Security Assessments (Chapter 6)

A Security Assessment (SA) is a formal document and an abbreviated evaluation of the security procedures and features at a dam — without fully accounting for attack Consequences, Vulnerabilities, or Threat. It focuses exclusively on evaluating the effectiveness of the existing security system.

• A full Vulnerability Assessment (VA) evaluates four factors: Consequence (C), Vulnerability (V), Threat (T) and its Likelihood (L), and Security Effectiveness (S). A Security Assessment only addresses Security — it skips C, V, T, and L.
• Because the SA omits Consequence, Vulnerability, and Threat analysis, a full risk assessment cannot be made from an SA alone.
• An SA is required for all Security Group 2 Dams and is an integral part of the Vulnerability Assessment for Security Group 1 Dams.
• An SA is a stand-alone document or can be incorporated within a more detailed Vulnerability Assessment.
• The main practical advantage of an SA over a VA is that it can potentially be completed with fewer resources and at a reduced effort.
• By definition, the anticipated risk at a Security Group 2 Dam is significantly less severe than at a Security Group 1 Dam — which is why the SA's reduced level of evaluation detail is acceptable for Group 2.
• FERC strongly encourages licensees to complete a full VA even for Group 2 Dams, because the VA produces a more-informed decision-making process about what needs to be protected, against what threat level, and at what cost.

Understanding the difference between a Security Assessment and a Vulnerability Assessment is essential for determining which document is required and what it must contain.

What the VA Evaluates (Full Risk Assessment)

• Consequences (C): loss of life, downstream damages, service disruption — for complete dam failure and for individual asset failures.
• Vulnerability (V): which specific assets (spillway gates, turbines, penstocks, etc.) can be exploited and how easily.
• Threat and Likelihood (T, L): which adversary groups or individuals may target the facility, with what capability and intent.
• Security Effectiveness (S): how well the existing system detects, assesses, delays, and enables law enforcement response.
• The VA produces a matrix of paired variables leading to a conditional risk value and specific recommended enhancements.

What the SA Evaluates (Security-Only)

• Security Effectiveness (S) only: the current state and appropriateness of on-site security systems and procedures.
• The SA identifies whether security enhancements are needed and specifically what those enhancements consist of — fencing, surveillance hardware, cameras, increased guards, etc.
• The SA must also address the state of maintenance and readiness of existing security systems and procedures.
• Without Consequence, Vulnerability, or Threat data, the SA evaluates security "in a vacuum" — it does not tie enhancements to the magnitude of specific risks.

When Factors from a VA Help an SA

• A Security Assessment is often preceded by, or incorporated within, a comprehensive Vulnerability Assessment.
• Factors from a VA (Consequences, Vulnerability, Threat) greatly assist with the proper evaluation of site security in the SA, leading to more-informed security assessment decisions.
• Without VA context, there is a greater risk of not identifying all vulnerable features, or of recommending security enhancements that are not comprehensively integrated with the entire project site.
• For this reason, the only advantage of an SA is reduced resource commitment — it is not a superior approach to a VA.

The format, scope, and details of the SA are determined by the licensee, but must be sufficient to address the current state of security for the project. Required sections are marked accordingly.

Although the SA does not require a full threat evaluation like a VA, the existing security system cannot be evaluated without some reference to a threat. FERC has established a minimum threat standard for consistency across all Group 2 facilities.

Minimum Threat Standard

• For consistency across all FERC dams, the SA for a Group 2 Dam must at a minimum measure security against a "generic" intruder — on foot, with no specialized tools, equipment, or weapons — gaining access to all identified assets.
• This minimum standard does not mean the licensee assumes this is the only threat. The licensee should always evaluate to the largest perceived threat pertinent to their facility if it is known or suspected.
• Evaluating to the largest perceived local threat leads to what is generally defined as the "design basis threat" for the SA.
• Always evaluate against any known or suspected local adversaries in addition to the generic intruder baseline.

