HLSS505Wk6

The National Domestic Preparedness Coalition’s® Homeland Security Comprehensive Assessment Model™

SUMMARY The National Domestic Preparedness Coalition’s® (NDPCI) Homeland Security Comprehensive Assessment Model (HLS-CAM™) helps jurisdictions systematically and objectively evaluate their communities for strengths and weaknesses; evaluate threats including all hazards; and identify and prioritize critical facilities, infrastructure, resources, assets, and events. It also provides an onsite vulnerability assessment methodology to identify vulnerabilities of critical infrastructure and key resources (CI/KR). The HLS-CAM™ is methodology designed by the NDPCI, developed by emergency responders for emergency responders. BACKGROUND The NDPCI is a stand alone 501(c)3, non-profit organization, conceived by the Orange County Sheriff’s Office in Orange County, Florida; the West Virginia University School of Medicine; and the West Virginia National Guard. Its membership primarily includes emergency responders from all disciplines and various federal, state, county, and local organizations. The NDPCI’s mission is to provide homeland security solutions that protect citizens, facilities, and infrastructure from all hazards, including terrorism, natural disasters, and hostile criminal activities. The NDPCI developed the HLS-CAM™ shortly after the terrorist attacks of September 11, 2001, to provide jurisdictions with a uniform and comprehensive method of evaluating threats to their CI/KR. Other methods of performing threat assessments, risk assessments, vulnerability assessments, security analysis, and security surveys proved to be complex and difficult to use. These methods could not be employed in an integrated manner, due in part to their use of contradictory definitions. The HLS-CAM™ was the first of its kind, integrating these methods and prioritizing the order in which CI/KR should be assessed to determine the risks for a given jurisdiction. GOALS The HLS-CAM™ provides jurisdictions with a comprehensive risk assessment tool that assesses a community’s CI/KR vulnerabilities. It enables federal, state, county, local, and private organizations responsible for protecting citizens, facilities, and infrastructure from all hazards to systematically and objectively identify, prioritize, and evaluate the threats to, relative criticality of, and vulnerabilities of sites and infrastructure.

Critical Infrastructure

Risk Assessments Terrorism

Community Preparedness

Emergency Management

Law Enforcement

2

DESCRIPTION The NDPCI designed the HLS-CAM™ to support a jurisdiction’s comprehensive risk management program. State or local law enforcement officials and emergency managers usually take the lead in implementing the Model jointly with fire, emergency medical services, and local government officials. The HLS-CAM™ is fully-compliant with all four objectives of the Homeland Security Presidential Directive 7, the National Infrastructure Protection Plan, and the National Incident Management System. The HLS-CAM™ has been used successfully by several state and county governments. Its methodology has been adopted by the State of Florida as the state's assessment model and is the State of Georgia’s preferred method of conducting assessments of privately owned critical facilities and infrastructure. The Model also has been used to facilitate vulnerability assessments in states such as Mississippi and New Hampshire. Key features of the HLS-CAM™ include a comprehensive risk assessment methodology, training programs for emergency responders on how to use the HLS-CAM™, HLS-CAM™ compact discs, and other support resources. Risk Assessment Methodology The Model’s risk assessment methodology consists of a five-part cycle:

Threat Assessment; Criticality Assessment; The Mission/Demography--Symbolism, History, Accessibility, Recognizability,

Population, Proximity (M/D-SHARPP) Matrix; The Community Priority Assessment Plan (CPAP); and A Vulnerability Assessment.

