Threat and Hazard Identification

and Risk Assessment (THIRA) 

and Stakeholder Preparedness 

Review (SPR) Guide

Comprehensive Preparedness Guide (CPG) 201 

3rd Edition 

May 2018 
CPG 201: THIRA/SPR Guide—3rd Edition 

2 
Preface CPG 201: THIRA/SPR Guide—3rd Edition

3 

Preface 

Comprehensive Preparedness Guide (CPG) 201, 3rd Edition, provides guidance for conducting a 

Threat and Hazard Identification and Risk Assessment (THIRA) and Stakeholder Preparedness 

Review (SPR), formerly State Preparedness Report. The 1st Edition of CPG 201 (April 2012) 

presented the basic steps of the THIRA process. Specifically, the 1st Edition described a 

standard process for identifying community-specific threats and hazards and setting targets for 

each core capability identified in the National Preparedness Goal. The 2nd Edition (August 

2013) expanded the THIRA process to include resource estimation, streamlined the number of 

steps in the process, and provided additional examples of how to develop a THIRA. 

CPG 201, 3rd Edition, includes both the THIRA and SPR because they are interconnected 

processes that, together, communities use to evaluate their preparedness. The 3rd Edition also

introduces updates to both methodologies. The THIRA includes standardized language to 

describe threat and hazard impacts and capability targets. This allows communities to collect 

more specific, quantitative information while also providing important context. Through the 

updated SPR process, communities collect more detailed and actionable data on their current 

capabilities and identified capability gaps. Communities then indicate their intended approaches 

for addressing those gaps, and assess the impact of relevant funding sources on building and 

sustaining capabilities. 

Where appropriate, the 3rd Edition highlights key changes from previous editions of CPG 201. 

This 3rd Edition supersedes the 2nd Edition of CPG 201. 
CPG 201: THIRA/SPR Guide—3rd Edition Table of Contents

4 

Table of Contents 

Contents

Preface ............................................................................................................................................ 3

Table of Contents .......................................................................................................................... 4

Introduction ................................................................................................................................... 5

The National Preparedness Goal ................................................................................................. 5

The National Preparedness System ............................................................................................. 6

Using the THIRA/SPR Strategically ........................................................................................... 7

Community-Wide Involvement .................................................................................................. 9

The THIRA Process .................................................................................................................... 10

Introduction to the Three Steps of the THIRA ......................................................................... 10

Step 1: Identify the Threats and Hazards of Concern ............................................................... 11

Step 2: Give the Threats and Hazards Context ......................................................................... 15

Step 3: Establish Capability Targets ......................................................................................... 19

The SPR Process .......................................................................................................................... 23

Step 1: Assess Capabilities ....................................................................................................... 24

Step 2: Identify and Address Capability Gaps .......................................................................... 34

Step 3: Describe Impacts of Funding Sources .......................................................................... 39

Conclusion .................................................................................................................................... 41

Glossary of Terms ....................................................................................................................... 42
Introduction CPG 201: THIRA/SPR Guide—3rd Edition

5 

Introduction 

The National Preparedness Goal

The National Preparedness Goal, Second Edition (2015)1 defines what it means for all 

communities to be prepared for the threats and hazards that pose the greatest risk to the security 

of the United States. The National Preparedness Goal (“the Goal”) is: 

A secure and resilient Nation with the capabilities required across the whole community to 

prevent, protect against, mitigate, respond to, and recover from the threats and hazards that 

pose the greatest risk.

The Goal identifies 32 distinct activities, called core capabilities, needed to address the greatest 

risks facing the Nation (see Figure 1). 2 The Goal organizes these core capabilities into five 

categories, called mission areas.

3 Some core capabilities apply to more than one mission area.

For example, the first three core capabilities—Planning, Public Information and Warning, and 

Operational Coordination—are cross-cutting capabilities, meaning they apply to each of the five 

mission areas. 

The National Preparedness Goal describes the five mission areas as follows:

• Prevention: Prevent, avoid, or stop an imminent, threatened, or actual act of terrorism. 

• Protection: Protect our citizens, residents, visitors, and assets against the greatest 

threats and hazards in a manner that allows our interests, aspirations, and way of life to 

thrive. 

• Mitigation: Reduce the loss of life and property by lessening the impact of future 

disasters. 

• Response: Respond quickly to save lives; protect property and the environment; and 

meet basic human needs in the aftermath of an incident. 

• Recovery: Recover through a focus on the timely restoration, strengthening, and 

revitalization of infrastructure, housing, and a sustainable economy, as well as the 

health, social, cultural, historic, and environmental fabric of communities affected by an 

incident.

The mission areas and core capabilities organize the community-wide activities and tasks 

performed before, during, and after disasters into a framework for achieving the goal of a 

secure and resilient Nation. 

 

1 For additional information on the National Preparedness Goal, please visit: https://www.fema.gov/nationalpreparedness-goal. 2 For additional information on core capabilities, please visit: https://www.fema.gov/core-capabilities. 3 For additional information on mission areas, please visit: https://www.fema.gov/mission-areas. 
CPG 201: THIRA/SPR Guide—3rd Edition Introduction

6 

Figure 1: Five mission areas organize the 32 core capabilities needed to address threat and hazards of 

concern.

The National Preparedness System

Communities assess, build, sustain, and deliver the core capabilities through an organized 

process called the National Preparedness System.

4 The National Preparedness System has six 

components (see Figure 2), each of which ties into the others to guide community-wide 

preparedness activities and achieve the Goal of a secure and resilient Nation. 

 

4 For additional information on the National Preparedness System, please visit: https://www.fema.gov/nationalpreparedness-system. 
Introduction CPG 201: THIRA/SPR Guide—3rd Edition

7 

Figure 2: There are six components of the National Preparedness System.

Using the THIRA/SPR Strategically

The THIRA/SPR sets a strategic foundation for putting the National Preparedness System into 

action. Communities complete the THIRA every three years and use the data from the process to 

assess their capabilities in the SPR, which is an annual review. It is important that communities 

complete the THIRA on a multi-year cycle, as it enables them to assess year-over-year trends in

changes to their capabilities, while still periodically reviewing the capability targets to keep them 

relevant. 

The three-year THIRA/SPR cycle starts with the first step in the National Preparedness System: 

Identifying and Assessing Risk. Risk is the potential for an unwanted outcome resulting from an 

incident or occurrence, as determined by its likelihood and the associated consequences.

5 In the 

THIRA, communities identify risks with the potential to most challenge their capabilities and 

expose areas in which the community is not as capable as it aims to be. These areas, or capability 

gaps, create barriers in a community’s ability to prevent, protect against, mitigate, respond to, and 

recover from a threat or hazard. Understanding the risks they face will make it easier for 

communities to determine what level of capability they should plan to build and sustain. 

Communities can use the information that comes from the THIRA/SPR process to answer five

key strategic questions about their preparedness risks and capabilities (see Figure 3). 

 

5

 DHS Risk Lexicon, June 2010: https://www.dhs.gov/sites/default/files/publications/dhs-risk-lexicon-2010_0.pdf. 
CPG 201: THIRA/SPR Guide—3rd Edition Introduction

8 

Figure 3: Communities use the THIRA/SPR to answer five key questions.

Since 2012, communities have used the THIRA/SPR to answer these questions, helping them 

better understand the risks their communities face. This helps communities make important

decisions on how to prevent, protect against, mitigate, respond to, and recover from the threats 

and hazards that pose the greatest risks. 

In addition to the Identifying and Assessing Risk component of the National Preparedness 

System, communities use the THIRA/SPR for Estimating Capability Requirements. This 

involves determining the specific level of capability that best addresses a community’s risks. 

These community-specific capability levels are what communities use to determine their current 

level of capability, identify their capability gaps, and identify how they can close those gaps. At 

the end of the three-year THIRA/SPR cycle, communities reassess their risks by completing the 

THIRA again and the process restarts. The outputs of the THIRA/SPR provide communities a 

foundation to prioritize decisions, close gaps in capability, support continuous improvement 

processes, and drive the other National Preparedness System components (see Figure 4). 
Introduction CPG 201: THIRA/SPR Guide—3rd Edition

9 

Figure 4: The THIRA/SPR fuels NPS implementation. 

Community-Wide Involvement

Recognizing that preparedness is a shared responsibility, the National Preparedness System calls 

for everyone—not just government agencies—to be involved in preparedness efforts. 

Community-wide involvement is an important principle in preparedness that entails involving 

stakeholders throughout preparedness development, and ensuring preparedness materials reflect 

their roles and responsibilities. Including stakeholders early on and throughout the THIRA/SPR 

process helps the community to conduct accurate and comprehensive assessments. Furthermore, 

involving stakeholders throughout the process empowers them to use the data to help drive 

priorities and investments within their own organizations.

