmental Facilities $230 - $300

Hospitality $120 – $180

Information and 

Telecommunications 

$400 – $750

Museum/Library $250 - $300

Hospital $220 - $300

Medical Office/Clinic $150 - $200

Residential $250 – $450

Educational $100 – $200

1.4 On Historic Registry 

This attribute characterizes whether or not the subject property is on 

the national, state, local or non-governmental historic registry. 

The screener should determine whether the building is on a historic 

registry. Otherwise, it is recommended that the screener perform an 

internet search. For buildings listed on the National Register consult 

www.nationalregisterofhistoriplaces.com. Individual states, local 

jurisdictions, and non-governmental organizations may also have 

listings of historically significant buildings within the locality. 

Sometimes there is a plaque outside the building indicating its status 

as an historic property. 

An example of an historic building in Cleveland, Ohio is the Society 

Bank which was the first skyscraper in Cleveland. 

This building characteristic has been included on Page 1 of the Data 

Collection Form and should be evaluated prior to the field visit. 

Options: 

No 

Yes 

Example of option: Yes 

Photograph courtesy of Westlake Reed Leskosky 

Architects.
CONSEQUENCES ASSESSMENT 27 

Table 6. Guidance on Consequences Assessment: 1. Consequences (continued) 

1 Consequences 

ID Building Characteristics Attribute Options 

1.5 Business Continuity 

Business Continuity refers to the degree to which an organization 

may achieve uninterrupted stability of operations. It is aimed at 

allowing an organization to continue functioning after (and ideally, 

during) a disaster, rather than simply being able to recover after a 

disaster. In terms of redundancy, it is measured in terms of how 

easily operations can be replaced, be returned to service, or 

replicated at another location. Included in this are human factors 

such as the confidence needed for people to return to that building 

or continue their relationship with that business into the future. 

The term ‘stability of operations’ is a function of the primary use of 

the building. For instance, if it is an apartment building, the 

‘stability of operations’ refers to the ability of people to be able to 

maintain their pre-event quality of life. If the building is a museum, 

the ‘stability of operations’ is dependent on the contents remaining 

intact and in an environment that is safe and secure. 

Some business sectors and local governments require business 

continuity plans in place to ensure operations are maintained during 

a disaster. There are also associations that provide best practice 

recommendations. The screener is recommended to become familiar 

with the regulatory requirements governing various businesses, 

sectors and governmental entities to be able to better judge what 

level of continuity a building may be able to achieve. Security 

representatives or local law enforcement are recommended as good 

sources for this type of information for a given building. 

Below are some open source information sources regarding business 

continuity: 

Financial Services Information Sharing and Analysis Center 

(http://www.fsisac.com/) 

Information Technology Information Sharing and Analysis Center 

(https://www.it-isac.org/) 

Information Sharing and Analysis Center Council 

(http://www.isaccouncil.org/about/) 

Food and Agriculture Information Sharing and Analysis Center 

(http://www.fmi.org/isac/) 

Options 

a Very High: The building is fully able to 

maintain functions during and after an attack, 

with completely redundant back-ups available 

off-site. There would be almost no interruption 

of service or function provided by the building 

if it were attacked. 

b High: The building has a high capability to 

maintain functions during or after an attack, 

with most back-ups available off-site. There 

would be minor interruption of service or 

function provided by the building if it were 

attacked. 

c Moderate: The building has a moderate 

capability to maintain functions during or after 

an attack, with some back-ups available off-site. 

There would be moderate interruption of service 

or function provided by the building if it were 

attacked. 

 d Low: The building has a low level of 

capability to maintain functions during or after 

an attack. There would be significant 

interruption of service or function provided by 

the building if it were attacked. 

e Very Low: The building has little or no 

capability to maintain functions during or after 

an attack. There would be devastating impact 

and complete loss of service or function 

provided by the building if it were attacked. 
28 CONSEQUENCES ASSESSMENT 

Table 6. Guidance on Consequences Assessment: 1. Consequences (continued) 

1 Consequences 

ID Building Characteristics Attribute Options 

1.5 

(contd)

Open source information affecting the business continuity of various 

sectors may found on the web site for the Department of Homeland 

Security: 

(http://www.dhs.gov/xinfoshare/programs/Copy_of_press_releas

e_0046.shtm) 

Homeland Security Threat Advisories contain actionable information 

about an incident involving, or a threat targeting, critical national 

networks or infrastructures or key assets. They could, for example, 

relay newly developed procedures that, when implemented, would 

significantly improve security or protection. They could also suggest 

a change in readiness posture, protective actions, or response. This 

category includes products formerly named alerts, advisories, and 

sector notifications. Advisories are targeted to Federal, state, and 

local governments, private sector organizations and international 

partners. 

Homeland Security Information Bulletins communicate information 

of interest to the nation's critical infrastructures that do not meet 

the timeliness, specificity, or significance thresholds of warning 

messages. 

Such information may include statistical reports, periodic 

summaries, incident response or reporting guidelines, common 

vulnerabilities and patches, and configuration standards or tools. It 

also may include preliminary requests for information. Bulletins are 

targeted to Federal, state, and local governments, private sector 

organizations, and international partners. 

A color-coded Threat Level System is used to communicate with 

public safety officials and the public at-large through a threatbased, color-coded system so that protective measures can be 

implemented to reduce the likelihood or impact of an attack. 

Raising the threat condition has economic, physical, and 

psychological effects on the nation; so, the Homeland Security 

Advisory System can place specific geographic regions or industry 

sectors on a higher alert status than other regions or industries, 

based on specific threat information. 

The DHS Daily Open Source Infrastructure Report (Daily Report) is 

collected each week day as a summary of open-source published 

information concerning significant critical infrastructure issues. Each 

Daily Report is divided by the critical infrastructure sectors and key 

assets defined in the National Strategy for the Physical Protection of 

Critical Infrastructures and Key Assets. 

(http://www.dhs.gov/xinfoshare/programs/editorial_0542.shtm). 
CONSEQUENCES ASSESSMENT 29 

Table 6. Guidance on Consequences Assessment: 1. Consequences (continued) 

1 Consequences 

ID Building Characteristics Attribute Options 

1.6 Physical Loss Impact 

This building characteristic is intended to capture the human and 

direct economic consequences in the event of a terrorist attack. 

Human consequences refer to loss of life and the extent and 

severity of injuries incurred. It also refers to the impact on public 

confidence. Direct economic consequences refer to the loss of 

functionality of that building for some period of time. This could be 

due to the lost income to people working there, lost revenues for 

businesses, or the costs required to regain a level of functionality 

for that building to pre-event levels. 

Each attribute option defines the geographic limits of the economic 

impact of a terrorist event, ranging from the local community 

through the global or international community. For instance, the 

loss of a federal building outside of Washington DC may have an 

impact that extends regionally, whereas, the loss of a multinational corporate headquarters may have international 

implications. 

Note that this building characteristic is independent of the 

population within the building. For instance, if the people within 

the building are largely from the international community, it does 

not mean that attribute option e (i.e., international) applies. 

Options: 

a Local. An impact locally is expected if an 

attack on this building were to occur. 

b Statewide. An impact throughout the state is 

expected if an attack on this building were to 

occur. 

c Regional. An impact to the region is 

expected if an attack on this building were to 

occur. 

d National. An impact to the nation is 

expected if an attack on this building were to 

occur. 

e International. An impact internationally is 

expected if an attack on this building occurs. 

NOTE: THIS BUILDING CHARACTERISTIC IS 

HEAVILY WEIGHTED IN THE SCORING. A MINOR 

CHANGE IN THE CHOICE OF ATTRIBUTE OPTION 

SELECTED MAY CAUSE A DISPROPORTIONATELY 

LARGE CHANGE IN THE FINAL RISK SCORE.

. 

THREAT ASSESSMENT 31 

 THREAT ASSESSMENT 

OVERVIEW 

he basic definitions used to assess the Threat associated with a 

terrorist attack are given in this chapter, along with detailed 

information and guidance on how to select the appropriate 

attribute options for each building characteristic related to Threat 

Rating. 

THREAT RATING 

he Threat Rating represents the relative likelihood that terrorists 

will attack the building with a given weapon and means of 

delivery. Information used to determine the Threat Rating 

typically comes from law enforcement and intelligence communities 

familiar with credible threats. 

Threat rating is a function of the following building characteristics: 

P Occupancy Use 

P Number of Occupants 

P Site Population Density 

P Visibility/Symbolic Value 

P Target Density 

P Overall Site Accessibility 

P Target Potential 

The Threat Rating is based on a defined set of threat types and 

scenarios executed within a certain distance from the targeted 

building(s). These basic concepts are discussed in the sections below. 

Although the building characteristics used for the Threat Rating are 

nearly identical to those used for Consequences, the screener should 

keep in mind that the Threat Rating is from the terrorist perspective, 

whereas the Consequence rating is from the owner/operator 

perspective. 

Page 4 of the Data Collection Form (Figure 5) is used to determine 

Threat Ratings for each of the nine threat scenarios, as a function of 

the subset of building characteristics and attribute options that pertain 

to the given threat. This organization has the advantage of enabling 

T

T

Threat is defined as any 

indication, circumstance 

or event with the 

potential to cause loss 

of, or damage to an 

asset.
32 THREAT ASSESSMENT 

this screening procedure to be easily expanded as additional threats 

are identified. 

THREAT TYPES 

errorist threats that have the ability to cause catastrophic losses 

in terms of damages, casualties and business interruption are 

considered in this rapid visual screening procedure. Specifically, 

the following three generic threat types are considered: 

P Internal Attack. Intrusion into the building by a person or persons 

with the intent of executing an attack by means of an explosive, 

chemical, biological or radiological (CBR) release or other attack 

type. An internal attack could also refer to the introduction of a 

weapon or hazard into the building from the exterior. Examples of 

this include introduction through openings in the building 

exterior such as a door, window, utility line or air intake. 

Alternatively, it may be delivered into the building by mail. 

P External Explosive Attack. A vehicle weapon (e.g., car bomb, VBIED). 

P External Chemical, Biological, Radiological (CBR) Release. An exterior 

ground release of an airborne chemical, biological, or radiological 

agent. Radiological agent does not refer to a nuclear weapon. It 

refers to a “dirty bomb” or a radiological dispersal device 

combining a conventional explosive, such as dynamite, with 

radioactive materials. 

ZONE DEFINITIONS 

or commercial office or other standard-use buildings, it is likely 

that the building under consideration is not the target of attack, 

but is close to one or more high-profile targets. In this case, the 

building will be subject to collateral effects, which will vary in severity 

depending on the proximity to the target and the magnitude of the 

threat. 

This rapid visual screening procedure has been designed to address 

both target and non-target buildings; however, it should not be used if 

the building is a one-of-a-kind iconic building, such as the White House 

or Pentagon. In these cases, the building would have a significantly 

greater likelihood of attack, and a higher level risk assessment 

procedure, such as is found in FEMA 452, should be used to evaluate 

the risk. 

T

F
THREAT ASSESSMENT 33 

Figure 5 Page 4 of Data Collection Form, Threats. 

For Internal threats, the subject building is, by definition, the target 

building. Exterior threats may or may not be targeting the building. 

To make this distinction, three external zones are defined as shown in 

Figure 6. 

Zone 1 refers to an attack occurring at a target less than 100 feet from 

the exterior envelope of the building under consideration; Zone 2 

refers to an attack occurring at a target at least 100 feet and less than 

300 feet from the subject building; and Zone 3 refers to an attack 

occurring at a target at least 300 feet but not more than 1000 feet from 

the subject building. 

The Zone 1 distances are based on the distances required to cause 

catastrophic effects in terms of casualties, damages, and business 

interruption. Zone 2 distances are based on the distances required to 

cause a moderate hazard level and Zone 3 corresponds to a minor 

hazard level. 
34 THREAT ASSESSMENT 

Figure 6 Zone Definitions. 

THREAT SCENARIOS 

o address both targeted and non-targeted buildings, nine 

distinct threat scenarios across three threat types are considered 

in this procedure, as summarized in Table 7. 

Table 7. Threat Scenarios and Threat Types 

Threat scenarios 1 through 3 comprise the Internal threat, scenarios 4 

through 6 comprise the External Explosive threat, and scenarios 7 

through 9 comprise the External CBR threat. The final risk score 

reports risk ratings as a single overall risk assessment score 

encompassing all nine scenarios, and for individual scenarios or threat 

types. 

T

Threat Scenario Threat Type

1. Internal Explosive Attack 

2. Internal CBR Release 

3. Other Internal Attack 

Internal Attack

4. External Zone I Explosive Attack

5. External Zone II Explosive Attack 

6. External Zone III Explosive Attack 

External Explosive Attack 

7. External Zone I CBR Release

8. External Zone II CBR Release 

9. External Zone III CBR Release 

External Chemical, Biological, Radiological (CBR) 

Release 

Not to be confused with 

FEMA 452 layers of defense, 

Zones are areas around the 

building under consideration, 

defined by the distances 

shown in Figure 6. Zones are 

used to inventory the number 

and location of potential 

targets in the vicinity of the 

subject building to define 

Target Density.
THREAT ASSESSMENT 35 

CONDUCTING THE FIELD ASSESSMENT 

s before, the Field Version is used to document (circle) the 

selected attribute option for each building characteristic that 

affects Threat Rating; this information is later transferred to 

the electronic database, where the risk scoring occurs automatically, or 

to the long form. When the long-form Data Collection Form 

containing scores is used, the score for the selected option is circled 

and inserted in the blank cell(s) to the right under one or more Threat 

Scenario columns; scores are then totaled at the bottom of the form 

and entered on the Risk Scoring Worksheet. 

Guidance and information to how to choose between attribute options 

for the building characteristics pertaining to Threat Rating are 

provided in Table 8. This table is a useful tool to be used in the field to 

accurately evaluate the appropriate attribute option. 

Table 8. Guidance on Threat Assessment: 2. Threat 

2 Threat 

ID Building Characteristics Attribute Options 

2.1 Occupancy Use 

This building characteristic is included on Page 1 of the Data 

Collection Form and it is recommended that it is researched 

prior to the field visit. In the field the use of the building 

may be verified by reviewing the directory in the lobby, 

speaking with a site representative, or from law enforcement 

familiar with the property. 

Examples of occupancy types within each group are given to 

the right. Because this procedure focuses on building 

structures, the examples are only for buildings in these 

categories. Note also that examples of occupancy types 

within these groups are arranged alphabetically. 

Based on historical data from past terrorist attacks (ref.: 

National Consortium for the Study of Terrorism and 

Responses to Terrorism, Global Terrorism Database 

(http://209.232.239.37/gtd2/Default.aspx), different 

occupancies have varying degrees of target attractiveness. 

For the purpose of determining the Threat Rating, this rapid 

visual screening procedure considers three occupancy groups, 

listed in order of increasing contribution to risk. 

Options (with examples of occupancy types) 

a Occupancy – Group I 

• Agricultural - processing plants for meat, dairy 

or grain type foods (also see Group III). 

• Chemical – chemical processing plant buildings, 

petrochemical manufacturing, hazardous 

chemical transport (pipelines, pumping stations, 

control centers, tankers, freight rail, chemical 

warehousing and storage). 

• Critical Manufacturing – iron and steel mills, 

power transmission equipment, electrical 

equipment, transportation equipment. 

• Dams – maintenance and operation buildings. 

• Defense Industrial Base - buildings clearly 

marked with the name of a major defense 

contractor, manufacturing plants associated with 

the production of military munitions, aircraft, 

space industry, combat vehicles, troop support or 

other product used by the military. 

• Drinking Water and Treatment Systems - 

waste treatment facility buildings, maintenance 

and operations buildings. 

A
36 THREAT ASSESSMENT 

Table 8. Guidance on Threat Assessment: 2. Threat (continued) 

2 Threat 

ID Building Characteristics Attribute Options 

2.1 

(contd)

The group definitions provided are based on the target 

attractiveness of the critical infrastructure sectors 

defined by the Department of Homeland Security. An 

abbreviated version of this taxonomy is provided in 

Appendix D (ref.: Infrastructure Taxonomy, Version 2, 

Risk Management Division Office of Infrastructure 

Protection, Department of Homeland Security, 

November 1, 2006). The groups are arranged in order 

of increasing target attractiveness. The electronic 

database version of this procedure allows the screener to 

identify the use by means of pull down menus to define 

not only the sector, but also sub-sectors of critical 

infrastructure. Note that the sectors may shift as the 

terrorist threat evolves or may vary in specific 

geographic regions. 

For a multi-use building, the highest risk occupancy 

should be selected, but in some cases using judgment 

may be more appropriate. For instance, if there is an 

automatic teller machine in the lobby of a multi-tenant 

office building, banking and finance would not 

necessarily be the appropriate occupancy group (unless 

the tenant base was dominantly in the banking and 

finance sector). 

• Information Technology - data centers, 

microprocessor manufacturing facility, high-technology 

corporate office buildings. 

• Postal and Shipping - post offices, shipping 

processing plants. 

b Occupancy – Group II 

• Commercial Nuclear Reactors/Materials - 

processing plant buildings for nuclear materials and 

waste; research laboratories using nuclear materials.

• Energy - power plant buildings, petroleum refinery 

buildings, maintenance and operation buildings.

• National Monuments/Icons – Federally owned 

buildings that are significant to the national identity of 

Americans, e.g., Liberty Bell Center.

• Public Health and Healthcare - hospitals, 

medical centers, clinics, medical research 

laboratories, and pharmaceutical facilities, medical 

educational facilities.

• Telecommunications - telephone switching centers, 

telephone or internet related firm office facilities.

c Occupancy – Group III 

• Agricultural/Food - restaurants, bars, nightclubs, 

supermarkets, convenience stores, gourmet food shops 

(also see Group I). 

• Banking and Finance - clearly marked or 

commonly recognized office building for a 

commercial bank, investment bank, insurance 

company, board of trade, mercantile exchange, stock 

exchange, or federal reserve building. Note that a 

store front bank branch or automated teller machine(s) 

is a low-risk example that falls within this group. 

• Commercial – A broad range of building types fall 

under this category. Some are listed below. 

− Community Organization Facilities – social 

advocacy, civic and social organization facilities. 

− Entertainment and Media Facilities – broadcasting 

(cable, radio, television), internet publishing, 

motion picture, sound recording, newspaper, 

magazine, publishing. 

− Gambling Facilities/Casinos (Resorts) – horse and 

dog racetracks, land-based casinos. 

− Industrial Assets – heavy manufacturing, 

operations and maintenance facilities, assembly 

plants, factory buildings. 

− Lodging Facilities – hotels, motels. 
THREAT ASSESSMENT 37 

Table 8. Guidance on Threat Assessment: 2. Threat (continued) 

2 Threat 

ID Building Characteristics Attribute Options 

2.1 

(contd)

− Industrial – heavy manufacturing, operations and 

maintenance facilities, assembly plants, factory buildings. 

− Museum/Library – buildings of great historical value due 

to contents. 

− Office – office buildings typically housing clerical and 

management functions. 

− Public Assembly/Sports Leagues Facilities – convention 

centers, movie theaters, museums, performing arts centers 

and auditoriums, arenas. 

− Recreational – gymnasiums, amusement arcades, 

bowling alleys, indoor swimming pools, indoor tennis 

courts, pool and billiard parlors. 

− Religious – places of worship, buildings housing religious 

objects or functions. 

− Residential – houses, townhouses, apartment complexes, 

multi-family dwellings. condominiums, dormitories, single 

family homes. 

− Retail – shopping centers, department stores. 

• Educational – pre-kindergarten, licensed day care facilities, 

K-12 schools, higher education facilities, specialized 

education facilities. 

• Emergency Services - police stations, emergency 

operations or control centers, fire command stations, 

armories.

• Government - federal, state, county or city buildings 

including city halls, state capital buildings, federal office 

buildings, courthouses, or governmental service agency 

center.

• Military – army, navy, marine corps, air force and coast 

guard bases. National guard facilities, joint and combined 

military installations and reservations. 

• Transportation Systems – port, airport, and light rail 

terminals; rapid transit stations.

2.2 Number of Occupants 

(See 1.2). 

Options 

Use same option as was used for Building Characteristic 1.2. 

When using the electronic database version of the procedure, this 

building characteristic is automatically filled in using the same 

option as was used in 1.2. 

NOTE: THIS BUILDING CHARACTERISTIC IS HEAVILY WEIGHTED IN 

THE SCORING. A MINOR CHANGE IN THE CHOICE OF ATTRIBUTE 

OPTION SELECTED MAY CAUSE A DISPROPORTIONATELY LARGE 

CHANGE IN THE FINAL RISK SCORE.
38 THREAT ASSESSMENT 

Table 8. Guidance on Threat Assessment: 2. Threat (continued) 

2 Threat 

ID Building Characteristics Attribute Options 

2.3 Site Population Density 

Refers to the population that are not in the building, but are 

nearby on the sidewalk, in vehicles, in adjacent or nearby buildings 

and below ground, for example, in pedestrian tunnels, or subway 

train stations. The time of peak population density is to be 

considered, for instance, during rush hour, or during an event 

when there is a public gathering. 

Options: 

a Very Low (1 person per 10,000 sq. ft.) 

b Low (1 person per 1,000 sq. ft.) 

c Moderate (1 person per 400 sq. ft.) 

d High (1 person per 40 sq. ft.) 

e Very High (1 person per 10 sq. ft.) 

NOTE: THIS BUILDING CHARACTERISTIC IS HEAVILY 

WEIGHTED IN THE SCORING. A MINOR CHANGE IN 

THE CHOICE OF ATTRIBUTE OPTION SELECTED MAY 

CAUSE A DISPROPORTIONATELY LARGE CHANGE IN 

THE FINAL RISK SCORE.

2.4 Visibility/Symbolic 

Example of Very Low Option (a): Hallidie Building, San 

Francisco, 1906: first true glass curtain wall building in the U.S. 

Example of Low Option ( b): Flatiron Building, New York City, 

1903, on triangular site, a very significant early skyscraper; many 

similar buildings exist in other cities. 

Options: 

a Very Low - The facility is unrecognizable to 

locals. Its significance can be recognized by 

experts only. No information is available to the 

general public. It has no media value or 

symbolism to the general public. 

b Low - The facility is recognizable but can be 

confused with other similar facilities. Insider 

information is required. The facility is rarely 

featured in the mass media at any level. 

c Moderate - The facility is easily recognizable 

around the state and somewhat regionally. The 

facility has media value and events at the site 

that are televised regionally and sometimes 

nationally. 

d High - The facility is recognizable to state and 

local residents. The facility is featured in the 

mass media on a regional and sometimes on a 

national level. Some events at the facility are 

televised internationally. 

e Very High - The facility is easily 

recognizable, and is featured in the mass 

media internationally. Its media value 

guarantees its recognition and events at the site 

are almost always televised nationally and 

internationally. 

NOTE: THIS BUILDING CHARACTERISTIC IS HEAVILY 

WEIGHTED IN THE SCORING. A MINOR CHANGE IN 

THE CHOICE OF ATTRIBUTE OPTION SELECTED MAY 

CAUSE A DISPROPORTIONATELY LARGE CHANGE IN 

THE FINAL RISK SCORE.
THREAT ASSESSMENT 39 

Table 8. Guidance on Threat Assessment: 2. Threat (continued) 

2 Threat 

ID Building Characteristics Attribute Options 

2.4 

(contd)

Example of Low Option (b): World Market Center in Las Vegas is recognizable to locals and 

interior designers who go to events there, but it is away from the main tourist area and is not 

well recognized by the general public. Photograph by Paulette Nelson, July 2005.

Example of Moderate Option (c): Hirshhorn Museum in Washington DC is well known in 

the local region with occasional national exposure. Photograph by Charles Phillips,1995. 

Example of High Option (d): Transamerica Pyramid, San Francisco, is generally recognized 

nationally as a symbol of San Francisco. 

Example of High Option (d): Mandalay Bay Casino and Hotel in Las Vegas; this hotel is 

shown in the opening sequence of a television show that is popular internationally. Photograph 

courtesy of Mandalay Bay Casino and Hotel. 
40 THREAT ASSESSMENT 

Table 8. Guidance on Threat Assessment: 2. Threat (continued) 

2 Threat 

ID Building Characteristics Attribute Options 

2.4 

(contd)

Example of Very High Option (e): The Empire State 

Building is recognized nationally and internationally as symbol 

of USA. Photograph courtesy of www.empire.state.ny.us. 

2.5 Target Density 

Target density is defined as the number of high-value targets

within a certain distance of the building under consideration. 

This information is included on Page 1 for pre-field 

assessment. 

Potential targets are grouped into Zones 1, 2, or 3, depending 

on their distance from the exterior face of the building. The 

number of targets within these zones is referred to as the 

target density. Note that this building characteristic refers to 

the facilities around it, not the building itself. 

It is important to do the research for this building characteristic 

before visiting the building. The quality of the risk score is a 

function of the quality of input that goes into the scoring. 

Sources of information include the internet (e.g., Googlearth) 

or the local building department. When performing the site 

visit, it is also valuable to take the time to walk around the 

area and gather additional information that is not accessible 

through other methods. 

Note that the definition of a target refers to a structure that is 

commonly known or recognized within the community or 

clearly marked as a facility that is considered significant to the 

economy, health or welfare of the community. This may be a 

building structure or other type of structure such as a bridge or 

dam. A list of the Critical Infrastructure and Key Resources 

sectors defined by the Department of Homeland Security is 

provided as a reference tool for evaluating target density 

(ref.: National Infrastructure Protection Plan, DHS, 2006). 

Sub-sectors within each category should also be reviewed as a 

part of the research for this characteristic and have been 

included within the pull down menu of the electronic version of 

the procedure.

Options: 

Zone 1- less than 100 ft 

Zone 2 – equal to or more than 100 ft 

 less than 300 ft 

Zone 3 – more than or equal to 300 ft 

 less than or equal to 1000 ft 

NOTE: THIS BUILDING CHARACTERISTIC IS HEAVILY 

WEIGHTED IN THE SCORING. A MINOR CHANGE IN 

THE CHOICE OF ATTRIBUTE OPTION SELECTED MAY 

CAUSE A DISPROPORTIONATELY LARGE CHANGE IN 

THE FINAL RISK SCORE.

