U.S. Department of EducationA Guide to SchoolVulnerability AssessmentsKey Principles for Safe SchoolsMn-at igiitrepre ssRecoveryondnPreventi oPrevention- PreparednessPaMitigationeResponse

A Guide to School Vulnerability AssessmentsKey Principles for Safe SchoolsU.S. Department of EducationOffice of Safe and Drug-Free Schools2008

This report was produced under U.S. Department of Education Contract No. ED04-CO-0091 with EMT Associates, Inc., and Macro International Inc. Tara Hillserved as the contracting officer’s technical representative. Sara Strizzi served asthe project manager.U.S. Department of EducationMargaret SpellingsSecretaryOffice of Safe and Drug-Free SchoolsDeborah A. PriceAssistant Deputy SecretaryWilliam ModzeleskiAssociate Assistant Deputy SecretaryThis report is in the public domain, except for the photos in Chapter 6 andAppendix D, which are by Jon Akers and the Kentucky Center for School Safetyand should be used only with permission. Authorization to reproduce the reportin whole or in part is granted. While permission to reprint this publication isnot necessary, the citation for the publication should be: U.S. Department ofEducation, Office of Safe and Drug-Free Schools, A Guide to School VulnerabilityAssessments: Key Principles for Safe Schools, Washington, D.C., 2008.This report is available on the Department’s Web site request, this publication is available in alternate formats, such as Braille, largeprint, or computer diskette. For more information, please contact the Department’sAlternate Format Center at 202-260-0852 or 202-260-0818.

ContentsList of Figures and Tables. ivAcknowledgments. vChapter 1:Introduction. 1An Important Note on ResearchWhat Is a Vulnerability Assessment?Why the Need for Conducting Vulnerability Assessments?Key Elements of a Vulnerability AssessmentChapter 2:Vulnerability Assessment Teams. 9Who Should Be Involved?Meetings and AssessmentsChapter 3:Examples of Hazards and Risks. 13BiologicalCommunityClimate and CultureNaturalPhysical EnvironmentTechnologicalTerrorismCrime and ViolenceChapter 4:Selecting a Vulnerability Assessment Tool. 19Key Issues for ConsiderationChapter 5:Assessing Vulnerabilities. 21Chapter 6:Reporting and Prioritizing Vulnerabilities. 25Chapter 7:Additional Considerations in Vulnerability Assessments. 29School PopulationSchool LocationCommunity ResourcesChapter 8:Review, Revise, and Reassess. 33Chapter 9:Closer Looks. 35References. 39Appendix A:Additional Resources. 43Hazard Links and Assessment ToolsFEMA ResourcesIntegrating People with DisabilitiesCultural DiversitySchool Types and LocationsAppendix B:Vulnerability Assessment Focus Group Participants. 51Appendix C: State Policy Requirements for K–12 School Safety andSecurity Assessments. 57Appendix D:Assessment Example. 61iii

FIGURES AND TABLESFigure 1:Vulnerability Assessment Process. 3Table 1:Risk Index Worksheet. 27iv

ACKNOWLEDGMENTSBronwyn Roberts of EMT Associates provided contract management; Lucinda Austin and CarolFreeman of Macro International provided research coordination and writing support.U.S. Department of EducationOffice of Safe and Drug-Free SchoolsSara StrizziManagement and Program AnalystMichelle SinkgravenManagement and Program AnalystTara HillManagement and Program AnalystYvonne BartoliSenior Policy AdvisorAmy BanksManagement and Program AnalystExternal Reviewer AcknowledgmentsGina KahnRisk Prevention Services CoordinatorHampden-Wilbraham (Mass.) Regional School DistrictDon MercerDirector, Risk Management and SecurityPrince William County (Va.) Public SchoolsMark HarveySenior Policy AdvisorFederal Protective ServiceGregory ThomasDirector, National Center for School Preparedness and PlanningMailman School of Public Health, Columbia Universityv


