Guide for Conducting Risk Assessments
CHAPTER 3 > TASK 2-4: Determine the likelihood that threat events of concern result in adverse impacts, considering: (i)

TASK 2-4: Determine the likelihood that threat events of concern result in adverse impacts, considering: (i)

the characteristics of the threat sources that could initiate the events; (ii) the vulnerabilities/predisposing
conditions identified; and (iii) the organizational susceptibility reflecting the safeguards/countermeasures
planned or implemented to impede such events.
Supplemental Guidance: Organizations employ a three-step process to determine the overall likelihood of threat events.
First, organizations assess the likelihood that threat events will be initiated (for adversarial threat events) or will occur
(for non-adversarial threat events). Second, organizations assess the likelihood that threat events once initiated or
occurring, will result in adverse impacts to organizational operations and assets, individuals, other organizations, or the
Nation. Finally, organizations assess the overall likelihood as a combination of likelihood of initiation/occurrence and
likelihood of resulting in adverse impact.
Organizations assess the likelihood of threat event initiation by taking into consideration the characteristics of the threat
sources of concern including capability, intent, and targeting (see Task 2-1 and Appendix D). If threat events require
more capability than adversaries possess (and adversaries are cognizant of this fact), then the adversaries are not
expected to initiate the events. If adversaries do not expect to achieve intended objectives by executing threat events,
then the adversaries are not expected to initiate the events. And finally, if adversaries are not actively targeting specific
organizations or their missions/business functions, adversaries are not expected to initiate threat events. Organizations
use the assessment scale in Table G-2 and provide a rationale for the assessment allowing explicit consideration of
deterrence and threat shifting. Organizations can assess the likelihood of threat event occurrence (non-adversarial)
using Table G-3 and provide a similar rationale for the assessment.
Organizations assess the likelihood that threat events result in adverse impacts by taking into consideration the set of
identified vulnerabilities and predisposing conditions (see Task 2-3 and Appendix F). For threat events initiated by
adversaries, organizations consider characteristics of associated threat sources. For non-adversarial threat events,
organizations take into account the anticipated severity and duration of the event (as included in the description of the
event). Organizations use the assessment scale in Table G-4 and provide a rationale for the assessment allowing explicit
consideration as stated above. Threat events for which no vulnerabilities or predisposing conditions are identified, have
a very low likelihood of resulting in adverse impacts. Such threat events can be highlighted and moved to the end of the
table (or to a separate table), so that they can be tracked for consideration in follow-on risk assessments. However, no
further consideration during the current assessment is warranted.
Summary of Key Activities - Task 2-3
•
Identify vulnerability and predisposing condition inputs (see Table F-1, as tailored by the
organization).
•
Identify vulnerabilities using organization-defined information sources; create or update
Table F-3.
•
Assess the severity of identified vulnerabilities (see Table F-2, as tailored by the
organization); update Table F-3.
•
Identify predisposing conditions (see Table F-4, as tailored by the organization); create or
update Table F-6.
•
Assess the pervasiveness of predisposing conditions (see Table F-5, as tailored by the
organization); update Table F-6.
•
Update Column 8 in Table I-5 for adversarial risk; or update Column 6 in Table I-7 for non-
adversarial risk (see Table F-3 and Table F-6).
•
Update Column 9 in Table I-5 for adversarial risk; or update Column 7 in Table I-7 for non-
adversarial risk (see Table F-2 and Table F-5).