Critical Infrastructure and Key Resources Sectors:

1. Agricultural/Food 

2. Banking and Finance 

3. Chemical 

4. Commercial 

5. Critical Manufacturing 

6. Dams 

7. Defense Industrial Base 

8. Emergency Services 

9. Energy 

10. Government Facilities 

11. Information Technology 

12. National Monuments/Icons 

13. Nuclear 

14. Postal and Shipping 

15. Public Health and Healthcare 

16. Telecommunications 

17. Transportation Systems 

18. Water Supply 

(See building characteristic 2.1 for building 

examples)
THREAT ASSESSMENT 41 

Table 8. Guidance on Threat Assessment: 2. Threat (continued) 

2 Threat 

ID Building Characteristics Attribute Options 

2.6 Overall Site Accessibility 

Site access provides a general assessment of the physical and 

operational security measures in place. It refers to the ability of the 

terrorist to become well-positioned to successfully execute a major 

attack against the building under consideration. It is a function of the 

site, the building layout, and the security measures in place. 

Site in this context refers to everything that is outside the building, but 

is on the property. In the case of urban environments, it also includes 

the sidewalk. Site access by pedestrians and vehicles are both to be 

considered. Landscaping features, parking restrictions, street 

configuration, sidewalk width as well as perimeter security are all 

factors to include in this evaluation. 

This is a general access of the accessibility of the site taking into 

consideration the overall effectiveness of the design features of the site 

to deter, delay or otherwise facilitate the execution of a terrorist 

attack. 

Example Inaccessible Option (a): water feature and steps as 

effective barrier to vehicles. Photograph by Frank Ooms, NBBJ 

Architects. 

Example Accessible Option (b): easy access to building security 

office.

Options: 

a Inaccessible

b Accessible
42 THREAT ASSESSMENT 

Table 8. Guidance on Threat Assessment: 2. Threat (continued) 

2 Threat 

ID Building Characteristics Attribute Options 

2.7 Target Potential 

This building characteristic addresses the likelihood of a terrorist 

attack occurring at the Facility under consideration or for the Facility 

Type represented in the context of the 18 critical infrastructure 

categories (see list of sectors for building characteristic 2.5 and the 

examples shown for building characteristic 2.1). 

Facility refers to the campus, compound, base, installation, etc. on 

the same property where the building under consideration is 

located. 

Facility Type refers to the Critical Infrastructure and Key Resources 

(CI/KR) sector corresponding to the primary type of business that is 

conducted within the building. For instance, if the facility is occupied 

primarily by tenants who are in the banking industry, then the 

Facility Type is “Bank”. If, based on open source material, the 

Facility Type is currently, or has in the past been, targeted within 

the continental United States, then the attribute option is YES. For 

instance, if the Facility Type is “Bank”, and Banking/Finance, 

Government and Commercial HAVE been targeted, then the option 

selected would be YES. 

This building characteristic is partially based on available factual 

information. However, in many cases judgment is required. It has 

been included on Page 1 for pre-field assessment. 

Information is most reliably obtained from a senior security 

representative for the building. Other sources include law 

enforcement officials in the area, newspapers and internet searches. 

The Target (threat) potential may change rapidly based on new 

information that becomes available. The screener is to base their 

response on the best available information at the time the screening 

is conducted. Target Potential refers to past AND present potential. 

The screener is to attach detailed information to the form explaining 

the reasoning behind the selection of YES or NO. 

Note that the area or district within the vicinity of the facility is NOT 

to be considered for this building characteristic. This concept is 

addressed under Target Density. 

Options: 

2.7.1 Facility 

 a No 

 b Yes 

Yes or No for the Facility is based on a credible 

threat to a subunit within the facility. For 

example, if a major tenant in the building under 

consideration has been targeted, then the facility 

has been targeted (i.e., the attribute option is 

Yes). Similarly, if a building within a compound 

of buildings has been threatened, then the 

compound (facility) has been threatened. 

2.7.2 Facility Type 

a No 

b Yes 

Yes or No for the Facility Type is based on a 

credible threat against the sector. For example, if 

the Las Vegas strip has been targeted or received 

a credible threat, all casinos may be considered 

to have the same target potential (i.e., the 

attribute option is Yes) 

NOTE: THIS BUILDING CHARACTERISTIC IS HEAVILY 

WEIGHTED IN THE SCORING. A MINOR CHANGE 

IN THE CHOICE OF ATTRIBUTE OPTION SELECTED 

MAY CAUSE A DISPROPORTIONATELY
VULNERABILITY ASSESSMENT 43 

 VULNERABILITY ASSESSMENT 

OVERVIEW 

n this chapter the factors used to determine the vulnerability 

rating are discussed. 

In the context of this rapid visual screening procedure, the 

vulnerability rating is the likely damage and loss resulting from each of 

the threat scenarios defined in the previous chapter. The vulnerability 

rating is a composite measure of the expected outcome, in terms of 

damage, casualties, and business interruption, given the threat is 

successfully carried out. Information used to assess the vulnerability 

rating typically comes from engineering analysis and expertise. 

DETERMINING THE VULNERABILITY 

RATING 

ssessment of the vulnerability rating for each threat scenario is 

more extensive than the assessment of consequences and 

threat rating because the vulnerability rating requires 

assessment of whether or not visually observable features of the building 

enhance or detract from the overall performance under terrorist attack. 

In this rapid visual screening procedure, building types are defined 

based on both the construction of the building exterior and the skeletal 

or structural frame type, since these are the dominant features that 

dictate performance for explosive attack. These definitions are biased 

towards building types found in dense urban, urban, and semi-urban 

areas; however, the definitions are versatile enough to be used for other 

building types, if needed. 

The age of the building is considered an important vulnerability 

parameter. Age can be tied to the year during which building codes 

incorporated requirements that significantly reduce the vulnerability of 

buildings subjected to terrorist attack. Age is also an indicator of the 

mass of the building, which has an impact on its resistance to explosive 

loads. Since elements of modern wind design improve the ability of the 

building exterior to resist impact loads, key dates associated with code 

updates for wind design are noted for their effects in increasing 

resistance to blast loads. 

For CBR attacks, key features that have an impact on the overall 

vulnerability of the building are the elevation of the air intakes and the 

height of the building. The elevation of the outdoor air intakes reflects 

the ease of CBR source introduction directly into the HVAC (Heating, 

I 

A

Vulnerability is defined 

as any weakness that 

can be exploited by an 

aggressor to make an 

asset susceptible to 

hazard damage. A 

vulnerability assessment 

is an analysis of the 

building functions, 

systems and site 

characteristics to identify 

building weaknesses and 

lack of redundancy. 
44 VULNERABILITY ASSESSMENT 

Ventilation, Air Conditioning) system (a form of internal CBR attack) as 

well as how much contaminant can enter the building due to an 

exterior event. These factors, as well as the details related to the type of 

ventilation systems and filters used, are included in the assessment of 

the vulnerability rating for the CBR threat scenarios. 

CONDUCTING THE FIELD ASSESSMENT 

s before, the process for archiving field assessment 

information depends on whether the screener is using the 

electronic version of the Data Collection Form, or the long 

form that contains scores for the various attribute options. 

Pages 5 through 9 of the long-from version of the Data Collection 

Form address building characteristics pertaining to vulnerability rating. 

In the Field Version of the form, which is used to document selected 

attribute options for later entry in the electronic version of the Data 

Collection Form, pages 4 through 6 cover building characteristics 

pertaining to vulnerability rating. Attributes are arranged according to 

the following individual building systems/ characteristics that may be 

adversely affected due to a terrorist attack: 

P Site 

P Architecture 

P Building Envelope 

P Structural Components and Systems 

P Mechanical/Electrical/Plumbing (MEP) Systems 

P Security 

Like the Consequences and Threat Rating, the Vulnerability Rating is 

focused on the building characteristics that may be visually observed 

and are critical to the overall risk to the building. The screener selects 

the most appropriate attribute option for each building characteristic, 

and circles the selected option, or associated numerical value. When 

the selected attribute options are entered in the electronic database, 

risk scores are calculated automatically. When the long-form version of 

the Data Collection Form is used, risk scores are calculated using the 

Risk Scoring Worksheet (Appendix A). 

More detailed instruction on how to choose between attribute options 

is provided in the tables included in this chapter. The sections that 

follow are arranged by building system/characteristic affected. 

The tables included in this chapter are useful in the field for evaluating 

the appropriate attribute option. 

A
VULNERABILITY ASSESSMENT 45 

SITE 

arts I and II of the Vulnerability Assessment portion of the Data 

Collection Form (see Figure 7 and 8) address site issues, 

architecture issues, and building envelope. This section provides 

detailed guidance on selecting attribute options pertinent to site issues; the 

subsequent section provides similarly detailed guidance on architecture 

issues, followed by a similarly detailed section on building envelope. 

The site refers to the area between the building and the property line. For 

densely urban areas, this may constitute just a portion of the sidewalk. For 

a campus setting, the site may be an expansive park like setting. Guidance 

on choosing between attribute options for building characteristics that 

address site vulnerability issues are provided in Table 9. 

Figure 7 Page 5 of Data Collection Form, Vulnerability Assessment (Part I), Site and Architecture 

Characteristics Contributing to Vulnerability Rating. 

P
46 VULNERABILITY ASSESSMENT 

Table 9 Guidance on Vulnerability Assessment: 3. Site 

3 Site 

ID Site Characteristics Attribute Options 

3.1 Distance to Unsecured Vehicles (ft) 

This building characteristic refers to the shortest distance from the 

building facade to a vehicle that may constitute a threat (an unsecured 

vehicle). It includes locations accessible by unsecured vehicles to: 

P a public road 

P a public parking area 

P an outside of secured perimeter, or 

P a drop off zone 

In addition to the explosive hazard, the distance of roadways may be 

significant in the event of CBR attack, especially if they are used to 

transport hazardous materials to and from chemical facilities. Note that 

major highways and rail lines, which are known to be used for transport 

of hazardous materials, may be considered in the Target Density Zone 

to Transportation Systems discussed in Building Characteristic 2.5. 

Options: 

a more than or equal to 75 ft 

b more than or equal to 50 ft and less 

than 75 ft 

c more than or equal to 25 ft and less 

than 50 ft

d more than or equal to 5 ft and less 

than 25 ft

e less than 5 ft. 

Example of building with various standoffs. The 

least standoff of 25 feet, corresponding to 

attribute option d, controls. Illustration courtesy 

of David Shafer, Architect. 

3.2 Perimeter Boundary 

This building characteristic describes the line separating the site 

surrounding the building from access by a vehicle that may constitute a 

threat (an unsecured vehicle). 

Note that if the perimeter boundary is not described well by any of the 

options, than select the option which offers a similar level of 

vulnerability. 

Options: 

a Continuous Anti-ram Barriers 

• The facility has anti-ram barriers on all 

sides of the perimeter. 

• There are active barriers (e.g., retractable 

bollards) at the vehicle access points 

• The barriers are able to stop a vehicle 

from reaching the building. 

b Effective Anti-Ram Design 

• The design takes all the site attributes into 

consideration, and denies penetration of 

a vehicle. 

• The facility reduces the risk of vehicle 

penetration to a reasonable and 

consistent level on all sides. 
VULNERABILITY ASSESSMENT 47 

Table 9 Guidance on Vulnerability Assessment: 3. Site (continued) 

3 Site (continued) 

ID Site Characteristics Attribute Options 

3.2 

(cont) 

Perimeter Boundary (continued) 

Also known as deterrent landscaping, Crime Prevention Through 

Environmental Design (CPTED) seeks to create a physical 

environment that discourages or minimizes criminal activity. It can 

be effective in delaying and deterring an attack. Examples include 

a monumental staircase, a circular driveway, speed bumps, 

terraced landscaping, public art strategically placed, and large 

planters that serve as truck traps. 

Options (continued) 

c Well Integrated CPTED 

• The landscaping makes it difficult to gain 

entry to the property (e.g., deep ditch, moat). 

• The landscaping provides “line of sight” to 

potential criminal activity. 

• The landscaping enhances a facility’s 

surveillance of surrounding area. 

d Ornamental/Temporary/Anti-climb 

Fence Barriers 

• Barriers can be defeated easily by vehicles 

traveling at low velocities. 

• Decorative planters resting on the sidewalk 

are the only deterrent. 

• There are only temporary solutions like jersey 

barriers, or police barricades around the 

building. 

• Parking restrictions are the only deterrent 

around the site. 

• There is an active barrier system but it is not 

activated (i.e., it is in the “down” position 

allowing vehicles to pass through). 

e No Security/ Discontinuous Security 

• There are locations along the perimeter where 

vehicles can penetrate the perimeter. 

• There are no obstacles to stop the impact of a 

vehicle into the building. 

• There are only light poles, parking meters, 

standpipes and other street furniture to deny 

penetration. 

3.3 Unobstructed View 

Unobstructed view is the smallest distance surrounding the building 

that is available for conducting counter-surveillance on potential 

criminal activity. This refers to the view from the building interior 

to public areas outside. 

Look for the features that can obstruct views from the building 

like: parked cars, hedges, shrubbery higher than 6 inches, 

newspaper kiosks, and lobby security desk located such that the 

building exterior cannot be seen.

Options: 

a more than or equal to 30 ft

b more than or equal to 20 ft, less than 

30 ft 

c more than or equal to 10 ft, less than 

20 ft 

d more than or equal to 5 ft, less than 10 

ft 

e less than 5 ft
48 VULNERABILITY ASSESSMENT 

Table 9 Guidance on Vulnerability Assessment: 3. Site (continued) 

3 Site (continued) 

ID Site Characteristics Attribute Options 

3.4 Unsecured Underground Access 

Unsecured underground access refers to miscellaneous openings that 

penetrate the perimeter and/or basement. This could be a pedestrian 

tunnel from an adjoining building or subway, or it could be a sewer 

line, culvert, drain pipe, utility tunnel, conduit or other means of 

access. Access requires that there is a void area of at least 96 square 

inches in cross sectional area and that there aren’t any physical 

obstructions (e.g., metal bars, metal cages, locking devices) or 

technology such as contact sensors to prevent access. 

Options: 

a None - There is not any way for a person to 

access the site or building from underground. 

All access is either too small or is blocked or 

controlled by sensors or other means. 

b Utility tunnel or culvert to site - There is a 

utility tunnel or a culvert that provides access 

onto the site. However, the access does not 

extend into the building. This access may be 

through a manhole cover or other means.

c Utility tunnel to building - There is a utility 

tunnel into the building from the site perimeter. 

d Pedestrian tunnel to building – There are 

secured and/or unsecured pedestrian tunnels 

that provide access to the building from 

unsecured areas on or off the site. 

NOTE: THIS BUILDING CHARACTERISTIC IS HEAVILY 

WEIGHTED IN THE SCORING. IT IS VERY IMPORTANT 

TO SELECT THE APPROPRIATE OPTION TO GET AN 

ACCURATE SCORING FOR THE BUILDING. 

3.5 Storage of Hazardous Materials 

Facilities that store hazardous materials pose a higher risk to 

occupants due to an explosive attack, potentially causing secondary 

fires, deflagrations, toxic releases or other unsafe conditions. 

The attribute options (e.g., Low, Moderate, and High) are based on 

the hazard classifications presented in the 2006 International 

Building Code (IBC). The screener should obtain the building hazard 

occupancy category from the site representative or building drawings. 

Note that there is abundant open-source information that can be 

obtained from an internet search, such as the EPA website, state 

office of emergency management or local fire department.

Options: 

a None

b Low - factory industrial uses that involve the 

fabrication or manufacturing of noncombustible 

materials (2006 IBC Classification S-2), 

buildings used for storage of noncombustible 

materials (2006 IBC Classification S-2)

c Moderate - factory industrial uses that present 

a fire hazard or buildings occupied for storage 

uses for combustible materials (2006 IBC

Classification F-1 and S-1). 

d High - uses of buildings or structures that 

involve the manufacturing , processing, 

generation or storage of materials that constitute 

a health hazard in quantities that exceed the 

levels defined in 2006 IBC (Tables 307.7,1 & 

2. Classification H) 
VULNERABILITY ASSESSMENT 49 

Table 9 Guidance on Vulnerability Assessment: 3. Site (continued) 

3 Site (continued) 

ID Site Characteristics Attribute Options 

3.6 Collateral Underground/Adjacent 

Structures 

This Building Characteristic refers to nearby structures that are not 

controlled by the owner of the building under consideration. 

Example of Option (c) where there is an elevated walkway 

connecting two buildings with separate security systems. 

Example of Option (d): Entrance to a train station inside the 

footprint of a building. 

Options (with example conditions): 

a None - No underground tunnels are under 

site; high value targets are more than 300 

feet from building. 

b Small - Utility tunnel or culvert to site. 

c Medium - Building is above a subway tunnel 

and near a subway station; an elevated 

walkway across a street provides access to 

the building. 

d Major - Building is above a subway station; 

high profile building is immediately adjacent 

to building; an above-ground public garage 

is immediately next to building; an 

underground public garage is in an 

immediately adjacent building. 

e Significant - Building is directly above a 

major roadway, vehicle tunnel, or primary 

transportation hub. 
50 VULNERABILITY ASSESSMENT 

ARCHITECTURE 

ocation of publicly accessible building functions with respect to 

occupied spaces is a key concern governing the architectural 

vulnerability of buildings. In addition the height and the use of 

overhangs are key to the overall vulnerability. 

Guidance and information to how to choose between attribute options 

for the building characteristics pertaining to Vulnerability Rating of 

the architecture are provided in Table 10. 

Table 10 Guidance on Vulnerability Assessment: 4. Architecture 

4 Architecture 

ID Building Characteristics Attribute Options 

4.1 Building Height 

The building height is classified according to the 

height above grade level. Estimates of the number 

of floors are also provided in parentheses after the 

height in feet for each attribute option. In general 

the story height may be assumed to be roughly 13 

feet. 

Subsets of building height categories are provided for 

“low” buildings (those with less than 16 floors above 

grade level), and for “high” buildings (those with 16 

floors or more above grade level). 

Options: 

Low 

a Less than 20 ft (1 floor) 

b More than or equal to 20 ft, less than 50 ft (2-3 floors) 

c More than or equal to 50 ft, less than 100 ft (4-8 floors) 

d More than or equal to 100 ft, less than 150 ft (9-12 floors) 

e More than or equal to 150 ft, less than 200 ft (13-15 floors)

High 

a More than or equal to 200 ft, less than 500 ft (16-40 floors) 

b More than or equal to 500 ft, less than 800 ft (41-60 floors) 

c More than or equal to 800 ft, less than 1000 ft (61-80 

floors) 

d More than or equal to 1000 ft, less than 1500 ft (81-120 

floors) 

e More than or equal to 1500 ft (at least 121 floors) 

Mix of building heights in urban setting 

L
VULNERABILITY ASSESSMENT 51 

Table 10 Guidance on Vulnerability Assessment: 4. Architecture (continued) 

4 Architecture (continued)

ID Building Characteristics Attribute Options 

4.1 

(cont) 

Facade design can sometimes conceal location of floors and careful 

observation is necessary. 

Varying difficulty of floor counting

Option b (High Building) 

In this sixty story building, the visible 

horizontal divisions occur every six 

floors. Note the 4 story commercial 

building in the foreground 
52 VULNERABILITY ASSESSMENT 

Table 10 Guidance on Vulnerability Assessment: 4. Architecture (continued) 

4 Architecture (continued)

ID Building Characteristics Attribute Options 

4.2 Ratio of Total Area / Footprint Area 

Buildings that are very tall and skinny are in general more 

vulnerable to terrorist attack than buildings that are very low 

but long and wide. Tall buildings tend to be more prone to 

progressive collapse following a terrorist attack, as compared 

with a low-rise building with a large footprint where a more 

localized effect may be expected (i.e., people on the end of 

the building furthest from the attack may not be aware or 

affected by an attack and will be better able to evacuate 

safely and quickly). 

The footprint refers to the area of the building at its base. In 

some cases this will be the area of the building at its ground 

floor. 

Total area refers to the total gross area of the building.

Options: 

a less than 10

b more than or equal to 10, to less than 30

c more than or equal to 30, to less than 50

d more than or equal to 50, to less than 100

e more than or equal to 100

Example of a building that has a very large foot print 

compared to its total area (Option a) 

Example of a building that has a very small footprint 

compared with its total area (Option e) 
VULNERABILITY ASSESSMENT 53 

Table 10 Guidance on Vulnerability Assessment: 4. Architecture (continued) 

4 Architecture (continued)

ID Building Characteristics Attribute Options 

4.3 Building Configuration 

The building configuration – its three-dimensional shape –

influences how a shock-wave from an explosion imparts load to 

the structure. Circular and convex shapes tend to shed the airblast loading better than a flat surface such as a rectangular 

“box” shaped building. Re-entrant corners – buildings with H, 

L, U, T, or combinations of these plan configurations – and 

concave surfaces tend to trap the shock-wave and amplify the 

effect of the air-blast due to multiple reflections. Note that 

sometimes the re-entrant corner may be provided by an adjacent 

building that is offset from the building under configuration. 

Configuration issues are only significant up to height of about 50 

feet. Therefore, if the shape of the building changes above 50 

feet, consider only the base of the building below 50 feet. Note 

that an explosion adjacent to high-risk buildings may result in 

damage to an un-targeted building. 

 Re-entrant corner configurations 

Options: 

a Circular and Convex

b Rectangular Box

c Re-entrant corners

d Concave shapes 

Re-entrant corner Circular (convex) 

plan showing multiple showing the air blast 

reflection condition “shedding” 

Option c Option a

Illustration courtesy of David Shafer, Architect. 

Concave building shape (Option d) 

4.4 Overhang 

This building characteristic pertains to overhangs or open floors 

that are up to two stories in height above the ground level, with 

the underside of the structural framing supporting occupied 

spaces or critical functions above. Pedestrian bridges are not 

considered an overhang unless they house office space, other 

occupied area, or critical functions. If the floor level above the 

overhang is not occupied or has critical functions, then option ‘a’ 

should be selected. 

Depth, measured from inside face of the free standing column to 

the face of the exterior envelope, can be a critical dimension. If 

the column spacing along the exterior is less than the depth, 

then use the spacing of the columns. In some cases this building 

characteristic may apply to drive-through conditions where the 

building lobby is accessed from an area that is covered by part of 

the building. (see figure, right). 

Options: 

a None

b Less than 5 ft

c More than or equal to 5 ft, less than 10 ft

d More than or equal to 10 ft, less than 15 ft

e. More than or equal to 15 ft

Illustration courtesy of David Shafer, Architect.
54 VULNERABILITY ASSESSMENT 

Figure 8 Page 6 of Data Collection Form, Vulnerability Assessment (Part II), Architecture and Building 

Envelope Characteristics. 

Table 10 Guidance on Vulnerability Assessment: 4. Architecture (continued) 

4 Architecture (continued)

ID Building Characteristics Attribute Options 

4.5 Lobby/Retail Location (in relation to 

main building footprint) 

Public areas of buildings, including the lobby and retail, are 

considered high risk areas where an explosive (or CBR) device could 

be placed undetected. The location of these spaces in relation to 

occupied/critical areas or primary structural framing affects the 

vulnerability of the building to explosive attack. It affects the 

vulnerability to CBR threats because of the potential for contaminants 

to be transmitted throughout the building. All figures in section 4.5 

courtesy of David Shafer, Gensler Architects. 

Options: 

a: Detached* - In this case the public areas of 

the facility are in a separate building. 
VULNERABILITY ASSESSMENT 55 

Table 10 Guidance on Vulnerability Assessment: 4. Architecture (continued) 

4 Architecture (continued)

ID Building Characteristics Attribute Options 

4.5 

(cont) 

Lobby/Retail Location (continued) 

Detached screening lobby, Option(a). Photograph 

courtesy of Gensler Architects. 

Options (continued)*: 

b: External and Separated* - The public areas 

are external to the main footprint of the building 

and are separated from the secured areas by a 

solid wall with limited openings. No routinely 

occupied areas or critical utilities are internal to 

the wall. 

c: External but not Separated* - Public areas 

are separated from the secured occupied/critical 

areas, but are not in the same “space” or “room” 

and are not separated by a physical barrier like 

a wall. This would apply to an multistory atrium 

for instance with a public lobby at the ground 

floor. 

d: Within Footprint* – The public areas of the 

building are inside the main footprint of the 

building but are not immediately adjacent to 

secured areas that are routinely occupied (i.e., 

hotel rooms, apartments, offices) or contains 

critical utilities. It is acceptable if public areas 

are adjacent to storage areas, restrooms, locker 

rooms or other support space. 

e: Adjacent to Occupied Areas* - Public 

areas are underneath or next to regularly 

occupied space. 

*Illustrations courtesy of David Shafer, Architect
56 VULNERABILITY ASSESSMENT 

Table 10 Guidance on Vulnerability Assessment: 4. Architecture (continued) 

4 Architecture (continued)

ID Building Characteristics Attribute Options 

4.6 Loading Dock/Mail Screening 

Location 

The loading dock and/or mail screening areas are considered 

high-risk where an explosive or CBR threat could be delivered to 

the building undetected. 

The screener should question the site representative or walk 

around the exterior of the building to ascertain the location of 

the loading dock and mail screening area, and select the 

attribute option that most closely represents its general location 

relative to the main building footprint and proximity to 

occupied/critical areas. 

If screener does not have access to interior areas, look for 

screening equipment located on the loading dock and visible 

from the outside. 

Loading dock under building (Option e)

0ptions: 

a Offsite / None - All deliveries are screened at 

a separate building before entering building. 

b Exterior to Building - Loading dock and/or 

mail screening occurs outside the main footprint 

of the building. 

c At Perimeter and Separated - Loading 

dock and/or mail screening are located inside 

the building footprint, but along the building 

perimeter and not adjacent, under or over 

occupied/critical areas. 

d Adjacent to Assets - Loading dock and/or 

mail screening are located next to occupied 

areas or other critical assets, but not underneath 

or over. 

e Under Building - Loading dock and/or mail 

screening are located underneath or over 

occupied/critical areas. 
VULNERABILITY ASSESSMENT 57 

Table 10 Guidance on Vulnerability Assessment: 4. Architecture (continued) 

4 Architecture (continued)

ID Building Characteristics Attribute Options

4.7 Vehicular Penetration of Exterior Envelope 

This building characteristic addresses the potential for high speed vehicular impact and 

penetration into the building. 

A moving vehicle can pose a substantial threat to a building if it is able to accelerate to a 

high speed on adjacent streets prior to impact. This is a function of the site layout, 

adjacent street configuration and perimeter security. 

The screener should review the potential vehicle approach paths to the building along 

roadways or wide walkways and determine the exposure of the building to a high speed 

vehicle impact. 

Example ‘No’ Option: Minimum standoff but well defended perimeter 

 ‘No’ Option: vehicle must ‘Yes’ Option: straight-on and 

swerve significantly corner 

Illustration courtesy of David Shafer, Architect. 