What the SA Must Identify

• The SA evaluates the current state and appropriateness of the on-site security system and procedures.
• It must identify whether any security enhancements are needed, and specifically what those enhancements consist of (e.g., installation of fences, gates, cameras, increased guards).
• The SA must address the state of maintenance and readiness of existing security systems and procedures — not just whether they exist, but whether they are functional and current.
• The level of response identified by the SA is highly dependent upon site-specific characteristics of the project and should consider anticipated threat and any changing local, regional, or national threat alerts.

Recommendations and Security Plan Integration

• All recommendations to improve security posture must be clearly defined within the SA document.
• Recommendations must include a plan and schedule for the dam owner to address all listed items.
• SA recommendations lead directly to improved security measures and are to be incorporated into the Security Plan (see §7.0).
• Unlike a VA, where recommendations are tied to specific risk values (C, V, T, S), SA recommendations are made in more generalized terms — identifying what the security system lacks without the full risk quantification.

The SA has defined documentation cycles and strict availability requirements during Dam Safety Inspections. It is never submitted directly to FERC.

• All assumptions must be well documented within the SA — including any methodological choices, adversary assumptions, and security system assessments.
• 10-Year Full Reprint Cycle: An SA must be re-evaluated and fully reprinted (redone) on a ten-year schedule. The first reprint was due ten years from the most current SA as of December 31, 2010, and reprinted on a ten-year schedule thereafter.
• Annual Update Requirement: In addition to the 10-year reprint, each SA must be updated annually. Changes to parameters and conclusions must be highlighted from the previous year. Changes may be inserted to the existing SA as attachments.
• In particular, variations arising from on-site modifications to security systems or procedures must always be addressed in the annual update.
• If there have been no changes from the previous year, an acceptable annual update is a one-page, dated insert to the SA indicating: "reviewed the SA and there are no changes."
• NOT Submitted to FERC: Licensees do not submit their SA to FERC; however, the document must be made available for review during each Dam Safety Inspection — no exceptions to this requirement will be entertained.
• Annual Certification Letter: In lieu of document submittal to FERC, licensees must submit an annual letter to their FERC Regional Office by December 31 of each year, certifying compliance with SA requirements for their Group 2 Dams (see §8.0).
• Multi-Dam Licensees: A single annual letter may include detailed compliance certification for all VA, SA, and SP requirements across multiple dams.

The Security Assessment does not exist in isolation. It feeds into the Security Plan, is reviewed during Dam Safety Inspections, and must be coordinated with the broader emergency response framework.

Security Group Requirements Summary

• Security Group 1 Dams: Do not complete a stand-alone SA. Instead, the Security Assessment is an integral component of the Group 1 Vulnerability Assessment — the Security Effectiveness (S) factor within the VA fulfills the SA requirement.
• Security Group 2 Dams: Must complete a stand-alone SA. The SA is their primary security evaluation document, reprinted every 10 years and updated annually.
• Security Group 3 Dams: Not required to complete a VA or SA. A Security Plan is also not required. However, Group 3 licensees must submit the annual certification letter and are encouraged to maintain good security practices.
• Any SG2 project that controls (or can control) an SG1 project must follow SG1 requirements — including completing a full Vulnerability Assessment instead of just an SA.

Relationship to the Security Plan

• The SA is a diagnostic tool — it identifies what the security system is, whether it is adequate, and what improvements are needed.
• The Security Plan (SP) is the operational tool — it describes how security is managed and exercised day-to-day.
• Recommendations arising from the SA are to be implemented and incorporated into the Security Plan. The SP must be updated whenever SA recommendations are implemented.
• The SP must not be allowed to become outdated relative to the SA — whenever site conditions change, both the SA (in its annual update) and the SP must be updated to reflect current conditions.

FERC Review During Dam Safety Inspections

• The SA must be available on-site for review by the FERC D2SI Engineer at each Dam Safety Inspection.
• The FERC Engineer uses the SA to verify that the licensee has properly identified security needs and that recommendations have been addressed.
• For Group 2 Dams, the SA results and the security response generally are discussed with the FERC Engineer during the inspection.
• If the SA is not available during the inspection, this is a compliance deficiency — FERC will not accept exceptions to the availability requirement.
• Details about the security measures at a facility are not to be conveyed via email or recorded outside of the formal FERC security documentation system (Project Security Memorandum and attached Security Checklist).