Critical Infrastructure Risk Assessment. Ernie Hayden, MIPM, CISSP, CEH, GICSP(Gold), PSP
of the Report
In this chapter you will discover:
8.1 Rule #1 — Don’t Shelve the Report and Findings!
8.3 Assign a Professional Project Manager
8.4 Review the Entire Risk Assessment Report
8.4.1 Recognize the Strengths!
8.4.2 Assign Unique Numbers to Each Finding
8.5 Build the Remediation Team
8.7 Monthly Meetings (or More Frequent)
8.10 Postmortem/After-Action Review
8.11 Questions for Consideration
Chapter 9 Continuing the Journey
“Hey Boss, I know how to do a Risk Assessment!”
APPENDIX A EXAMPLE RISK ASSESSMENT REPORT
Introduction
When eating an elephant, take one bite at a time.
- General Creighton Abrams, US Army
or,
A journey of a thousand miles must begin with a single step.
- Lao Tzu
“Oh, Crap!”
Your bosses are worried about the state of your facility. They heard of a major accident at one of your competitor’s plants and there is worry your facility could suffer the same fate. During the daily Skype call with headquarters your boss, the Vice President of Operations, gives you the order. “Tell me if we are at risk for this same issue!!” he exclaims. “I want a report emailed to me in two weeks or less. Be sure to let me know if you have any questions or need any help.”
The call ends and you begin to ponder — worry, actually. How am I going to “assess” my plant? You vaguely heard about your competitor’s event but don’t know any of the details. Also, your plant is huge. It covers a square mile including the fence-line, roads, etc. How am I going to “eat the elephant?”
Frankly, this story is not that unusual. There are many instances where seasoned managers are tasked with conducting major inspections and assessments of their operations. But, even new engineers, insurance adjustors, and quality assurance staff are confronted with this same dilemma. How do I start? Where do I start? Exactly what do I do?
Besides, even if I start with such an “assessment or inspection” what do I focus on? Why? What do I do with all the data I accumulate? How do I collect it? How do I organize it?
This book is written after conducting such inspections and assessments for the past 40+ years. I have performed inspections on power plants, factories, refineries, oil and gas pipelines, warships, major sports arenas, 30+ story business buildings, and even my own house. With this experience this book will offer you a methodology along with a collection of tools and techniques to use when conducting risk and vulnerability assessments of large and small industrial facilities and critical infrastructure.
In this chapter you will discover:
The value of a Risk Assessment.
Ideas on “where to begin” to perform a Risk Assessment.
An overall view of the Risk Assessment Process.
Your journey in reading this book will offer you guidance on these key topics:
What constitutes Critical Infrastructure.
The fundamentals of risk and the risk equation.
Overall risk assessment process and methodology.
Ideas on how to prepare for the assessment.
Guidance on performing the onsite assessment.
Entry and exit Meetings.
Interviewing site personnel.
Reviewing client documentation.
Conducting physical plant inspections.
Performing and documenting observations.
Developing the final report and findings.
Details on identifying risk and risk severity ratings.
Preparation of the initial draft.
Issuing the report and follow-up.
The advice and suggestions in this book are intended to provide guidance and training for new as well as seasoned staff.
With this book I hope to offer some interesting stories of my own and from experienced assessors and inspectors you can use to become better at your job. You will learn new techniques for attacking the targeted facility, you’ll have access to some new checklists and guidelines, and I hope you’ll learn what the better “knives and forks” are to use when Eating the Elephant.
Who Should Read This Book?
So, who should