Options: 

a No - The site is configured on all 

sides such that a high-speed 

approach is mitigated by means 

of landscaping, anti-ram barriers, 

terrain, or other methods around 

the entire perimeter, including 

vehicle access points. 

Alternatively, the site is such that 

an oncoming vehicle would need 

to turn or approach the building 

from an angle to impact it on one 

or more sides Conditions 

considered as None should be 

assessed as “NO” 

b Yes - The site is configured such 

that a straight-on approach of a 

high-speed vehicle is possible on 

one or more streets. This occurs, 

for instance, at street corners or 

“T” intersections. Conditions 

considered as Straight-on should 

be assessed as “YES” 
58 VULNERABILITY ASSESSMENT 

Table 10 Guidance on Vulnerability Assessment: 4. Architecture (continued) 

4 Architecture (continued)

ID Building Characteristics Attribute Options 

4.8 Garage Location 

The garage is a particularly high-risk area where an unscreened or 

screened vehicle could potentially deliver a weapon. 

The screener should question the site representative or walk 

around the exterior of the building to ascertain the location of a 

parking garage and select the attribute option that most closely 

represents its location relative to the building footprint and 

proximity to occupied/critical areas.

Underground parking garage (Option d ) 

Garage Entrance Adjacent to Occupied Areas (Option d) 

Options: 

a None - There is no garage in the building 

b Adjacent and Above Ground* - The garage 

is immediately adjacent to the building and 

above ground. No part of the garage is under or 

over the main building. 

c Adjacent to Critical Utilities* - The garage is 

over, next to, or below critical building utilities, 

but not immediately under office space or 

regularly occupied areas. Transitory space such 

as lobby, restrooms, storage or corridors is 

acceptable. 

d Adjacent to Occupied Areas - The garage is 

over, below, or next to office space or regularly 

occupied areas. It may or may not be adjacent 

to critical utilities. 

*Illustrations courtesy of David Shafer, Architect. 
VULNERABILITY ASSESSMENT 59 

BUILDING ENVELOPE 

arts II and III of the Vulnerability Assessment Rating portion 

of the Data Collection Form (see Figures 8 and 9) address the 

building envelope, which refers to the exterior of the 

building. The building characteristics of concern are the window and 

wall system visible from the building exterior and the degree of debris 

impact protection. 

Guidance and information to how to choose between attribute options 

for the building characteristics pertaining to Vulnerability Rating of 

the building envelope are provided in Table 11. Further information 

on building envelope design concepts is provided on the Whole 

Building Design Guide web site (www.wbdg.org), which is maintained 

by the National Institute of Building Sciences (NIBS). 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope 

5 Building Envelope 

ID Building Characteristics Attribute Options 

5.1 Window Support Type 

Window support type refers to the manner in which the 

typical windows are connected into the exterior envelope 

and the structure. 

Note that the windows at lower floors and/or the entrance 

of a building are often different from the typical windows 

on upper floors and are not what should be used when 

categorizing the window support type. In other cases, there 

may be one or two floors at the top of the building or at 

another floor that have larger windows. Again, these are 

not the typical windows and should not be used when 

assessing the risk to the entire building except if the critical 

assets are located in the region of that window type. 

In cases where there is more than one window type, the 

type in the most vulnerable location, or the type that is the 

most vulnerable may be used, depending on the other site 

characteristics. For instance, the typical window type on the 

building side closer to a public street will be more 

vulnerable than a window type on other sides of the 

building and therefore govern. On the other hand, if the 

standoff distance is comparable on all sides of the building, 

then it may make more sense to use the most vulnerable 

window type based on how it is supported in the frame. 

Options: 

a No Windows - Buildings that do not have windows 

or have very few windows include warehouses, ‘big 

box’ stores, data centers and telecommunications 

facilities. Buildings with no windows are the least 

vulnerable condition; this option is intended 

specifically for these and other specialized building 

types. 

b Punched - This type of window may consist of two 

panes that can slide open vertically (i.e., double sash 

windows), or it can be opened like a door or a pivot 

mechanism. In other cases, a punched window may 

have intermediate framing between several window 

panes that is oriented in the horizontal direction. 

c Glass and Metal Framing - For this glazing type, 

a significant part of the building exterior is covered 

with windows supported by aluminum or possibly steel 

framing. 

d Ribbon - Ribbon windows have thin vertical metal 

framing separating the individual panes, and are 

supported by the wall at the top and bottom. This 

framing system tends to be less robust than punched 

windows, and usually the wall spans horizontally and 

is attached only to each floor instead of spanning 

vertically and being secured to a lower and upper 

floor. The system is very economical and a common 

façade type.

P
60 VULNERABILITY ASSESSMENT 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued) 

5 Building Envelope 

ID Building Characteristics Attribute Options 

5.1 

(cont) 

Example of older building that has ‘no windows‘ 

(Option a)

Example of punched windows (Option b). 

Punched windows are considered less vulnerable than other window 

types because the frame is attached directly into the wall on all sides, 

which is generally of more robust construction. It is very common to 

see these types of windows used for older masonry buildings and also 

for residences. 

Options (continued): 

e Point Supported - Point supported windows 

are usually held in place by a metal system of 

cables behind the window that are connected to 

the glass at points near the corner. This is 

considered the most vulnerable window type in 

terms of the hazard presented to the people 

inside if there is an explosive event outside. 
VULNERABILITY ASSESSMENT 61 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued 

5 Building Envelope 

ID Building Characteristics Attribute Options 

5.1 

(cont)

Example of glass and metal framing. This building has floor-toceiling glass, with the floor structure concealed by metal 

paneling (Option c) 

Option ‘c’ windows (Glass and Metal Framing/Curtain Wall) have an 

increased risk of the glass and the framing becoming a flying hazard 

compared with punched windows. However, it has more resiliency than 

support types ‘d’ and ‘e’ due to its flexibility, which allows it to bend 

significantly before failing. In some situations, the glass will be opaque 

near the floor level but will still be glass. In other situations, a light weight 

material like metal panel or wood or plastic is used near the floor levels. 

A glass curtain wall may provide the complete wall for the building 

envelope, as shown in Option ‘b’ of Building Characteristic 5.5 (Glass 

Curtain Wall). 

Example of ribbon window in older building (Option d) 
62 VULNERABILITY ASSESSMENT 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued) 

5 Building Envelope (continued) 

ID Building Characteristics Attribute Options 

5.1 

(cont)

Example of ribbon window in newer building with continuous 

wall elements above and below (Option d)

Ribbon windows (Option ‘d’) in older buildings consist of several window 

panes side by side with narrow framing between. Newer ribbon windows, 

dating from the 1960’s and after, consist of alternating bands of glazing 

and opaque material constructed using precast panels, poured concrete or 

insulated metal panels. The opaque area conceals the floor structure and is 

referred to as a ‘spandrel’. 

.

Example of common type of ribbon window with alternating 

horizontal bands of window and spandrel (Option d)
VULNERABILITY ASSESSMENT 63 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued 

5 Building Envelope 

ID Building Characteristics Attribute Options 

5.1 

(cont)

Example of point supported with cable (Option e) 

Sometimes the supports for Point Supported windows (Option ‘e’) include 

cables that look more like brackets at the corners, or there is sturdy metal 

framing present but only on the interior. The panes are typically separated 

by a clear or translucent polymer material instead of the metal framing 

(referred to as “butt glazed”). 

A cable supported system that supports glazing by tensioned cables is a 

resilient system with better performance than a typical point supported 

system. 
64 VULNERABILITY ASSESSMENT 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued) 

5 Building Envelope (continued) 

ID Building Characteristics Attribute Options 

5.2 Window Bite Depth 

Bite refers to the depth of window glass captured by 

the frame for the typical windows. This part of the 

window often cannot be seen from the outside because 

it is inside the frame. This characteristic provides a 

measure of how firmly the window is held in place by 

the frame. Sometimes bite can be measured, but often 

it cannot. The following guidance will help the 

screener to determine which attribute option to 

choose: 

a More than or equal to 0.5 in 

Situations where the bite is often greater than or equal 

to 0.5 in are: 

(1) newer buildings constructed in the 1980’s or 

later. 

(2) Large panes of glass 

(3) High rise construction 

(4) Commercial construction 

(5) High wind areas 

Other conditions when this attribute may be selected 

include: 

P when structural silicone sealant (a translucent 

material connecting the glass and frame) is 

provided. This material acts as a ‘glue’ to 

adhere the glass to the frame, helping it to stay 

in place. 

P when the window film is mechanically attached. 

(i.e., the window film is placed over the framing 

members with battens to hold it in place). 

P when the windows of a commercial building 

have been replaced in the past decade to 

provide additional energy efficiency (look for 

windows that look much newer than the rest of 

the building). 

b Less than 0.5 in 

Older construction, which typically uses smaller panes 

of glass, will tend to have smaller window bites. For 

these windows a rubber gasket will typically be used to 

hold the glass tight into the frame. Also, this option is 

typical for residential construction. 

Options: 

a More than or equal to 0.5 in

b Less than 0.5 in

NOTE: The age of the building provided on Page 1 of the Data 

Collection Form, which is determined prior to the field visit, 

provides useful input to selecting the appropriate attribute 

option. 
VULNERABILITY ASSESSMENT 65 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued) 

5 Building Envelope (continued) 

ID Building Characteristics Attribute Options 

5.3 Total % Window Area 

The exposure of building occupants to failed window 

glass provides a serious hazard in explosive events. 

The % window area is defined as the ratio of the 

window area to the total wall area, where walls are 

assumed to provide greater protection than windows to 

occupants. 

Estimates can be based a typical area of the building 

between two column lines (i.e., one bay width). 

Examples of % window area: 

Greater than or equal to 20%, less than 

40% (Option b) 

Greater than or equal to 40%, less than 60% 

(Option c )

Options: 

a less than 20%

b Greater than or equal to 20%, less than 40%

c Greater than or equal to 40%, less than 60%

d Greater e than or equal to 60%, less than 80%

e Greater than or equal to 80%

Example estimates:

Top row (from left to right): 

 Option a: < 20% Option b: 25% Option c: 40% 

Bottom row: 

 Option e: 80% Option d: 75% Option c: 55% 

Illustrations courtesy of David Shafer, Architect. 

Greater than or equal to 80% (Option e) 
66 VULNERABILITY ASSESSMENT 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued) 

5 Building Envelope (continued) 

ID Building Characteristics Attribute Options 

5.4 Glass Type 

For the purposes of this rapid visual screening procedure, 

five categories of glass are provided as attribute options 

for typical windows. For buildings where there may be a 

variety of glass types, select the type that is likely to 

cause the most hazard due to a variety of factors 

including window size, number of windows of that type, 

location, and occupancy level, using a “worst-reasonablecase standard” approach. 

a Laminated Glass 

For low impact conditions, the laminate holds the glass in 

the frame, which is safer than if the glass fragments are 

thrown from the window. For higher impact conditions 

the glass pieces adhere to the laminate forming “clumps”

of glass, which exit the frame. Again, this situation is safer 

than if no laminate is used. 

Laminated glass is relatively uncommon for conventional 

construction. However, it is used often for buildings that 

are designed to mitigate the effects of explosive attack. 

Newer government buildings or buildings with high-risk 

tenants may have laminated glass construction. It should 

be shown on the construction drawings and can be 

determined by using a glass meter. For insulated glass 

with two glass panels separated by a small air gap, 

typically it will only be the inner pane that is laminated. 

Often a conversation with the building manager will be 

sufficient for determining whether laminated glass has 

been used. 

Laminated glass is safety glazing certified by the Safety 

Glazing Certification Council (SGCC®) and identified by a 

permanent label affixed to the product. A typical label 

would include the following information: 

SGCC® Licensee or Primary Producer 

Company Name (optional) 

Laminated Glass 

ANSI Z97.1-2004 

16 CFR 1201 CII 

SGCC 9999 6mm U A 

Options: 

a Laminated glass - Laminated glass refers to 

two or more glass panels connected or “glued” 

together with layers of polyvinyl butryal (PVB). It 

is used most commonly as safety glass for 

skylights or for glass panels that are near the 

floor and could be accidentally broken through 

impact. 

b Security film - Security film, which varies from 

4 mil to about 20 mil in thickness, is thicker than 

solar film or glare film. Access to typical 

windows is needed to confirm that security film 

has been added to windows. 

c Tempered glass - Tempered glass, like 

laminated glass, is considered to be safety glass 

and may be used for the same applications 

where impact is a concern (e.g., skylights, 

lobbies). When impacted it breaks into small 

cubes rather than sharp shards like other types 

of unlaminated glass. 

d Heat strengthened glass - Heat 

strengthened glass is the most typical type of 

glass used for commercial office buildings 

today. 

e Annealed glass - Annealed glass is the 

weakest type of glass and creates shards when 

it is broken. Non-retrofitted glazing in older (pre 

1960s) buildings will usually be annealed glass. 

This glass type may also be used in residential 

buildings. 
VULNERABILITY ASSESSMENT 67 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued) 

5 Building Envelope (continued) 

ID Building Characteristics Attribute Options 

5.4 

(cont)

b Security Film 

Installing security film on the inside of window glass is a 

common retrofit used for office buildings where terrorist 

attack is a concern. For daylight applications, the film 

may be detected along the edges. Older film retrofits may 

peel, have air bubbles, or be clouded. In some cases, the 

film will be attached into the framing using metal plates 

or battens. Solar film, which typically is 2 mil thick, is 

much thinner than security glass, and does not qualify as 

security film. Knowledge of retrofit is needed to select this 

option (refer to Page 1 of the Data Collection Form where 

retrofit information is requested). 

c Tempered Glass 

Sometimes tempered glass is used for all or some glass 

panes at the ground floor so that firefighters or other first 

responders can safely gain access to the building in case 

of emergency. Like laminated glass, there is a marking in 

the corner of the pane indicating that it has been 

tempered. 

Note that it is relatively uncommon to use tempered glass 

for typical vision panels above the ground floor. 

d Heat Strengthened Glass 

Heat strengthened glass may be easily identified if the 

glass has been tinted. For high-rise commercial buildings 

built during the last thirty years and/or with large glass 

panes, it may be assumed that the glass is heat 

strengthened. 

e Annealed Glass 

While annealed glass is typically installed in older 

buildings built before 1960 (refer to age of building 

requested on Page 1), it is still often used for 

P Single family residences 

P Smaller multi-family apartment buildings 

P Commercial buildings constructed prior to World 

War II or with multi-pane windows 
68 VULNERABILITY ASSESSMENT 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued) 

5 Building Envelope (continued) 

ID Building Characteristics Attribute Options 

5.5 Wall Type 

Wall type refers to the type of wall construction used on the building 

exterior to support the window and wall system (i.e., façade). 

The screener should determine the composition of the exterior wall 

through site observations and, if available, as-built drawing review. 

This information may also be ascertained through questioning of the 

site representative or facility engineer. 

If it is not known what the wall type is, the screener should select the 

option that is the closest to the options provided. 

Cast-in-place reinforced concrete (Option a) 

Glass curtain wall (Option b) concealing the floor structure. 

Options: 

a. Cast-in-Place Reinforced Concrete - 

Reinforced cast-in-place concrete walls have a 

very solid appearance with punched 

windows. Often cast-in-place reinforced 

concrete walls are used in monumental 

construction or in high-seismic or high-windload areas. The concrete usually has an 

architectural textured finish, or has an applied 

veneer of natural stone slabs. 

b. Curtain wall - Glass curtain wall 

construction refers to a façade consisting of 

glass panels supported by metal framing. In 

some cases, instead of glass, the panels are 

light, insulated, metal panels. 

c. Precast Panels/Reinforced Masonry - 

Precast concrete panels can give the 

appearance of just about any material and be 

any color or architectural style. Reinforced 

masonry refers typically to concrete masonry 

unit (CMU) construction with steel reinforcing 

bars in the voids. Look for the vertical and 

horizontal seams between the panels, or 

evidence of the stacking of reinforced 

masonry blocks. These construction types are 

typically used for smaller office or government 

buildings. 

d. Massive Unreinforced Masonry – Older 

unreinforced masonry (URM) buildings with 

multi-wythe brick walls having a height-tothickness ratio less than or equal to ten. 

Sometimes the brick is covered with stucco or 

other material that disguises the brick. Older 

buildings used for civic construction are often 

of this type of construction. 

e. Light Frame or Slender Unreinforced 

Masonry - Smaller brick residential or 

commercial buildings with height-to-thickness 

ratios more than ten. Light frame refers to 

wood or metal-stud construction with a light 

weight exterior wall like gypsum board 

covered with stucco. It also refers to 

Unreinforced Masonry Units (i.e., concrete 

blocks) or tile backed with plaster and lath. 
VULNERABILITY ASSESSMENT 69 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued) 

5 Building Envelope (continued) 

ID Building Characteristics Attribute Options 

5.5 

(cont)

Precast concrete panels (Option c) 

Example reinforced masonry building (Option c) 

Example massive unreinforced masonry building 

(Option d) 

Options (continued): 
70 VULNERABILITY ASSESSMENT 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued) 

5 Building Envelope (continued) 

ID Building Characteristics Attribute Options 

5.5 

(cont)

Example of light wood or metal frame (Option e)

Example unreinforced masonry (brick) historic residential 

apartment row (Option e). 

Example brick veneer residence (Option e) 

Photograph courtesy of Petrillo and Sons Corporation, North 

Reading, Massachusetts. 
VULNERABILITY ASSESSMENT 71 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued) 

5 Building Envelope (continued) 

ID Building Characteristics Attribute Options 

5.5 

(cont)

Wall Type (continued) 

Light Frame or Slender Unreinforced Masonry (Option e) 

buildings:- Note that finished brick, stone, or ceramic tile are often 

used as a veneer over a sheet backing, which is attached to a wood, 

steel or concrete frame structure. Other identifying features of brick 

veneer buildings are: 

• brick layers that are not staggered 

• larger windows than traditional brick buildings 

• small keystones over arches for decoration 

• much newer then traditional brick buildings. 

• Over five stories high 

Figure 9 Page 7 of Data Collection Form, Vulnerability Assessment (Part III), Building Envelope and 

Structural Components and Systems Contributing to Vulnerability Rating. 
72 VULNERABILITY ASSESSMENT 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued) 

5 Building Envelope (continued) 

ID Building 

Characteristics 

Attribute Options 

5.6 Windborne Debris 

Impact Protection 

This characteristic refers to 

benchmark years for 

windborne debris impact 

protection, primarily 

established through code 

requirements after the year 

2000, with some locations 

earlier. 

The table to the right may be 

used to identify the locations 

within a state where windborne 

debris impact is a 

consideration. The year in 

which these provisions were 

initiated are shown in the right 

most column. 

Options: 

a Post-benchmark year – building was designed after bench-mark year, 

or has window screens that meet bench-mark year wind-borne debris 

impact standards.

b All other buildings

State Locality Bench-mark 

Year*

ALABAMA City of Mobile, and possibly some smaller communities 2001

CONNECTICUT The jurisdictions of East Lyme, North Stonington, Ledyard, Old 

Lyme, New London, and Stonington 2007 

DELAWARE Sussex County East of the canal (in lieu of one mile from the 

coast) 2005 

FLORIDA 

Panhandle: one mile inland from the coast; in all other counties 

except Dade, Broward, and Palm Beach County: at least 5 miles 

inland from the coast 

2002 

Dade and Broward Counties: at least 5 miles inland from the coast 1994

Palm Beach County: at least 5 miles inland from the coast 1999

LOUISIANA City of New Orleans 2003

MARYLAND Worcester County (excluding Ocean City) within 1 mile of the 

Atlantic 2003 

MASSACHUSETTS. Within one mile from the coast except Boston 2005

NEW JERSEY Within one mile from the coast 2003

NEW YORK All of Long Island East of Riverhead, and within one mile from the 

North and South coasts of Long Island (except possibly NYC) 2003 

NORTH 

CAROLINA 1,500 feet inland from Atlantic Ocean 2006 

RHODE ISLAND 

South of highway US 1 from the Connecticut border to 

Sauderstown (about midway on the south coast), including Block 

Island 

2004 

SOUTH CAROLINA All counties seaward of the 120 mph Windspeed contour 2005

TEXAS 

All areas seaward of the Intercoastal Waterway (mostly Barrier 

Islands) 1998 

First tier coastal counties (all of Calhoun, Chambers, and Galveston 

Counties; other 11 counties seaward of the 120 mph Windspeed 

contour, Defined as specific highways, mostly US 77 and US 59) 

2003 

VIRGINIA Within one mile from the coast, excluding Chesapeake Bay 2005

* Year in which windborne debris impact protection code requirements were adopted and enforced. It is recommended that local building codes be consulted to 

verify these benchmark dates. 
VULNERABILITY ASSESSMENT 73 

Table 11 Guidance on Vulnerability Assessment: 5. Building Envelope (continued) 

5 Building Envelope (continued) 

ID Building 

Characteristics 

Attribute Options 

5.6 

(cont) 

Window screens used to 

meet windborne debris 

impact can protect against 

impact due to explosive 

effects. 

An example of a screen 

used to resist explosions is 

shown to the right. Similar 

solutions are provided for 

hurricane protection. 

Buildings constructed prior 

to the benchmark years 

may be retrofitted to meet 

standards by using 

shutters, storm windows or 

a curtain system. 

STRUCTURAL COMPONENTS AND 

SYSTEMS 

he ability of a screener to observe the building structure by way 

of a rapid visual screening will be limited by the extent to which 

the structure is covered by finishes, such as granite on the 

outside of the building or a tile ceiling on the inside of the building. 

As a result, the following steps should be taken to identify the 

structural characteristics that most closely represent the subject 

building: 

P Review the structural as-built drawings, including 

renovations/upgrades, prior to the site visit or make arrangements 

to review them at the site. Drawings will provide the most detailed 

information about the building structure. 

P Make arrangements for the building engineer to be available for 

the walkthrough and questioned while performing the site visit. It 

T
74 VULNERABILITY ASSESSMENT 

is advisable to meet with the most senior building engineer who has 

been at the site the longest and would be knowledgeable in past 

renovations and upgrades. 

P Request access to areas of the building where interior finishes are 

not present such as interstitial spaces, mechanical rooms and 

loading docks. 

P Make arrangements for a ladder to be located within an 

unoccupied tenant space to remove a few ceiling tiles for 

observation of the underside of the structural floor system. It is 

advisable to perform this at the building perimeter and at a column 

line where both the exterior façade and its attachment to the 

structure could also be determined. 

The above information-gathering measures should be arranged prior 

to the site visit, keeping time constraints in mind. Review of the 

building drawings and questioning of the building engineer may prove 

to be the most efficient, while performing site observations may be 

more time consuming but highly recommended when building 

drawings are unavailable. 

The structural building characteristics addressed on the Data 

Collection Form (see Figure 9), and discussed below, are expected to 

be readily identifiable and have a strong influence on a building’s 

performance when subjected to extreme loading scenarios generated 

by an explosive event, with potential for progressive collapse. 

Characteristic 6.7 Structural Enhancements and Weaknesses may be 

difficult to interpret. It is recommended that the screener review 

information in this section prior to the walkthrough, consult with the 

checklist of structural questions and commentary presented in FEMA 

426, Reference Manual to Mitigate Potential Terrorist Attacks Against 

Buildings, or consult with a knowledgeable professional. 

The vulnerability of a structural system to an explosive event is 

dependent upon the magnitude of the air-blast shock wave as it loads 

walls, columns and floor/roof framing. Typically, air-blast loading 

causes localized damage that may in-turn initiate a progressive collapse. 

Progressive collapse is the spread of damage caused by the 

redistribution of loads to other supporting elements around a localized 

point of failure. As these elements are overwhelmed beyond their 

capacity, they fail and cause further damage. 

Air-blast loading decreases exponentially with distance, with the closest 

structural elements to the explosive event sustaining more extreme 
VULNERABILITY ASSESSMENT 75 

loading and severe damage than elements further away. Potential 

loading scenarios include: a package weapon within close proximity to 

a heavily loaded column whose failure initiates the successive failure of 

the floor framing it supports; failure of a weak façade wall due to a 

large exterior vehicle weapon threat that in-turn damages the 

perimeter bay of the floor system due to uplift loading; and failure of 

the floor system immediately above and below an interior weapon with 

debris that overloads floors below and causes their collapse. 

Precast frames and shear wall buildings that consist of precast concrete 

planks, tees or double tees supported on precast girders and columns, 

with resistance to lateral loads provided by concrete shear walls, are 

especially vulnerable, primarily because the interconnection between 

structural elements is provided through rigid, non-ductile welded 

inserts that are susceptible to fracture under extreme loading 

conditions. These buildings are mainly parking garages or low- to midrise office facilities. 

Guidance and information to how to choose between attribute options 

for the building characteristics pertaining to Vulnerability Rating of 

the structural components and systems are provided in Table 12. This 

table is useful during the field visit as a reference document. 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems 

6 Structural Components and Systems 

ID Building Characteristics Attribute Options 

6.1 Structural System 

The structural system is what enables the building to support its 

own weight, the weight of the contents and resist loads due to 

wind and earthquake. Sometimes, the structural system is the 

same as the exterior envelope, but often it is not. If the exterior 

envelope is the ‘skin’ of the building, then the structural system 

is the ‘bones’ or skeletal frame of the building. It is what enables 

the building to remain standing even if the exterior envelope is 

pierced by explosive forces. 

a Reinforced Concrete Shear Walls, or Bundled Tubes

Shear wall buildings typically have significant resistance to 

blast loads and airborne contaminants, particularly when the 

walls are solid along the entire perimeter. Walls with punched 

openings for windows, as shown in the photo on the following 

page, often have a structurally strong center core. While rare, 

solid perimeter-wall configurations may be more common in hot 

climates where concrete is used for energy conservation 

purposes. 

Options: 

a Reinforced concrete shear walls, or 

bundled tubes – This option covers buildings 

having either reinforced concrete shear walls, or 

bundled tubes. Shear wall buildings may have 

solid, or “punched” exterior concrete walls along 

their perimeter, with modest-sized window 

openings, or may have shear walls along both 

interior and exterior wall lines at selected 

locations. Bundled tube buildings have 

structural systems that consist of vertical “tubes” 

that are “bundled” together; such buildings are 

designed so that in the event one of the “tubes” is 

severely damaged, the others will remain intact. 
7

T

6 

able 12 G

ID Bu

6.1 

(cont)

Struc

Examp

buildin

Plan of

buildin

Importa

to have 

of unrei

Bundle

typically

location

it is stru

to locali

the stru

Note: th

building

structur

significa

uidance on Vul

6 S

uilding Cha

ctural Syste

ple reinforced con

g (Option a) 

f reinforced conc

g with center co

ant note: Some old

concrete shear wal

inforced masonry. 

ed Tubes. This typ

y used for very tall 

ns. It has a high leve

ucturally compartme

ize damage by stru

cture from other pa

his attribute option

gs with other structu

ally compartmenta

antly localizes the d

nerability Asse

Structural 

aracteristic

em (continue

ncrete shear wal

crete shear wall 

ore 

er buildings may a

lls, but in fact have

See Option d. 

pe of construction is

buildings in dense 

el of redundancy be

entalized so that it 

cturally isolating pa

arts. 

 may also be used 

ural systems that ar

lized in a way that 

damage to a buildin

essment: 6. Str

Componen

cs 

ed) 

ll 

ppear 

e walls 

s

urban 

ecause 

is able 

art of 

for 

re 

ng. 