Vulnerability assessments are an import ant andThis guide is intended to be a companion piece to Practical Information on CrisisPlanning: A Guide for Schools and Communities, originally published by the U.S.Department of Education in 2003 as a guide for schools and districts to prepare for avariety of crises. This guide emphasizes a valuable part of emergency managementplanning—ongoing vulnerability assessment—and is intended to assist schools with theimplementation of an effective vulnerability assessment process, to include choosing anappropriate vulnerability assessment tool.part of school emergency management planning.Vulnerability assessment is the ongoing process for identifying and prioritizing risksto the individual schools and school districts. It also includes designing a system ofaccountability with measurable activities and timelines to address risks. As schoolscontinue to plan and prepare for critical events that could have severe consequences,identifying the appropriate vulnerability assessment tool(s) is an important step forhelping schools to understand what they are at risk from and just how seriously theycould be affected. Schools need to use appropriate tools to capture the relevant dataneeded to inform the development and maintenance of customized plans.talCrises affect schools across the country every day. While natural hazards such astornadoes, floods, hurricanes, and earthquakes may be thought of more commonlyas emergencies, schools are also at risk from other hazards such as school violence,infectious disease, and terrorist threats. Through the vulnerability assessment process,schools can take steps to prevent, mitigate, and lessen the potential impact of theserisks by developing customized district and school emergency management plans incollaboration with community partners. Vulnerability assessments are integral to, ratherthan separate from, the ongoing emergency management activities of school districtsand schools.viChAPTEr 1:introductionVulnerability assessment tools may vary from one school site to another, dependingon variables such as: location, environment, size, and structure, and even studentpopulation and school culture. For example, schools may be located in urban or ruralenvironments, may have limited or greater resources, or may have specific populationswith their own unique needs. As a result, vulnerability assessments must be customizedon an individual district and school basis, taking all of these factors into consideration.This guide is not intended to be prescriptive or to give step-by-step instructions forconducting assessments, rather it is intended to describe the key elements to beconsidered when selecting an assessment tool appropriate for school environmentsand provide guidance for conducting an assessment that will inform school emergencymanagement activities.1

Action Checklist;; Consider forming a vulnerability assessment teamcomposed of varied district, school, and communitymembers that could help to identify hazards and whomight be involved in responding to an emergency.;; Develop a timeline for ongoing regular assessments.;; Brainstorm potential hazards that could impactschool districts, schools, communities, andgeographic locations, such as, biological (e.g.,diseases), community, physical environment, natural,technological, terrorism, and violence hazards.;; Identify other considerations that impact school anddistrict vulnerability, including school populations,locations, and resources.;; Select an assessment tool to evaluate schoolvulnerabilities.;; Determine the district and school’s individual riskto hazards through data review, research intopast incidents, surveying community and studentpopulations, and using the assessment tool to identifyvulnerabilities as well as areas for improvement.;; Compile information gained from the vulnerabilityassessment and determine risk priorities.;; Report findings of vulnerability assessment to informand update the Prevention-Mitigation phase ofemergency management planning.ü;; Create a prioritized action plan based on thefindings of the vulnerability assessment, including asystem of accountability for implementation of anyrecommendations.;; Review, revise, and reassess the assessment process(see Figure 1).2

Figure 1: Vulnerability Assessment Process3

AN IMPORTANT NOTE ON RESEARCHAs with overall school emergency management planning, we lack extensive dataand conclusive evidence on best practices for school vulnerability assessments.However, experience shows that there are certain key prevention and mitigationstrategies important for all schools to consider. In addition, when conducting avulnerability assessment, schools are encouraged to focus on a holistic approach,that is to consider all possible hazards and identify the greatest risks and priorities.Much of the information in this guide draws from what is known about vulnerabilityassessments in many settings, as well as what is known specifically about the uniquecharacteristics of districts and schools.In October 2006, the Department of Education conducted focus groups with safeschool planning and preparedness coordinators, policy makers, scholars, and otherspecialists in the field (see Appendix B) to gather their thoughts and insights onvulnerability assessments. This guide incorporates recommendations from this panelas well as other specialists in the field.WHAT IS A VULNERABILITY ASSESSMENT?Vulnerability assessment is the ongoing process through which school districts andschools identify and evaluate potential risks and areas of weakness that could haveadverse consequences for schools and school systems. Vulnerability assessments arean important and vital part of school emergency management planning. This guidefocuses specifically on vulnerability assessments as an all-hazards assessment forexamining risks, needs, and threats. A vulnerability assessment focuses on a particularschool’s susceptibility to specific threats or hazards and how those weaknessesor threats might be mitigated through emergency management. Vulnerabilityassessments should be used to inform all four of the interconnected phases ofemergency management (Prevention-Mitigation, Preparedness, Response, andRecovery) but will serve as an especially significant component of the preventionmitigation phase of emergency management to help determine which areas should bepriorities of focus.Many other terms are used in relation to assessment such as needs assessments, threatassessments, risk analysis, safety and security audits, hazards assessments, and facilitiesassessments. Each one of these terms can have its own meaning, depending on thecontext in which it is used. Some of these types of assessments—such as safety andsecurity audits and facilities assessments—focus only on specific aspects or areas ofvulnerability.4