As such, developing a comprehensive and accurate THIRA/SPR requires active community 

involvement from stakeholders and subject-matter experts (SMEs), such as: 

 Colleges/universities, and other research organizations 

 Cybersecurity experts 

 Emergency management/homeland security agencies

 Emergency Planning Committees 

 Federal agencies (e.g. Department of Health and Human Services)

 FEMA regional offices

 Fire, police, emergency medical services, and health departments

 Hazard mitigation offices

 Infrastructure owners and operators

 Major urban area and state fusion centers

 National Laboratories

 National Weather Service offices

 Port or transit organizations

 Supply chain stakeholders 

 Private sector partners (including the 16 critical infrastructure sectors) 
CPG 201: THIRA/SPR Guide—3rd Edition The THIRA Process

10 

 Professional associations

 Tribal governments 

 U.S. Department of Homeland Security (DHS) Protective Security Advisors 

 Volunteer Organizations Active in Disasters (VOAD)

 Other organizations or agencies with significant impact on the local economy 

Communities should also include SMEs 

from planning, exercises, mitigation, 

training, and other key areas in their 

THIRA/SPR process. Including the 

perspectives and expertise of these key 

stakeholders gives communities critical 

information regarding planning factors 

and capability levels across all mission 

areas. As a result, emergency managers

will be well-positioned to provide 

essential information about the status of 

capabilities and consider THIRA/SPR data in their planning efforts, including the development 

of strategic, operational, and tactical plans. 

Importance of Community-Wide Involvement

The outputs of the THIRA/SPR process inform 

all other preparedness activities; helping 

communities identify challenges, drive priorities, 

and close gaps in capabilities. Therefore, when 

developing and updating THIRA/SPRs, 

communities should ensure their assessment and 

planning efforts include community-wide input 

and perspectives.

The THIRA Process 

Introduction to the Three Steps of the THIRA

The THIRA is a three-step risk assessment completed every three years. It helps communities 

answer the following questions: 

 What threats and hazards can affect our community?

 If they occurred, what impacts would those threats and hazards have on our community? 

 Based on those impacts, what capabilities should our community have? 

The THIRA helps communities understand their risks and determine the level of capability they 

need in order to address those risks. The outputs from this process lay the foundation for 

determining a community’s capability gaps during the SPR process. 

This section describes the three-step process for developing a THIRA (see Figure 5): 

Figure 5: There are three steps in the THIRA process.
THIRA Step 1 CPG 201: THIRA/SPR Guide—3rd Edition

11 

1. Identify Threats and Hazards of Concern: Based on a combination of experience, 

forecasting, subject matter expertise, and other available resources, develop a list of threats 

and hazards that could affect the community. When deciding what threats and hazards to 

include in the THIRA, communities consider only those that challenge the community’s 

ability to deliver at least one core capability 

more than any other threat or hazard; the 

THIRA is not intended to include less 

challenging threats and hazards. 

2. Give Threats and Hazards Context:

Describe the threats and hazards identified in 

Step 1, showing how they may affect the 

community and create challenges in 

performing the core capabilities. Identify the 

impacts a threat or hazard may have on a 

community. 

3. Establish Capability Targets: Using the impacts described in Step 2, determine the level of 

capability that the community plans to achieve over time in order to manage the threats and 

hazards it faces. Using standardized language, create capability targets for each of the core 

capabilities based on this desired level of capability by identifying impacts, objectives, and 

timeframe metrics.

THIRA: Key Changes

▪ FEMA now recommends that 

communities complete the THIRA on a 

three-year cycle, rather than annually. 

▪ The THIRA is now a three-step 

assessment; FEMA has removed 

THIRA Step 4—Apply Results—from 

the process. 

Step 1: Identify the Threats and Hazards of Concern 

In Step 1 of the THIRA process, communities develop a list of threats and hazards (see Figure 

6). 

Figure 6: The output of Step 1 of the THIRA is a list of threats and hazards of concern.

Categories of Threats and Hazards 

For the purposes of the THIRA, threats and hazards are organized into three categories. 

 Natural hazards: acts of nature 

 Technological hazards: accidents or the failures of systems and structures 

 Human-caused incidents: the intentional actions of an adversary 

Table 1 provides example threats and hazards for each of the three categories. 
CPG 201: THIRA/SPR Guide—3rd Edition THIRA Step 1

12 

Table 1: Example threats and hazards by category. 

Natural Technological Human-caused

Avalanche

Drought

Earthquake

Epidemic

Flood

Hurricane/Typhoon

Space weather

Tornado

Tsunami

Volcanic eruption

Winter storm

Dam failure

Hazardous materials release

Industrial accident

Levee failure

Mine accident

Pipeline explosion

Radiological release

Train derailment

Transportation accident

Urban conflagration

Utility disruption

Active shooter incident

Armed assault

Biological attack

Chemical attack

Cyber-attack against data

Cyber-attack against 

infrastructure

Explosives attack

Improvised nuclear attack

Nuclear terrorism attack

Radiological attack

Communities consider two criteria when 

identifying threats and hazards for the 

assessment: (1) the threat or hazard is 

reasonably likely to affect the community; 

and (2) the impact of the threat or hazard

challenges at least one of the 32 core 

capabilities more than any other threat or 

hazard. As a single incident may most 

challenge the ability to perform multiple 

core capabilities, the number of threats and hazards that each community includes will depend 

on the specific risk profile of the community. 

See Figure 7 for an example where a community selected an earthquake, a cyber-attack, a flood, 

an active shooter, and a chemical hazmat release—each of which most challenged at least one 

core capability. 

 

The Most Challenging Threat or Hazard

For the purposes of this Guide, if a threat or 

hazard “most challenges” a core capability, it 

means that the community would struggle to 

deliver the core capability during that specific 

incident more so than for any other threat or 

hazard.
THIRA Step 1 CPG 201: THIRA/SPR Guide—3rd Edition

13 

Figure 7: A single threat or hazard may most challenge more than one core capability.

Sources of Threat and Hazard Information 

Consulting multiple sources during the THIRA process helps establish a comprehensive list of 

the threats and hazards that communities may face. These sources may include, but are not 

limited to: 

 Existing Federal, state, local, and tribal strategic and operational plans 

 Existing threat or hazard assessments (e.g., the Hazard Identification and Risk 

Assessment) 

 Forecasts or models of future risks due to changing weather and demographic patterns or 

emerging threats

 Hazard mitigation plans

 Intelligence fusion center bulletins and assessments

 Local, regional, tribal, and neighboring community THIRAs 

 Records from previous incidents, including historical data 

 Homeland security and emergency management laws, policies, and procedures 

 Private-sector plans and risk assessments, including those for lifeline functions 

(communications, energy, transportation, and water)6

Factors for Selecting Threats and Hazards 

When identifying threats and hazards to include in the THIRA, communities consider two key 

factors: (1) the likelihood of a threat or hazard affecting the community; and (2) the challenge 

presented by the impacts of that threat or hazard, should it occur. 

 

6 Lifeline functions are functions that are essential to the operation of most critical infrastructure sectors. For 

additional information on lifeline functions please visit: 

https://www.dhs.gov/sites/default/files/publications/national-infrastructure-protection-plan-2013-508.pdf. 
CPG 201: THIRA/SPR Guide—3rd Edition THIRA Step 1

14 

Factor #1: Likelihood of a Threat or Hazard Affecting a Community 

For the purposes of the THIRA, “likelihood” is the chance of a given threat or hazard affecting a 

community. Likelihood is important to consider because communities must allocate limited 

resources strategically. A particular threat or hazard might be possible, but communities should 

determine whether the likelihood of its occurrence is large enough to drive investment decisions. 

Through the THIRA, communities 

identify the threats and hazards that 

are challenging enough to expose 

their capability gaps, and are likely

enough that a community can 

justify investing in the capabilities 

necessary to manage those threats 

and hazards. 

The ability to predict the likelihood 

of a specific incident varies greatly 

across threats and hazards. Some 

hazards, such as floods, have 

mature prediction models that can

allow communities to calculate the 

numerical probability of a specific 

incident, such as 1 in 100 or 1 percent a year, with a moderate degree of accuracy. Other 

incidents, such as terrorism, are more difficult to predict and communities may most easily 

express them on a logarithmic scale, such as 1 in 1,000, or on an ordinal scale, such as low, 

medium, and high. Regardless of how communities express the probability of a specific 

incident, understanding the likelihood of their threats and hazards can help communities 

understand capability requirements and prioritize investments. 

Including estimates of probability in the THIRA is not necessary, but communities may do so if 

they deem it appropriate. Communities can also consider additional sources for useful likelihood 

and consequence information to inform their threat and hazard selections, such as hazard 

mitigation plans. Regardless of whether probability is included in the THIRA process, 

communities only consider those threats and hazards that could realistically occur. 

Factor #2: The Impacts of a Threat or Hazard 

The projected impacts of threats and hazards determine the level of capability that a community 

will need to address those impacts. To understand their risks effectively, communities should 

identify and select threats and hazards that have impacts that most challenge their communities, 

and therefore their capabilities. When assessing impact, it is important to consider that different 

incidents present different types of challenges. In some cases, the sheer magnitude of the 

incident may be substantial. In other cases, there may be operational or coordination 

complexities or economic and social challenges. 

Communities may include as many threats or hazards in their THIRA as they desire but should, 

at a minimum, include as many threats and hazards as needed to most challenge each of the 32 

core capabilities.

Considering the Location of Threat and Hazard 

Consequences

Although incidents may have wider regional or national 

effects, communities completing the THIRA should 

focus strictly on the consequences within their 

community. In some cases, it may be useful to include 

threats and hazards that occur in other locations if they 

trigger local effects.