Optio

a Re

(c

Threeconcr

lines (

Schem

exteri

courte

uctural Compon

nts and Sy

ons (Contin

einforced co

ontinued)

-dimensional 

ete shear wal

(Option a) 

matic of bund

or columns be

esy of David S

nents and Syst

ystems (con

Attribute

ued): 

oncrete she

schematic of 

lls along selec

led tube struc

etween each w

Shafer, Archit

VULNERABI

ems (continued

ntinued) 

e Options 

ar walls, or

building with 

cted interior a

ture, with clos

window (Opti

ect.

ILITY ASSESSM

d) 

r bundled t

reinforced 

nd exterior w

sely spaced 

ion a). Illustra

MENT 

ubes 

wall 

ation 
VULNERABILITY ASSESSMENT 77 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems (continued) 

6 Structural Components and Systems (continued) 

ID Building Characteristics Attribute Options 

6.1 

(cont)

Structural System (continued) 

Example bundled tube building (Option a) 

b Braced Exterior Frame Buildings Often the braces are 

exterior to a glass curtain wall and may be easily identified by 

visual observation.

Example braced exterior frame building (Option b)

Options (Continued): 

a Reinforced concrete shear walls, or 

bundled tubes (continued)

b Braced exterior frames - This type of 

construction contains braced exterior frames that 

provide lateral support throughout the height of 

the building. 
78 VULNERABILITY ASSESSMENT 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems (continued) 

6 Structural Components and Systems (continued) 

ID Building Characteristics Attribute Options 

6.1 

(cont)

Structural System (continued) 

c Frame with Core, or Precast 

Frame with core is a common type of structural system used for 

office buildings. The core can often be seen through the exterior 

windows, or by inspecting the lobby. When a glass curtain wall is 

used on the exterior of the building without any solid areas of 

exterior walls, which is a common configuration, there is little 

protection against contaminants or explosive loads; therefore this 

building type is not considered very robust. All the structural 

strength is at the center of the building. In core buildings it is 

typical for the elevator shafts, stairwells, electrical conduit, and 

bathrooms to be placed in the core. 

Many design variations are possible: large plan buildings may have 

two or more cores, small plan buildings may have clear span 

framing from core to perimeter, and irregular shaped plans can be 

accommodated. 

Plan of office building with center core and end stairs 

(Option c) 

 

Office building with central core (Option c). 

Options (Continued): 

c Frame with core, or precast - This option 

covers buildings having either a frame with a 

strong structural core, or a structural system 

composed of precast concrete panels and 

elements. In frame-with-core systems, the 

core acts like a backbone to the building and 

provides lateral support, with the frame serving 

as the ribs and an exterior frame supporting 

curtain walls. The frame may be constructed of 

steel or reinforced concrete. Precast concrete 

buildings typically consist of precast concrete 

planks, tees or double tees supported on 

precast girders and columns; concrete shear 

walls provide lateral-load resistance. 

Typical frame with strong structural core (Option c). 

Illustration courtesy of David Shafer, Architect. 
VULNERABILITY ASSESSMENT 79 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems (continued) 

6 Structural Components and Systems (continued) 

ID Building Characteristics Attribute Options 

6.1 

(cont)

Structural System (continued) 

Precast concrete buildings can be especially vulnerable if 

interconnection between structural elements is provided through 

rigid, non-ductile welded inserts that are susceptible to fracture 

under extreme loading conditions. Structural systems of this type 

are mainly used for parking garages or low- to mid-rise office 

buildings. 

Example of precast parking structure (Option c)

In some cases, an “egg crate” design may be used, in which 

precast shear walls are used instead of columns to separate the 

bays; in these instances, the building may have significant 

ductility if the connections are robust. This type of construction is 

typically used for residential construction where large open 

spaces are not required. 

Note that precast concrete systems, as described herein, are also 

termed structural precast, which is different from architectural 

precast that is used as exterior cladding for the facade. Structural 

precast refers to the skeletal structure of the building. 

Options (Continued): 

c Frame with core, or precast (continued)

Three-dimensional schematic of building with 

structural precast girders and columns; shear walls 

at selected locations resist lateral loads (Option c) 
80 VULNERABILITY ASSESSMENT 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems (continued) 

6 Structural Components and Systems (continued) 

ID Building Characteristics Attribute Options 

6.1 

(cont)

Structural System (continued) 

d Precast tilt-up, Frame with Infill, Reinforced 

Masonry, or Belt Truss 

Precast tilt-up construction is typically used for mixed use 

office, manufacturing and warehouse, or large retail facilities. 

Such buildings are low-rise (between one and three stories). 

Perimeter walls resist lateral loads and, in some cases, braced 

frames are located in the interior to support large-span roof and 

floor diaphragms. 

Example of precast tilt-up R&D building (Option d) 

Frame buildings with infill are typically pre-1950s vintage 

steel frame structures, in which the entire steel frame is cast 

within concrete for fire-proofing purposes and then clad with a 

brick or stone veneer; in other instances the perimeter frames 

are fully encased in exterior unreinforced masonry. The infill in 

this case may not be well 

connected into the frame and 

therefore can fail easily in the 

event of an explosive attack. 

In many cases, a distinguishing 

feature of this construction type 

are spandrels between column 

lines.

Steel frame with infill spandrel diagram (Option d). 

Illustration courtesy of David Shafer, Architect.

Options (Continued): 

d Precast tilt-up, or frame with infill, or 

reinforced masonry, or belt truss - This 

option covers buildings having one of the 

following types of structural systems: (1) precast 

tilt-up, (2) concrete or steel frame with unreinforced 

masonry infill walls, (3) reinforced masonry walls, 

or (4) framing system with diagonal bracing at 

selected locations. Precast tilt-up buildings are 

low-rise, with precast concrete perimeter panels 

that are cast on site and tilted up into place. Floor 

and roof framing is of light frame construction. 

Frame with infill buildings are typically older 

steel frame structures with concrete or masonry 

infill between exterior columns. Reinforced 

masonry wall buildings are typically low- or midrise, with reinforced grouted brick or concrete 

block masonry walls that support floor and roof 

framing. Belt truss systems, which contain 

diagonal bracing at selected floor levels, are 

typically used in high-rise construction. 

Three-dimensional schematic of building with precast 

tilt-up construction (Option d) 
VULNERABILITY ASSESSMENT 81 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems (continued) 

6 Structural Components and Systems (continued) 

ID Building Characteristics Attribute Options 

6.1 

(cont)

Structural System (continued) 

Reinforced Masonry wall buildings generally have 

punched openings with substantial wall area and light-frame 

floor/roof construction. This structural system type is often 

used in instances where building function is more important 

than the appearance. It may be used for educational, 

governmental or health facilities, but is typically not used for 

high-rise construction. The masonry may be disguised by the 

façade, so some internal inspection may be needed to confirm 

this construction type. 

Example of reinforced masonry school (Option d) 

Belt Truss construction in high-rise buildings typically 

consists of diagonal braces at selected floor levels, which may 

be visible on the building exterior, or hidden by louvers. 

Often belt trusses are located at mechanical equipment floor 

levels because there aren’t any windows at these levels, and 

extra bracing may be needed due to a larger floor-to-floor 

height required for mechanical equipment. 

Mid-height mechanical equipment floor (Option d) 

Options (Continued): 

d Precast tilt-up, or frame with infill, or 

reinforced masonry, or belt truss 

(continued)

Three-dimensional schematic of building with 

reinforced masonry construction (Option d) 

Three-dimensional schematic of building with belt truss 

(Option d). Illustration courtesy of David Shafer, 

Architect.
82 VULNERABILITY ASSESSMENT 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems (continued) 

6 Structural Components and Systems (continued) 

ID Building Characteristics Attribute Options 

6.1 

(cont)

Structural System (continued) 

e Light-Metal Frame, Brick, or Timber 

Light Metal Frame buildings are one story and 

typically house mechanical equipment or storage. 

These buildings are clad in light-gage metal stud 

construction at roofs and walls that would have little 

resistance to very high explosive loads. 

e Light-metal frame, or brick, or timber - This 

option covers buildings having one of the following 

types of structural systems: (1) light-metal frame, 

(2) unreinforced brick bearing wall, or (3) timber (wood) 

stick-frame or post and beam construction. Light-metal 

frame buildings are pre-engineered and pre-fabricated 

structures, with steel rod tension-only bracing in the 

longitudinal direction and tapered steel wide-flange 

moment-frames in the transverse direction. Unreinforced 

brick buildings are typically older structures with thick 

bearing perimeter walls and wood frame floors. 

Timber “stick frame” and “post and beam” structures 

are typically residential or office buildings. 

Three-dimensional schematic of light metal frame (Option e) 
VULNERABILITY ASSESSMENT 83 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems (continued) 

6 Structural Components and Systems (continued) 

ID Building Characteristics Attribute Options 

6.1 

(cont)

Structural System (continued) 

Brick masonry buildings are typically older buildings with little or 

no reinforcement within their walls and light-frame floor/roof 

construction. These buildings are differentiated from their 

reinforced counterparts by the thickness of their exterior walls. 

Reinforced masonry and cast-in-place bearing walls are typically 

6-to-8 inches thick while unreinforced masonry walls can vary 

from 12 inches for one- or two-story buildings up to 24 inches for 

taller buildings. 

Timber buildings are either of “stick frame” or “post and beam”

construction. Stick frame buildings are typically single-family or 

multi-unit residential buildings with exterior and interior bearing 

walls providing the principal means of gravity support. 

Post and beam buildings have larger volume interior spaces such 

as those in warehouses and low-rise institutional buildings. Deep 

beams or large wood-frame trusses span between 20 and 80 feet 

to large posts (8 inches or greater in each dimension). 

Wood-frame buildings are of “light” construction and do not 

possess the mass and strength needed to resist the effects of a 

relatively close-in explosive event. However, these buildings are 

highly ductile, with stick frame construction providing a good 

measure of redundancy that would be effective in resisting the 

impacts of a far-range explosive event and mitigating the 

potential spread of damage, avoiding progressive collapse. 

Heavy timber, post and beam building (Option e) 

e Light-metal frame, or brick, or timber 

(continued)

Three-dimensional schematic of unreinforced brick 

masonry construction (Option e)

Three-dimensional schematic of wood frame 

residential type construction (Option e)
84 VULNERABILITY ASSESSMENT 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems (continued) 

6 Structural Components and Systems (continued) 

ID Building Characteristics Attribute Options 

6.2 Number of Bays in the Short 

Building Direction 

A “bay” refers to the space between two columns. In most 

cases, the building footprint is wider in one direction than in 

the other. The “short direction” refers to the smaller footprint 

direction. The number of bays in the short building direction 

is an indication of its ability to remain standing in the event of 

the loss of a primary supporting member such as a column. 

The higher the number of bays, the higher the chances are 

that it will withstand the loss of a column or other primary 

load carrying element. 

Note that the shorter building width does not always 

correspond to the number of bays. The bay sizes could be 

longer in one direction than in the other. Also note that the 

column spacing may be different on the building exterior than 

on the interior so the interior of the building should be 

inspected. 

Example three bay buildings in short direction 

(Option b). A small number of bays is common for casino 

hotels, which typically have a single long corridor with rooms 

on either side on each floor.

Options: 

a 5 or more bays

b 3 to less than 5 bays 

c less than 3 bays 

Option c: Option b: 

1 bay (less than 3) 3 bays (3 to less than 5). 

Illustrations courtesy of David Shafer, Architect. 

Seven bay building in short direction (Option a) 

One bay building in short direction (Option c)
VULNERABILITY ASSESSMENT 85 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems (continued) 

6 Structural Components and Systems (continued)

ID Building Characteristics Attribute Options 

6.3 Column Spacing (ft) 

The column spacing or structural bay size is the distance 

between column centerlines or bearing walls along each 

principal direction. Building columns and cross-walls that are 

closely spaced do not support as much of the weight of the 

building as those that are further apart due to the relative 

tributary area that each column supports from floor to floor. 

The screener should determine the typical spacing between 

columns/bearing walls in each principal direction and use the 

maximum of these values to determine the distance for use in 

completing the Data Collection Form. 

A laser distance measuring tool is helpful in the field for 

determining the column spacing. 

Example of building with columns spaced 40-to-60 

feet apart (Option d) 

Options: 

a less than 15 feet

b more than or equal to 15 ft, less than 25 ft 

c more than or equal to 25 ft, less than 40 ft 

d more than or equal to 40 ft, less than 60 ft

e more than or equal to 60 ft

 

Building with columns spaced less than 15 feet apart 

for full height of building (Option a). Photograph 

courtesy of www.aviewoncities.com. 
86 VULNERABILITY ASSESSMENT 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems (continued) 

6 Structural Components and Systems (continued)

ID Building Characteristics Attribute Options 

6.4 Column Height (ft) 

The column height refers to the height of a column that 

is not braced by a floor system or by beams in two 

directions. Often the lobby area or the building exterior 

will have greater heights than typical floor levels. The 

column height is an indication of the stability of the 

structure. Taller columns, particularly if they are 

slender, will have a larger chance of failing in the event 

of an explosion than shorter or stouter columns. 

Select the worst case scenario for this Building 

Characteristic (i.e., pick the longest column supporting 

the most number of floor levels). 

Note that in some cases there may be very long columns 

that are not under the main foot print of the building 

and are supporting only a few floor levels. These are 

not the columns to select for this Building Characteristic. 

Instead select the longest column supporting the tower. 

Options: 

a less than 12 ft 

b more than or equal to 12 ft, less than 24 ft

c more than or equal to 24 ft, less than 36 ft

d more than or equal to 36 ft

 

Less than 12 ft column height (Option a) 

 

Column height in the 12-to-24 ft range (Option b) 
VULNERABILITY ASSESSMENT 87 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems (continued) 

6 Structural Components and Systems (continued)

ID Building Characteristics Attribute Options 

6.5 Publicly Accessible Column 

The vulnerability of publicly accessible columns to explosive loading 

depends on the exposure of the columns to a potential weapon and 

how much of the column (tributary area) would be loaded. Optional 

attributes for this building characteristic are ‘none’, ‘yes, massive’, and 

‘yes, slender’, where ‘massive’ and ‘slender’ refer to column size. 

Slender refers to columns that have a height-to-width ratio of more 

than 5, and massive refers to columns that have a height-to-width 

ratio of less than 5. 

Slender columns are more common on modern and/or steel buildings, 

whereas massive columns are more common on older and/or concrete 

buildings. 

The existing column conditions vary, depending on the architecture 

and structural system of the building: 

P Protected – Columns that are located behind and separated from 

the building facade and are enclosed by an architectural cover 

that extends at least 6 inches from face of column. 

P Inside Wall – Columns that are part of the exterior building 

facade, such as a steel frame with concrete or masonry infill 

where the infill also serves as the exterior wall. 

P Bracing Curtain Wall – Columns with an exterior curtain wall 

attached along its height, where the column would potentially 

be loaded for a full column bay width of area. 

Example of massive, publicly accessible column in the 

basement of a concrete building (Option b) 

Options: 

a None

b Yes, massive

c Yes, slender

Example of a publicly accessible massive column 

(Option b) 

Example of a publicly accessible slender column 

(Option c)
88 VULNERABILITY ASSESSMENT 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems (continued) 

6 Structural Components and Systems (continued)

ID Building Characteristics Attribute Options 

6.6 Transfer Girder Conditions 

Transfer girders are typically long-span beams supporting a 

discontinuous column above. They typically span over high 

volume areas such as a main lobby, loading dock or 

auditorium. 

Transfer girders supporting an upper-story column may be 

especially hazardous if they support disproportionately large 

loads when compared to girders supporting floor areas at only 

one level. The failure of a transfer girder or the column that 

supports it could potentially initiate a progressive collapse, if 

the structural design does not otherwise provide a means to 

resist such a failure. 

Interior transfer girders are the most challenging to identify. 

Sometimes there is a very long clear span in the lobby of a 

building, which may be an indication that the above ground 

floors have closer column spacing. To verify this, it is helpful to 

look at the above ground floor levels to see if the long span 

exists everywhere or just on the ground level. 

Another indication of a transfer condition is if there is a regular 

spacing of columns in both directions, except for one location 

where it looks like a column is missing. In this case, attempt to 

verify that on the floor above there is not a column that is 

“missing”. 

This Building Characteristic can be difficult even for trained 

structural engineers to identify with certainty, based on a visual 

inspection alone. Inspection of structural drawings by an 

engineer and a discussion with the site representative is 

necessary to verify these conditions. Additional guidance is also 

available in other FEMA Risk Management Series documents, 

including FEMA 426, Reference Manual to Mitigate Potential 

Terrorist Attacks Against Buildings. 

Options: 

a None – all columns are continuous from roof to 

foundation 

b Interior girder supporting one column – a 

beam/girder that spans over an interior space 

and supports one column above 

c Interior girder supporting more than one 

column – a beam/girder that spans over an 

interior space and supports more than one column 

d Exterior girder supporting one column – a 

beam/girder that is located along the perimeter of 

the building and is supporting one column above 

e Exterior girder supporting more than one 

column – a beam/girder that is located along 

the perimeter of the building and is supporting 

more than one column above 

NOTE: THIS BUILDING CHARACTERISTIC IS HEAVILY 

WEIGHTED IN THE SCORING. IT IS VERY IMPORTANT TO 

SELECT THE APPROPRIATE OPTION TO GET AN 

ACCURATE SCORING FOR THE BUILDING.

Examples of transfer girder conditions:

Option b 

Option d 

Illustrations courtesy of David Shafer, Architect. 
VULNERABILITY ASSESSMENT 89 

Table 12 Guidance on Vulnerability Assessment: 6. Structural Components and Systems (continued) 

6 Structural Components and Systems (continued)

ID Building Characteristics Attribute Options 

6.6 

(cont) 

Transfer Girder Conditions 

(continued) 

Example of transfer beam to create wide service entry at 

building exterior (Option d)

6.7 Structural Enhancements and 

Weaknesses 

This building characteristic is intended to account for 

enhancements or weaknesses that will serve to 

improve or downgrade performance of a structural 

system or individual elements (e.g., slabs, beams and 

columns). Inspection of structural drawings by an 

engineer and a discussion with the site representative 

are necessary to verify these options. If this is not 

possible, than assume Option c (None), unless the 

building being assessed is an older building that has 

not been maintained (as evidenced by cracked or 

broken exterior elements), in which case Option d 

(Marginal) or Option e (Substandard) should be 

selected. 

Note that certain public buildings built after 1993 in 

cities like New York City and Washington, DC, have 

undergone some level of required hardening. 

Options: 

a Hardened - a building designed to resist the effects of 

explosive attack 

b Robust - a building designed or retrofitted to meet 

current extreme loading conditions related to high levels 

of hurricane or earthquake loads, or designed to resist 

progressive collapse 

c None - The building does not have any structural 

enhancements or weaknesses, as described by the 

other attribute options. This is the most common case. 

d Marginal - buildings designed using old versions of 

codes that are no longer considered acceptable for 

meeting serviceability conditions, or are designed using 

materials or connections that have been shown to 

perform poorly in abnormal loading situations. This 

option may be selected in some cases if the building 

has not been maintained well (e.g., corrosion or large 

cracks are visible). 

e Substandard - buildings that are designed to a level 

that has extremely little, if any, reserve strength to 

withstand any abnormal loads without catastrophic 

failure.
90 VULNERABILITY ASSESSMENT 

MECHANICAL/ELECTRICAL/PLUMBING 

(MEP) 

echanical, Electrical and Plumbing systems are often not 

readily observable from the building exterior. A tour of 

the interior mechanical areas, review of drawings and an 

interview with the facilities manager is recommended to ensure that 

the vulnerability of these systems are captured during the screening 

process. 

Four MEP building characteristics are addressed by the Data Collection 

Form (see Figure 10). Guidance and information to how to choose 

between attribute options for the building characteristics pertaining to 

Vulnerability Rating of the mechanical, electrical, and plumbing 

components and systems are provided in Table 13. 

Figure 10 Page 8 of Data Collection Form, Vulnerability Assessment (Part IV), 

Mechanical/Electrical/Plumbing Systems Contributing to Vulnerability Rating. 

M
VULNERABILITY ASSESSMENT 91 

Table 13 Guidance on Vulnerability Assessment: 7. Mechanical/Electrical/Plumbing Systems 

7 Mechanical/Electrical/Plumbing Systems 

ID Building Characteristics Attribute Options 

7.1 Primary External Air-Intake 

Conditions 

The likelihood of a CBR contaminant being introduced into a 

building’s air system is dependent on the accessibility to the 

building’s external air-intake. 

Air-intakes are often located at ground level because mechanical 

rooms and garages are located at or below ground level in 

buildings. Some air-intakes are located below grade with 

sidewalk grates over them, and these are generally the most 

vulnerable if they are in public areas. Sometimes air-intakes at 

ground level service only the garage and not the critical 

equipment or occupied spaces. Wall-mounted intakes are usually 

covered with louvers. These are also vulnerable if they are at a 

height that can be easily accessed by a person on the sidewalk or 

street. 

The vulnerability of occupants to a CBR contaminant being 

introduced into a building’s air-intake system depends on many 

variables such as prevailing winds, distance from the release, 

height of the building, air-pressure differential between inside 

and outside, and air-tightness of the facade. Another variable is 

the location of the air-intake along the height of the building. 

The screener should determine where air-intakes are located 

relative to the exterior of the building. Once air-intakes are 

located, the screener should determine which of the five options 

indicated best represents the existing condition. 

It should be noted that the rapid visual screening procedure for 

assessment of exterior air-intake conditions is intended as an 

initial assessment, and is not comprehensive. More detailed 

investigation of this issue should be performed by a security 

expert with extensive experience in performing complicated and 

exhaustive threat assessments of exterior air-intake conditions. 

Mechanical rooms and intakes at upper floors of highrise building (Option a)

Options: 

a Greater than 30 ft (above ground level) or 

roof – The primary air-intakes are located on the 

roof of a building, at the third floor level, or higher 

b Greater than 10 ft but less than or equal 

to 30 ft (above ground level) - The air-intake 

is covered with a protective louver or grate with a 

minimum slope of 45 degrees 

c Between ground level and less than or 

equal to 10 ft (above ground level) - The 

air-intake is covered with a protective louver or 

grate with a minimum slope of 45 degrees, and is 

protected by security fencing maintaining access 

at least 30 feet away from the air intake louver 

d At ground level - the air-intake is in a public 

area that has surveillance as a means to deter 

delivery of a CBR contaminant 

e Below grade, or at ground level with 

unrestricted access

NOTE: THIS BUILDING CHARACTERISTIC IS HEAVILY 

WEIGHTED IN THE SCORING. IT IS VERY IMPORTANT TO 

SELECT THE APPROPRIATE OPTION TO GET AN 

ACCURATE SCORING FOR THE BUILDING.

Air-intake about 15 ft above ground (Option b) 

Air-intake is above ground but less than 10 ft from 

ground surface (Option c) 
92 VULNERABILITY ASSESSMENT 

Table 13 Guidance on Vulnerability Assessment: 7. Mechanical/Electrical/Plumbing Systems (continued) 

7 Mechanical/Electrical/Plumbing Systems (continued) 

ID Building Characteristics Attribute Options 

7.2 Return Air-Intake System 

CBR filtration and detection are rare for all but the most high-risk 

buildings. If a building has CBR filtration and detection systems, it is 

likely not a suitable candidate for the rapid visual screening procedure 

and should have a more sophisticated assessment performed. 

It will be necessary to question the site representative or facility 

engineer to ascertain whether the return air system is ducted or 

unducted. Ducted return air is less vulnerable than unducted or plenum 

air systems that are, for instance, under the floor or through corridors. 

The following sketches of typical building cross sections illustrate the 

difference between ducted and unducted air return systems. 

Ducted air return system Unducted air system 

(Option b) (Option c) 

‘Subject to Buoyancy’ is an attribute option that relates mainly to 

connecting tunnels. For example in a building that is connected to an 

adjacent subway station by a tunnel, buoyancy-driven flows will 

transport contaminants from the subway into the building under certain 

conditions. (Typically buoyancy only pertains to buildings where there 

is a train station under the building.) 

Subject to buoyancy condition (Option d)

Options: 

a Ducted secured - air-handling equipment 

rooms are ducted and inaccessible in secure 

observable locations 

b Ducted accessible - the air-return system is 

ducted but accessible to the public 

c Unducted - the air-return system is unducted 

d Subject to buoyancy - the air-return system 

is subject to buoyancy because the building is 

situated above a tunnel (e.g., subway tunnel) 

NOTE: THIS BUILDING CHARACTERISTIC IS HEAVILY 

WEIGHTED IN THE SCORING. IT IS VERY IMPORTANT 

TO SELECT THE APPROPRIATE OPTION TO GET AN 

ACCURATE SCORING FOR THE BUILDING.

Ducted accessible air return system (Option b) 

Unducted floor air return system (Option c) 

Air duct 
VULNERABILITY ASSESSMENT 93 

Table 13 Guidance on Vulnerability Assessment: 7. Mechanical/Electrical/Plumbing Systems (continued) 

7 Mechanical/Electrical/Plumbing Systems (continued) 

ID Building Characteristics Attribute Options 

7.3 Internal Air Distribution System 

High-risk areas such as lobby, loading dock, mail room and retail spaces 

within a building pose a potential for introduction of a CBR contaminant 

into the internal air distribution system. 

It will be necessary to question the site representative or facility engineer 

to ascertain the design of the internal air system and determine the most 

appropriate attribute option for this building characteristic. 

Options 

a High Risk Separated – areas of high 

risk that have their own dedicated HVAC 

system and are maintained with positive 

pressure to less secured areas of the 

building 

b Multi-Zoned/Single System Ducted - 

there is only one HVAC system serving the 

entire building and it is ducted 

c Single System/Unducted - there is only 

one HVAC system serving the entire 

building and it is unducted 

NOTE: THIS BUILDING CHARACTERISTIC IS 

HEAVILY WEIGHTED IN THE SCORING. IT IS 

VERY IMPORTANT TO SELECT THE APPROPRIATE 

OPTION TO GET AN ACCURATE SCORING FOR 

THE BUILDING.