Examples of specific types of assessments include: Needs assessment, (often used interchangeably with vulnerability assessment)commonly refers to an assessment done to identify gaps or areas needingimprovement and to determine unmet needs, but not necessarily allvulnerabilities or potential threats. In a research article on creating safe schools,Pollack and Sundermann1 stated, “A needs assessment will point out thenature and extent of problems, identify existing efforts and activities, and helpestablish the school’s priorities.” Hazards assessments focus on general hazards and determining which hazardsa school might be prone to, for example, proximity to natural or man-madeelements. Threat assessments also focus on hazards that could potentially threaten theschool but have generally been used in assessing students or outsiders whomay pose a threat to other students or themselves within the school throughmeans of violence. The 2002 publication of Threat Assessment in Schools: AGuide to Managing Threatening Situations and to Creating Safe School Climatesby the Secret Service and the Department of Education discusses threatassessments in relation to school violence and school safety. Consequence assessments aim to assess potential consequences that schoolsmight face as a result of a hazard or risk. Consequences are any negativeoutcomes or effects on schools that may occur in the event of an emergency. Risk analysis usually focuses on the calculation of specific risk levels todetermine how vulnerable schools would be to specific threats or whatspecific consequences schools could face in the event of crisis and how severethese consequences might be. Generally a risk analysis is conducted afterspecific hazards and threats are identified.This guide to vulnerability assessment encompasses all of these areas of assessmentand uses vulnerability assessment as a comprehensive term, including assessments ofhazards, threats, consequences, and risk analysis, as well as needs that result from theseassessments. This definition of vulnerability assessments is designed to coordinate withbest practices adopted by the Department of Homeland Security’s (DHS’) NationalInfrastructure Protection Plan (NIPP) as a model for identifying, understanding,and strategically managing potential risks and threats. Since 2006, the Departmentof Education’s Office of Safe and Drug-Free Schools has been involved in criticalinfrastructure protection for education facilities in relation to DHS’ NIPP. The NIPPfocuses on assessing risks and identifies risk as a function of consequence, vulnerability,and threat. These are discussed in the following text box.1 ollack, I., and Sundermann, C. (2001). “Creating safe schools: A comprehensive approach. “ Juvenile Justice,P8 (1), 13–20 Retrieved January 21, 2003, from 2001 6/jj2.html.5

The Department of Homeland Security’s (DHS’) National Infrastructure Protection Plan(NIPP) is designed to provide a coordinated approach to establish national priorities, goalsand requirements for the protection of critical infrastructure. This is done to help ensurethe effective application of federal funding and resources to reduce vulnerability, deterthreats and minimize consequences of attacks and other incidents. The NIPP is based on arisk-management framework, which establishes the process for combining consequence,vulnerability, and threat information to produce an assessment of risk that informsprotection activities.DHS’ NIPP focuses on assessing risks. In the context of homeland security, the NIPP identifiesrisk as a function of consequence, vulnerability, and threat. Each of these are defined by theNIPP as follows:THREAT: “The likelihood that a particular asset, system, or network will suffer an attack oran incident. In the context of risk from terrorist attack, the estimate of this is based on theanalysis of the intent and the capability of an adversary. In the context of natural disaster oraccident, the likelihood is based on the probability of occurrence.”VULNERABILITY: “The likelihood that a characteristic of, or flaw in, an asset, system, ornetwork’s design, location, security posture, process, or operation renders it susceptible todestruction, incapacitation, or exploitation by terrorist or other intentional acts, mechanicalfailures, and natural hazards.”CONSEQUENCE: “The negative effects on public health and safety, the economy, publicconfidence in institutions, and the functioning of government, both direct and indirect,that can be expected if an asset, system, or network is damaged, destroyed, or disruptedby a terrorist attack, natural disaster, or other incident.” [U.S. Department of HomelandSecurity, National Infrastructure Protection Plan, (NIPP), 2006, p. 35.](For more information, the NIPP is available online at: Plan.pdf.)Typically, schools refer to risk assessments in the school community as vulnerabilityassessments. For schools, vulnerability assessments should provide a comprehensive profileof the variety of hazards facing a particular entity. Therefore, vulnerability assessments arenot separate from, but rather a key component of, school emergency management.The three elements of the DHS model can be applied to schools as follows:1—Assessing risk: Identifying the hazards that could potentially affect a school or that makea school more susceptible to hazards and how likely it is that each hazard could occur. Forschools, this could include a variety of natural (e.g., hurricane, earthquake, wildfire, flood,tornado) or man-made (e.g., chemical spill, active shooter, arson, etc.) hazards.2—Assessing vulnerabilities: Determining the characteristics of the school that aresusceptible to hazards. Such assessments identify areas of weakness that could result in avariety of undesirable consequences for the school and the community. For schools, thiscould include elements of a school’s structure, procedures, equipment, systems, grounds,surroundings, etc.3—Assessing consequence: Measuring the range of loss or damage that could occur from theimpact of an incident. For schools, this could include, but not be limited to, the disruptionof the social and physical learning environment—whether short or long term—and subsequentpsychological impact on the school community, the community at large, public confidenceand morale, and potential economic impacts.This application of the three DHS elements is just one example of considerations whenchoosing an assessment for schools.6