For Example: 

An industrial accident at a chemical plant located in one 

particular community could affect people in another 

community who are downwind or downriver from the 

accident.
THIRA Step 2 CPG 201: THIRA/SPR Guide—3rd Edition

15 

Step 2: Give the Threats and Hazards Context 

In Step 2 of the THIRA process, communities create context descriptions and estimate the 

impacts of the threats and hazards identified in Step 1 (see Figure 8). Context descriptions and 

impacts inform THIRA Step 3 where communities determine the level of capability they would 

like to achieve. When creating context 

descriptions and estimating impacts, 

communities should consider community-wide 

sources, such as real-world incidents, SMEs, 

exercises, response and recovery plans, 

modeling, or tools. Identifying different sources 

provides communities with key data points that 

they can use to determine how a threat or hazard

may affect their community. For example, SMEs 

can help shape context descriptions by outlining 

the time, place, and location of the threat or 

hazard in a way that shows how it challenges a 

community’s capabilities. 

Identifying sources of information is extremely 

important for continuity of the assessment 

process. Communities may not update the THIRA for several years, so there may be changes in 

staff involved in the process between updates. The potential resulting loss in knowledge and 

experience after staff turnover can make it challenging to maintain continuity between updates.

Citing sources helps to complete future THIRA updates, increasing consistency, improving data 

credibility, and reducing duplication of effort. 

THIRA Step 2: Key Changes

▪ Communities now identify the impacts 

for their chosen threats and hazards in 

Step 2, rather than Step 3, because this 

flows more naturally from developing 

context descriptions. 

▪ Communities now estimate the impacts 

of each threat and hazard using 

standardized impact language 

(numerical entry), rather than providing 

free-text impacts, establishing a 

common language for describing 

impacts at all levels of government.

Figure 8: The outputs of Step 2 of the THIRA are context descriptions and impact numbers. 

Step 2.1: Context Descriptions

In Step 2.1 of the THIRA, communities add context to each threat and hazard identified in Step 

1. Context Descriptions are the details about a threat or hazard needed to identify the impacts it 

will have on a community and includes critical details such as location, magnitude, and time

of an incident. 

If an element of the scenario is essential to understanding the impact of an incident and the 

capabilities required to manage it, that element should be included in the context description. 
CPG 201: THIRA/SPR Guide—3rd Edition THIRA Step 2

16 

For example, at night, residential structures have a higher occupancy, while during the day, 

schools and office buildings have higher occupancies. In this example, search and rescue 

missions would target different locations based on the time of the day the scenario occurs. See 

Table 2 for more examples on how critical details can influence a context description. 

Table 2: Questions to Consider When Developing Context Descriptions

Best Practices for Developing Context Descriptions

Questions to Consider Examples in Practice

How would the timing of an incident affect the 

community’s ability to manage it? What time of day 

and what season would be most likely or have the 

greatest impact? 

Community A is a very popular summer tourist 

destination. A tornado occurring at 7:00 p.m. in

June might have the greatest impacts, as large 

numbers of tourists will be on the roads 

returning to their hotels.

How would the location of an incident affect the 

community’s ability to manage it? Which locations 

would be most likely or have the greatest impacts

(e.g., populated areas, coastal zones, industrial or 

residential areas)?

Community B has a high population density in 

the north and very low population density in the 

south. A pandemic might result in the greatest 

impacts in the north, where the disease can 

spread among the population more quickly.

What other conditions or circumstances make the 

threat or hazard of particular concern (e.g., 

atmospheric conditions like wind speed/direction 

and relative humidity, or multiple incidents 

occurring at the same time)?

Community C experiences a hazardous 

materials release. The worst impacts might 

occur on a day with increased wind speed 

directed towards the highly populated 

residential areas in the community.

What social or physical vulnerabilities make the 

threat or hazard of particular concern? (e.g., flood 

prone areas, populations with limited or no ability to 

evacuate)?

Community D is located in a mountainous 

region, with its population spread between the 

suburban areas in the foothills and the rural 

mountain communities. A wildfire might have 

greater impacts in the mountain communities, 

which have limited roads that the population 

can use to evacuate and is more difficult to 

access by response workers.

See the example context descriptions below for a comparison between sufficient and insufficient

levels of detail. The example with sufficient detail provides suggested types of information that 

a community might want to consider including in their context descriptions. 

Example Context Description: Insufficient Level of Detail

An active shooter incident occurs, involving multiple gunmen and many potential victims. 

There are dozens of fatalities and injuries, and first responders arrive to the scene quickly. 

There are reports that the incident may be related to terrorism.
THIRA Step 2 CPG 201: THIRA/SPR Guide—3rd Edition

17 

 

Example Context Description: Sufficient Level of Detail

At approximately 2:00 p.m. on a Sunday afternoon, local police and State Troopers are 

dispatched to Thiraland City Mall responding to reports of an active shooter situation. 9-1-1 

calls from patrons report between one and four shooters, with varying reports of the types of 

weapons, number of weapons, and number of injured people. At the time of the incident—

among the busiest the mall experiences during a normal week—the 1,200,000 square foot 

facility was occupied by approximately 8,500 shoppers and employees. Upon arrival, 

authorities find crowds pouring out of the mall’s exits. Some are unharmed while others are 

severely injured. Advanced Life Support (ALS) and Basic Life Support (BLS) units are en 

route, with mutual aid EMS being dispatched. Shots are still heard inside, and the injury count 

cannot be immediately estimated. The closest hospital facility is approximately 3 miles from 

Thiraland City Mall. The closest Level I Trauma Center is approximately 18 miles from 

Thiraland City Mall. The medical facilities have been notified of the incoming patients, but 

the unknown number and extent of injuries, ongoing shortages of IV bags, and understaffing 

raise concern about the facilities’ ability to care for the incoming victims. Within an hour, the 

state fusion center is receiving credible intelligence of a terrorism link to the attack.

Step 2.2: Estimate Impacts

In Step 2.2, communities estimate the impacts a scenario would have on their community if the 

threat or hazard occurred. Communities write impacts in the language of common emergency 

management metrics, such as affected population, number of people requiring shelter, or 

number of people requiring screening. The THIRA process uses a uniform set of these common 

metrics, or standardized impact language (see Figure 9). The standardized impact language 

represents metrics estimated by every community, and in most cases, across multiple different 

threats and hazards. The estimated impact from this step provides the basis for creating 

capability target statements in Step 3 of the THIRA process (see Figure 10). 

When determining the impacts of a threat or hazard, it is important to engage relevant 

stakeholders and SMEs that can provide varying perspectives. For example, when estimating 

impacts and setting capability targets for the Infrastructure Systems core capability, including 

input from each of the infrastructure sectors provides a holistic view of the different ways a 

threat or hazard may challenge the capability.7

Figure 9: Impacts are developed by adding community-specific numbers to standardized impact language.

7 For additional information on the Critical Infrastructure sectors, please visit: https://www.dhs.gov/criticalinfrastructure-sectors. More information is also available at: https://www.fema.gov/media-librarydata/1471451918443-dbbb91fec8ffd1c59fd79f02be5afddd/Recovery_FIOP_2nd.pdf. 
CPG 201: THIRA/SPR Guide—3rd Edition THIRA Step 2

18 

Figure 10: Communities use standardized impacts data to create capability targets.

Communities develop capability targets in Step 3 based on their estimated impacts. As such, 

communities identify a community-specific number for the standardized impact language in 

Step 2.2 before proceeding to Step 3. Ideally, communities will estimate all standardized 

impacts for each threat or hazard scenario. However, at a minimum, to develop capability targets 

in THIRA Step 3, communities will 

develop an estimate for each 

standardized impact at least once 

across all included threats and 

hazards.

In addition to the impacts for which 

there is standardized language, 

communities may include as many 

other impacts in their THIRA as they 

deem appropriate. They may choose 

to include additional non-standardized impact language, if they want to describe certain effects 

of a disaster that are not included in the standardized impact language. Communities may find 

this helpful when considering their threats and hazards. If a community chooses to estimate an 

impact using data from only one scenario, they should use data from the scenario that would 

create the most challenging impact. 

Identifying the Most Challenging Impact

The impact with the largest number is not necessarily 

always the most challenging to address. For example, 

it may be more challenging to provide medical care to 

a smaller number of individuals affected by a 

radiological attack (which may include additional 

considerations like decontamination or personal 

protective equipment) than a larger number of 

hurricane survivors. 
THIRA Step 3 CPG 201: THIRA/SPR Guide—3rd Edition

19 

Step 3: Establish Capability Targets 

In Step 3 of the THIRA process, communities establish capability targets—which describe the 

level of capability a community plans to work toward achieving—for each of the 32 core 

capabilities (see Figure 11). These capability targets are not a reflection of a community’s 

current capability and may represent a 

long-term desired capability level. To 

develop capability targets, communities 

consider what is required to address the 

impacts of their threats and hazards. In 

addition to the risks posed by their 

threats and hazards, communities also 

take into account expected resources 

and other factors to determine the level 

of capability their community plans to 

work toward achieving. 

 

Capability Targets

 For the purposes of the THIRA/SPR, 

communities should view their capability targets 

as the level of capability communities plan to 

build to, instead of a target based on maximum 

capability requirements.

 Communities can also include a maximum 

requirement target in addition to their capability 

target if they choose. 