7.4 Critical Utilities Located Close to High Risk 

Areas 

Protecting critical utilities will serve to mitigate post-event hazards, such 

as fire, and expedite evacuation and search and rescue efforts by 

emergency responders. 

Critical Utilities include: 

(1) emergency generators including fuel systems, day tank, fire 

sprinkler and water supply; 

(2) normal fuel storage; 

(3) main switchgear; 

(4) telephone distribution & main switchgear; 

(5) fire pumps; 

(6) building control centers; 

(7) uninterrupted power supply (UPS) systems controlling critical 

functions; 

(8) main refrigeration systems if critical to building operation; 

(9) elevator machinery and controls; 

(10) shafts for stairs, elevators, and utilities; and 

(11) critical distribution feeders for emergency power. 

It will be necessary to question the site representative or facility engineer 

to ascertain the location of critical utilities. Once located, the exposure to 

a potential threat and the implication of losing function should be 

evaluated using the ‘no’ and ‘yes’ options provided.

Options: 

a No - critical utilities are located at least 

50 feet away from high-risk areas that 

include lobbies, loading docks, mailrooms 

and parking, or are separated by a 

hardened partition wall (i.e., reinforced 

concrete or concrete masonry block wall 

anchored to floor framing at top and 

bottom 

b Yes - critical utilities are located within 50 

feet of high risk areas and are not 

separated by a hardened partition wall 

NOTES: 

A. THIS BUILDING CHARACTERISTIC IS HEAVILY 

WEIGHTED IN THE SCORING. IT IS VERY 

IMPORTANT TO SELECT THE APPROPRIATE 

OPTION TO GET AN ACCURATE SCORING FOR 

THE BUILDING. 

B. IT IS RECOMMENDED THAT THIS 

INFORMATION BE OBTAINED FROM A 

KNOWLEDGEABLE SITE REPRESENTATIVE.
94 VULNERABILITY ASSESSMENT 

SECURITY 

art V of the Vulnerability Assessment Rating portion of the 

Data Collection Form (see Figure 11) addresses security issues 

and characteristics. 

The effectiveness of security systems is highly dependent on proper 

design as well as operational and training procedures in place. Because 

of this, it is worthwhile for the screener to have some basic 

understanding of security principles. It is also recommended that 

security personnel are interviewed during the screening. Review of 

security systems documentation may also be of help. 

Figure 11 Page 9 of Data Collection Form, Vulnerability Assessment (Part V), Security Characteristics 

Contributing to Vulnerability Rating. 

Security building characteristics apply only for internal threats or 

external threats within 100 feet (i.e., within Zone 1). Security building 

characteristics are also a function of the scenario, i.e., intrusion, 

explosive or CBR. In total, five of the nine scenarios are affected by 

security measures: 

P
VULNERABILITY ASSESSMENT 95 

P 3 scenarios for Internal Threats -- Intrusion, Explosive Zone 1, 

CBRZone 1; and 

P 2 scenarios for External Threats -- Explosive, CBR 

Vulnerability assessment of the security characteristics begins with a 

review of the security-related detection systems available in the building 

and the determination of the effectiveness of each system. Detection 

systems considered by the assessment process are described in Table 

14, and effectiveness criteria are provided in Table 15. The screener 

initially characterizes the overall effectiveness of the detection systems 

and documents the effectiveness on the Security Vulnerability matrix, 

which is provided in Figure 12. The objective of this initial step is to 

assess the ability of a given security system in thwarting intrusion, 

explosive or CBR threat separately. 

The screener then documents the number and effectiveness of the 

security detection systems on the Data Collection Form (Field 

Version). The screener should note that, at tightly controlled sites, 

there may be more than one layer of security system. For instance 

there may be security guards at the site entrance and at the garage 

entrance. In this case, the screener may decide that there are two 

systems operating, one at each layer of security. It is also noteworthy 

that certain systems may be effective for detecting one type of threat, 

but not another. For instance, an electronic screening system may be 

effective for detecting an explosive but not a CBR threat. 

Table 16 provides guidance and information to assist in selecting 

attribute options pertaining to Vulnerability Rating of the Security 

system(s). The information is organized first by threat type, and then 

threat scenario, which is different from the formulation used for other 

aspects of the Vulnerability Rating. For each of the five threat 

scenarios affected by security measures (see above), two building 

characteristics are defined: 

P Number of Detection Systems; and 

P Overall Security Effectiveness. 
96 VULNERABILITY ASSESSMENT 

Table 14 Building Security Detection Systems and Desired Attributes 

Intrusion Detection P The facility has perimeter intrusion alarms

P Intrusion alarms around the perimeter are of the following types: contact sensors, motion sensors, 

cameras with motion sensors; or an equivalent system 

P Intrusion alarms function in the manner appropriate for the facility 

P The alarms are tested frequently 

P The alarm system is locally audible when activated 

P The alarm system and/or major components of the alarm system are younger than their design life. 

P The alarm system is approved by Underwriters Laboratories, Inc. (UL approved) 

P Output from the intrusion sensors and/or detection devices are transmitted outside the facility

Video Surveillance and Assessment P The perimeter is monitored by cameras 

P The cameras are functioning as required by facility 

P The cameras are in protective housing 

P The cameras monitor and record on a 24 hours/day, 7 days/week basis 

P The cameras are tested frequently 

P Cameras are present at the following locations 

o Entrance gate that is manned or unmanned if the facility is in a suburban area and has 

grounds before one reaches the building(s) 

o The perimeter of the building envelope monitoring areas such as entrances/exits, internal fire 

exits and any utility such as electric boxes 

o HVAC intakes, if accessible from the ground. 

o Entrance to any parking area, especially if underground 

o The lobby areaa

o Turnstile or other access screening area 

o Elevator lobby 

o Loading dock 

o Mail room entrance (if entrance is external)

Security Guards 

Key attributes for this system type are the 

number and placement of guards at the 

public access points for pedestrians and 

vehicles. Also of importance is the visual 

inspection of people and contents as they 

enter on to the property or into the 

building. Security guards locations depend 

very much on the current needs of that 

facility. Generally, they should be found at 

an entrance gate (if there is one), within 

the lobby at the reception desk and at the 

screening point to the core of the building 

(i.e., turnstiles or other type of entrance). 

P There are security guards at the facility 

P Security guards are monitoring or patrolling the perimeter 

P Security guards are on site 24 hours/day, 7 days/week 

P Security guards are in uniform or dress suit attire 

P Security guards possess communication devices 

P There is a combination of static and roving posts 

P The security guard system meets license requirements of the state 

P Security guards have received a formal training program and it is on going 

P Security guards are stationed at access points and are examining documentation of the drivers to 

verify authorization 

P Security guards physically inspect vehicles 

P Security guards positioned at access points are armed 

P Security guards that control the active barriers are stationed in a protective structure/building or 

ballistic resistant booth
VULNERABILITY ASSESSMENT 97 

Table 14 Building Security Detection Systems and Desired Attributes (continued) 

Security Lighting 

The two primary purposes of lighting are to 

create a psychological deterrent to 

intrusion and to enable detection. It is 

recommended that the screeners visit the 

site at night to see how effective the 

lighting is. For this building characteristic, 

only proprietary lighting is to be 

considered, not municipal provided 

lighting. 

P There is external proprietary lighting at the perimeter, exterior of building envelope, entrances, 

emergency exits, and parking areas 

P The lighting appears adequate in order to identify vehicles and pedestrians at the aforementioned 

areas 

P The lighting properly illuminates all facility roads 

P Perimeter illumination is adequate for the exterior "clear zone" area (if applicable) 

P The perimeter illumination scheme consists of overlapping cones of light 

P The facility has a separate emergency lighting system that activates when the main lighting fails 

P There is adequate exterior and interior lighting to provide a safe and secure environment for facility 

operations 

P All exits are equipped with emergency lights and illuminated exit signs 

P Protective lighting is tested periodically 

P All switch boxes, photoelectric cells, and/or automatic timers are secure 

P Someone is assigned responsibility for immediate replacement of burned out luminaries 

P The current security lighting system is cost effective 

P There is an emergency back-up power system for the protective lighting system

P Emergency lighting is available for the data center if a power failure should occur 

P The facility's power supply is monitored to detect the occurrence of electrical transients 

P Emergency lighting in all facility areas illuminates fire extinguishers even if there is a power outage

Vehicle Access Control and Screening 

This security-system addresses the control 

of vehicles to ensure that only employees 

and authorized visitors are permitted entry 

to the site or building. Secure vehicle 

access points are entrances that are 

physically protected using technology, 

security personnel, and/or active barriers 

at the locations where vehicles are 

permitted onto the property. 

P There are procedures for inspecting all vehicles permitted within the perimeter zone 

P Vehicles are searched when entering the perimeter zone 

P Vehicles are searched when leaving the perimeter zone 

P All individual members of a group entering or leaving the perimeter zone in the same vehicle are 

checked for authorization and identification 

P The access points are monitored by video assessment and surveillance systems (i.e., cameras) 

P The access points are electronically controlled (e.g., active vehicle anti-barrier, access card) 

P X-ray or CBR detection equipment is used for screening; dogs may be used to inspect 

vehicles/packages

Pedestrian Access Control and 

Screening 

This security system addresses the control 

of pedestrians to ensure that only 

employees and authorized visitors are 

permitted entry to the site or building. 

Secure pedestrian access points are 

entrances that are physically protected 

using technology, security personnel, 

and/or active barriers at the locations 

where pedestrians are permitted onto the 

property and into secure areas. 

P Security personnel control all perimeter openings to the facility 

P There is a designated individual responsible for authorizing building entry, including when it is 

unattended 

P There is a procedure to control badges, keys, combinations, and/or cards used for entry to the facility

P Authorization lists and control mechanisms allowing entry into the facility are updated when a 

person's authorization for entry has been revoked 

P There are effective procedures in place for authorizing perimeter zone entry 

P There is an independent verification of the requests for perimeter entry authorization 

P Positive identification is required for a person to receive authorization for perimeter entry 

P Entrances or gates to the perimeter are zone controlled 

P All entrances to the perimeter zone are controlled during normal working hours 

P All entrances to the perimeter zone are controlled after normal working hours 

P All entrances to the perimeter zone are controlled during emergencies 
98 VULNERABILITY ASSESSMENT 

Table 14 Building Security Detection Systems and Desired Attributes (continued) 

Pedestrian Access Control and 

Screening (continued) 

P Entry to the perimeter zone is controlled by a guard(s) 

P Entry to the perimeter zone is permitted by a guard (i.e. verifying ID from a list, visual recognition, 

checking badge) 

P The access points are monitored by video assessment and surveillance systems (i.e., cameras) 

P The access points are electronically controlled (e.g., active vehicle anti-barrier, access card)

Package Screening P Vehicles are screened by a security guard before they are permitted entry 

P A mirror is used to inspect the undercarriage of any entering vehicles 

P The interior of any entering vehicles is inspected 

P The shipping/receiving area or building is surrounded by a fence with a controlled access gate 

P Access to all loading and unloading areas and platforms is strictly controlled 

P All loading and unloading areas and platforms are designed so vehicle operators do not have direct 

access to merchandise storage areas without passing through a monitored area such as shipping or 

receiving processing office 

P All freight doors are secured when not in immediate use 

P Security officers regularly patrol the shipping/receiving areas 

P The receiving and shipping areas are physically separated 

P There are separate areas for employee and visitor parking 

P All parking and building areas are well lit 

P There are surveillance cameras located in the inventory area 

P All areas are covered by a monitored intrusion alarm 

P Employee's entrances are monitored by electronic access controlled keypads that record all employee 

pass code transactions 

P Employee pass code transaction records are regularly reviewed by security for irregularities 

P All shipments are loaded and unloaded only by company personnel 

P All shipments are checked against the corresponding manifests to insure that all merchandise items 

listed are physically accounted for 

P There is an established procedure for inspecting merchandise at the beginning and end of a trip or 

route 

P There are special procedures and documentation for removing packages from an area or building 

P An individual has been assigned direct responsibility for the supervision and monitoring of high value 

storage areas 

P There are special inspection procedures for personnel or merchandise entering an area such as metal 

detectors, X-ray, BCR machines, or dogs 

P There are cameras strategically located at the screening areas

 
VULNERABILITY ASSESSMENT 99 

Table 15 Examples of Building Security System Effectiveness Criteria 

Example Criteria 

Regardless of how many security systems 

are provided, if they are not effective, they 

are will not be helpful for thwarting 

attacks. The criteria provided to the right 

are examples of criteria that render 

security systems effective. 

P Vehicle access points have been minimized 

P Employee and public vehicle entry points are separated 

P Access points are designed so that a vehicle denied access can be safely turned away from the facility. 

P The deportment of guards is professional and alert as opposed to guards that lean against walls or are 

unobservant. 

P Active barrier are activated at all times except when an authorized vehicle is permitted into the 

facility. 

P Redundant systems are provided

P The loading dock is designed so that vehicles refused entry can exit without first entering the facility 

P There are separate entrances for truck and pedestrian deliveries 

P The loading dock is located on the ground floor, away from any major entrance or exit. 

P There is adequate queuing, which is well placed, so trucks are not lined up in front of the building

8.1 Internal Threat 8.2 External Threat 

(Zone 1) 

Systems 8.1.1 

Intrusion 

8.1.2 

Explosion 

8.1.3 

CBR 

8.2.1 

Explosion 

8.2.1 

CBR 

Intrusion Detection 

Video Surveillance 

and Assessment 

Security Guard 

Security Lighting 

Vehicle Access 

Control and Screening 

Pedestrian Access 

Control and Screening 

 

Package Screening 

Figure 12 Security System Effectiveness Matrix. For each system in place that is able to 

detect, delay or deny an aggressor from executing the listed threat scenarios, 

indicate the effectiveness of the overall system in the appropriate box with 

one of the following descriptors: 

(a) Highly effective; 

(b) Effective; 

(c) Meets Minimum Requirements; 

(d) Ineffective; or 

(e) No Security.
100 VULNERABILITY ASSESSMENT 

Table 16 Guidance on Vulnerability Assessment: 8. Security 

8 Building Security

ID Building Characteristics Attribute Options 

8.1 Internal Threat 

8.1.1 Intrusion 

8.1.1.1 Number of Detection Systems 

Redundant detection systems are highly desirable. The screener is given 

the option of selecting 3 systems, 2 systems, 1 system or none. 

8.1.1.2 Overall Security Effectiveness 

Regardless of how many security systems are provided, if they are not 

effective, they are will not be helpful for thwarting attacks. This building 

characteristic is intended to capture the overall effectiveness of the 

systems collectively. 

8.1.2 Explosion 

8.1.2.1 Number of Detection Systems 

Redundant detection systems are highly desirable. The screener is given 

the option of selecting 3 systems, 2 systems, 1 system or none. 

8.1.2.2 Overall Security Effectiveness 

Regardless of how many security systems are provided, if they are not 

effective, they are will not be helpful for thwarting attacks. This building 

characteristic is intended to capture the overall effectiveness of the 

systems collectively. 

8.1.3 CBR 

8.1.3.1 Number of Detection Systems 

Redundant detection systems are highly desirable. The screener is given 

the option of selecting 3 systems, 2 systems, 1 system or none. 

8.1.3.2 Overall Security Effectiveness 

Regardless of how many security systems are provided, if they are not 

effective, they are will not be helpful for thwarting attacks. This building 

characteristic is intended to capture the overall effectiveness of the 

systems collectively. 

Options*: 

a 3 or more systems

b 2 systems

c 1 system

d None

Options*: 

a Highly Effective

b Meets minimum requirements

c Ineffective

d No security

Options*: 

a 3 or more systems

b 2 systems

c 1 system

d None

Options*: 

a Highly Effective

b Meets minimum requirements

c Ineffective

d No security

Options*: 

a 3 or more systems

b 2 systems

c 1 system

d None

Options*: 

a Highly Effective

b Meets minimum requirements

c Ineffective

d No security
VULNERABILITY ASSESSMENT 101 

Table 16 Guidance on Vulnerability Assessment: 8. Security (continued) 

8 Building Security 

ID Building Characteristics Attribute Options 

8.2 External Threat (Zone 1) 

8.2.1 Intrusion 

8.2.1.1 Number of Detection Systems 

Redundant detection systems are highly desirable. The screener is given 

the option of selecting 3 systems, 2 systems, 1 system or none. 

8.2.1.2 Overall Security Effectiveness 

Regardless of how many security systems are provided, if they are not 

effective, they are will not be helpful for thwarting attacks. This building 

characteristic is intended to capture the overall effectiveness of the 

systems collectively. 

8.2.2 CBR 

8.2.2.1 Number of Detection Systems 

Redundant detection systems are highly desirable. The screener is given 

the option of selecting 3 systems, 2 systems, 1 system or none. 

8.2.2.2 Overall Security Effectiveness 

Regardless of how many security systems are provided, if they are not 

effective, they are will not be helpful for thwarting attacks. This building 

characteristic is intended to capture the overall effectiveness of the 

systems collectively. 

Options*: 

a 3 or more systems

b 2 systems

c 1 system

d None

Options*: 

a Highly Effective

b Meets minimum requirements

c Ineffective

d No security

Options*: 

a 3 or more systems

b 2 systems

c 1 system

d None

Options*: 

a Highly Effective

b Meets minimum requirements

c Ineffective

d No security

 

*NOTE: THIS BUILDING CHARACTERISTIC IS HEAVILY WEIGHTED IN THE SCORING. IT IS VERY IMPORTANT TO SELECT 

THE APPROPRIATE OPTION TO GET AN ACCURATE SCORING FOR THE BUILDING.

RISK ASSESSMENT RATING 103 

 RISK ASSESSMENT RATING 

OVERVIEW 

n this chapter, the calculation and interpretation of risk 

assessment ratings are discussed. 

The potential risk, R, to a building subjected to terrorist attack is 

defined as a function of the product of three factors across all threat 

scenarios as follows: 

α ( ) ( ) = == ×× = ×× ∑ ∑

9 9 10

10

1 1

 7.227 n n iii iii

i i

R CTV CTV (2)

where: 

 Ci = Consequences Rating for threat scenario i

Ti = Threat Rating for threat scenario i

Vi = Vulnerability Rating for threat scenario i

The multiplier of 7.227 (α , a scaling constant) and the 10th power 

summation formulation controls the limits of R such 

that9 9000 ≤ ≤ R . A power value of n =10 produced realistic and 

practical risk scores, when validated during three formal pilot studies 

of this procedure in two cities within the United States. 

Consequences rating refers to the relative importance of the building 

to an owner and the surrounding region, and the potential 

consequences of a terrorist attack. Threat rating refers to the 

attractiveness of the building to attack, analogous to a measure of the 

relative likelihood of the threat occurring. Vulnerability rating refers 

to the expected outcome, in terms of damage, casualties, and business 

interruption, given a threat is successfully carried out. 

The value of each of the parameters (C, T, and V) varies from 1 to 10, 

where 1 represents the lowest risk and 10 represent the highest 

contribution to risk. The various attributes that contribute to the 

overall value of C, T and V are embedded in the scoring design of the 

Data Collection Form. A detailed description of the numerical 

derivation of the risk scoring procedure is provided in Appendix C. 

DETERMINING THE RISK RATING 

he values for each of the risk factors determined on the Data 

Collection Form are tabulated on the Risk Scoring Worksheet. 

The risk rating for each threat scenario is then computed as the 

I

T
104 RISK ASSESSMENT RATING 

product of consequences rating (C), threat rating (T), and vulnerability

rating (V), where consequences rating, threat rating and vulnerability

rating are threat-specific and building-specific. The overall risk 

assessment rating for the building is then computed using Equation 2. 

An example of the use of the Risk Scoring Worksheet is shown in 

Figure 13. 

FEMA 455 RISK SCORING WORKSHEET 

THREAT 

SCENARIO Consequences 

(C) 

Threat 

Rating 

(T) 

 

Vulnerability 

Rating 

(V) 

Threat 

Scenario Risk 

Rating 

 

(C x T x V) 

Internal 

Intrusion 7.36 8.32 9.13 559 

Explosive 9.31 8.32 8.33 645 

CBR 8.77 8.32 7.68 560 

Explosive 

Zone I 9.31 9.17 8.96 765 

Zone II 9.31 10.00 8.56 797 

Zone III 9.31 10.00 8.68 808 

CBR 

Zone I 8.77 9.17 5.22 420 

Zone II 8.77 10.00 1.62 142 

Zone III 8.77 10.00 2.38 209 

A. TOTAL RISK RATING FOR BUILDING (using Equation 2) 6427 

Figure 13 Risk Rating Example. 

Note that the total risk rating is NOT a simple addition for the 

component values, but the 10th root of the sum of the de-aggregated 

risk scores each raised to the power of 10, as represented in 

Equation 2. Assuming cutoff scores to distinguish low, moderate, and 

high total risk scores at the one third and two third values of the 

maximum achievable score of 9000, low-risk scores are less than 3006, 

and medium-risk scores are less than 6003 but more than or equal to 

3006. Using these cutoffs, the total risk score for the example in Figure 

13 is considered a high-risk score. 

The de-aggregated values for each threat scenario and the individual 

risk factors can be used to obtain a more detailed understanding of the 

building’s risk. For each threat scenario and risk factor, the higher the 

score, the greater the risk contribution. For example, using the risk 

factor and threat scenario risk rating results shown in Figure 13, the 

following observations can be made about the building’s risk: 
RISK ASSESSMENT RATING 105 

P The external and internal explosive threats, with consequence 

ratings of 9.31, have the highest consequences in terms of damages, 

business interruption and casualties; 

P Explosive threats represent a greater risk than CBR threats; and 

P The greatest overall risk for this building is an external explosive 

threat located more than 300 feet but less than 1000 feet from the 

building. 

WEIGHTED BUILDING CHARACTERISTICS 

he Data Collection Form contains a limited number of building 

characteristics that have more importance in the overall risk 

scoring than others. In part this "heavier" weighting is a 

function of the importance of the individual building characteristic. In 

addition, weighting is used to balance the scoring, so that the building 

systems with fewer building characteristics have scores that are 

comparable to those with many building characteristics. The building 

characteristics with heavily weighted scoring require more careful 

consideration than the others, because a slight difference in scoring of 

these may cause a significant change in the overall risk score. The 

heavily weighted building characteristics are identified in the tables 

that provide guidance for selecting attribute options in the individual 

chapters for each of the three risk factors: Consequences, Threat 

Rating and Vulnerability Rating. 

A listing of the heavily weighted building characteristics is given below 

with the corresponding identification number (ID) on the Data 

Collection Form. 

P Number of Occupants (1.2, 2.2) 

P Replacement Value (1.3) 

P Physical Loss Impact (1.6) 

P Site Population Density (2.3) 

P Visibility / Symbolic (2.4) 

P Target Density (2.5) 

P Target Potential (2.7) 

P Unsecured Underground Access (3.4) 

P Transfer Girder Conditions (6.6) 

P Primary External Air Intake Conditions (7.1) 

T
106 RISK ASSESSMENT RATING 

P Return Air Intake System (7.2) 

P Internal Air Distribution System (7.3) 

P Critical Utilities Located Close to High Risk Areas (7.4) 

P Internal Threat - Security Systems (8.1) 

P Zone 1 Threat - Security Systems (8.2) 

EVALUATING THE RISK FOR MULTIPLE 

BUILDINGS IN A LOCALIZED AREA

his rapid visual screening procedure is well suited for obtaining 

the relative risk among buildings in a portfolio, community, or 

region, where each building is scored separately. In some cases it 

may be desirable to obtain a single risk rating for a group, or “cluster”, 

of buildings that are located in close proximity to each other in a 

particular area. In this context, a cluster is defined as a group of 

buildings within a 1-mile radius for an area with a total target density of 

10 or more for the three zones. 

To evaluate a single risk rating for a cluster of buildings, it is 

recommended that up to six building types be identified that are 

representative of buildings that exist in the cluster. The risk rating for 

the cluster is taken as the weighted average rating of these 

representative buildings, based on the number of buildings of each 

type in the cluster. 

EVALUATING THE RISK FOR 

INTERCONNECTED BUILDINGS 

his screening procedure was developed for use on individual 

buildings. For a facility with multiple interconnected buildings 

some care needs to be given to proper application of the 

procedure. 

Interconnected buildings may be joined by means of pedestrian 

passage ways that may or may not contain retail or other uses. Often, 

each of the buildings has a separate, distinct use, which has unique 

characteristics in terms of its risk. From an operational security 

viewpoint, the interconnected buildings may be reasonably considered 

one building. However, from a structural perspective often these types 

of interconnected buildings are structurally isolated and therefore an 

explosive attack on one may not mean the other building will be 

damaged. It Is also likely that there are separate ventilation systems 

with separate controls (which should be verified) for each building and 

T

T
RISK ASSESSMENT RATING 107 

possibly the passageways. For this reason, it is recommended that each 

structure is considered separately. Consideration of the 

interconnectedness may be addressed through careful consideration of 

the building characteristics that focus on collateral effects associated 

with an attack on a structure under, next to, or connected to the 

building under consideration. The screener will need to pay careful 

attention to the attribute options provided for these building 

characteristics to capture the impact of their interrelationship on the 

terrorist risk. If a single score is desired, the average of the scores for 

the individual buildings may be computed when the assessments are 

complete. 

INTERPRETATION OF THE RISK 

ASSESSMENT RATING 

he risk scoring procedure results in an aggregated rating for the 

building, which is a power formulated summation of the ratings 

attributed to the nine defined threat scenarios. It also provides 

de-aggregated risk ratings for each threat scenario. Both the 

aggregated and de-aggregated scores are shown on the Risk Scoring 

Worksheet. 

The aggregated and de-aggregated risk scores are identified as low, 

moderate or high risk in the electronic version of the tool by means of 

green, yellow and red color coding respectively. The cut-off scores are 

defined so that the low/moderate risk cut off is one third of the 

maximum range of scores (from 9 to 9,000), and the medium/high 

risk cut-off score is at two thirds of the maximum score range. These 

cut-offs were found to be accurate during the three pilot studies 

performed as part of the development of this procedure. 

The specific cut-off values defining low-, moderate-, and high-risk may 

vary based on the priorities of the stakeholders. Risk management 

decisions and prioritization for further studies can be based on the 

overall risk assessment rating. Buildings identified as high risk should 

receive the highest priority for further evaluation while buildings 

identified as low risk should receive lower priority. 