Threat Assessment The Threat Assessment stage is the first step in the HLS-CAM™ methodology. A team of assessors, primarily consisting of emergency responders from multiple emergency response disciplines within a given jurisdiction, gathers information about its community. The team identifies the community’s mission and factors that can affect emergency response operations within the community. These factors include the community’s main emergency response concerns, geographic and demographic layout, and communication among emergency response organizations. The assessors also create a list of the community’s CI/KR and identify possible threats to these assets. All hazards, including natural disasters and terrorism, are considered. The assessors create the CI/KR list by using existing CI/KR lists from local emergency response

3

organizations and public works agencies. Once the initial list is compiled, the assessors convene to review the list, adding and deleting facilities as needed. The assessors calculate threat assessment variables for each CI/KR and evaluate the most likely threat courses of action that could take place in their community. Criticality Assessment The Criticality Assessment stage is the second step in the HLS-CAM™ methodology. The assessors identify, evaluate, and prioritize the criticality, or asset value, of a community’s most important CI/KR. The team gauges the relative importance of these assets and determines the impact of a terrorist attack, natural disaster, or hostile criminal act against each asset in their community. The assessors measure the impact of these threats according to five categories:

Death and injury; Economic impact; Environmental impact; Impact on critical infrastructure; and Symbolic effect.

The assessors assign a value for each category to accurately assess the potential effect of a specific target’s destruction. This enables the assessors to develop better site vulnerability assessment priorities. The M/D-SHARPP Matrix The M/D-SHARPP Matrix stage is the third step in the HLS-CAM™ methodology. The assessors use this stage to analyze the likelihood of criminal and/or terrorist acts and the specific methods of attack against assets identified in the CI/KR list. The assessors evaluate what type of weapons and tactics (i.e. truck bomb, sniper attack, etc) are most likely to be employed by selected threat groups against each specific target. They classify these methods of attack using the M/D-SHARPP Matrix’s eight categories:

Mission: The likelihood that an attack against a specific target will degrade the community’s ability to function

Demography: Actors in the community that threat groups may consider as potential targets

Symbolism: The degree to which a target has symbolic significance for a specific community

History: The threat group’s history of attacking these types of targets

Accessibility: The critical access paths to the targets and their vulnerabilities

Recognizability: The degree to which the targets can be identified by a threat group

Population: The number of casualties that can be predicted for an attack against a specific target

Proximity: The degree to which a threat group may value the collateral damage caused to facilities or persons by a terrorist and/or hostile criminal attack against a specific target

Each of the aforementioned target components is assigned a specific value. The highest scoring methods of attack are determined to be the most likely tactics to be employed against a specific target.

4

The Community Priority Assessment Plan The Community Priority Assessment Plan (CPAP) stage is the fourth step in the HLS-CAM™ methodology. The assessors evaluate the results of the Criticality Assessment and the M/D- SHARPP Matrix stages to identify the most vulnerable high-impact targets on the CI/KR list. They combine each target’s Criticality Assessment score and M/D-SHARPP Matrix score to prioritize the order in which the targets’ onsite vulnerability assessments should be conducted. This helps jurisdictions focus assessment efforts on the most critical sites, thus ensuring effective management of scarce resources. Vulnerability Assessment The Vulnerability Assessment stage is the fifth step in the HLS-CAM™ methodology. The assessors identify and evaluate the weaknesses and susceptibilities of a jurisdiction’s most vulnerable high-impact targets to known methods of attack. They conduct onsite physical, operational, and procedural security inspections for each target. This includes a detailed walk-through of the facility’s perimeter, property within each perimeter, as well as exterior and interior building spaces. The assessors interview building occupants and security staff and evaluate all operational systems and security procedures to identify each target’s vulnerabilities. The NDPCI strongly recommends that the first assessment completed by novice assessors be facilitated by an experienced and certified security professional. The NDPCI also recommends that all assessments be conducted in cooperation with site proprietors and personnel. This can facilitate a better understanding of the facility’s standard operating procedures. Novice assessors can conduct basic Vulnerability Assessments independently after completing HLS-CAM™ training, supported by supplementary worksheets. An experienced assessor should always review the novice assessors’ completed assessments. HLS-CAM™ Training Programs The NDPCI offers a 3-day HLS-CAM™ training program that covers all aspects of HLS-CAM™ methodology at various sites across the United States. Students include emergency responders, security personnel, and private sector representatives. Training generally consists of a classroom-based course supplemented by a number of hands-on exercises and an onsite Vulnerability Assessment. The program provides students with a working knowledge of the HLS-CAM™ process and teaches them how to use the methodology in a community based upon each student’s jurisdictional expertise. A core group of HLS-CAM™ certified professionals instruct the HLS-CAM™ course. HLS-CAM™ instructors include both current and retired law enforcement personnel, fire department personnel, health and medical personnel, emergency managers, and security experts from the private sector. Jurisdictions that are interested in being trained in HLS-CAM™ methodology usually request the training through the NDPCI and pay for the training with Department of Homeland Security Urban Area Security Initiative grant funding, state grant funding, or though their own resources. HLS-CAM™ Compact Discs and Support Resources The NDPCI offers each jurisdiction and participating members an auto-play compact disc (CD) with all applicable HLS-CAM™ forms stored in Microsoft Word and Excel files. The CD organizes assessment collection and dissemination processes. It also contains a vast CI/KR list.