Figure 11: The outputs of Step 3 of the THIRA are capability targets that use standardized target language. 

In the THIRA, communities create capability targets for each of the 32 core capabilities. To 

create a capability target, communities fill in the blanks within the standardized target language 

to show the level of capability they want to achieve. FEMA developed standardized target 

language (see Figure 12) for each capability based on previous THIRA targets submitted by 

communities, the National Planning Frameworks,8 the critical tasks in the Federal Interagency 

Operational Plans (FIOPs),

9

 FEMA Core Capability Development Sheets,

10 and community and 

interagency feedback on draft versions of the targets. 

8 For additional information on the National Planning Frameworks, please visit: https://www.fema.gov/nationalplanning-frameworks. 9 For additional information on the FIOPs, please visit: https://www.fema.gov/federal-interagency-operationalplans. 10 For additional information on the Core Capability Development Sheets, please visit: https://www.fema.gov/corecapability-development-sheets. 
CPG 201: THIRA/SPR Guide—3rd Edition THIRA Step 3

20 

Figure 12: Standardized target statements allow communities to determine their specific needs. 

The intent of standardized target language is to create measurable indicators of preparedness, 

not a comprehensive list of everything a community must do to achieve each of the core 

capabilities successfully. In addition to setting capability targets using the standardized 

language, communities may also develop non-standardized capability targets if they find it 

beneficial to capture other elements of their core capabilities. 

Impacts, Objectives, and Timeframe Metrics 

Each capability target describes a critical task that, when completed, helps communities 

successfully manage a threat or hazard. These critical tasks (1) are based on the activities that 

emergency managers plan for; and (2) define activities that must be performed for a wide variety 

of threats and hazards, not only the 

ones identified in the THIRA. 

Additionally, communities 

estimate which threat or hazard 

most challenges their ability to 

achieve the critical task described 

in each capability target. This adds 

more utility to the THIRA during 

real-world incidents. For example, 

if a hurricane is approaching 

Community A, emergency 

managers can look at their THIRA 

data and see which critical tasks 

Community A estimated would be 

most challenged by a hurricane 

and use that data to inform 

decisions. 

THIRA Step 3: Key Changes

▪ Communities insert community-specific numbers into 

standardized target language to develop capability 

targets, rather than provide free-text capability targets; 

this establishes a common language for discussing and 

establishing clear preparedness goals and better aligns 

the THIRA process with planning. 

▪ Communities now indicate which threat or hazard 

places the greatest challenge on each critical task 

described in a target, providing potentially useful 

contextual information during response operations. 

▪ Communities will only establish timeframe metrics 

(formerly referred to as desired outcomes) within their 

targets, and not also as a standalone element, reducing 

duplication effort.
THIRA Step 3 CPG 201: THIRA/SPR Guide—3rd Edition

21 

Capability targets are specific and measurable; communities build them by combining impacts, 

which represent the size of the capability requirement, and timeframe metrics, which represent 

the timeframe in which the action must be performed (see Figure 13). 

Figure 13: Capability targets are composed of impacts and timeframe metrics.

Impacts and Objectives

For each capability target, communities identify the level of capability they want to work toward 

achieving. To determine this desired level of capability, communities consider the impacts of 

their threats and hazards (as estimated in Step 2.2), estimated resource requirements, expected 

available resources, and other relevant factors. The impact that a community selects for their

target does not need to match the impacts identified in Step 2.2. However, communities should 

ensure they understand the risk posed by their threats and hazards and use that knowledge to 

inform the impacts they include in their capability targets. For example, Community B estimates 

that an earthquake will result in 890 miles of road affected while a wildfire will result in 700. 

Community B lists “890” as its impact in Step 2.2 but this does not mean that they must set their 

capability target as “clear 890 miles of road affected.” Communities can set their capability 

target to the level they deem appropriate and should use their impact data to guide decisions on 

what that level of capability should be. If a community selects an impact that is different from 

the one identified in Step 2.2, they describe how they chose that impact and the sources used. 

THIRA capability targets should reflect communities’ unique planning and investment 

strategies.

In addition to capability targets, communities may also set an additional target called a

“maximum requirement” target. The maximum requirement reflects the highest level of a 

potential capability requirement. This maximum requirement reflects the impacts of the threat or 

hazard that most challenges the critical task described in the capability target. 

It is important to note that not all capability targets are impact-based. While most targets use 

post-incident quantitative impacts as explained above, some capabilities focus on preventing an 

occurrence of or lessening the vulnerabilities that affect the scale of a threat or hazard. Instead of 

a traditional standardized impact, these targets include a measurable objective that represents a 

goal the community has set for that core capability (see Table 3). 
CPG 201: THIRA/SPR Guide—3rd Edition THIRA Step 3

22 

Table 3: Examples of the two main types of capability targets.

Examples: Types of Capability Targets 

Driven by Quantitative Impacts Driven by Measurable Objectives

Within (#) months of an incident, reopen (#) 

businesses closed due to the incident.

Coordinate across state, local, and federal 

communities and integrate with partners,

community-wide, to effectively invest (#) % of 

all available mitigation funding, within (#) years.

Within (#) hours of an incident, complete triage, 

begin definitive medical treatment, and transfer to 

an appropriate facility (#) people requiring medical 

care.

Every (#) months, (#) % of critical infrastructure 

facilities conduct a risk assessment and 

accompanying facility security level (FSL) 

determination for assessing and addressing 

changes in threats and vulnerabilities.

Timeframe Metrics

Timeframe metrics describe the timeframe or level of effort needed to successfully deliver core 

capabilities. When constructing targets, it is not enough to know how much of an objective you 

plan to accomplish, you may also need to know how quickly you must be able to activate that 

capability, and how long you need to be able to sustain it. The answers to these questions will be 

unique to the capability target in question. 

When considering timeframes, communities should not be constrained by their current ability to 

meet timeframes or other conditions of success; rather, they should identify the timeframe that 

they desire to achieve. Communities should use the type of 

metric that is most appropriate for the given capability. For the 

core capability Mass Search and Rescue Operations that might 

be “search (#) structures within # hours,” while for Threats 

and Hazards Identification, a more appropriate timeframe

might be “model (#) scenarios every # years.” Communities

should work with SMEs and stakeholders to determine timebased metrics that are most appropriate for each capability.

Developing Capability Targets 

Capability targets define success for each core capability and describe what the community 

wants to achieve. In the THIRA, communities create capability targets for the core capabilities

listed in the National Preparedness Goal. Communities use standardized language and 

community-specific metrics to construct these targets. 

For example, under the Critical Transportation core capability, the standardized target language 

for debris removal is “Within (#) (time) of an incident, clear (#) miles of road affected, to enable 

access for emergency responders, including private and non-profit.” In this example, a 

community would choose a time-based metric (i.e., hours), and fill in the number of hours and 

miles of affected road to capture the level of capability they plan to work toward achieving. 

In addition to setting capability targets using the standardized target language for each of the 32 

core capabilities, communities may also want to develop additional targets. These additional 

targets can capture goals to achieve additional capabilities or critical tasks that are specific to the 

community’s needs. 

Timeframe Metrics

Communities can use the 

following timeframe metrics:

 (#) minutes 

 (#) hours 

 (#) days 

 (#) weeks

 (#) years
The SPR Process CPG 201: THIRA/SPR Guide—3rd Edition

23 

The SPR Process 

The SPR is an annual three-step self-assessment of a community’s capability levels based on the 

capability targets identified in the THIRA. It helps answer the questions: 

 What are our current capability levels and how have our capabilities changed over the 

last year?

 What gaps exist between the capabilities we want to achieve and the capabilities we 

currently have? 

 What do we need to do to close the capability gaps or sustain the capabilities? 

 What impact did different funding sources—including grants—have on building or 

sustaining the capabilities assessed by the capability targets over the last year?

Figure 14: The SPR process consists of three steps, building off the capability targets developed in the 

THIRA.

The SPR supports the National Preparedness System by helping to identify current capabilities 

and capability gaps in preparedness at the community level. States, territories, tribes, urban 

areas, and the Federal Government use the SPR results to prioritize capabilities to build and 

sustain, plan for threats and hazards, and validate capabilities. 

Developing an accurate and complete SPR requires the perspectives of a broad range of 

informed stakeholders and SMEs from a variety of fields. Communities are encouraged to seek 

input from community stakeholders and SMEs, including local governments (such as counties 

and townships), businesses, faith-based organizations, non-profit organizations, lifeline 

functions (communications, energy, transportation and water), and institutions of higher 

education. 

This section describes a three-step process for completing an SPR (see Figure 14): 

1. Assess Capabilities. Based on the language from the capability targets set in THIRA Step 3, 

identify the community’s current capability and how that capability changed over the last 

year, including capabilities lost, sustained, and built. Then, provide additional context to 

explain the reported data and its sources.

2. Identify Capability Gaps and Intended Approaches to Address Them. Determine the 

causes of the capability gap between the capability target and the current capability 

identified in SPR Step 1. Then, describe the actions and investments needed to close the 

capability gap or sustain the capability.
CPG 201: THIRA/SPR Guide—3rd Edition SPR Step 1

24 

3. Describe the Impacts of Funding Sources. Identify how relevant funding sources, 

including but not limited to grant programs and the community’s own resources, helped to 

build or sustain the capabilities assessed by the capability targets and describe how those 

capabilities were used in a real-world incident(s) over the past year. 