Decisions regarding moderate risk buildings would depend on the 

specifics of the risk management program and available resources. 

Regardless of the range in which the total ratings fall, the buildings can 

be ranked by overall risk assessment rating to determine the order in 

which further evaluation should be performed as resources become 

available. 

T
108 RISK ASSESSMENT RATING 

De-aggregated ratings for each threat scenario, including the average 

risk rating of the nine threat scenarios and the maximum risk rating 

among the nine threat scenarios, provide useful information to help 

prioritize further action. The results identify the relative contribution 

of each to the overall risk rating for the building. Using this 

information, a specific aspect of the building may be identified for 

further evaluation or a specialist in a given type of threat (e.g., CBR) 

could be hired to further study the risk to the building caused by a 

specific threat. 
CONCEPT MITIGATION OPTIONS 109 

 CONCEPT MITIGATION OPTIONS 

OVERVIEW 

he risk assessment process, using the tiered approach described 

in the chapter entitled “Performing a Rapid Visual Screening”, is 

designed to isolate the highest risk buildings. In this chapter, 

some basic concepts and qualitative guidance is provided to begin the 

process of developing mitigation options. Further guidance may be 

found in other publications within the FEMA Risk Management Series, 

including FEMA 452, Risk Assessment: A How-To Guide to Mitigate 

Potential Terrorist Attacks, Chapter 7, and FEMA 427, Primer for Design of 

Commercial Buildings to Mitigate Terrorist Attacks. 

USING THE RAPID VISUAL SCREENING 

PROCEDURE TO EVALUATE MITIGATION 

OPTIONS 

or each building that is considered for upgrade, a prioritization 

process needs to occur to isolate which site and building specific 

characteristics have the strongest influence on the risk score 

overall, or the risk score associated with the threat scenario(s) of most 

concern. 

The rapid visual screening procedure may then be used for beginning 

the mitigation design process by reviewing the attribute options for the 

critical building characteristics. Attribute options with lower scores will 

give lower risk scores. Generally the first attribute labeled (a) will have 

the lowest risk score, with the subsequent choices representing 

successively lower levels of protection. One or a combination of several 

options may be considered to investigate the impact on the risk score. 

The electronic database tool makes this type of investigation particularly easy by 

interactively modifying the attribute options to monitor the effect on the risk 

score.

A good place to start the mitigation evaluation process would be to 

review the heavily weighted building characteristics, which have 

especially high impact on the overall scoring: 

P Number of Occupants (1.2, 2.2) 

P Replacement Value (1.3) 

P Physical Loss Impact (1.6) 

T

F
110 CONCEPT MITIGATION OPTIONS 

P Site Population Density (2.3) 

P Visibility / Symbolic (2.4) 

P Target Density (2.5) 

P Target Potential (2.7) 

P Unsecured Underground Access (3.4) 

P Transfer Girder Conditions (6.6) 

P Primary External Air Intake Conditions (7.1) 

P Return Air Intake System (7.2) 

P Internal Air Distribution System (7.3) 

P Critical Utilities Located Close to High Risk Areas (7.4) 

P Internal Threat - Security Systems (8.1) 

P Zone 1 Threat - Security Systems (8.2) 

Improving the protection provided by any one of these building 

characteristics may be as effective as upgrading several building 

characteristics not on this list. 

Although quick and useful, there are some limitations to using the 

rapid visual screening procedure for mitigation concept evaluation 

including: 

P There are limited attribute options provided, which limits the types 

of mitigation types that can be considered; 

P Some of the attribute options are not useable for retrofit situations 

(they are more appropriate or cost effective for new construction) 

and; 

P Cross correlation between any two building characteristics may not 

be properly accounted for in the scoring for a given set of 

mitigation measures. 

In some cases, the building characteristic that controls the risk 

assessment is so inherent to the building or the site that it can not be 

changed, or the mitigation measures required seem excessive. This 

may be an indication that mitigation measures alone are insufficient 

for reducing the risk to tolerable levels and that critical assets may need 

to be relocated to another facility. 
CONCEPT MITIGATION OPTIONS 111 

PRACTICAL CONSIDERATIONS FOR 

EVALUATING MITIGATION OPTIONS 

ome additional guidance is given below for evaluating effective 

mitigation concepts. 

It is tempting to pick mitigation options based on ease of 

implementation and available funding, but if the mitigation is not 

reducing the risk much, then no real benefit has been achieved. For 

example, it may be inexpensive to apply security film to the windows, 

but the benefit may be very low for a building that is close to a major 

transportation artery, for instance. In this case, the risk of progressive 

collapse may far outweigh the risk of lacerations due to glass fragments, 

making a window upgrade nearly useless for reducing risk. This should 

be easily verified through use of the rapid visual screening procedure 

that captures information about setback and window design. 

Another example of an ineffective mitigation is to place film only on 

the windows on the first three floors, when credible explosive threat 

levels will cause hazardous glass breakage for the entire building. In 

the rapid visual screening procedure, this is accounted for by noting 

that the attribute option for security film assumes that the film has 

been applied to all or most of the building. An analogous example 

would be to place bollards only along part of the perimeter to resist a 

ramming threat. 

Tailoring an upgrade to a specific threat does not always make sense 

for a variety of reasons including the uncertainty associated with the 

threat size and the potential for the threat to change over the life of 

the building. For these reasons, it is often most effective to develop a 

set of mitigation options that optimize the inherent level of protection 

that the building is able to achieve. For instance, if the structural frame 

is the weakest part of the structural design for an explosive threat, it is 

cost prohibitive to perform a structural upgrade. In this case, the 

benefit of upgrading the exterior envelope to match the capacity of the 

frame is a more reasonable approach. 

It is always worthwhile to reduce the profile of the building to be less 

noticable. It may be sufficient to reduce the overall visibility of a 

facility, for instance, by eliminating or changing the signage to be less 

noticeable to passersby. In some cases it may be more beneficial not to 

place bollards along the curb (for instance if none of the other 

buildings on the block have bollards) so as not to draw attention to the 

building. Making the building more unobtrusive in these ways may be 

S
112 CONCEPT MITIGATION OPTIONS 

as effective as more expensive solutions. Note that this type of 

mitigation is not directly addressed in the rapid visual screening 

procedure. 

Also, beware of instituting mitigation measures that may reduce the 

perception of risk but not the actual risk. Some examples include: 

P using untrained guards who are unable to respond appropriately in 

an emergency; or 

P installing card access readers with alarms that are set off so often 

that no one pays attention. 

These attribute options would only be discerned by the rapid visual 

screening procedure if the screener observed building operations 

during the field visit. 

Finally, in some cases, mitigation measures can reduce the risk for a 

particular terrorist threat but worsen it for another threat that may be 

more apt to occur. One example is that by hardening the exterior 

envelope, the ability to easily get into and out of the building in an 

emergency may be compromised. Another example is that some 

materials that perform well for blast, perform poorly for other threats. 

For instance polyurethane has blast resistant properties but may 

generate toxic fumes in the event of a fire. 

Any mitigation product manufacturer who is being considered needs 

to be able to produce testing results that verify that the product resists 

a credible threat level. The threat needs to be fully quantified in the 

test report and the test specimen attachments need to correspond to 

the actual built condition in order for a test report to be useful for 

decision making (e.g., window frames and attachments need to be 

included for any window glass test). 

MITIGATION PROTECTION LEVELS 

epending on the acceptable level of risk for the facility, the 

mitigation measures may be selected to achieve a low, 

moderate or high level of protection. 

Examples of low, moderate and high levels of protection for a 

hypothetical building are provided in Table 17 for each of the building 

systems considered in the procedure. 

D
CONCEPT MITIGATION OPTIONS 113 

Table 17 Examples of Protection Levels for a Hypothetical Building 

Building System Low Moderate High 

Site Close street lane 

and use vehicles 

to block vehicle 

entrances at 

times of high 

alert 

Attractive street 

furniture around 

perimeter; drop 

arm at vehicle 

access points 

Fixed anti-ram 

barriers around 

perimeter; 

Wedge barrier at 

vehicle access 

points

Exterior Envelope Daylight security 

film on all 

windows 

Replace vision 

panels and 

strengthen 

structural framing 

from windows 

into floor system

Replace windows 

and upgrade 

walls to 

consistent level 

Architecture Optimize internal 

spaces to 

separate secure 

from unsecure 

spaces. 

Create an entry 

pavilion and 

loading dock 

area outside 

main footprint.

Offsite deliveries, 

parking and 

visitor screening. 

Structural Harden publicly 

accessible 

columns for 

credible design 

threat. 

Strengthen 

exterior frame 

connections to 

resist effects of 

column removal 

at first two 

ground levels. 

Strength exterior 

frame 

connections to 

resist effects of 

column removal 

at any floor level. 

MEP Raise air-Intakes Raise air-intakes,

Install a detection 

for contaminants 

Raise air-intakes, 

Install detection 

and filtration 

systems for 

contaminants

Security Screen all 

persons entering 

secured spaces 

Screen all 

persons at 

building entrance 

and at entrance 

to secured areas 

Screen all 

persons at 

property line, at 

building entrance 

and at entrance 

to secured areas 

NEXT STEPS 

To develop the mitigation options further, it is recommended that a 

team of experts in anti-terrorist design be engaged to verify the 

conclusions developed using the rapid visual screening procedure, and 

further improve the chances of effective mitigation measures being 

implemented. Such experts can be invaluable in performing analyses 

to evaluate effectiveness of various mitigation options and in assisting 

in the selection of mitigation products. A list of antiterrorist disciplines 

on the team may include: 
114 CONCEPT MITIGATION OPTIONS 

P Architect 

P Security Professional 

P Blast Engineer 

P Structural Engineer 

P MEP Engineer 

P Cost Estimator 

P General Contractor 

P Specialty Contractors 

For a turnkey approach, all these disciplines are engaged as a team to 

develop an integrated mitigation solution from the beginning of 

concept design through implementation. In other situations, a more 

sequential approach is taken in which a conceptual design is first 

developed, then a final design, and finally, construction. In the latter 

case, the conceptual design typically includes a narrative with sketches, 

calculations, and a preliminary cost estimate. The final design includes 

a set of construction documents for bidding. To contain costs and 

minimize disruption, the retrofit may be planned to be in phases and 

clearly marked as such on the drawings. During construction, shop 

drawings will be provided by the specialty contractors for the exterior 

envelope and perimeter protection. After construction, it is 

recommended that a set of as-built drawings be kept on file for future 

retrofits. 
DATA COLLECTION FORM AND RISK SCORING WORKSHEET 115 

 DATA COLLECTION FORM AND RISK SCORING 

 WORKSHEET A 
FEMA 455 DATA COLLECTION FORM, PAGE 1 GENERAL BUILDING INFORMATION 

PRE-FIELD INFORMATION

This page of the form is to be completed before the field visit from 

available documentation or from a knowledgeable site representative. Building Name/ID ________________________________________ Address: _______________________________________________ Cross Streets: __________________________________________ Year Built: _____________________________________________ Year(s) of major retrofits: __________________________________ Retrofit Description ______________________________________ Type of Glass: __________________________________________ Number of Floors/Building Height: ___________________________ # Occupants ____________________________________________ Total Area (sq ft): ________________________________________ Footprint Area (sq ft) _____________________________________ Occupancy Use: ________________________________________ (Critical Infrastructure and Key Resources [CI/KR] Sector and Sub-Sector Info) Hazardous Material Kept on Site: ___________________________ Replacement Value: _____________________________________ Target Potential to this Facility ______________________________ Target Potential to this Facility Type: _________________________ Historic Registry Listing ___________________________________ 

TARGET DENSITY

Number of potential high value targets within vicinity of subject building.

Facility Type (CIKR Sector): 

Distance 

< 100 feet ≥100 ft and 

< 300 ft 

≥ 300 ft and ≤ 1000 ft 

Agriculture and Food Banking and Finance Chemical Commercial Critical Manufacturing Dams Defense Industrial Base Emergency Services Energy Government Facilities Information Technology National Monuments/Icons Nuclear Postal and Shipping Public Health and Healthcare Telecommunications Transportation Systems Water Supply 

TOTAL = 

116 DATA COLLECTION FORM AND RISK SCORING WORKSHEET 
FEMA 455 DATA COLLECTION FORM, PAGE 2 CONSEQUENCES 

BUILDING CHARACTERISTICS 

ATTRIBUTE OPTIONS

CONSEQUENCES RATING FOR GIVEN 

THREAT SCENARIO 

Internal Explosive CBR 

a. b. c. d. e. 

Intrusion 

Explosive 

CBR 

Zone I 

Zone II 

Zone III 

Zone I 

Zone II 

Zone III 

1. CONSEQUENCES 

1.1 Locality Type 

Rural / 

Suburban 

Semi-urban/ 

Lt. Industrial Industrial Urban Dense Urban 

0.06 0.46 0.53 0.58 0.63 0.04 0.32 0.37 0.40 0.43 0.17 1.23 1.41 1.55 1.67 0.04 0.32 0.37 0.40 0.43 0.17 1.23 1.41 1.55 1.67 

1.2 # Occupants

< 200 ≥200 - < 400 ≥400 - < 600 ≥ 600 - < 800 ≥800 - < 1000 

0.25 1.21 1.52 1.74 1.92 0.17 0.84 1.06 1.21 1.33 0.33 1.61 2.03 2.32 2.55 0.17 0.84 1.06 1.21 1.33 0.33 1.61 2.03 2.32 2.55 

≥ 1,000 - 

< 2,000 

≥ 2,000 - 

< 4,000 

≥4,000 - 

< 6,000 

≥6,000 - 

< 8,000 

≥ 8,000 - < 10,000 

1.98 2.09 2.19 2.28 2.37 1.38 1.46 1.53 1.59 1.65 2.65 2.79 2.92 3.05 3.16 1.38 1.46 1.53 1.59 1.65 2.65 2.79 2.92 3.05 3.16 

≥10,000 - 

< 20,000 

≥ 20,000 - 

< 40,000 

≥ 40,000 - 

< 60,000 

≥ 60,000 - 

< 80,000 ≥ 80,000 

2.41 2.44 2.46 2.48 2.50 1.68 1.69 1.71 1.72 1.74 3.22 3.25 3.28 3.31 3.33 1.68 1.69 1.71 1.72 1.74 3.22 3.25 3.28 3.31 3.33 

1.3 Replacement

Value

< $20 M ≥ $20 M - < $40 M 

≥ $40 M - 

< $60 M 

≥ $60 M - 

< $80 M 

≥ $ 80 M - 

< $100 M 

0.13 0.60 0.76 0.87 0.96 0.13 0.63 0.79 0.91 1.00 0.08 0.40 0.51 0.58 0.64 0.13 0.63 0.79 0.91 1.00 0.08 0.40 0.51 0.58 0.64 

≥ $100 M - 

< $200 M 

≥ $200 M - 

< $400 M 

≥ $400 M - 

< $600 M 

≥ $600 M - 

< $800 M 

≥ $800 M - 

< $1 B 

0.99 1.05 1.10 1.14 1.18 1.04 1.09 1.14 1.19 1.24 0.66 0.70 0.73 0.76 0.79 1.04 1.09 1.14 1.19 1.24 0.66 0.70 0.73 0.76 0.79 

≥ $1 B - 

< $2 B 

≥ $2 B - 

< $4 B 

≥ $4 B - 

< $6 B 

≥ $6 B - 

< $8 B ≥ $8 B 

1.21 1.22 1.23 1.24 1.25 1.26 1.27 1.28 1.29 1.30 0.80 0.81 0.82 0.83 0.83 1.26 1.27 1.28 1.29 1.30 0.80 0.81 0.82 0.83 0.83 

DATA COLLECTION FORM AND RISK SCORING WORKSHEET 117 
FEMA 455 DATA COLLECTION FORM, PAGE 3 CONSEQUENCES (continued) 

1. CONSEQUENCES 

1.4 On Historic Registry 

No Yes 

0.25 2.50 0.04 0.43 0.08 0.83 0.04 0.43 0.08 0.83 

1.5 Business Continuity 

Very High High Moderate Low Very Low 

0.13 0.92 1.05 1.16 1.25 0.09 0.64 0.73 0.81 0.87 0.17 1.23 1.41 1.55 1.67 0.09 0.64 0.73 0.81 0.87 0.17 1.23 1.41 1.55 1.67 

1.6 Physical Loss 

Impact 

Local Statewide Regional National International 

0.19 1.38 1.58 1.74 1.88 0.52 3.84 4.40 4.84 5.22 0.17 1.23 1.41 1.55 1.67 0.52 3.84 4.40 4.84 5.22 0.17 1.23 1.41 1.55 1.67 

BUILDING CHARACTERISTICS A.1 TOTAL RATING FOR CONSEQUENCES (C): Sum values in for Consequences and enter in column C on Risk Scoring Worksheet 

ATTRIBUTE OPTIONS

CONSEQUENCES RATING FOR GIVEN 

THREAT SCENARIO 

Internal Explosive CBR 

a. b. c. d. e. 

Intrusion 

Explosive 

CBR 

Zone I 

Zone II 

Zone III 

Zone I 

Zone II 

Zone III 

118 DATA COLLECTION FORM AND RISK SCORING WORKSHEET 
FEMA 455 DATA COLLECTION FORM, PAGE 4 THREATS 

BUILDING CHARACTERISTICS 

ATTRIBUTE OPTIONS

THREAT RATING FOR GIVEN 

THREAT SCENARIO 

Internal Explosive CBR 

a. b. c. d. e. 

Intrusion 

Explosive 

CBR 

Zone I 

Zone II 

Zone III 

Zone I 

Zone II 

Zone III 

2. THREAT 

2.1 Occupancy Use 

Occupancy 

Group I 

Occupancy 

Group II 

Occupancy 

Group III 

0.14 1.13 1.4 0.11 0.89 1.1 

2.2 # Occupants

< 200 ≥ 200 - < 400 ≥ 400 - < 600 ≥ 600 - < 800 ≥ 800 - < 1000 

0.14 0.68 0.85 0.97 1.07 0.11 0.53 0.67 0.77 0.84 

≥ 1,000 - 

< 2,000 

≥ 2,000 - 

< 4,000 

≥4,000 - 

< 6,000 

≥6,000 - 

< 8,000 

≥ 8,000 - 

< 10,000 

1.11 1.17 1.23 1.28 1.33 0.87 0.92 0.96 1.00 1.04 

≥10,000 - 

< 20,000 

≥ 20,000 - 

< 40,000 

≥ 40,000 - 

< 60,000 

≥ 60,000 - 

< 80,000 ≥ 80,000 

1.35 1.36 1.38 1.39 1.4 1.06 1.07 1.08 1.09 1.1 

2.3 Site Population 

Density (per sq ft) 

Very Low 

(1/10000) 

Low 

(1/1000) 

Moderate 

 (1/400) 

High 

 (1/40) 

Very High 

 (1/10) 

0.11 0.81 0.93 1.02 1.1 0.30 2.21 2.53 2.78 3.0 

2.4 Visibility/Symbolic 

Very Low Low Moderate High Very High 

0.29 2.14 2.45 2.69 2.9 0.24 1.77 2.02 2.23 2.4 

2.5 Target 

Density 

2.5.1 Zone I 

(< 100 ft) 

0 1 2 3 > 4 

0.12 0.88 1.01 1.11 1.2 

2.5.2 Zone II 

(≥100 - <300 ft) 

0 1-3 4-6 7-9 > 10 

0.30 2.21 2.53 2.78 3.0 

2.5.3 Zone III 

(≥300 - ≤1000 ft) 

0 1-6 7-12 13-19 > 20 

0.80 5.89 6.75 7.43 8.0 

2.6 Overall Site 

Accessibility 

Inaccessible Accessible 

0.14 1.4 0.06 0.6 

2.7 Target Potential 2.7.1 Facility No Yes 0.15 1.45 0.13 1.25 0.20 2 0.10 1 2.7.2 Facility Type No Yes 0.15 1.45 0.13 1.25 0.20 2 0.10 1 

T.1 TOTAL THREAT RATING (T): Sum values for each Threat Scenario in column T on Risk Scoring Worksheet 

DATA COLLECTION FORM AND RISK SCORING WORKSHEET 119 
FEMA 455 DATA COLLECTION FORM, PAGE 5 VULNERABILITY ASSESSMENT (Part I) 

BUILDING CHARACTERISTICS 

ATTRIBUTE OPTIONS

VULNERABILITY RATING FOR GIVEN 

THREAT SCENARIO

Internal Explosive CBR 

a. b. c. d. e. 

Intrusion 

Explosive 

CBR 

Zone I 

Zone II 

Zone III 

Zone I 

Zone II 

Zone III 

3. SITE 

3.1 Distance to Unsecured 

Vehicles (ft) 

≥ 75 ≥ 50 - < 75 ≥ 25 - < 50 ≥ 5 - < 25 < 5 0.06 0.46 0.53 0.58 0.63 

3.2 Perimeter Boundary 

Continuous 

Anti-Ram 

Barriers

Effective 

Anti-Ram 

Design

WellIntegrated 

CPTED

Ornamental, 

Temp, or AntiClimb Barriers

No Security/

Discontinuous

0.03 0.22 0.25 0.28 0.30 0.01 0.08 0.09 0.10 0.11 0.03 0.23 0.26 0.29 0.31 0.02 0.15 0.17 0.19 0.2 

3.3 Unobstructed View (ft) 

≥ 30 ≥ 20 – < 30 ≥ 10 - < 20 ≥ 5 - < 10 < 5 0.06 0.45 0.51 0.57 0.61 0.01 0.08 0.09 0.10 0.11 0.02 0.12 0.13 0.15 0.16 0.02 0.15 0.17 0.19 0.2 

3.4 Unsecured 

Underground Access 

None 

Utility Tunnel 

or Culvert to 

Site

Utility 

Tunnel to 

Bldg.

Pedestrian 

Tunnel to Bldg. 

0.24 1.77 2.13 2.4 0.09 0.63 0.76 0.86 

3.5 Storage of Hazardous 

Materials 

None Low Moderate High 

0.06 0.45 0.54 0.61 0.04 0.32 0.38 0.43 0.02 0.12 0.14 0.16 0.01 0.06 0.07 0.08 

3.6 Collateral 

Underground / Adjacent Structures 

None Small Medium Major Significant 

0.10 0.72 0.83 0.91 0.98 0.09 0.67 0.77 0.84 0.91 

4. ARCHITECTURE 

4.1 Building Height (ft)

< 20 

(1 flr)

≥ 20 - < 50 

(2-3 flr)

≥ 50- < 100 

(4-8 flr)

≥ 100 - <150 

(9-12 flr)

≥ 150-< 200 

(13-15 flr)

0.02 0.10 0.13 0.15 0.16 0.01 0.07 0.09 0.11 0.12 0.02 0.09 0.12 0.13 0.15 0.07 0.41 0.52 0.59 0.65 

≥ 200 - < 500

(16-40 flr)

≥ 500 - < 800 

(41-60 flr)

≥800 -<1000 

(61-80 flr)

≥1000 -<1500

(81-120 flr)

≥ 1500 

(≥121 flr)

0.16 0.17 0.17 0.17 0.176 0.12 0.12 0.12 0.13 0.128 0.15 0.15 0.15 0.16 0.16 0.67 0.68 0.70 0.71 0.72 

4.2 Ratio of Total Area / 

Footprint Area 

< 10 ≥ 10 - < 30 ≥ 30 - < 50 ≥ 50 - < 100 ≥ 100 

0.00 0.03 0.04 0.04 0.044 0.00 0.02 0.03 0.03 0.032 0.00 0.03 0.03 0.04 0.04 0.02 0.13 0.15 0.17 0.18 

4.3 Building Configuration 

Circular/ 

Convex Box Re-entrant Corners Concave 

0.01 0.08 0.10 0.11 0.03 0.23 0.28 0.31 

4.4 Overhang (ft) 

None < 5 ≥5 – <10 ≥10 – <15 ≥ 15 

0.03 0.23 0.26 0.29 0.31 0.02 0.12 0.13 0.15 0.16 

V.1 SUB-TOTAL FOR VULNERABILITY RATING (V): Sum values in each column and enter on line V.1 on Vulnerability Assessment Rating (Part V) 

120 DATA COLLECTION FORM AND RISK SCORING WORKSHEET 
FEMA 455 DATA COLLECTION FORM, PAGE 6 VULNERABILITY ASSESSMENT (Part II) 

BUILDING CHARACTERISTICS 

ATTRIBUTE OPTIONS

VULNERABILITY RATING FOR GIVEN 

THREAT SCENARIO

Internal Explosive CBR 

a. b. c. d. e. 

Intrusion 

Explosive 

CBR 

Zone I 

Zone II 

Zone III 

Zone I 

Zone II 

Zone III 

4. ARCHITECTURE

4.5 Lobby/Retail Location (in 

relation to main building footprint) 

Detached External & Separated External but not Separated Within Footprint Adjacent to Occupied Areas 

0.04 0.32 0.36 0.40 0.43 

4.6 Loading Dock and/or Mail 

Screening Location 

Offsite / 

None 

Exterior to 

Building 

At Perimeter & 

Separated 

Adjacent to 

Assets 

Under 

Building 

0.04 0.32 0.36 0.40 0.43 0.01 0.06 0.07 0.07 0.08 

4.7 Vehicular Penetration of 

Exterior Envelope 

No Yes 

0.06 0.63 

4.8 Garage Location 

None 

Adjacent 

& Above 

Ground 

Adjacent to 

Critical 

Utilities 

Adjacent to 

Occupied 

Areas 

0.04 0.32 0.38 0.43 0.07 0.52 0.63 0.71 0.01 0.06 0.07 0.08 

5. BUILDING ENVELOPE

5.1 Window Support Type 

No 

Windows Punched Glass & Metal Framing Ribbon Point Supported 

0.06 0.46 0.53 0.58 0.63 0.13 0.96 1.10 1.21 1.3 

5.2 Window Bite Depth 

≥ 0.5 in. < 0.5 in. 

