Transcription
Threat and Hazard Identificationand Risk Assessment (THIRA)and Stakeholder PreparednessReview (SPR) GuideComprehensive Preparedness Guide (CPG) 2013rd EditionMay 2018
CPG 201: THIRA/SPR Guide—3rd Edition2
PrefaceCPG 201: THIRA/SPR Guide—3rd EditionPrefaceComprehensive Preparedness Guide (CPG) 201, 3rd Edition, provides guidance for conducting aThreat and Hazard Identification and Risk Assessment (THIRA) and Stakeholder PreparednessReview (SPR), formerly State Preparedness Report. The 1st Edition of CPG 201 (April 2012)presented the basic steps of the THIRA process. Specifically, the 1st Edition described astandard process for identifying community-specific threats and hazards and setting targets foreach core capability identified in the National Preparedness Goal. The 2nd Edition (August2013) expanded the THIRA process to include resource estimation, streamlined the number ofsteps in the process, and provided additional examples of how to develop a THIRA.CPG 201, 3rd Edition, includes both the THIRA and SPR because they are interconnectedprocesses that, together, communities use to evaluate their preparedness. The 3rd Edition alsointroduces updates to both methodologies. The THIRA includes standardized language todescribe threat and hazard impacts and capability targets. This allows communities to collectmore specific, quantitative information while also providing important context. Through theupdated SPR process, communities collect more detailed and actionable data on their currentcapabilities and identified capability gaps. Communities then indicate their intended approachesfor addressing those gaps, and assess the impact of relevant funding sources on building andsustaining capabilities.Where appropriate, the 3rd Edition highlights key changes from previous editions of CPG 201.This 3rd Edition supersedes the 2nd Edition of CPG 201.3
CPG 201: THIRA/SPR Guide—3rd EditionTable of ContentsTable of ContentsContentsPreface . 3Table of Contents . 4Introduction . 5The National Preparedness Goal . 5The National Preparedness System . 6Using the THIRA/SPR Strategically. 7Community-Wide Involvement . 9The THIRA Process . 10Introduction to the Three Steps of the THIRA . 10Step 1: Identify the Threats and Hazards of Concern . 11Step 2: Give the Threats and Hazards Context . 15Step 3: Establish Capability Targets . 19The SPR Process. 23Step 1: Assess Capabilities . 24Step 2: Identify and Address Capability Gaps . 34Step 3: Describe Impacts of Funding Sources . 39Conclusion. 41Glossary of Terms . 424
IntroductionCPG 201: THIRA/SPR Guide—3rd EditionIntroductionThe National Preparedness GoalThe National Preparedness Goal, Second Edition (2015) 1 defines what it means for allcommunities to be prepared for the threats and hazards that pose the greatest risk to the securityof the United States. The National Preparedness Goal (“the Goal”) is:A secure and resilient Nation with the capabilities required across the whole community toprevent, protect against, mitigate, respond to, and recover from the threats and hazards thatpose the greatest risk.The Goal identifies 32 distinct activities, called core capabilities, needed to address the greatestrisks facing the Nation (see Figure 1). 2 The Goal organizes these core capabilities into fivecategories, called mission areas. 3 Some core capabilities apply to more than one mission area.For example, the first three core capabilities—Planning, Public Information and Warning, andOperational Coordination—are cross-cutting capabilities, meaning they apply to each of the fivemission areas.The National Preparedness Goal describes the five mission areas as follows: Prevention: Prevent, avoid, or stop an imminent, threatened, or actual act of terrorism. Protection: Protect our citizens, residents, visitors, and assets against the greatestthreats and hazards in a manner that allows our interests, aspirations, and way of life tothrive. Mitigation: Reduce the loss of life and property by lessening the impact of futuredisasters. Response: Respond quickly to save lives; protect property and the environment; andmeet basic human needs in the aftermath of an incident. Recovery: Recover through a focus on the timely restoration, strengthening, andrevitalization of infrastructure, housing, and a sustainable economy, as well as thehealth, social, cultural, historic, and environmental fabric of communities affected by anincident.The mission areas and core capabilities organize the community-wide activities and tasksperformed before, during, and after disasters into a framework for achieving the goal of asecure and resilient Nation.1For additional information on the National Preparedness Goal, please visit: r additional information on core capabilities, please visit: https://www.fema.gov/core-capabilities.3For additional information on mission areas, please visit: https://www.fema.gov/mission-areas.5
CPG 201: THIRA/SPR Guide—3rd EditionIntroductionFigure 1: Five mission areas organize the 32 core capabilities needed to address threat and hazards ofconcern.The National Preparedness SystemCommunities assess, build, sustain, and deliver the core capabilities through an organizedprocess called the National Preparedness System. 4 The National Preparedness System has sixcomponents (see Figure 2), each of which ties into the others to guide community-widepreparedness activities and achieve the Goal of a secure and resilient Nation.4For additional information on the National Preparedness System, please visit: https://www.fema.gov/nationalpreparedness-system.6