Step 1: Assess Capabilities

The purpose of Step 1 of the SPR is to assess and describe a community’s current capability and 

how the capability has changed during the last year (see Figure 14). There are three primary 

elements in Step 1 of the SPR:

 Step 1.1: Communities quantitatively 

assess their current capability and how 

that capability has changed over the last 

year.

 Step 1.2: Communities qualitatively 

describe how their capabilities have 

changed over the last year.

 Step 1.3: Communities provide context 

on how they calculated their capability 

and how confident they are in that 

assessment.

SPR: Key Changes

 Communities now assess their current 

capability using the same language as 

their capability target, rather than 

assigning 1-5 ratings to core capabilities. 

 Communities will also now provide 

free-text descriptions to elaborate on 

their capability estimates, and will rate 

their confidence in the accuracy of the 

information they report. 

Step 1.1: Quantitatively Assess Capability 

The purpose of Step 1.1 of the SPR is to identify how a community’s capabilities have changed 

over the last year and how those changes affect the community’s current capability (see Figure 

15). This step requires determining five quantitative data-points: 

 Beginning Capability: How much capability did the community have at the start of the 

year being assessed? 

 Capability Lost: How much capability did the community lose over the course of the 

year?

 Capability Sustained: How much of the capability that the community started the year 

with still remains?

 Capability Built: How much capability did the community add during the year? 

 Current Capability: How much capability does the community have now? 

Figure 15: The output of Step 1 of the SPR is an assessment and description of current capability.
SPR Step 1 CPG 201: THIRA/SPR Guide—3rd Edition

25 

Accurately assessing capabilities, while important, 

is challenging, and often situation-dependent. The 

quantitative data entered in Step 1.1 of the SPR 

process, while only an estimate, should be as 

accurate as a community can reasonably achieve to 

make the assessment results useful to the 

community. 

All capabilities are fundamentally dependent on 

timeframe metrics. Asking a community “how 

many people can you feed?” provides limited data unless paired with the questions “how 

quickly?” and “for how long?” During Step 3 of the THIRA process, communities identify a 

timeframe metric for each capability target. When communities assess their current capability in 

the SPR, they base their assessment on the same timeframe metric that they identified in Step 3 

of the THIRA (see Figure 16). For example, if a capability target says a community will perform 

a capability in one week, the capability assessment will determine the extent to which they can 

actually perform that capability in one week. 

Benefits of Identifying Changes in 

Capability

Capturing capabilities built, sustained, 

and lost provides a more complete 

preparedness picture by accounting for 

the work communities are doing to 

build capability, offset attrition and 

maintain existing capabilities.

Figure 16: Communities use the timeframe metric(s) from their capability target in the capability assessment.

The data collected in Step 1 of the SPR forms the basis of the formulas used to calculate the 

current capability. One approach is to start with the beginning capability, and subtract the 

amount of capability lost over the last year to identify the capability sustained. Using that 

capability sustained, communities can add in the capability built over the last year to identify 

the current capability (see Figure 17). 

Figure 17: Communities can use a formula to calculate their current capability.
CPG 201: THIRA/SPR Guide—3rd Edition SPR Step 1

26 

Beginning Capability

The beginning capability describes the level of capability the community had at the beginning of 

the year they are assessing. This number will typically be the current capability from the prior 

year’s SPR, if the community completes the SPR annually (see Figure 18). 

Figure 18: The beginning capability is frequently, though not always, the current capability from the 

previous year’s SPR.

The beginning capability may be different from the previous year’s current capability, however, 

if the community receives new information about its current capability after the completion of 

the last year’s SPR and prior to beginning the current year’s SPR. This could occur in several 

ways, including performance in a real-world incident or exercise that provides the community

with a better understanding of their capability (see Figure 19). In such cases, communities will 

use their new estimate of their beginning capability, and describe the reasons behind the change 

in the SPR Step 1.3 free-text box. 

Figure 19: The beginning capability can change from the previous year’s SPR current capability if a 

community identifies more accurate information between SPRs.

Capability Lost

Unfortunately, capabilities that a community has built are sometimes lost, either through 

attrition (retirements, expired training, etc.) or degradation (resources are used, equipment 

breaks, etc.). Accurately tracking capabilities requires understanding how much capability is 

lost. Tracking lost capabilities also helps to demonstrate the challenge that emergency managers 

face in maintaining the existing capabilities needed to meet their capability targets.
SPR Step 1 CPG 201: THIRA/SPR Guide—3rd Edition

27 

In some cases, a capability may be completely lost, such as the dissolution of a public-private 

partnership focused on infrastructure restoration. In many cases, however, a capability may only 

partially degrade, such as a mitigation planning team losing personnel due to retirements. In the 

SPR, communities will track current capabilities that can actually be used, and therefore a 

capability should be considered lost if it was operational at the time of the last SPR submission 

but is no longer operational at the time of the 

current submission. If a community brings that 

capability back on-line in the future, they should 

consider it a capability built. 

Capability Sustained

Capabilities that communities maintain from the 

previous year are considered sustained. 

Including capabilities sustained in the SPR 

recognizes the necessary investments that 

communities make to maintain the capabilities 

they have previously built. If a capability was 

operational at the time of the previous SPR submission and is still operational at the time of the 

current submission, it is considered sustained, even if that capability was not operational during 

portions of the preceding year.

Capability Built

Capabilities built are new capabilities that were not operational during the prior year. This can 

occur for several reasons: 1) because the capability did not exist during the prior year; 2) 

because the capability was under development during the prior year; and 3) because the 

capability had partially degraded during the prior year and needed to be brought back on-line. 

Table 4 depicts examples of Building Capability and common reasons why each might occur. 

A capability is not operational until it is complete. For example, a fire company may be working 

to become a Type III Search and Rescue team, and over the span of five years, they may add 

personnel, equipment, and training. All of that work is important, but the capability is not 

operational for the purposes of the SPR capability assessment until all required components are 

complete. Communities can still capture the development of incomplete capabilities, however, 

in SPR Step 1.2, in the free-text descriptions for the capability built over the past year. 

Most communities will not build all capabilities every year due to funding, available time and 

personnel, or other reasons. FEMA does not make any judgement on what is “normal” regarding 

how often, and to what degree, capabilities should change. The methodology is designed to 

accurately capture any positive, neutral, or negative changes in capability in a way that most 

accurately reflects the unique experience of each community. 

Reporting Changes in Capability

Reporting annual changes in capability by 

those lost, sustained, and built—compared 

to the previous 1-5 ratings—better 

highlights small, but significant 

improvements in capabilities. This allows 

communities to account for the work they 

are doing to offset attrition and maintain 

existing capabilities, which helps prioritize 

investments and inform strategic plans. 
CPG 201: THIRA/SPR Guide—3rd Edition SPR Step 1

28 

Table 4: Examples of several ways that how communities might build capability.

Examples of How Communities Can Build Capability

Driver of Capability Building Examples

Capability did not exist in the prior 

year

 First-time purchases of resources and materials

 Additional personnel hires

 New partnerships with community stakeholders that have 

required capabilities

Capability was under development 

during the prior year

 Training is underway, but it was incomplete at the time of 

the prior SPR

 The community ordered new equipment, but had not yet 

received it at the time of the prior SPR

Capability had partially degraded 

during the prior year and was 

brought back on-line

 Damaged equipment was repaired since the prior SPR

 A team that required a position filled has hired a new

employee for that position since the prior SPR

 Renewed expired training since the prior SPR

Current Capability

Current capability represents a community’s current operational capability. An operational 

capability is one that can be used somewhere within the community. A capability does not need 

to be immediately available for it to be operational (see Figure 20). A capability that is currently 

deployed, for example, should be considered operational unless it will not be available for future 

use until additional requirements are met. Single use and disposable capabilities that are 

currently deployed should not be considered operational for the SPR. 

Figure 20: An example of operational vs. non-operational capability. 
SPR Step 1 CPG 201: THIRA/SPR Guide—3rd Edition

29 

Individual resources are often not capabilities by themselves. Capabilities typically require some 

combination of planning, organization, equipment, training, and exercises. As such, 

communities likely have many capabilities that are partially built, but not fully operational. For 

example, if a community hires 

people to make up a shelter 

management team but cannot provide 

them the required training and has no 

plans addressing shelter 

management, their capability is not 

fully operational. These partial 

capabilities should not be included in 

a community’s current capability 

because they are not operationally 

ready; however, the partial 

capabilities often represent a costeffective way to build new capabilities and close capability gaps. 

Using Internal Capabilities

The capabilities assessed in SPR Step 1.1 should be 

those that exist within the boundaries of the 

community, whether owned by sub-jurisdictions, or 

private and non-profit organizations. The capabilities 

should not be from the Federal Government or 

achieved through interstate mutual aid. The capability 

targets are goals for building internal capability, 

therefore communities complete the capability 

assessment considering only internal capabilities. 

Step 1.2: Describe Current Capabilities and Capability Changes

The purpose of Step 1.2 of the SPR is to elaborate on the quantitative assessment of the 

capability change provided in Step 1.1 (see Figure 21). Communities identify the POETE 

areas—planning, organization, equipment, training, and exercises (see Table 5)—in which they 

lost, sustained, and built capability, and develop free-text descriptions explaining: 

 What caused the reported level of capability lost over the last year?