0.03 0.31 0.07 0.67 

5.3 Total % Window Area 

< 20 ≥ 20 - < 40 ≥ 40 - < 60 ≥ 60 – < 80 ≥ 80 

0.03 0.22 0.25 0.28 0.3 0.07 0.49 0.57 0.62 0.67 0.13 0.96 1.10 1.21 1.3 0.05 0.37 0.42 0.46 0.5 

5.4 Glass Type 

Laminated 

Glass 

Security 

Film 

Tempered 

Glass 

Heat 

Strengthened Glass Annealed Glass 

0.03 0.23 0.26 0.29 0.31 0.06 0.46 0.53 0.58 0.63 0.13 0.96 1.10 1.21 1.3 

5.5 Wall Type 

Cast-inplace 

Reinforced 

Concrete 

Curtain 

Wall 

Precast or 

Reinforced 

Masonry 

Massive 

Unreinforced 

Masonry 

Lt. Frame or 

Slender 

Unreinforced 

Masonry 

0.03 0.23 0.26 0.29 0.31 0.07 0.49 0.57 0.62 0.67 0.03 0.22 0.25 0.28 0.3 

V.2 SUB-TOTAL FOR VULNERABILITY RATING (V): Sum values in each column and enter on line V.2 on Vulnerability Assessment Rating (Part V) 

DATA COLLECTION FORM AND RISK SCORING WORKSHEET 121 
FEMA 455 DATA COLLECTION FORM, PAGE 7 VULNERABILITY ASSESSMENT (Part III) 

BUILDING CHARACTERISTICS 

ATTRIBUTE OPTIONS

VULNERABILITY RATING FOR GIVEN 

THREAT SCENARIO

Internal Explosive CBR 

a. b. c. d. e. 

Intrusion 

Explosive 

CBR 

Zone I 

Zone II 

Zone III 

Zone I 

Zone II 

Zone III 

5. BLDG. 

ENV. 5.6 Windborne Debris Impact 

Protection 

Post 

Benchmark 

Year 

All Other 

0.02 0.16 0.03 0.31 0.07 0.67 

6. STRUCTURAL COMPONENTS AND SYSTEMS 

6.1 Structural System 

Reinf Conc 

Shear Wall 

or Bundled 

Tubes 

Braced 

Exterior 

Frame 

Frame w/ 

Core or 

Precast 

Tilt-up or 

Frame w/ 

infill or 

Reinf. 

Masonry or 

Belt Truss 

Lt. Metal 

Frame or 

Brick or 

Timber 

0.04 0.32 0.36 0.40 0.43 0.03 0.23 0.26 0.29 0.31 0.07 0.49 0.57 0.62 0.67 

6.2 Number of Bays in Short 

Building Direction 

≥ 5 ≥ 3 - < 5 < 3 

0.04 0.35 0.43 0.03 0.27 0.33 

6.3 Column Spacing (ft) 

< 15 ≥ 15 - < 25 ≥ 25 - < 40 ≥ 40 - < 60 ≥ 60 

0.04 0.32 0.36 0.40 0.43 0.03 0.24 0.28 0.31 0.33 

6.4 Column Height (ft) 

< 12 ≥ 12 - < 24 ≥ 24 - < 36 ≥ 36 

0.04 0.32 0.38 0.43 0.03 0.24 0.29 0.33 

6.5 Publicly Accessible 

Column 

None Yes, Massive Yes, Slender 

0.04 0.35 0.43 0.03 0.27 0.33 

6.6 Transfer Girder 

Conditions 

None 

Int. Girder 

Sup. 1 

column 

Int. Girder 

Sup. > 1 

column 

Ext. Girder Supporting 1 column 

Ext. Girder Supporting > 1 column 

0.09 0.63 0.73 0.80 0.86 0.06 0.46 0.53 0.58 0.63 0.13 0.96 1.10 1.21 1.3 0.07 0.51 0.58 0.64 0.69 

6.7 Structural Enhancements 

& Weaknesses 

Hardened Robust None Marginal Sub- standard 

0.09 0.63 0.73 0.80 0.86 0.06 0.46 0.53 0.58 0.63 0.10 0.77 0.88 0.97 1.04 0.11 0.81 0.93 1.02 1.1 

V.3 SUB-TOTAL FOR VULNERABILITY RATING (V): Sum values in each column and enter on line V.3 on Vulnerability Assessment Rating (Part V) 

122 DATA COLLECTION FORM AND RISK SCORING WORKSHEET 
FEMA 455 DATA COLLECTION FORM, PAGE 8 VULNERABILITY ASSESSMENT (Part IV) 

BUILDING CHARACTERISTICS 

ATTRIBUTE OPTIONS

VULNERABILITY RATING FOR GIVEN 

THREAT SCENARIO

Internal Explosive CBR 

a. b. c. d. e.

Intrusion 

Explosive 

CBR 

Zone I 

Zone II 

Zone III 

Zone I 

Zone II 

Zone III 

7. MECHANICAL/ELECTRICAL/ 

PLUMBING SYSTEMS

7.1 Primary External 

Air Intake Conditions 

> 30 ft or 

Roof >10 - ≤30 ft >0 - ≤10 ft Ground Level Below Grade 

0.03 0.24 0.27 0.30 0.32 0.37 2.73 3.12 3.43 3.7 0.62 4.57 5.23 5.76 6.2 0.53 3.91 4.47 4.92 5.3 

7.2 Return Air Intake 

System 

Ducted 

Secured 

Ducted 

Accessible Unducted Subject to Buoyancy 

0.12 0.85 1.02 1.15 0.15 1.09 1.31 1.48 0.30 2.21 2.66 3.00 

7.3 Internal Air 

Distribution System 

High Risk 

Separated 

Multi-Zoned/ 

Single 

System 

Ducted 

Single 

System/ 

Unducted 

0.12 0.93 1.15 

7.4 Critical Utilities 

Located Close to High Risk Areas 

No Yes 

0.04 0.43 0.02 0.16 

V.4 SUB-TOTAL FOR VULNERABILITY RATING (V): Sum values in each column and enter on line V.4 on Vulnerability Assessment Rating (Part V) 

DATA COLLECTION FORM AND RISK SCORING WORKSHEET 123 
FEMA 455 DATA COLLECTION FORM, PAGE 9 VULNERABILITY ASSESSMENT (Part V) 

BUILDING CHARACTERISTICS 

ATTRIBUTE OPTIONS

VULNERABILITY RATING FOR GIVEN 

THREAT SCENARIO

Internal Explosive CBR 

a. b. c. d. e.

Intrusion 

Explosive 

CBR 

Zone I 

Zone II 

Zone III 

Zone I 

Zone II 

Zone III 

8. SECURITY 

8.1 Internal Threat 

8.1.1 

Intrusion 8.1.1.1 Number of Detection Systems ≥ 3 Systems 2 Systems 1 System None 0.12 0.90 1.08 1.216 8.1.1.2 Overall Security Effectiveness Highly Effective Effective Meets Min. Requirements Ineffective No Security 0.49 3.58 4.10 4.52 4.864 

8.1.2 

Explosion 8.1.2.1 Number of Detection Systems ≥ 3 Systems 2 Systems 1 System None 0.05 0.39 0.48 0.536 8.1.2.2 Overall Security Effectiveness Highly Effective Effective Meets Min. Requirements Ineffective No Security 0.21 1.58 1.81 1.99 2.144 

8.1.3 CBR 8.1.3.1 Number of Detection Systems ≥ 3 Systems 2 Systems 1 System None 0.09 0.65 0.78 0.884 8.1.3.2 Overall Security Effectiveness Highly Effective Effective Meets Min. Requirements None No Security 0.35 2.61 2.98 3.28 3.536 

8.2 Zone 1 Threat 

8.2.1 

Explosion 8.2.1.1 Number of Detection Systems ≥ 3 Systems 2 Systems 1 System None 0.03 0.22 0.26 0.294 8.2.1.2 Overall Security Effectiveness Highly Effective Effective Meets Min. Requirements Ineffective No Security 0.12 0.87 0.99 1.09 1.176 

8.2.2 CBR 8.2.2.1 Number of Detection Systems ≥ 3 Systems 2 Systems 1 System None 0.07 0.53 0.64 0.724 8.2.2.2 Overall Security Effectiveness Highly Effective Effective Meets Min. Requirements Ineffective No Security 0.29 2.13 2.44 2.69 2.896 

V.0 SUB-TOTAL FOR VULNERABILITY RATING (V): Sum values in each column and enter here V.1 SUB-TOTAL FOR VULNERABILITY RATING (V): Enter values for each column from line V.1 on Vulnerability Assessment Rating (Part I) V.2 SUB-TOTAL FOR VULNERABILITY RATING (V): Enter values for each column from line V.2 on Vulnerability Assessment Rating (Part II) V.3 SUB-TOTAL FOR VULNERABILITY RATING (V): Enter values for each column from line V.3 on Vulnerability Assessment Rating (Part III) V.4 SUB-TOTAL FOR VULNERABILITY RATING (V): Enter values for each column from line V.4 on Vulnerability Assessment Rating (Part IV) V.5 TOTAL VULNERABILITY RATING (V): Sum values from lines V.0, V.1, V.2, V.3, and V.4 and enter total for each Threat Scenario in column V on Risk Scoring Worksheet 

124 DATA COLLECTION FORM AND RISK SCORING WORKSHEET 
FEMA 455 RISK SCORING WORKSHEET 

THREAT SCENARIO Consequences (C) Threat Rating (T) Vulnerability Rating (V) Threat Scenario Risk Rating (C x T x V) 

Internal 

Intrusion Explosive CBR 

Explosive 

Zone I Zone II Zone III 

CBR 

Zone I Zone II Zone III 

A. TOTAL RISK RATING FOR BUILDING 

DATA COLLECTION FORM AND RISK SCORING WORKSHEET 125 

DATA COLLECTION FORM (FIELD VERSION) 127 

 DATA COLLECTION FORM (FIELD VERSION) B 
FEMA 455 DATA COLLECTION FORM (FIELD VERSION), PAGE 1 GENERAL BUILDING INFORMATION 

PRE-FIELD INFORMATION

This page of the form is to be completed before the field visit from 

available documentation or from a knowledgeable site representative. Building Name/ID ________________________________________ Address: _______________________________________________ Cross Streets: __________________________________________ Year Built: _____________________________________________ Year(s) of major retrofits: __________________________________ Retrofit Description ______________________________________ Type of Glass: __________________________________________ Number of Floors/Building Height: ___________________________ # Occupants ____________________________________________ Total Area (sq ft): ________________________________________ Footprint Area (sq ft) _____________________________________ Occupancy Use: ________________________________________ (Critical Infrastructure and Key Resources [CI/KR] Sector and Sub-Sector Info) Hazardous Material Kept on Site: ___________________________ Replacement Value: _____________________________________ Target Potential to this Facility ______________________________ Target Potential to this Facility Type: _________________________ Historic Registry Listing ___________________________________ 

TARGET DENSITY

Number of potential high value targets within vicinity of subject building.

Facility Type (CIKR Sector): 

Distance 

< 100 feet ≥100 ft and 

< 300 ft 

≥ 300 ft and ≤ 1000 ft 

Agriculture and Food Banking and Finance Chemical Commercial Critical Manufacturing Dams Defense Industrial Base Emergency Services Energy Government Facilities Information Technology National Monuments/Icons Nuclear Postal and Shipping Public Health and Healthcare Telecommunications Transportation Systems Water Supply 

TOTAL = 

128 DATA COLLECTION FORM (FIELD VERSION) 
FEMA 455 DATA COLLECTION FORM (FIELD VERSION), PAGE 2 

CONSEQUENCES 

BUILDING CHARACTERISTICS 

ATTRIBUTE OPTIONS

Red 

Flag Comments a. b. c. d. e. 

1. CONSEQUENCES 

1.1. Locality Type Rural/ Suburban Semi-urban Lt. Industrial Industrial Urban Dense 1.2. # Occupants

Low < 200 ≥ 200 < 400 ≥ 400 < 600 ≥ 600 < 800 ≥ 800 < 1000 

Medium 

≥ 1,000 

< 2,000 

≥ 2,000 

< 4,000 

≥ 4,000 

< 6,000 

≥ 6,000 

< 8,000 

≥ 8,000 

< 10,000 

High 

≥ 10,000 

< 20,000 

≥ 20,000 

< 40,000 

≥ 40,000 

< 60,000 

≥ 60,000 

< 80,000 ≥ 80,000 

1.3. Replacement Value

Low < $20M ≥ $20M < $40M ≥ $40M < $60M ≥ $60M < $80M ≥ $80M < $100M 

Medium ≥ $100M < $200M ≥ $200M < $400M ≥ $400M < $600M ≥ $600M < $800M ≥ $800M < $1B 

High ≥ $1B < $2B ≥ $2B < $4B ≥ $4B < $6B ≥ $6B < $8B ≥ $8B 

1.4. On Historic  Registry No Yes 1.5. Business Continuity Very High High Moderate Low Very Low 1.6 Physical Loss  Impact Local Statewide Regional National International 

DATA COLLECTION FORM (FIELD VERSION) 129 
FEMA 455 DATA COLLECTION FORM (FIELD VERSION), PAGE 3 

THREAT 

BUILDING CHARACTERISTICS 

ATTRIBUTE OPTIONS

Red 

Flag Comments a. b. c. d. e. 

2. THREAT 

2.1. Occupancy Use Occupancy Group I Occupancy Group II Occupancy. Group III 1.2. # Occupants

Low < 200 ≥ 200 < 400 

≥ 400 

< 600 

≥ 600 

< 800 

≥ 800 

< 1000 

Medium 

≥ 1,000 

< 2,000 

≥ 2,000 

< 4,000 

≥ 4,000 

< 6,000 

≥ 6,000 

< 8,000 

≥ 8,000 

<10,000 

High 

≥ 10,000 

< 20,000 

≥ 20,000 

< 40,000 

≥ 40,000 

< 60,000 

≥ 60,000 

< 80,000 ≥ 80,000 

2.3 Site Population 

Density (per sq ft) 

Very Low 

(1/10000) 

Low 

(1/1000) 

Moderate 

(1/400) 

High 

(1/40) 

Very High 

(1/10) 

2.4. Visibility/  Symbolic Very low Low Moderate High Very High 

2.5 Target 

Density 

2.5.1. Zone I 

(< 100 ft ) 0 1 2 3 ≥ 4 

2.5.2. Zone II (≥ 100 ft , < 300 ft ) 0 1 – 3 4 - 6 7 - 9 ≥ 10 2.5.3. Zone III (≥ 300 ft , ≤ 1,000 ft ) 0 1 – 6 7 - 12 13 - 19 ≥ 20 

2.6. Overall Site 

Accessibility Inaccessible Accessible 

2.7 Target 

Potential 2.7.1 Facility No Yes 2.7.2 Facility Type No Yes 

130 DATA COLLECTION FORM (FIELD VERSION) 
FEMA 455 DATA COLLECTION FORM (FIELD VERSION), PAGE 4 

VULNERABILITY 

BUILDING CHARACTERISTICS 

ATTRIBUTE OPTIONS

Red 

Flag Comments a. b. c. d. e. 

3. SITE 

3.1. Distance to Unsecured 

Vehicles (ft) ≥ 75 ≥ 50 < 75 

≥ 25 

< 50 

≥ 5 

< 25 < 5 

3.2. Perimeter Boundary 

Continuous 

Anti-Ram 

Barriers 

Effective 

Anti-Ram 

Design 

WellIntegrated 

CPTED 

Ornamental 

Temporary or 

Anti-Climb 

Barriers 

No Security/ 

Discontinuous 

3.3. Unobstructed View (ft) ≥ 30 ≥ 20 < 30 

≥ 10 

< 20 

≥ 5 

< 10 < 5 

3.4. Unsecured Underground 

Access None 

Utility Tunnel 

or Culvert to 

Site 

Utility Tunnel 

to Bldg. 

Pedestrian 

Tunnel to Bldg. 

3.5. Storage of Hazardous 

Materials None Low Moderate High 

3.6. Collateral Underground 

/Adjacent Structures None Small Medium Major Significant 

4. ARCHITECTURE 

4.1.Building Height (ft)

Low < 20 (1 flr) 

≥ 20, < 50 

(2-3 flr) 

≥ 50, < 100 

(4-8 flr) 

≥ 100, < 150 

(9-12 flr) 

≥ 150, < 200 

(13-15 flr) 

High ≥ 200,< 500 (16-40 flr) 

≥ 500,< 800 

(41-60 flr) 

≥ 800, < 1000 

(61-80 flr) 

≥ 1000, < 1500 

(81-120 flr) 

≥ 1500 

(≥121 flr) 

4.2. Ratio of Total Area /

Foot

print Area < 10 ≥ 10, < 30 

≥ 30 

< 50 

≥ 50 

< 100 ≥ 100 

4.3 Building Configuration Circular/ Convex Box Re-entrant Corners Concave 4.4. Overhang (ft) None < 5 ≥ 5 < 10 

≥ 10 

< 15 ≥ 15 

4.5. Lobby/Retail Location (in 

relation to main building footprint) 

Detached External & Separated External But Not Separated Within Footprint Adjacent to Occupied Areas 

4.6. Loading Dock and/or Mail 

Screening Location 

Offsite/ 

None 

Exterior to 

Building 

At Perimeter 

& Separated 

Adjacent to 

Assets 

Under 

Building 

4.7. 

Vehicular Penetration of 

Exterior Envelope No Yes 

4.8. Garage Location None 

Adjacent & 

Above 

Ground 

Adjacent to 

Critical 

Utilities 

Adjacent to 

Occupied 

Areas 

DATA COLLECTION FORM (FIELD VERSION) 131 
FEMA 455 DATA COLLECTION FORM (FIELD VERSION), PAGE 5 

VULNERABILITY (Cont’d)

BUILDING CHARACTERISTICS 

ATTRIBUTE OPTIONS

Red 

Flag Comments a. b. c. d. e. 

5. BUILDING ENVELOPE

5.1. Window Support Type No Windows Punched 

Glass & 

Metal 

Framing 

Ribbon Point Supported 

5.2. Window Bite Depth ≥ 0.5 in. < 0.5 in. 5.3. Total % Window Area < 20 ≥ 20 < 40 

≥ 40 

< 60 

≥ 60 

< 80 ≥ 80 

5.4. Glass Type Laminated Security Film Tempered Glass Heat Strength- ened Glass Annealed Glass 5.5. Wall Type 

Cast-inPlace Reinf. 

Concrete 

Curtain Wall 

Precast or 

Reinf. 

Masonry 

Massive 

Unreinf. 

Masonry 

Lt. Frame or 

Slender 

Unreinf. 

Masonry 

5.6. Windborne Debris Impact 

Protection 

Post 

Benchmark 

Year 

All Other 

6. STRUCTURAL COMPONENTS 

AND SYSTEMS 

6.1. Structural System 

Reinf Conc 

Shear Wall 

or Bundled 

Tubes 

Braced 

Exterior 

Frame 

Frame w/ 

Core or 

Precast 

Tilt-up or 

Frame w/IInfill 

or Reinf. 

Masonry or 

Belt Truss 

Lt. Metal 

Frame or 

Brick or 

Timber 

6.2 Number of Bays in Short 

Building Direction ≥ 5 ≥ 3 < 5 < 3 

6.3. Column Spacing (ft) < 15 ≥ 15 < 25 

≥ 25 

< 40 

≥ 40 

< 60 ≥ 60 

6.4. Column Height (ft) < 12 ≥ 12 < 24 

≥ 24 

< 36 ≥ 36 

6.5. Publicly Accessible Column None Yes, Massive Yes, Slender 6.6. Transfer Girder 

Conditions None 

Int. Girder 

Sup. 1 

Column 

Int. Girder 

Sup. > 1 

Column 

Ext. Girder Supporting 1 Column 

Ext. Girder Supporting > 1 Column 

6.7. Structural Enhancements 

& Weaknesses Hardened Robust None Marginal Sub- standard 

7. M/E/P 

SYSTEMS

7.1. Primary External Air 

Intake Conditions (ft) > 30 or Roof > 10 

≤ 30 

> 0 

≤ 10 Ground Level Below Grade 

7.2. Return Air Intake System Ducted Secured Ducted Accessible Unducted Subject to Buoyancy 7.3 Internal Air Distribution 

System 

High Risk 

Separated 

Multi-Zoned/ 

Single Sys. 

Ducted 

Single 

System/ 

Unducted 

7.4. Critical Utilities Located 

Close to High Risk Areas No Yes 

132 DATA COLLECTION FORM (FIELD VERSION) 
FEMA 455 DATA COLLECTION FORM (FIELD VERSION), PAGE 6 

VULNERABILITY (Cont’d) 

BUILDING CHARACTERISTICS 

ATTRIBUTE OPTIONS

Red 

Flag Comments a. b. c. d. e. 

8. SECURITY 

8.1 Internal 

Threat 

8.1.1 

Intrusion 

8.1.1.1 

# Detection Systems 

≥ 3 

Systems 2 Systems 1 System None 

8.1.1.2 

Overall Security 

Effectiveness 

Highly 

Effective Effective Meets Min. Req’ments Ineffective No Security 

8.1.2 

Explosion

8.1.2.1 

 # Detection Systems 

≥ 3 

Systems 2 Systems 1 System None 

8.1.2.2 

Overall Security 

Effectiveness 

Highly 

Effective Effective Meets Min. Req’ments Ineffective No Security 

8.1.3 

CBR 

8.1.3.1 

 # Detection Systems 

≥ 3 

Systems 2 Systems 1 System None 

8.1.3.2 

Overall Security 

Effectiveness 

Highly 

Effective Effective Meets Min. Req’ments Ineffective No Security 

8.2 Zone 1 

Threat 

8.2.1 

Explosion

8.2.1.1 

# External Detection 

Systems 

≥ 3 

Systems 2 Systems 1 System None 

8.2.1.2 

Overall Security 

Effectiveness 

Highly 

Effective Effective Meets Min. Req’ments Ineffective No Security 

8.2.2 

CBR

8.2.2.1 

# Detection Systems 

≥ 3 

Systems 2 Systems 1 System None 

8.2.2.2 

Overall Security 

Effectiveness 

Highly 

Effective Effective Meets Min. Req’ments Ineffective No Security 

DATA COLLECTION FORM (FIELD VERSION) 133 

RISK SCORING METHODOLOGY 135 

 RISK SCORING METHODOLOGY C 

n this screening procedure, the quantification of risk follows 

directly from the method used in FEMA 452, providing a 

consistent and logical link among the recently-published FEMA 

assessment guides for addressing terrorism risk. 

This appendix contains a description of the step-by-step process used to 

develop the scoring procedure as a function of the Data Collection 

Form building characteristics and corresponding attribute options. It 

explains the logic and methodology embedded in the ratings 

contained within the forms. The process for developing the ratings 

contained within the Data Collection Form (and the companion 

electronic version of the procedure) is described in detail so that users 

can complete the scoring procedure in an informed and 

knowledgeable manner, which will result in ratings that are more 

reliable and consistent. An example of how screeners can use the Data 

Collection Form to develop a rating is provided at the end of this 

appendix. 

Conceptually the risk scoring methodology has been developed so that 

each of the three factors (Consequences, C; Threat Rating, T; and 

Vulnerability Rating, V) is ultimately assigned a value in the range of 1 

to 10, where 1 indicates the lowest value of the factor and 10 indicates 

the highest, in terms of contribution to the risk for a given threat 

scenario. Risk ratings for each of the nine threat scenarios are 

computed as the product of the assigned values (in the range, 1 to 10) 

for each of these three factors (C, T, and V ). The methodology 

development process involved the following steps. 

1. Building characteristics contributing to each of these three factors 

(C, T, and V) for the building systems considered (see Table 2), 

along with possible attribute options, were initially identified, based 

on the project team's knowledge and expert judgment. 

2. For each set of possible attribute options for a given building 

characteristic (where each set ranges from two to five multiplechoice options – a., b., c., d., or e.) rating values were initially 

assigned based on a scale of 1 to 10, where 1 indicates the lowest 

level of hazard or risk and 10 the highest. 

3. For each building characteristic in the subset corresponding to a 

given factor, the relative contribution of that building characteristic 

to the overall value of the given factor was then assigned. The 

I
136 RISK SCORING METHODOLOGY 

relative contribution was denoted by VH (very high), H (high), M 

(medium), or L (low). 

Table C-1 illustrates the development of the scoring values, as 

prescribed in Steps 1 through 3 above, for building characteristics 

and attribute options initially assigned to Consequences (C). As 

indicated, the assigned values range from 1 to 10, and the relative 

contributions of each building characteristic are denoted with VH 

(very high), H (high), M (medium), or L (low). 

Table C-1 Information Used in the Initial Risk Scoring Methodology Development for Consequences 

BUILDING 

CHARACTERISTICS a. b. c. d. e. 

CONSEQUENCES 

1.1. Locality Type 

Rural/ 

Suburban 

Semiurban/ Lt. 

Industrial 

Industrial Urban Dense 

Urban L 

1 3 5 7 10 

Non-Dense Urban < 100 100 - 500 500 - 2000 2000 - 5000 > 5000 

Dense Urban < 1000 1000 - 3000 3000 - 7000 7000 - 10000 > 10000 H 

1.3. # Occupants 1 4 6 8 10 

Non-Dense Urban < $1M $1M - 

$20M 

$20M – 

$100M 

$100M – 

$500M > $500M 

M Dense Urban < $20M $20M - 

$150M 

$150M – 

$400M 

$400M – 

$750M > $750M 

1.5. Replacement Value 1 4 6 8 10 

1.7. Historic Value No Yes L 1 10 

1.8. Operational 

Redundancy 

Very High High Moderate Low Very Low M 1 3 5 7 10 

1.9. Impact of Asset 

Physical Loss 

Local Regional Statewide National International VH 

1 4 6 8 10 

4. The results of Step 3 (the relative contribution of each relevant 

building characteristic to each factor) were used to develop 

weighting factors that essentially averaged the values associated 

with each attribute option(defined in Step 2) for the relevant 

building characteristics that comprise each factor. 

Step 4 of the methodology can be illustrated by examining the 

information in Table C-1, which identifies six building 

characteristics pertinent to Consequences, one of which has a very 

high (VH) contribution, one a high (H) contribution, two a 

medium (M) contribution, and two a low (L) contribution. In this 

initial development of the scoring system, the weighting factors (six 

in this case) were normalized to sum to 1.0. For computing 

Consequences, VH was set to 0.44, H was set to 0.22, M to 0.11 and 
RISK SCORING METHODOLOGY 137 

L to 0.055 (this corresponded to un-normalized weighting factors 

of 8, 4, 2, and 1 respectively). 

5. The results of Step 4 (the weighting factors) were used to 

normalize the values associated with each attribute option (defined 

in Step 1) for the relevant building characteristics that comprise 

each factor. 

Initially the normalization was essentially just the multiplication of 

the values from 1 to 10 for each multiple attribute option on the 

Data Collection Form (shown in the example in Table C-1) by the 

appropriate weighting factor for each building characteristic. For 

this example, the values of 1, 3, 5, 7, and 10 corresponding to 

attribute options for building characteristic 1.1 were multiplied by 

0.055. Similarly the values of 1, 5, and 10 corresponding to 

attribute options for building characteristic 1.3 were also multiplied 

by 0.22, while the values for building characteristic 1.5 were 

multiplied by 0.11, the values for building characteristic 1.7 were 

multiplied by 0.055, the values for building characteristic 1.8 were 

multiplied by 0.11, and the values for building characteristic 1.9 

were multiplied by 0.44. The result of this step is shown in Table C2 for the example of Table C-1. 