WHY THE NEEDFOR CONDUCTINGVULNERABILITYASSESSMENTS?As listed in the Practical Information onCrisis Planning: A Guide for Schools andCommunities, vulnerability assessmentsare an integral part of the preventionmitigation phase of emergencymanagement. Before taking actionand actually conducting emergencymanagement activities, schools must knowfor which hazards they are most likely atrisk. Through assessing vulnerabilities,schools can work with partners to identify,correct, and prevent problems as wellas foster advance communication withpopulations that would be involved in acrisis situation such as students, schoolpersonnel, first responders, and othercommunity partners. School assessmentsshould not happen in isolation, but insteadshould occur in the context of communityassessments and in coordination withcommunity partners, which can build acommunitywide commitment to saferschools.Assessments are connected to all phases ofemergency management and can help tobuild customized planning. Specifically,vulnerability assessments can help schoolsidentify and prioritize what actions theyshould take to mitigate or prevent potentialhazards that might impact the school.Vulnerability assessments can also assistwith other phases of emergency planningby helping schools to better understandHow Assessments Promote SafetyExample 1An elementary school in a large Midwesterncitya experienced the need for a chemicalhazards response when a school staff memberlearned from a former teacher that mercuryhad been spilled in a classroom seven yearsago but was never reported. The currentteacher then reported the incident. Uponinspection, elevated levels of mercury werefound in the classroom and correctiveactions were taken. Vulnerability assessmentscan assist in situations such as these whenconsistent surveys of school personnel andstudents along with assessment of chemicalmanagement can help to identify problemareas in a timely manner.Example 2After an assessment of schools in Seattlethat had been impacted by earthquakes,bnonstructural hazards were identifiedthat contributed to earthquake damageand school risk. As part of Seattle ProjectImpact, initiated by FEMA, these lessonslearned were incorporated to make changesin non-structural elements within schools.These non-structural hazards included issuessuch as restraints for heavy objects suchas bookshelves or desktop equipment. Byusing the checklists developed for schoolsfrom these lessons learned, schools can assesstheir own risks and identify nonstructuralhazards that could impact a school duringthe event of an earthquake and can decreasethe resulting risk to health and safety of theschool population.U.S. Department of Education, Readiness andEmergency Management for Schools TechnicalAssistance Center. (2007). Incorporating ChemicalHazards into an Emergency Management Plan, 2(4).a Seattle Public Schools (2000). School Facilities ManualNonstructural Protection Guide: Safer Schools EarthquakeHazards Nonstructural, Lessons Learned Seattle SchoolDistrict. Accessed at:b Schools/assets/NonStructuralGuide.pdf.7

school and community populations and their needs as well as the actual schoolstructure, grounds, and surrounding community, allowing schools to take specificactions based on the needs and vulnerabilities identified.KEY ELEMENTS OF A VULNERABILITY ASSESSMENTAlthough schools and school districts maintain different approaches to vulnerabilityassessments, there are certain elements that can help to make a vulnerabilityassessment stronger. These include: tilizing a team assessment approach to bring a variety of perspectives to theUassessment process Ensuring that schools consider all potential hazards that might affect theschool and surrounding community—including areas in which students haveto travel to and from school Understanding and inventorying not only vulnerabilities but also the existingresources and capabilities available to prevent or mitigate the impact of avulnerability Conducting a walk-through of school grounds and facilities, surveying theschool population and community about potential hazards, and looking atexisting crime and school incidence data Reporting on the findings identified in the assessment, developing correctiveactions and accountabilities, and using the findings to inform and updateemergency management plansMore information about these key elements is highlighted throughout the followingsections of this document.8