 What actions did the community take to sustain the reported level of capability sustained 

over the last year?

 What actions did the community take to achieve the reported capability built over the last 

year?

 How might existing mutual aid agreements help bridge the gap between the capability 

target and current capability?

Figure 21: A visual depiction of the relationship between SPR Steps 1.1 and 1.2.

While the quantitative assessment provides a valuable breakdown of how capability has changed 

over the past year, it does not explain how or why those changes occurred. As such, 

communities describe, in as much detail as possible, the specific actions, investments, resources, 

or external factors that led to the changes in capability. Many of the explanations may relate to 
CPG 201: THIRA/SPR Guide—3rd Edition SPR Step 1

30 

funding availability and will be reflected in SPR Step 3. For example, communities might 

explain that they built their capability by fully training all their shelter management teams and 

purchasing an additional facility that the community can use as a fully accessible shelter. 

Table 5: These are the definitions of the POETE areas: planning, organization, equipment, training, and 

exercises. 

POETE Areas

Planning

Development of policies, plans, procedures, mutual aid agreements, strategies, and 

other publications; also involves the collection and analysis of intelligence and 

information

Organization Individual teams, an overall organizational structure, and leadership at each level in 

the structure

Equipment Equipment, supplies, and systems that comply with relevant standards

Training Content and methods of delivery that comply with relevant training standards

Exercises

Exercises and actual incidents that provide an opportunity to demonstrate, evaluate, 

and improve the ability of core capabilities to perform assigned missions and tasks 

to standards

When referring to equipment, teams, and personnel throughout the assessment of capabilities, 

communities consider pre-existing national resource type definitions, such as those outlined in 

National Incident Management System (NIMS) resource typing.11 Including these resources 

and terms allows communities to maintain consistent language over multiple assessment 

periods. Providing as much detail as possible makes the SPR data more useful for planning, 

prioritizing investments, and preparing for real-world incidents. 

While the SPR does not quantitatively assess mutual aid, it is an important consideration for 

planners. Mutual aid is an essential component of a successful response and recovery, as it 

offsets capability gaps and is often the most efficient way to deliver certain capabilities, 

resources, and services. As such, communities use a free-text box to describe how mutual aid 

agreements may affect their current capability and should provide any additional context that 

they deem necessary or useful. For example, they may provide additional information on the 

nature and extent of their mutual aid agreements with other communities, such as what they 

include, how long the agreement has been in place, or whether the mutual aid agreement has 

been activated during a real-world incident. This information supplements the internal capability 

assessment and planners can use it to identify sources of additional capability, or potential 

overlap in mutual aid agreements among communities in the same region.

In addition to the free-text descriptions, communities identify the POETE area changes that 

resulted in changes in capability over the past year. For capability lost, communities select the 

POETE areas in which that capability was lost over the past year. For capability sustained and 

 

11 For additional information on NIMS and resource typing please visit: https://www.fema.gov/national-incidentmanagement-system. 
SPR Step 1 CPG 201: THIRA/SPR Guide—3rd Edition

31 

capability built, communities note in which POETE areas they made investments that resulted in 

either capability sustainment or growth.

Step 1.3: Provide Context on Current Capability Estimations

The purpose of Step 1.3 of the SPR is to provide additional context for the responses provided in 

Step 1.1 and Step 1.2. Communities do this in three ways: 

 Describe their level of confidence in the accuracy of their quantitative assessment

 Identify the sources used to determine their responses

 Provide any other useful context to better understand their quantitative responses 

Describe Confidence in the Accuracy of the Quantitative Assessment

Communities may find that they can measure some capabilities more easily than others. 

Moreover, even for those capabilities, the necessary data may be difficult to access or otherwise 

be unavailable. Conversely, some communities 

may be extremely proficient in understanding 

and measuring their capability in certain areas 

due to vast experience across many disasters. To 

identify their level of confidence in the accuracy 

of their capability assessment, Step 1.3 asks 

communities to rate their confidence on a fivepoint Likert scale:

 1 – Lower confidence

 2 

 3 

 4 

 5 – Higher confidence 

Benefits of Assessing Confidence in 

Capability Assessments

Rating the level of confidence in each 

capability assessment allows the Federal 

Government to identify areas of relative 

low or high confidence throughout the 

Nation, which it can use to target technical 

assistance efforts.

The data confidence ratings provide additional context on the reliability of the reported 

capability assessments, which can be useful in both strategic and operational contexts. Federal 

planners will have a stronger sense of which information is most credible and can better 

understand how the data should be interpreted as they follow-up with communities. In addition, 

it allows communities to be transparent about potential variance and, therefore, more accurate in 

their reporting. See Table 6 for examples of why a community might report a given confidence 

level on the scale.
CPG 201: THIRA/SPR Guide—3rd Edition SPR Step 1

32 

Table 6: Examples of how communities can approach their selection of a confidence level for their capability 

assessment.

Confidence 

Level Example Rationale for Chosen Confidence Level

Confidence 

Level: 1

 Have not performed a large-scale sheltering mission in over 13 years, and have no 

AARs to review

 No past exercises focusing on their sheltering capability; they have minimal subjectmatter expertise

 Capability estimate is based on that of similar surrounding states, but they have very 

little confidence that it is accurate

Confidence 

Level: 2

 Have not performed a large-scale sheltering mission in over 10 years, and only has 

a high-level AAR to review

 No past statewide exercise of their sheltering capability; only two counties have 

exercised their capability

 Data on potential locations for shelters is five years old

 They used the minimal available data to estimate a statewide capability to shelter 

7,000 people, but they think it could be as high as 11,000 people or as low as 4,000 

people 

Confidence 

Level: 3

 They performed a large-scale sheltering mission seven years ago, during which they 

had a peak sheltering capacity of 9,500 people

 Several counties have conducted sheltering exercises in recent years showing an 

increased capability

 Recently hired several SMEs have experience leading shelter management teams 

in other states

 The list of potential locations for shelters was recently updated but they are not 

confident about some options in rural communities

 They estimate that they can shelter a maximum of 11,800 people, but they believe it 

could be as high as 14,000 or as low as 10,500

Confidence 

Level: 4

 Reviewed their AAR from an incident four years ago, where they had a peak 

sheltering capacity of 13,000 people

 Starting with 13,000 people as a baseline, SMEs met to discuss the changes since 

the last incident

 The list of available locations for sheltering is less than two years old and includes a 

wide variety of options

 Based on documented improvements and a recent regional sheltering tabletop 

exercise, they estimate that they can shelter 15,000 people and are mostly confident 

that their estimate is accurate within 750 people

Confidence 

Level: 5

 They performed a large-scale sheltering mission two years ago where they had a 

peak sheltering capacity of 14,200 people

 The list of available locations for sheltering is less than a year old and includes 

recent additions of private-sector facilities with agreements to provide sheltering

 They participated in a regional sheltering and mass care exercise last year

(including private-sector partners and several large counties) 

 Based on their capability in the recent incident, the validation provided by the 

regional exercise, and the formal agreements with the private-sector, they are

confident that they can now shelter a maximum of 15,500 people

Identify the Sources of Information Used to Determine the Quantitative Responses

Communities identify the sources of information considered in assessing capabilities, including 

real-world incidents, SMEs, exercises, plans, policies, modeling or tools, and other sources of 
SPR Step 1 CPG 201: THIRA/SPR Guide—3rd Edition

33 

information. Identifying sources of information is extremely important for continuity of 

assessments within a community. Citing sources helps to map out where the baseline for the 

assessment originated for future SPRs, increasing consistency and reducing duplication of 

effort.

Provide Context to Better Understand the Quantitative Current Capability Assessment

While the quantitative assessment provides valuable estimates of a community’s capability, it 

cannot capture all the information needed to contextualize the quantitative assessment or expand 

on it. In Step 1.3, communities provide that extra context. Communities are encouraged to 

consider the following questions:

 How would your capability change if the timeframe metrics were increased or 

decreased?

 Is there a range of capability numbers that accurately capture the upper and lower bounds 

of your capability? If so, what made 

you select the number that you did for 

your estimated current capability? 

 Are there specific known factors in 

your community that would 

significantly alter your estimated 

current capability?

 What is the rationale behind your 

selected level of confidence in your 

data?

Uses for Additional Context

This content helps planners and other users of 

the data fully understand a community’s 

capabilities, including any caveats or special 

factors that might be important to consider 

when developing plans or responding to a 

real-world incident. It is also useful for 

assessment continuity within a community, as 

new staff will understand the rationale behind 

For example, a community might report that previous years’ capability estimates.

it can shelter 13,000 people within 48 hours 

and maintain that capability for 14 days. Due to internal conditions, however, it is possible that 

community would be able to shelter far more people if the duration of the sheltering was only 

seven days. Including in the free-text description that the community can shelter 20,000 people 

for seven days is important information that response planners can use to improve the accuracy 

of their planning efforts. This information would otherwise not have been known through only 

the quantitative assessment results. 

Moreover, understanding why a community might have a relatively low confidence in their 

capability assessment is also valuable information. The data necessary to validate the capability 

may simply not be available or may not be possible to collect. This additional context enables 

communities to more accurately interpret the reported data confidence ratings and as 

appropriate, to target outreach, prioritize technical assistance efforts, and develop supporting 

operational plans. 

