Vulnerability & Security Assessments (Chapters 5–6)

A Vulnerability Assessment (VA) is a formal document that provides a structured analysis of all factors defining full Security Risk. It ultimately produces recommended changes to physical security or operational procedures to decrease overall risk.

• Traditional risk analysis is defined as: Risk = Impact × Threat × Vulnerability. The VA must work through each of these components systematically.
• FERC uses the following comparative risk equation (from DAMSVR; any fully substantiated method is acceptable): Relative Risk = {[C × (V + L + T)] ÷ S} ÷ 300
• C = Consequence (scale 1–10): potential loss of life, downstream damages, and service disruption.
• V = Vulnerability (scale 1–10): how easily an adversary could exploit specific project assets.
• L = Likelihood of Attack (scale 1–10): realistic probability that a threat actor would target this facility.
• T = Threat (scale 1–10): capability and intent of potential adversaries.
• S = Security (scale 10–1, inverted): effectiveness of the existing security system — higher security = lower risk.
• 300 is a scaling factor to normalize the result to a maximum output of 1.0.
• Because of wide uncertainties in defining Threat and the potential for random human intervention, a "pure" Risk value is extremely difficult. The VA leads more to a definition of relative or conditional risk — a function of identifying vulnerabilities.
• A VA is required for all Security Group 1 Dams. It is also required for any dam requesting a permanent (>30 day) closure of recreational or other licensed facilities. It is strongly suggested for all dams regardless of Security Group.

The format, scope, and level of detail of a VA are determined by the licensee, but must be sufficient to address the pertinent vulnerabilities of the project. The following sections are required (marked Required) or suggested.

A multi-person team — including several technical disciplines, the dam operator, and a security expert — is the best approach. The VA must address four key factors, each of which interacts with the others.

Factor 1: Consequences (C)

• Consequences must account for potential loss of life (related to the population at risk downstream), property damages downstream and on-site, and disruption of services such as power generation or water supply.
• Consequences must be evaluated for: (1) complete dam failure, and (2) failure of individual vulnerable project assets such as spillway gates, turbines, penstocks, etc.
• If all realistic attack scenarios produce low consequences, the required security response will be less stringent than for a project with medium or high consequences.
• For security risk, dam-breach consequences are determined from the sunny-day case (normal reservoir pool elevation), not flood condition.
• Consequences from complete dam failure (often shown in the EAP) will generally be greater than consequences from loss of an individual asset such as one spillway gate.

Factor 2: Vulnerability (V)

• Identify the "weak points" or vulnerable project features (assets): not only the dam and powerhouse as a whole, but specific assets such as spillway gates, turbines, penstocks, intake structures, etc.
• Assessing specific asset vulnerabilities allows a coordinated, comprehensive security system to be designed — rather than a generic perimeter approach.
• An asset may be vulnerable to a certain level of threat but not to a lesser-level threat. Both conditions must be evaluated.
• Understanding what is being protected and how well those critical physical assets are being protected assists planners in prioritizing security resources.

Factor 3: Threat and Likelihood of Attack (T and L)

• Assess potential threats based on organizations or individuals (including locals) who may wish to cause harm to the facility.
• Assess the likelihood that these groups actually have intent to attack, and evaluate whether their capabilities make a successful attack feasible.
• A history of security, criminal, and vandalism incidents specific to the site, and information from the FBI or other law enforcement agencies specific to the area, is essential.
• Threat must first be evaluated for its presence; if present or suspected, evaluate the group's capability to successfully exploit a known vulnerability.
• A good assessment of threat helps the planner determine to what level an asset must be protected.
• The threat assessment portion of the VA must be annually reviewed and updated as necessary as part of the annual VA update.

Factor 4: Security Effectiveness (S)

• Evaluate the effectiveness of the on-site security system against anticipated adversary attack scenarios. For SG2 Dams, this sub-component constitutes the Security Assessment (SA) requirement.
• Four security system sub-elements must be addressed: (1) ability to detect an intruder; (2) capability to assess the detection to determine if it is a real threat; (3) ability of the security system to delay the intruder; and (4) time taken for law enforcement to respond.
• If the security system is judged to be deficient, recommended enhancements must be proposed as a function of the overall risk arising from the attack.
• All security enhancement recommendations must be incorporated into the Security Plan (see §7.0).
• Recommendations must include a plan and schedule for the dam owner to address all listed items.
• The VA result is a matrix of paired variables: specific consequences aligned with specific vulnerabilities, resulting from specific threats, measured against specific security features — each variable changes as others are adjusted.

Regardless of whether a specific threat is believed to exist, the VA must evaluate the existing security against a defined spectrum of threat scenarios. This is not a concession that these scenarios are anticipated — it is an exercise to stress-test the security system.

