The vulnerability of the agency or business unit to an emergency, hazard or threat is based on the combination of the probability of an event occurring and the impact the event would have on operations.

A vulnerability assessment should consider primary and secondary risks that may occur at a given site.

Hazard or threat identification and vulnerability assessment combine probabilities of event occurrence (earthquake, hurricane, terrorism, etc.) with factors relevant to the specific site (location, operational, and structural characteristics) to determine the risk of a given threat at a site.

Hazards and threats may be from a secondary source. Neighboring offices or facilities may house materials or perform operations that generate hazards or threats for your operation. While you have no direct control over that type of hazard or threat, your site vulnerability may be higher.

A Site Vulnerability Analysis typically considers problems relating to the location of the facility in question. The Vulnerability Analysis may reference the risk of demonstrations, acts of terrorism and crime rates in the immediate area. In addition, the analysis may discuss the current protection methods used such as camera systems, guards and access control systems.