Communities may also be interested in assessing their level of capability for timeframe metrics 

that they did not include in the capability target. This can also be useful for planning purposes, 

to identify a community’s capability for various situations with differing requirements. For 

example, a community may wish to know the number of customers they can return power to 

within 24 hours, in addition to the capability target timeframe metric of three days. 
CPG 201: THIRA/SPR Guide—3rd Edition SPR Step 1

34 

Step 2: Identify and Address Capability Gaps

In Step 2 of the SPR, communities describe the capability gap between the capability target they 

set in THIRA Step 3 and the current capability determined in Step 1 of the SPR, and describe 

how they plan to address those capability gaps (see Figure 22). There are two primary elements 

in Step 2: 

 Step 2.1: Communities identify and provide free-text descriptions of the capability gaps 

in relevant POETE areas.

 Step 2.2: Communities describe how they plan to address their capability gaps and 

sustainment needs in relevant POETE areas. 

Figure 22: The output of Step 2 of the SPR is a description of capability gaps and approaches to address 

capability gaps.

Step 2.1: Identify and Describe 

Capability Gaps 

The purpose of Step 2.1 of the SPR is to 

identify and contextualize the capability 

gap between a community’s capability

target and their estimated current 

capability (see Figure 23). The 

remaining questions in this step allow 

communities to add context to that 

capability gap and explain why the 

capability gap exists. By understanding 

capability gaps, communities can begin 

to prioritize their building and 

sustainment activities. 

SPR Key Changes

▪ The new SPR methodology collects more 

information on capability gaps than the previous 

methodology, which only required communities 

to select standard functional area gaps. 

▪ Communities now report a numerical capability 

gap (based on their capability target), identify 

specific POETE areas that contain gaps, provide 

free-text descriptions for each POETE area, and 

describe their intended approaches to address 

those capability gaps. 
SPR Step 2 CPG 201: THIRA/SPR Guide—3rd Edition

35 

Figure 23: The calculation for identifying an example capability gap.

Priority for Achieving Capability Target 

A community has a capability gap if the current capability is less than the capability target. After 

identifying that capability gap, communities assign a priority rating (High Priority, Medium 

Priority, and Low Priority) to identify how important it is to achieve that capability target. 

Communities should attempt to assign priority ratings relative to their other targets and avoid 

providing the same priority rating for all or most capability targets. This will result in more 

useful data, as it will clearly demonstrate which capability gaps are more important to address. 

Figure 24: Explanation for how to assign a priority rating for capabilities

with and without a capability gap.
CPG 201: THIRA/SPR Guide—3rd Edition SPR Step 2

36 

In rare cases, a community might not have a capability gap, or may even end up with greater 

capability than the capability target they set in the THIRA. If their current capability matches or 

exceeds their capability target, the community still reports a priority rating (see Figure 24) for the 

capability. This will reflect the level of importance the community places on sustaining their 

capability, relative to their other targets. For example, a community might have no capability gap 

in their Mass Search and Rescue Operations capability target, but due to frequent severe 

flooding, they prioritize the sustainment of that capability more than they prioritize building 

capacity in other core capabilities that have capability gaps. 

POETE Capability Gap Selection and Description 

Once communities have prioritized their ability to achieve their capability targets, they provide 

more context as to the shortfall(s) causing their capability gaps. For each capability target’s 

capability gap, communities identify the POETE areas in which they have a shortfall. The 

POETE model divides capabilities into meaningful, broad categories of activity and can help 

communities think through their specific capability gaps. Communities that report a capability 

gap—meaning their capability target is greater than current capability—report a shortfall in at 

least one of the POETE areas for the core capability.

In the POETE areas with identified capability gaps, communities then provide a free-text 

description of how shortfalls or other limitations in that POETE area contributed to their 

capability gap (see Figure 25). In some cases, the shortfall might be a long-term issue, such as 

the need to develop and implement training for 100 percent of the required workforce, while 

other shortfalls may be more temporary occurrences, such as a facility undergoing renovations. 

This process enables communities to provide actionable data about their capability gaps, and can 

help communities plan to address key capability gaps. 

Figure 25: Communities select POETE capability gaps and provide free-text descriptions.
SPR Step 2 CPG 201: THIRA/SPR Guide—3rd Edition

37 

Recognizing that community-specific factors will affect the level of detail available to report, the 

amount of information and detail that communities provide in free-text descriptions will vary. It 

is highly recommended, however, that communities provide all the key information that they 

believe is necessary to fully understand the shortfalls leading to the capability gap. See Table 7 

below for an example of how to identify capability gaps for an example Mass Care Services 

capability target. 

Table 7: An example capability gap identification for an example Mass Care Services capability target.

Example Capability Gap Identification

Capability Target

Within 48 hours of an incident, provide emergency sheltering for 20,000

residents, including 4,000 with access and functional needs. Maintain sheltering 

operations for 14 days. 

Current Capability

Within 48 hours of an incident, provide emergency sheltering for 17,000

residents including 3,000 with access and functional needs. Maintain sheltering 

operations for 14 days. 

Capability Gap

Within 48 hours of an incident, provide emergency sheltering for 3,000

residents including 1,000 with access and functional needs. Maintain sheltering 

operations for 14 days. 

POETE Area Free-Text Capability Gap Description

Planning

Our community has not identified buildings that could be used together to house 

20,000 residents. Our housing annex has not been updated in many years and 

does not include all communities within 1 hour of the affected area. Mutual aid 

agreements that previously existed with private sector facility owners have 

lapsed. 

Organization

Our community does not have sufficient personnel to maintain six Type I Shelter 

Management Teams. In addition, the recent restructuring of our Emergency 

Management and Homeland Security divisions into one agency is very new and 

has not yet operated during a major disaster. 

Equipment

While many rural faith-based institutions are willing to open their doors to be 

shelters, they lack sufficient bathing facilities. Most are also inaccessible to 

shelter seekers with access and functional needs.

Training

18 new shelter management team members will need role appropriate training 

(Type I and II Shelter Managers, Type I Shelter Registration Team Leaders, and 

Type I Shelter Dormitory Team Leaders). Our community currently lacks the 

funding and resources to provide this training. 

Exercises

Our community has never conducted an exercise that would provide functional 

experience operating a shelter; the only exercise involving sheltering was a brief 

tabletop exercise in 2015 which only covered sheltering roles and

responsibilities. Further, the private sector and faith-based institutions that are 

committed to supporting sheltering operations in our community have never 

been involved in any exercises involving sheltering. 

In most cases, the standardized target language will not address the full scope of each core 

capability. Communities therefore also identify any POETE are gaps related to each capability 

that the standardized target language does not address. For these gaps, communities do not 
CPG 201: THIRA/SPR Guide—3rd Edition SPR Step 2

38 

include free-text descriptions elaborating on the cause of the capability gaps. Identifying 

capability gaps across all aspects of the core capabilities can help communities to develop 

strategic plans and prioritize investments for building and sustaining capabilities. 

Step 2.2: Describe Approaches to Address Gaps and Sustainment Needs 

Once communities have identified their capability gaps, they identify their intended approaches 

for addressing the capability gaps or sustainment needs. This information will help communities

use SPR results to drive their strategic planning and investment strategies. Communities identify 

approaches for sustainment or filling the capability gap(s) in the relevant POETE area and then 

add specific information, including: 

 Over what timeframe does this intended approach cover? 

 What activities or investments will need to occur to address the existing capability gap or 

support sustainment? 

 What partners may support the efforts?

Due to a variety of factors, including funding, available resources, and personnel, communities 

cannot always plan to address all capability gaps in any given year. Therefore, communities may 

not always have an intended approach for addressing every single POETE area gap they 

identified and described in Step 2.1. Additionally, communities can report plans to address 

sustainment needs, even if they did not select the POETE area in Step 2.1. See Table 8 below for 

example plans to address capability gaps and sustain the existing capability for the example 

Mass Care Services capability target shown above in Table 7. 

Table 8: Example approaches to addressing capability gaps and sustainment needs for an example Mass Care 

Services capability target.

Example Approaches for Addressing Capability Gaps and Sustainment Needs

POETE Area Free-Text Approaches to Address Capability Gaps and Sustainment Needs 

Planning

Engage stakeholders and internal partners to conduct a full review and update of 

the housing annex to our State Response Plan. Also, assess the current list of 

facilities available to use as shelters to identify requirements for additional 

facilities.

Organization Identify 18 employees willing to serve on a shelter management team as part of 

our surge capacity force. 

Equipment Our community does not currently intend to address the equipment gap in the 

next year, due to competing priorities.

Training

Provide appropriate training for four Type I and three Type II Shelter Managers, 

six Type I Shelter Registration Team Leaders, and five Type I Shelter Dormitory 

Team Leaders.

Exercises Include a housing component in our full-scale hurricane response exercise in 

March. 
SPR Step 3 CPG 201: THIRA/SPR Guide—3rd Edition

39 

Once a community has described their intended approaches to building or sustaining their 

capability, they indicate the general timeframe during which they plan to do so. For example, 

some communities might want to plan for a single grant cycle, while others might have more 

general, long-term plans to address their capability gaps and sustainment needs. It is important 

to note that describing an approach in this section does not create an obligation to complete the 

activity within the identified timeframe. Communities should view it as a resource they can use 

internally to drive their strategic planning and investment strategies. 