Table C-2: Example Initial Values in Risk Scoring Methodology for Consequences 

6. The normalized factors from Step 5 for each building 

characteristic attribute option were inserted in an initial Data 

BUILDING 

CHARACTERISTICS a. b. c. d. e. 

CONSEQUENCES 

1.1. Locality Type 

Rural/ 

Suburban 

Semiurban/ Lt. 

Industrial 

Industrial Urban Dense 

Urban 

0.06 0.17 0.28 0.39 0.56 

Non-Dense Urban < 100 100 - 500 500 - 2000 2000 - 5000 > 5000 

Dense Urban < 1000 1000 - 3000 3000 - 7000 7000 - 10000 > 10000 

1.3. # Occupants 0.22 0.89 1.3 1.8 2.2 

Non-Dense Urban < $1M $1M - 

$20M 

$20M – 

$100M 

$100M – 

$500M > $500M 

Dense Urban < $20M $20M - 

$150M 

$150M – 

$400M 

$400M – 

$750M > $750M 

1.5. Replacement Value 0.11 0.44 0.67 0.89 1.1 

1.7. Historic Value No Yes 

0.06 0.56 

1.8. Operational 

Redundancy 

Very High High Moderate Low Very Low 

0.11 0.33 0.56 0.78 1.1 

1.9. Impact of Asset 

Physical Loss 

Local Regional Statewide National International 

0.44 1.8 2.7 3.6 4.4 
138 RISK SCORING METHODOLOGY 

Collection Form for use in the first pilot testing of the methodology 

in New York City. The pilot testing was designed to evaluate the: 

P user-friendliness of the documentation and scoring forms; 

P clarity of the description of the methodology; 

P duration of typical building evaluation by newly-trained 

assessors; 

P sensitivity of the scoring system to various building attributes; 

P variation among resulting scores for different building types; 

and 

P consistency (repeatability) in the assessment results. 

The initial pilot testing involved the use of the initial Data 

Collection Form as well as the initial electronic version of the 

procedure, which is described in Appendix E. Attribute options for 

each building characteristic considered were selected based on 

observed features of the building, and the ratings for these options 

(normalized in Step 5 above) were entered on the open (unshaded) cell in the Data Collection Form. The values of the cells in 

each column were totaled to compute one value for Consequences, 

one value for Threat Rating, and one value for Vulnerability Rating 

for each of the nine pertinent threat scenarios. As a result of the 

normalization of the attribute option ratings in Step 5 above, the 

resulting total values for each of the three factors (C, T, and V ) 

range from 1 to 10, corresponding to the scales used in FEMA 452 

to quantify Consequences rating, Threat Rating, and Vulnerability 

Rating. 

The values of the factors (C, T, and V ) were then copied into the 

Risk Scoring Worksheet in the appropriate columns for each threat 

scenario. The risk rating for each threat scenario,i , was computed 

using Equation C-1 for a given row in the Risk Scoring Worksheet. 

Ri iii = ×× CTV (C-1)

where: 

 Ci = Consequences rating for threat scenario i

Ti = Threat rating for threat scenario i

Vi = Vulnerability rating for threat scenario i

7. Threat scenario risk ratings from Step 6 were evaluated by 

participants in the initial Pilot Study, and used as a basis for adding, 
RISK SCORING METHODOLOGY 139 

deleting, and modifying, as required, the building characteristics 

for each factor as well as the ratings for each attribute option. The 

method for calculating the Total Risk Rating, R, for a given 

building was also evaluated and revised to increase the total score 

to match perceived levels of risk (for the buildings evaluated in the 

pilot testing). As a result, the method for calculating R was 

changed from a simple summation of the threat scenario risk 

ratings (for each of the nine threat scenarios considered) to 

incorporate a power summation formulation and a scaling factor, 

α , that together control the limits of R such that9 9000 ≤ R ≤ . 

The revised formulation for computing R is as follows: 

( )

9

1

n n i

i

R α R == ∑ (C-2) 

where α equals 7.227 and n = 10. 

A value of n = 10 was found to produce realistic results that avoids 

the apparent averaging results (when n =1) that would imply 

direct correlation between all nine scenarios. 

A revised Data Collection Form was then developed that 

incorporated the revised building characteristics, and 

corresponding attribute option ratings. The initial electronic 

version of the procedure was similarly updated to incorporate the 

changes to the initial Data Collection Form. 

8. A pilot testing of the revised Data Collection Form (Version 2) was 

again conducted in New York City and included some of the same 

buildings tested previously and some that were new. The new 

buildings in the second Pilot Study were selected to exercise risk 

characteristics that had not been explored in the first Pilot Study, 

including a high-consequence, low-threat building and a lowconsequence, low-threat building. Using data collected during the 

second pilot testing, threat scenario risk ratings and the Total Risk 

Rating, R, were again calculated (using equations C-1 and C-2), and 

the results were used as a basis for adding, deleting, and modifying, 

as required, the building characteristics for each factor as well as 

the ratings for each attribute option. 

As before, a revised Data Collection Form was again developed 

(Version 3) that incorporated the revised building characteristics, 

and corresponding attribute option ratings. The electronic version 

of the procedure was also updated to incorporate the changes to 

the Data Collection Form and the scoring process. 
140 RISK SCORING METHODOLOGY 

9. A final pilot testing of Version 3 of the Data Collection Form was 

then conducted in Las Vegas. Using data collected during the 

third pilot testing, threat scenario risk ratings and the Total Risk 

Rating, R, were again calculated (using equations C-1 and C-2), and 

the results were used as a basis for adding, deleting, and modifying, 

as required, the building characteristics and attribute options. 

Version 4 of the Data Collection Form (final version, as provided 

herein) was then developed, incorporating the revised building 

characteristics, and corresponding attribute option ratings. The 

electronic version of the procedure was again updated to 

incorporate the changes to the Data Collection Form. 

Example Application of the Procedure 

An example application of the scoring procedure for Consequences 

(Ci ) for the nine threat scenarios (using Version 4 of the Data 

Collection Form) is provided below. In this example, surveyors of the 

example building selected the attribute options shown in Table C-3. 

Table C-3 Building Characteristics and Selected Attribute Options 

Building characteristic Attribute Option 

1.1 Locality Type Semi Urban 

1.2 # Occupants Greater than or equal to 4,000 

Less than 6,000 

1.3 Replacement Value Greater than or equal to $600 M Less 

than $800 M 

1.4 Historic Value No 

1.5 Business Continuity Moderate 

1.6 Physical Loss Impact National 

To carry out the scoring procedure, the user circles the numeric values 

in the Consequences portion of the Data Collection Form (as shown in 

Tables C-4 and C-5) that correspond to the selected attribute options 

identified in Table C-3. Those numeric values are then transcribed 

into the corresponding locations for each of the nine scenarios, as 

shown on the right side of Tables C-4 and C-5. A simple sum over each 

column for each threat scenario results in the Consequence score for 

that particular threat scenarioCi . 
RISK SCORING METHODOLOGY 141 

The method for computing the values for Threat Rating and 

Vulnerability Rating follows the same process as described in the above 

example for computing Consequences. 

Table C-4 Example Values in Risk Scoring Methodology of Consequences, Page 2 
142 RISK SCORING METHODOLOGY 

Table C-5 Example Values in Risk Scoring Methodology of Consequences, Page 3 
INFRASTRUCTURE TAXONOMY 143 

 INFRASTRUCTURE TAXONOMY D 

his appendix contains an abbreviated version of the 

Infrastructure Taxonomy prepared by the Department of 

Homeland Security. It provides a listing of facility types included 

as part of each of the 18 critical infrastructure categories. Selected 

facilities provided below focus on facility types that include buildings. 

This appendix may be used as a reference for defining Occupancy Use 

and also Target Density definitions provided on the Data Collection 

Form. The electronic version of this procedure includes a drop down 

menu for Occupancy Use and Target Density, which is a complete and 

unabridged version of the DHS listing. 

AGRICULTURE AND FOOD 

 Supply 

 Processing/Packaging/Production 

 Agriculture and Food Product Storage 

 Agriculture and Food Product Transportation 

 Agriculture and Food Product Distribution 

 Farm Product Wholesalers 

 Grocery and Related Product Wholesalers 

 Food and Beverage Retailers 

 Supermarkets and Grocery Stores 

 Food Service and Drinking Facilities 

 Full Service Restaurants 

 Limited Service Food Facilities 

 Drinking Establishments 

 Bars 

 Nightclubs 

 Agriculture and Food Supporting Facilities 

 Regulatory, Oversight, and Industry Organizations 

BANKING AND FINANCE 

 Banking and Credit 

 Securities, Commodities and Financial Investments 

 Insurance Carriers 

CHEMICAL AND HAZARDOUS MATERIALS 

INDUSTRY 

 Chemical Manufacturing Plants 

 Hazardous Chemical Transport 

Hazardous Chemical Storage/Stockpile/ Utilization/ 

Distribution 

 Regulatory, Oversight, and Industry Organizations 

T
144 INFRASTRUCTURE TAXONOMY 

COMMERCIAL FACILITIES 

 Entertainment and Media Facilities 

 Broadcasting 

 Cable and Other Subscription Programming 

 Radio Broadcasting 

 Television Broadcasting 

 Internet Publishing 

 Motion Picture and Sound Recording Facilities 

 Print Media 

 Newspaper and Periodical Publishing 

 Other Print Publishing 

 Gambling Facilities/Casinos (Resorts) 

 Gambling Cruises 

Horse and Dog Racetracks 

Land-Based Casinos 

Permanently-Moored Casinos 

Riverboat Casinos 

Other Gambling Establishments 

Lodging Facilities 

 Bed and Breakfast Inns 

 Hotels and Motels 

 Other Lodging Facilities 

 Outdoor Events Facilities 

 Amusement, Theme and Water Parks 

 Community Parks, Fairgrounds, Pavilions 

 Community Water Facilities 

 Community Special Gatherings 

 Parades 

 Special Events 

 Public Assembly/Sports Leagues Facilities 

 Amphitheaters 

 Arenas 

 Convention Centers 

 Golf Courses and Country Clubs 

 Motor Racetracks 

 Movie Theaters 

 Museums, Planetariums 

Performing Arts Centers and Auditoriums 

 Stadiums 

 Zoos, Aquariums, Botanical Gardens 

 Public Assembly/Other Facilities 

 Entertainment Districts 

 Fitness and Recreational Facilities 

 Marinas 

 Skiing Facilities 

 Other Amusement and Recreational Facilities 

 Real Estate Facilities 

 Office Buildings 

 Office Buildings – Stand Alone 
INFRASTRUCTURE TAXONOMY 145 

 Office Districts 

 Office Parks 

 Residential Units 

 Multi-Family Residences 

 Single-Family Residences 

 Retail Facilities 

 Store Retailers 

 Shopping Centers and Malls 

 Shopping Districts 

 Stand-Alone Stores 

 Non-Store Retailers 

 Industrial Assets 

 Manufacturing Facilities 

Food, Beverage, Tobacco Product 

Manufacturing 

Textile, Textile Product, Apparel, Leather 

Manufacturing 

 Wood Product Manufacturing 

 Paper Manufacturing 

 Printing and Related Support Activities 

 Petroleum and Coal Products Manufacturing 

 Chemical Manufacturing 

 Plastics and Rubber Products Manufacturing 

 Non-Metallic Mineral Products Manufacturing 

Primary Metal Manufacturing 

Fabricated Metal Manufacturing 

Machinery Manufacturing 

Computer and Electronic Product 

Manufacturing 

Electrical Equipment, Appliance, Component 

Manufacturing 

Transportation Equipment Manufacturing 

 Furniture and Related Products Manufacturing 

 Miscellaneous Manufacturing 

Mining 

Oil and Natural Gas Extraction 

Coal Mining 

Metal Ore Mining 

Nonmetallic Mineral Mining 

 Community Organization Facilities 

Religious Organization Facilities 

Social Advocacy Organization Facilities 

Civic and Social Organization Facilities 

Political Organization Facilities 

 Other Commercial Facilities 

Weather Forecasting Services 
146 INFRASTRUCTURE TAXONOMY 

CRITICAL MANUFACTURING 

Primary Metal Manufacturing 

Machinery Manufacturing 

Electrical Equipment, Appliance, and Component 

Manufacturing 

Transportation Equipment Manufacturing 

DAMS 

Dam Projects 

Navigation Locks 

Mine Tailings Dams 

Hurricane Barriers 

River Control Structures 

Levees 

Regulatory, Oversight and Industry Organizations 

Other Dam Facilities 

DEFENSE INDUSTRIAL BASE 

 Shipbuilding Industry 

 Aircraft Industry 

 Missile Industry 

 Space Industry 

 Combat Vehicle Industry 

Ammunition Industry 

Weapons Industry 

Troop Support Industry 

Information Technology Industry 

Electronics Industry 

Electrical Industry Commodities 

Electronic Industry Commodities 

Mechanical Industry Commodities 

Structural Industry Commodities 

EMERGENCY SERVICES 

Law Enforcement 

Fire, Rescue, and Emergency Services 

Search and Rescue 

Emergency Medical Services 

Emergency Management 

ENERGY 

Electricity 
INFRASTRUCTURE TAXONOMY 147 

Petroleum 

Natural Gas 

Coal 

Ethanol 

Regulatory, Oversight, and Industry Organizations 

GOVERNMENT FACILITIES 

 Personnel-Oriented Government Facilities 

Personnel-Oriented Buildings and Structures 

Offices and Office Building Complexes 

Agency Headquarters 

Field, District and Satellite Offices 

Legislative Chambers and Offices 

Judicial Chambers and Offices 

Data and Call Centers 

Housing 

Correctional Facilities 

Embassies, Consulates and Border Facilities 

Educational Facilities 

Pre-Kindergarten 

Licensed Day Care Facilities 

K-12 Schools 

Higher Education Facilities 

Specialized Education Facilities 

Personnel-Oriented Land 

 Service-Oriented Government Facilities 

Service-Oriented Buildings and Structures 

Emergency Services 

Maintenance and Repair Shops 

Operations, Command, Dispatch and Control 

Centers 

Training Buildings 

Libraries 

Service-Oriented Land 

 Government Research Facilities 

Government Research and Development Buildings and 

Structures 

Analysis and Assessment Research Facilities 

Environmental Research 

Basic Science Research 

Aerospace Research Facilities 

Military Research 

Government Research and Development Land 

 Government Storage and Preservation Facilities 

Storage and Preservation Buildings and Structures 

Archive and Record Centers 

Warehouses 

Weapons and Ammunition Storage 
148 INFRASTRUCTURE TAXONOMY 

Precious Metal Storage 

Currency Storage 

Special Nuclear Materials and Waste Storage 

Storage and Preservation Land 

 Government Sensor and Monitoring Systems 

Global Positioning System 

GPS Space Segment 

GPS Control Segment 

Government Observation Systems 

 Government Space Systems 

Military Facilities 

Launch Vehicles 

Launch Facilities 

Mission Control Facilities 

Satellites 

NASA Facilities 

Launch Vehicles 

Launch Facilities 

Mission Control Facilities 

Satellites 

 Military Facilities 

Army Bases 

Navy Bases 

Marine Corps Bases 

Air Force Bases 

Coast Guard Bases 

National Guard Facilities 

Joint and Combined Military Installations and 

Reservations 

 Other Government Facilities 

Other Government Buildings and Structures 

Other Government Land 

HEALTHCARE AND PUBLIC HEALTH 

 Direct Patient Healthcare 

Public Health Agencies 

Healthcare Educational Facilities 

Health Supporting Facilities 

End-of-Life Facilities 

Regulatory, Oversight, and Industry Organizations 

INFORMATION TECHNOLOGY 

Hardware Production 

Software Production 

Information Technology Services 

Internet 
INFRASTRUCTURE TAXONOMY 149 

Next Generation Networks 

Regulator, Oversight and Industry Organizations 

NATIONAL MONUMENTS AND ICONS 

National Monument/Icon Structures 

National Monument/Icon Geographic Areas 

National Monument/Icon Documents and Objects 

Other National Monuments and Icons 

POSTAL AND SHIPPING 

U.S. Postal Service 

Couriers 

Other Postal and Shipping Facilities 

TELECOMMUNICATIONS 

Wired Telecommunications 

Wireless Telecommunications 

Satellite Telecommunications 

Internet 

Information Services 

Next Generation Networks 

Regulatory, Oversight and Industry Organizations 

Other Telecommunication Facilities 

TRANSPORTATION 

Aviation 

Railroad 

Road 

Maritime 

Mass Transit 

Pipelines 

Regulatory, Oversight and Industry Organizations 

WATER 

Raw Water Supply 

Raw Water Transmission 

Raw Water Storage 

Water Treatment Facilities 

Treated (Finished) Water Storage 

Treated Water Distribution Systems 

Treated Water Monitoring Systems 

Treated Water Distribution Control Centers 

Wastewater Facilities 

Regulatory, Oversight and Industry Organizations 

SCREENER’S GUIDE TO ELECTRONIC VERSION OF PROCEDURE 151 

 SCREENER’S GUIDE TO ELECTRONIC VERSION 

 OF PROCEDURE E 

RAPID VISUAL SCREENING DATABASE 

o support Rapid Visual Screening (RVS), the data collection 

process has been incorporated into the existing FEMA Risk 

Assessment Database application, FEMA 452, Risk Assessment: A 

How-To Guide to Mitigate Potential Terrorist Attacks Buildings. 

The database tool is designed to support a quick collection of RVS 

information as well as photos, GIS portfolios, and other files to 

facilitate analysis. In addition, the database tool is designed to be 

compatible and exchange information with other assessments in the 

FEMA 452 Risk Management Database. 

Download and install the database program from the FEMA website: 

http://www.fema.gov/plan/prevent/rms/rmsp452.shtm. Follow the 

download and self installation instructions. It is recommended to 

install the database on two separate systems: one as the permanent 

database at an organization’s headquarters and one on the 

computer(s) that your RVS assessors will use to collect data, such as a 

laptop. For small organizations, one copy of the database can be used 

to perform both management and data collection functions. Note: a 

full user guide is provided with the database and can be opened from 

the Help button on the database screens. 

INSTALLATION PROCESS 

P Download the database program from the FEMA website: 

http://www.fema.gov/plan/prevent/rms/rmsp452.shtm. 

P After downloading the program, begin the installation process by 

first closing all other programs and then left click on the 

SETUP.EXE file. Note: If the program was previously downloaded 

to your computer, left click <Start>, <Run>, identify the location 

where the SETUP.EXE program can be found (CD, C:/Temp, or 

some other storage location on hard drive or media) and then left 

click on the SETUP.EXE file. 

P The Install Wizard first identifies the name of the software being 

installed. Left click <Next> to continue after confirming that this is 

the software you want to install. 

T
152 SCREENER’S GUIDE TO ELECTRONIC VERSION OF PROCEDURE 

P A standard screen showing the End User License Agreement will 

appear. Read as you feel appropriate, then left click on the 

<Accept> circle, and left click on <Next> to continue with the 

installation. 

 

P Add the User Name and Organization in the appropriate windows. 

Continue with the installation by left clicking <Next>. 

P There is no advantage in using the Custom Installation. There are 

no component programs to select. The only feature that the 

Custom Installation allows is to change the file name and/or file 

location. In most cases you should follow the Typical Installation. 

To proceed, left click on <Typical>. 

P A standard screen to ensure you are ready to install will appear. 

Proceed by left clicking <Install>. 
SCREENER’S GUIDE TO ELECTRONIC VERSION OF PROCEDURE 153 

 

P If the Access program is not located in the standard location, the 

Install Wizard will take a long time looking for it with a searching 

flashlight. It should eventually find it and get to this screen. The 

final standard screen indicates the Install Wizard has completed the 

installation. Left click <Finish> to end the installation. 

P Following the same procedure, install a second copy of the 

program to use in the Assessment Tool operating mode on the 

computer(s) that your assessors will use to collect data, such as a 

laptop. 

OPENING THE DATABASE 

o open the Master Assessment Database, you first left click on 

<Start>, select "Open" from the menu, then double-click 

<Programs>, and look for the <FEMA Master Assessment 

Database> to left click. The FEMA Master Assessment Database should 

be at the end of the Startup Program Menu immediately after the 

T
154 SCREENER’S GUIDE TO ELECTRONIC VERSION OF PROCEDURE 

installation. You can copy the shortcut icon for the FEMA Master 

Assessment Database to another location at any time. 

Note: the database can only be opened by left clicking on the FEMA 

Master Assessment Database Icon. 

The first action to enter the database is the Logon. You can enter the 

database Tool as an Assessor, Editor, Reader or Administrator. It is 

recommended that the database be accessed the first time using the 

Administrator log on, which provides access to all functions of the 

program. The initial Password for Administrator is “Administrator”. 

The Database Manager / Administrator will be able to establish new 

user accounts and passwords. If this has been completed use your 

assigned user name and password. 
SCREENER’S GUIDE TO ELECTRONIC VERSION OF PROCEDURE 155 

P This leads to a Main Menu of the database. It may start either in the 

Assessment operating mode or in the Master Database operating 

mode. (It opens in the mode for which it was last used.) 

The following are the hardware and software requirements for the Risk 

Assessment Database: 

P Pentium® 4 or equivalent processor 

P Windows XP® 

P MS Access® 2002 

P 256 MB of RAM recommended for all components 

Note: the Database must be opened using the shortcut installed during 

the initial setup. 

The initial passwords are: 

Name: Administrator Password: Administrator 

Name: Assessor Password: Assessor 

Name: Editor Password: Editor 

Name: Reader Password: Reader 

It is highly recommended that your database administrator assign new 

user names and change these passwords following the initial 

installation of the database. See the Database Administrator 

Information section and the Change Password section of the User 

Guide for more detailed information. 

USE OF THE DATABASE 

he database is designed to be loaded on several different 

systems and to allow an organization to exchange information 

between two or more copies of the database: one database (or 

more) loaded on the assessor team laptop(s) and operating in the 

Assessment Tool mode for conducting assessments in the field; and 

one database loaded on a computer at an organization’s headquarters 

and operating in the Master Database mode for collecting the results, 

printing reports, and analyzing the information from a number of 

assessments. The Master Database copy also provides the organization 

the ability to search for vulnerabilities common to many assessed 

facilities, search for specific vulnerabilities, and other functions. 

Essentially it can be used as a Risk Management tool to identify and 

track mitigation measures to reduce risk. 

T
156 SCREENER’S GUIDE TO ELECTRONIC VERSION OF PROCEDURE 

The Assessment Tool mode was designed for engineers and security 

specialists to be able to easily collect data from the facility being 

assessed. As you will see, the software is very user friendly. The Master 

Database mode was designed for the Program Manager. 

The diagram provided above shows how the copies of the database 

interact. When an organization collects pre-assessment information 

and prepares to conduct an assessment of a facility or a series of 

facilities, an assessment record is prepared in the lead assessor’s 

database using the Assessment Tool operating mode (usually on a 

laptop computer). Into this assessment record is placed references, site 

plans, GIS portfolios, and other facility specific data that is known 

about the assessment facility or is developed during the pre-assessment 

phase. 

This assessment record is then exported (if required) to other 

assessment team members by an administrator using the Import 

Assessor Database function in the Master Database operating mode. 

The assessment team then conducts the assessment and records 

information using the Assessor Tool operating mode. At the end of the 

assessment, the assessment team leader uses the Import Checklist 

function in the Assessment Tool operating mode to combine the 

Assessment Tool Mode 

Import 

Assessment

Master Database Mode 

Conduct RVS Assessment 

Exchange 

Files, 

Pictures, 

Data 

Manage Program 

Store / 

Analyze 

Data 

Lead Assessor 

Physical 

Security SME 

Infrastructure 

Engineer 
SCREENER’S GUIDE TO ELECTRONIC VERSION OF PROCEDURE 157 

team’s checklist, vulnerability and recommendation entries into one 

record. They also combine photos, and miscellaneous files into the 

lead assessor’s database folder using the “Add Photo”, “Add GIS 

Portfolio Images” and “Miscellaneous Files” functions. The Project 

Manager then uses the Import Assessor Database function in the 

Master Database operating mode to transfer the complete assessment 

data and files into the Master Database for analysis and printing. 

Note: a full user guide is provided with the database and can be 

opened from the Help buttons on the database screens. 

REFERENCES 159 

 REFERENCES 

DHS, 2005, Protective Measures Infrastructure Category: Commercial Office 

Buildings, Protective Measures Section, Protective Security 

Division, Department of Homeland Security, Washington, D.C. 

(For Official Use Only [FOUO]). 

DHS, 2006, Infrastructure Taxonomy, Version 2, Risk Management 

Division Office of Infrastructure Protection, Department of 

Homeland Security, Washington, D.C. 

DHS, 2006, National Infrastructure Protection Plan, Department of 

Homeland Security, Washington, D.C. 

DOJ, 1995, Vulnerability Assessment of Facilities, Department of Justice, 

Washington, D.C. 

FEMA, 2003a Reference Manual to Mitigate Potential Terrorist Attacks 

Against Buildings, FEMA 426, Federal Emergency Management 

Agency, Washington, D.C. 

FEMA, 2003b, Primer for Design of Commercial Buildings to Mitigate Terrorist 

Attacks, FEMA 427, prepared by the Applied Technology 

Council for the Federal Emergency Management Agency, 

Washington, D.C. 

FEMA, 2005, Risk Assessment: A How-To Guide to Mitigate Potential Terrorist 

Attacks Against Buildings, Risk Management Series, FEMA 452, 

Federal Emergency Management Agency, Washington, D.C. 

FEMA, 2007, HAZUS-MH MR-3 Technical Manual for the Flood Model, at: 

http://www.fema.gov/plan/prevent/hazus/hz_manuals.shtm, 

Federal Emergency Management Agency, Washington, D.C. 

FHWA, 2003, Recommendations for Bridge and Tunnel Security, Requested 

by American Association of State Highway and Transportation 

Officials, Prepared by: Blue Ribbon Panel on Bridge and 

Tunnel Security, Washington, D.C. 

GSA, 2003, Progressive Collapse Analysis and Design Guidelines, U.S. 

General Services Administration (GSA), Washington, D.C. 

ISC, 2004, Security Design Criteria, Interagency Security Committee 

(ISC), Washington, D.C. (FOUO)