IntroductionCPG 201: THIRA/SPR Guide—3rd EditionFigure 2: There are six components of the National Preparedness System.Using the THIRA/SPR StrategicallyThe THIRA/SPR sets a strategic foundation for putting the National Preparedness System intoaction. Communities complete the THIRA every three years and use the data from the process toassess their capabilities in the SPR, which is an annual review. It is important that communitiescomplete the THIRA on a multi-year cycle, as it enables them to assess year-over-year trends inchanges to their capabilities, while still periodically reviewing the capability targets to keep themrelevant.The three-year THIRA/SPR cycle starts with the first step in the National Preparedness System:Identifying and Assessing Risk. Risk is the potential for an unwanted outcome resulting from anincident or occurrence, as determined by its likelihood and the associated consequences. 5 In theTHIRA, communities identify risks with the potential to most challenge their capabilities andexpose areas in which the community is not as capable as it aims to be. These areas, or capabilitygaps, create barriers in a community’s ability to prevent, protect against, mitigate, respond to, andrecover from a threat or hazard. Understanding the risks they face will make it easier forcommunities to determine what level of capability they should plan to build and sustain.Communities can use the information that comes from the THIRA/SPR process to answer fivekey strategic questions about their preparedness risks and capabilities (see Figure 3).5DHS Risk Lexicon, June 2010: ns/dhs-risk-lexicon-2010 0.pdf.7
CPG 201: THIRA/SPR Guide—3rd EditionIntroductionFigure 3: Communities use the THIRA/SPR to answer five key questions.Since 2012, communities have used the THIRA/SPR to answer these questions, helping thembetter understand the risks their communities face. This helps communities make importantdecisions on how to prevent, protect against, mitigate, respond to, and recover from the threatsand hazards that pose the greatest risks.In addition to the Identifying and Assessing Risk component of the National PreparednessSystem, communities use the THIRA/SPR for Estimating Capability Requirements. Thisinvolves determining the specific level of capability that best addresses a community’s risks.These community-specific capability levels are what communities use to determine their currentlevel of capability, identify their capability gaps, and identify how they can close those gaps. Atthe end of the three-year THIRA/SPR cycle, communities reassess their risks by completing theTHIRA again and the process restarts. The outputs of the THIRA/SPR provide communities afoundation to prioritize decisions, close gaps in capability, support continuous improvementprocesses, and drive the other National Preparedness System components (see Figure 4).8
IntroductionCPG 201: THIRA/SPR Guide—3rd EditionFigure 4: The THIRA/SPR fuels NPS implementation.Community-Wide InvolvementRecognizing that preparedness is a shared responsibility, the National Preparedness System callsfor everyone—not just government agencies—to be involved in preparedness efforts.Community-wide involvement is an important principle in preparedness that entails involvingstakeholders throughout preparedness development, and ensuring preparedness materials reflecttheir roles and responsibilities. Including stakeholders early on and throughout the THIRA/SPRprocess helps the community to conduct accurate and comprehensive assessments. Furthermore,involving stakeholders throughout the process empowers them to use the data to help drivepriorities and investments within their own organizations.As such, developing a comprehensive and accurate THIRA/SPR requires active communityinvolvement from stakeholders and subject-matter experts (SMEs), such as: Colleges/universities, and other research organizations Cybersecurity experts Emergency management/homeland security agencies Emergency Planning Committees Federal agencies (e.g. Department of Health and Human Services) FEMA regional offices Fire, police, emergency medical services, and health departments Hazard mitigation offices Infrastructure owners and operators Major urban area and state fusion centers National Laboratories National Weather Service offices Port or transit organizations Supply chain stakeholders Private sector partners (including the 16 critical infrastructure sectors)9
CPG 201: THIRA/SPR Guide—3rd Edition The THIRA ProcessProfessional associationsTribal governmentsU.S. Department of Homeland Security (DHS) Protective Security AdvisorsVolunteer Organizations Active in Disasters (VOAD)Other organizations or agencies with significant impact on the local economyCommunities should also include SMEsImportance of Community-Wide Involvementfrom planning, exercises, mitigation,training, and other key areas in theirThe outputs of the THIRA/SPR process informTHIRA/SPR process. Including theall other preparedness activities; helpingperspectives and expertise of these keycommunities identify challenges, drive priorities,stakeholders gives communities criticaland close gaps in capabilities. Therefore, wheninformation regarding planning factorsdeveloping and updating THIRA/SPRs,and capability levels across all missioncommunities should ensure their assessment andareas. As a result, emergency managersplanning efforts include community-wide inputwill be well-positioned to provideand perspectives.essential information about the status ofcapabilities and consider THIRA/SPR data in their planning efforts, including the developmentof strategic, operational, and tactical plans.The THIRA ProcessIntroduction to the Three Steps of the THIRAThe THIRA is a three-step risk assessment completed every three years. It helps communitiesanswer the following questions: What threats and hazards can affect our community?If they occurred, what impacts would those threats and hazards have on our community?Based on those impacts, what capabilities should our community have?The THIRA helps communities understand their risks and determine the level of capability theyneed in order to address those risks. The outputs from this process lay the foundation fordetermining a community’s capability gaps during the SPR process.This section describes the three-step process for developing a THIRA (see Figure 5):Figure 5: There are three steps in the THIRA process.10
THIRA Step 1CPG 201: THIRA/SPR Guide—3rd E
Figure 3: Communities use the THIRA/SPR to answer five key questions. Since 2012, communities have used the THIRA/SPR to answer these questions, helping them better understand the risks their communities face. This helps communities make important decisions on how to prevent, protect against, mitigate, respond to, and recover from the threats