• At a minimum, the licensee must evaluate on-site conditions against the following threat levels (site-specific threats should always be evaluated in addition to these):
• • Insider threat.
• • Vandalism / Theft.
• • Group of 3–5 individuals with small arms and backpack explosives.
• • Group of 3–5 individuals with small arms, vehicles (land and water), and a VBIED (delivery/water-truck size, and the equivalent for a water-side boat attack).
• • SCADA controls attack.
• • Any identified local, regional, national, or transnational threat groups that are appropriate to the site.
• Dam owners do not concede that a scenario is anticipated or feasible — they may footnote any scenario: "There is no present evidence to indicate that this level of threat exists in this area."
• The dam owner must choose a "design basis threat" — the level of threat used for normal conditions. This level is applied to the security system to determine baseline security effectiveness.
• If the threat level increases, security posture/procedures/operations should be temporarily enhanced per §4.3 and Appendix D.
• Multiple threat scenarios must be reviewed because they inform the dam owner about potential deficiencies if future threat levels increase, and guide how to temporarily address increased threat postures.
• A useful reference for measuring security is the DHS publication "Dams Sector Protective Measures Handbook — A Guide for Owners and Operators," available on the HSIN Dams Portal (contact dams@hq.dhs.gov for access).

The VA is a living document with strict documentation and update requirements. It is never submitted to FERC directly, but must be available at every Dam Safety Inspection.

• All assumptions must be well documented within the VA, including estimates of Consequences, Vulnerabilities, Threat, and Security effectiveness.
• Recommendations (suggested changes to site security) arising from the study must be clearly defined within the document.
• 5-Year Full Reprint Cycle: A VA must be completely reprinted (fully redone) on a five-year cycle, beginning December 31, 2010 — i.e., a full reprint is due at least every five years.
• Annual Update Requirement: In addition to the 5-year reprint, each VA must be updated annually. Changes to parameters and conclusions must be highlighted from the previous year. Changes may be inserted as attachments to the existing VA.
• If there have been no changes from the previous year, an acceptable annual update is a one-page, dated insert stating: "Reviewed the VA and there are no changes" — with the name of the law enforcement agency contacted to verify the annual Threat Analysis and the date of that contact.
• Annual Threat Analysis: A new threat analysis must be completed annually as part of each annual VA update and must be coordinated through local law enforcement agencies.
• Who Requires a VA: (1) All Security Group 1 Dams; and (2) any dam where there is a request to permanently (>30 days) close recreational or other licensed facilities for security reasons. A VA is strongly suggested for all dams.
• The annual VA update and 5-year reprint are required whether driven by SG1 classification or by a proposed license modification.
• NOT submitted to FERC: Licensees do not submit their VA to FERC. However, the document must be made available for review during each Dam Safety Inspection — no exceptions.
• Annual Certification Letter: In lieu of document submittal to FERC, licensees must submit an annual letter to their FERC Regional Office by December 31 of each year, certifying compliance with VA requirements for their Group 1 Dams (see §8.0).

A Security Assessment (SA) is an abbreviated evaluation of the security procedures and features at a dam — without fully accounting for attack Consequences, Vulnerabilities, or Threat. It is required for Security Group 2 Dams and is an integral part of the VA for Security Group 1 Dams.

Definition and Purpose

• The SA evaluates only Security effectiveness (S) — it does not conduct a full risk assessment because it does not address Consequence (C), Vulnerability (V), or Threat (T) independently.
• Because anticipated risk at an SG2 Dam is significantly less severe than SG1, the level of evaluation detail is less stringent.
• An SA is a stand-alone document or can be incorporated within a more detailed Vulnerability Assessment.
• The only practical advantage of an SA over a VA is that it can be completed with fewer resources and reduced effort.
• FERC strongly encourages licensees to complete the more-detailed VA even for SG2 Dams, as it produces a more-informed decision-making process.

SA General Outline — Required vs. Suggested Sections

• Introduction / Scope / Methodology Used / Assumptions — Suggested.
• List of Critical Physical Dam-related Assets (dam structures and appurtenant structures) — Suggested.
• Inherent accessibility and visibility of each identified asset — Suggested.
• Effectiveness of the security system/procedures/response to address anticipated adversaries; at a minimum, consider how a "generic" intruder on foot with no specialized tools, equipment, or weapons could gain access to all identified assets — Required.
• Recommendations (if necessary) to improve the security posture, including a Plan and Schedule to address all recommendations — Required.

Minimum Threat Standard for SA

• Although the SA does not need to fully evaluate Threat as a VA does, a security system cannot be evaluated without some reference threat.
• For consistency across FERC dams, the SA for a Group 2 Dam must at a minimum measure security against a "generic" intruder on foot with no specialized tools, equipment, or weapons.
• The licensee should always evaluate to the largest perceived threat pertinent to their facility if it is known or suspected — this defines the "design basis threat" for the SA.

SA Documentation and Update Requirements

• All assumptions must be well documented within the SA.
• 10-Year Full Reprint Cycle: An SA must be re-evaluated and fully reprinted on a ten-year schedule (first due ten years from the most current SA as of December 31, 2010).
• Annual Update: Each SA must be updated annually, with changes highlighted from the previous year. Changes may be inserted as attachments. If there are no changes, a one-page dated insert stating "reviewed the SA and there are no changes" is acceptable.
• On-site modifications to security systems or procedures must always be addressed in the annual update.
• NOT submitted to FERC: Licensees do not submit their SA to FERC, but it must be made available for review during each Dam Safety Inspection — no exceptions.
• Annual Certification Letter: Licensees must submit an annual letter to their FERC Regional Office by December 31 of each year, certifying compliance with SA requirements for their Group 2 Dams.