The HLS-CAM™ Training, Certification and Vulnerability Assessment Kit is now available at no cost through successful application to the Department of Homeland Security’s Commercial Equipment Direct Assistance Program. For more information, please visit the NDPCI’s HLS-CAM™ application Web page.

5

The NDPCI’s Homeland Security Task Force Web site provides HLS-CAM™ users with a comprehensive resource database to assist them with the assessment process and to enable them to communicate with other responders. The HLS-CAM™ and the Buffer Zone Protection Program The HLS-CAM™ also enables communities to apply for grants through the Department of Homeland Security’s Buffer Zone Protection Program (BZPP). The BZPP is designed to reduce vulnerabilities of critical infrastructure and key resources by extending the protected area around a site to include the surrounding community. The program also supports the prevention and preparedness efforts of local emergency responders. It provides jurisdictions with targeted federal funding and technical expertise that might otherwise be unavailable at the local level. For more information on the BZPP, please visit the Department of Homeland Security’s Fiscal Year 2005 Buffer Zone Protection Program: Program Guidelines and Protection Kit. REQUIREMENTS Keys to Success Close collaboration and coordination among federal, state, and local organizations, and NDPCI personnel who are experienced in conducting Vulnerability Assessments are the keys to the success of the HLS-CAM™. Each participating organization contributes its respective expertise and available resources to execute the HLS-CAM™ effectively. Resources HLS-CAM™ training costs approximately $600 per trainee but can vary according to the needs, constraints, and capabilities of each jurisdiction. Staffing requirements for HLS- CAM™ implementation vary, but many jurisdictions use a small group of officers working part-time to coordinate assessment collection efforts. Links The National Domestic Preparedness Coalition®. The Homeland Security Comprehensive Assessment Model™. http://www.ndpci.us/hls_cam.html CITATIONS Carden, Greg and Tim Young. West Virginia Joint Intelligence Fusion Center. HLS-CAM™ Briefing PowerPoint. West Virginia Energy Infrastructure Workshop. Roanoke, WV. 11 Dec 2003. https://www.llis.dhs.gov/member/secure/detail.cfm?content_id=23753

Department of Justice, Bureau of Justice Assistance. Assessing and Managing the Terrorism Threat. Sep 2005. https://www.llis.dhs.gov/member/secure/detail.cfm?content_id=21519

Glantz, Kenneth M. Executive Director, National Domestic Preparedness Coalition. Interview with Lessons Learned Information Sharing, 11 Oct 2005.

For more information on NDPCI’s resource database, please visit the NDPCI’s Homeland Security Task Force.

6

DISCLAIMER Lessons Learned Information Sharing (LLIS.gov) is the US Department of Homeland Security/Federal Emergency Management Agency's national online network of lessons learned, best practices, and innovative ideas for the emergency response and homeland security communities. The Web site and its contents are provided for informational purposes only, without warranty or guarantee of any kind, and do not represent the official positions of the US Department of Homeland Security. For more information on LLIS.gov, please email [email protected] or visit www.llis.gov.