Step 3: Describe Impacts of Funding Sources

The purpose of Step 3 of the SPR is to indicate the extent to which relevant funding sources—

including but not limited to a community’s own resources and Federal and state grants—played 

a role in building and sustaining the capabilities assessed by the capability targets (see Figure 

26). There are two primary elements in Step 3 of the SPR: 

 Step 3.1: Assess the degree to which specific funding sources had a role in building and 

sustaining the capability assessed by the target. 

 Step 3.2: Qualitatively assess how your community used capabilities built and sustained 

with funding in a real-world incident over the past year.

Figure 26: The output of Step 3 of the SPR is an assessment and description of the impact of funding sources 

on capabilities.

This information can help communities better understand the impact that their funding has on 

building and sustaining capabilities and to relay that information to key stakeholders and 

decision-makers. 

Step 3.1: Assess the Role of Funding for Building and Sustaining Capabilities

The purpose of Step 3.1 is to estimate the degree to which various funding sources, including 

but not limited to communities’ own resources and Federal and state grants, impacted the 

building and sustainment of the capabilities assessed by the capability targets. 

When answering these questions, communities consider the relevant POETE area activities or 

resources (including assets with national resource-typed definitions as outlined in NIMS) that 

they supported with each funding source. Communities should try to estimate, with reasonable 

accuracy, which efforts and investments relevant to each capability target they funded with each 
CPG 201: THIRA/SPR Guide—3rd Edition SPR Step 3

40 

source. Then, among those efforts and investments, communities identify whether they were 

used primarily to sustain an existing capability, to build new capability, or both. 

A coordinated approach to track investments using different funding sources can help drive 

investments to be increasingly effective. This enhances communities’ ability to understand the 

return on investment of their funding sources. 

Identifying the sources of funding for 

specific, quantitative changes in capability 

can guide communities’ strategic planning 

considerations and help them make resource 

allocation decisions to build and sustain 

capabilities as effectively as possible.

Revealing the Entire Picture of Funding 

Contribution

Identifying the degree to which different 

funding sources supported sustainment 

activities enables communities to identify the 

impact of their funding, even in those instances 

where there is no change in capability. 

This reveals the entire picture by reflecting the 

reality that emergency managers are constantly 

working and making investments to maintain 

what they have achieved, and are not just 

building new capabilities.

Step 3.2: Assess the Role of Funding

in Real-World Incidents 

Finally, communities describe the impact that 

capabilities built or sustained with different 

funding sources had in real-world incidents 

over the past year. This is intended to capture 

how they used previous years’ investments since the last assessment. While this question is 

concerned with capabilities used over the past year, the funding can be from any year in the past. 

Communities attempt to answer the following questions: 

 Was the capability used to address a real-world incident? If so, how? 

 What would have been the impact on the community’s ability to deliver the capability 

had it not received funding? 

 What impact would that change in capability have had on survivors, infrastructure, or the 

response and recovery mission overall?

Answering these questions enables communities to report positive examples of how they used 

specific funding sources to increase or sustain preparedness capabilities and make a difference 

during response to real-world incidents. Communities will also be able to describe how 

sustainment of their capabilities would be negatively impacted by reduced funding—whether it 

is the community’s own capital, state or Federal grants, or another source—despite reporting no 

capability built by that funding. This can help communities think strategically about how to 

spend their money and consider whether they are doing so efficiently. 
Conclusion CPG 201: THIRA/SPR Guide—3rd Edition

41 

Conclusion 

Understanding the risks faced by communities, and the Nation as a whole, is essential to 

sustaining and building national preparedness. This document provides a common and 

consistent approach for communities to support the first two components of the National 

Preparedness System: 1) Identifying and Assessing Risk; and 2) Estimating Capability 

Requirements, as implemented through the THIRA/SPR. It provides a foundation for all levels 

of government to complete the National Preparedness System by generating actionable data to 

drive investment strategies through identified planning efforts, organizational and equipment 

investments, and training and exercise initiatives. 

The THIRA/SPR provides a national risk and capability picture from the perspective of the 

states, territories, urban areas, and tribes. This contributes to achieving the National 

Preparedness Goal of “a secure and resilient Nation with the capabilities required to prevent, 

protect against, mitigate, respond to, and recover from the threats and hazards that pose the 

greatest risk.” Achieving the Goal requires participation at all levels of the community. Through 

the THIRA/SPR process, communities are better able to educate individuals, families, 

businesses, organizations, community leaders, and senior officials about the risks they face and 

their roles in and contributions to prevention, protection, mitigation, response and recovery 

efforts.
CPG 201: THIRA/SPR Guide—3rd Edition Glossary

42 

Glossary of Terms

Beginning Capability: The level of capability the community had at the beginning of the year 

they are assessing. 

Capability Assessment: The process of identifying how a community’s capabilities have 

changed over the last year and how those changes affect the community’s current capability. 

Capability Built: New capabilities that were not operational during the prior year. 

Capability Gap: The difference between the capability target a community sets in THIRA Step 

3 and the current capability they determine in SPR Step 1.

Capability Lost: Capabilities that a community had as of the previous year’s SPR that they no 

longer have during as of the current year’s SPR, due to attrition or degradation. 

Capability Sustained: Capabilities that communities have maintained from the previous year.

Capability Target: The level of capability that a community plans to achieve over time in order 

to manage the threats and hazards it faces.

Context Description: The details about a threat or hazard scenario needed to identify the 

impacts it will have on a community that includes critical details such as the location, magnitude, 

and time of an incident. 

Core Capabilities: The distinct critical elements necessary to achieve the National Preparedness 

Goal.

Critical Task: Defined actions that are executed by organizations to deliver the core 

capabilities.

Cross-Cutting Core Capabilities: The three core capabilities—Planning, Public Information 

and Warning, and Operational Coordination—that span all five mission areas. They serve to 

unify the mission areas and, in many ways, are necessary for the success of the remaining core 

capabilities.

Current Capability: Represents a community’s current operational capability that can be used 

somewhere within the community. 

Functional Areas: The broad categories of activity included under a core capability. 

Human-Caused Hazard: A potential incident resulting from the intentional actions of an 

adversary. 

Impact: The community-specific effects a threat or hazard scenario would have on a community 

if the threat or hazard occurred, written in the language of common emergency management 

metrics.
Glossary CPG 201: THIRA/SPR Guide—3rd Edition

43 

Internal Capabilities: Capabilities that exist within the boundaries of a community, whether 

owned by sub-jurisdictions, or private and non-profit organizations. The capabilities should not 

be from the Federal Government or achieved through interstate mutual aid.

Likelihood: The chance of something happening, whether defined, measured, or estimated 

objectively or subjectively, or in terms of general descriptors (e.g., rare, unlikely, likely, almost 

certain), frequencies, or probabilities. 

Maximum Requirement: The highest level of potential capability requirement reflecting the 

impacts of the threat or hazard that most challenges the critical task described in the capability 

target. 

Mission Areas: Categories used to organize the core capabilities and national preparedness 

activities: Prevention, Protection, Mitigation, Response, and Recovery.

Mitigation Core Capabilities: Reduce the loss of life and property by lessening the impact of 

future disasters.

Mutual Aid: Agreements that establish the terms under which one party provides resources—

personnel, teams, facilities, equipment, and supplies—to another party.

National Preparedness Goal: Defines what it means for the whole community to be prepared 

for all types of disasters and emergencies. The goal itself is: ‘A secure and resilient Nation with 

the capabilities required across the whole community to prevent, protect against, mitigate, 

respond to, and recover from the threats and hazards that pose the greatest risk.’

National Preparedness System: Outlines an organized process for everyone in the whole 

community to move forward with their preparedness activities and achieve the National 

Preparedness Goal.

Natural Hazard: A potential incident resulting from acts of nature. 

POETE Areas: A model that divides capabilities into meaningful, broad categories of 

activity—planning, organization, equipment, training, and exercises.

Prevention Core Capabilities: Prevent, avoid, or stop an imminent, threatened, or actual act of 

terrorism.

Protection Core Capabilities: Protect our citizens, residents, visitors, and assets against the 

greatest threats and hazards in a manner that allows our interests, aspirations, and way of life to 

thrive.

Recovery Core Capabilities: Recover through a focus on the timely restoration, strengthening, 

and revitalization of infrastructure, housing, and a sustainable economy, as well as the health, 

social, cultural, historic, and environmental fabric of communities affected by an incident. 
CPG 201: THIRA/SPR Guide—3rd Edition Glossary

44 

Response Core Capabilities: Respond quickly to save lives; protect property and the 

environment; and meet basic human needs in the aftermath of an incident. 

Risk: The potential for an unwanted outcome resulting from an incident or occurrence, as 

determined by its likelihood and the associated consequences.

Standardized Target Language: Common, uniform emergency management metrics with 

blanks for community-specific numbers that are required for all communities to complete; for 

example: (#) people requiring sheltering.

Technological Hazard: A potential incident resulting from accidents or failures of systems or 

structures. 

Timeframe Metrics: The amount of time or level of effort needed to successfully deliver core 

capabilities and/or sustain the delivery of the core capabilities.