Security Risk Assessment for Transport Operators - Department of ...

Example 10: Conducting a criticality assessmentAssetA local ferry company has one pier at each end of its only route, with noalternatives identified.Impact from worst case scenarioThe most plausible worst case scenario is complete physical loss of the pier, whichwould lead to services being terminated for at least two months.MethodologyThe company uses Table 9 to assess criticality and rates as ‘extreme’, the loss of anyasset or dependency which leads to a complete cessation of services for at least onemonth (operational).The criticality of each pier is therefore rated as ‘extreme’.As the company treats anything rated as ‘high’ or ‘extreme’ as a critical asset,each pier is added to the list of critical assets.The company’s criticality assessment now states:AssetImpact from worstcase scenarioCriticalityratingCriticalasset?PierTermination of services for aperiod of at least two monthsExtremeYesA.2 Conducting a threat assessmentUnderstanding the composition of threats and allocating them a rating, can be of substantial usein gaining a deeper understanding of the overall threat environment in which you operate. A morein-depth knowledge can be of benefit in the later stages of the risk assessment process, particularlyin establishing the likelihood of risks and prioritising.For the purposes of this document:Threat is determined by assessing intent and capability.Table 10: Intent and capability descriptorsOptional advanced technique:For smaller operators, identifyingindividual sources of risk may beall that is required. For others,gaining a greater understandingand rating factors that drive thethreat may be desirable.IntentCapabilityDetailFocuses on an individual or group’smotivation and objectives.Considers an individual or group’sknowledge, skills andaccess to resources.ExampleTo take vengeance on an organisationfor previous actions (such assupporting a particular cause).An insider’s knowledge of securityprocedures, access and ability to usea range of firearms.In order to rate the threat, the intent and capability of the attacker should be assessed thencross-referenced to determine a threat rating.Security Risk Assessment Guide 33