AgdaPkt 2020-06-22 Joint SA PFA - Laserfiche WebLink

Browse Search

6.H. - Page 19 of 24 ATTACHMENT A Risk = Consequences x Vulnerability x Threat Likelihood. The Resilience Analysis shall be performed to calculate how resilient the utility is systemically and how resilient select assets are to specified threats. 1) Asset Characterization What assets do I have and which are critical? 2) Threat Characterization �.—� What threats and hazards should 1 consider? 3) Consequence Analysis I What happens to my assets if a threat or hazard happens? i—1 much money lost, how many lives lost, how many injuries? 4) Vulnerability Analysis What are my vulnerabilities that would allow a threat or hazard to cause these consequences? 5) Threat Analysis What is the likelihood that a terrorist, natural hazard, or dependencylproximity hazard will strike my facility? 6) Risk/Resilience Analysis What is my risk and resilience? Risk = Consequence x Vulnerability x Threat Likelihood Resilience = Service Outage x Vulnerability x Threat Likelihood d7) Risk/Resilience Management What options do 1 have to reduce risks and increase resilience? How much will each benefit in reduced risks and increased resilience? How much will it cost? What is the benefit -cost ratio of my options? ► Deliverables: List of Critical Assets; Threat -Asset Workshop; Consequence - Vulnerability Workshop; Management Out -Briefing. 1.3 — Perform Risk and Resilience Assessment The RRA shall address all elements required by the AWIA, including: • Risk to the system from malevolent acts, including physical and cyber intrusion. • Risk to the system from natural hazards. • Dependency hazards,; including utility interruptions (power outages, communications outages), supply chain, employee staffing issues (illness, strike), customers, transportation, proximity, etc. • Risk to the system from unintentional human -caused risks, (hazardous chemical spills, incorrect system operation, network security gaps or failures, critical component failure) • The resilience of the SCADA system and all automated systems (including cyber REV: 06-04-2020 MI • Resilience of the pipes and constructed conveyances, physical, barriers, source water, water collection and intake, pretreatment, treatment, storage and distribution facilities, electronic, computer, or other automated systems (including system security). • Monitoring practices of the potable water system. • Financial infrastructure assessment. • The use, storage, or handling of various chemicals by the system. • Operation and maintenance of the systems. • Sufficiency of Monitoring practices. ATTY/AGR.2020.088/ARRC Consultants, LLC (Page 16 of 20) 206