A team approach provides a variety of perspectivesVulnerability assessment teams are an important part of creating a unified andcomprehensive effort for assessing risks and hazards. Teams can be used to establishgoals and objectives for assessment, develop a timeline for assessments, assign rolesand responsibilities for next steps, monitor progress on action items, and update andrevise assessments as needed. A team approach provides districts and schools witha variety of perspectives from the individuals who recognize and can best assess theday-to-day hazards and risks that could affect schools.Action Checklist;; Identify individuals who are knowledgeable about differentareas of the district, school and the surrounding community.;; Identify individuals from district, school and partner agencieswho are knowledgeable about school hazards and emergencymanagement.;; Form a vulnerability assessment team from among a varietyof these individuals.;; Create clear goals and develop a plan for the team.;; Develop a timeline for consistent team meetings and followup assessments.WHO SHOULD BE INVOLVED?Vulnerability assessment teams may be formed at the school district level, the schoollevel, or a combination of both. There are potential advantages to each of thesearrangements. If teams are formed at the district level, a standardized vulnerabilityassessment process can be created that can then be tailored to assess individualschools. Coordination of the vulnerability assessment process at a district level canhelp schools to avoid duplication of efforts and save time and resources. Districtcoordination will also typically convey an organizational framework of support thatwill make the process more meaningful and more likely to be sustained over time. Ifassessments teams are formed at the district level, however, caution should be takento ensure that individual schools still have input into or leadership of the assessmentprocess at their own locations. Forming an assessment team at the school level givesschools more individual control over their own assessment process and may allowm individuals who can best assess the day-to-day hazards that could affect schools.froCHAPTER 2:VULNERABILITY ASSESSMENT TEAMS9

assessments to be tailored more on an individual school basis. If assessment teams areformed at the school level, however, schools should make sure that they complyingwith any district level policies or procedures and communicating their findings backto the district level.Involve a wide variety of individuals in the assessment process. Createvulnerability assessment teams composed of varied district, school, and communitymembers with expertise in a variety of related fields. Teams should consist ofmembers of the community that could help to identify hazards and might beinvolved in a crisis response if a hazard or disaster were to occur. Vulnerabilityassessment teams should provide multiple perspectives based on a wide variety ofexperiences, which can foster better identification of the wide range of hazardspotentially affecting a school and its students, staff, and visitors. Once a teamhas been established, consider soliciting input from individuals who might haveknowledge of specific areas affecting the school such as: School building and grounds staffResidents of the surrounding neighborhoodResidents of the larger communityStudentsParents of studentsPublic safety officialsRegardless of the individuals chosen for vulnerability assessment teams, keep the linesof communication open with as many groups who represent or can support diverseaspects of the school and community as possible.Administrators such as principals or district representatives can serve as leadersin vulnerability assessment efforts and facilitate formation of teams by selectingand coordinating or supporting team members. Administrators may haveinfluence over policy that could affect vulnerabilities and can help to secure funds forassessments and changes to be implemented as a result of the assessment that mightotherwise be hard to procure.10School personnel such as general and special educators, school resource officers,security officers, administrators, school nurses, clerical and reception staff,paraprofessionals, guidance counselors, coaches, cafeteria and facilities staff, andbus drivers can provide valuable input into the daily occurrences within schools.While all of these individuals may not be members of the vulnerability assessmentteam, ensuring that a variety of school personnel are involved and have input canprovide a more comprehensive assessment approach. If these individuals are not partof the team, team members should reach out to them for their insight into specific

vulnerabilities, for example: S chool resource officers or school security officers should also be involvedin the assessment process as they have firsthand knowledge of many of theschool’s vulnerabilities as well as experience in responding to incidents. Teachers may be able to attest more to hazards and vulnerabilities amongstudents and in the classroom. Facilities personnel can recognize structural and property hazards and dangersand can also gauge the prevalence of risk indicators such as graffiti, vandalism,or carelessly disposed alcohol beverage containers. Counselors may be more familiar with emotional and mental healthchallenges within specific student populations. Bus drivers will be more familiar with hazards students face along schoolroutes. School nurses may be more familiar with biological or health issues andchallenges. Teachers within specific areas may be able to contribute differently toassessments: special education teachers would be able to provide informationon how hazards might impact students with special needs or disabilities, whilescience teachers may know more about identifying chemical hazards in theirlabs or classrooms.Involve members of the community outside of the school. Teams should alsoinclude key community partners such as law enforcement officials, local governmentofficials, the local first responders, and public and mental health practitioners.Emergency management professionals such as law enforcement officers, firedepartment professionals, and emergency medical services personnel have experienceresponding to crises and can help toAssessing Community Hazardsidentify hazards that might occur at theschool or in the community around theCapistrano Unified School Districtschool and explain how those hazardsAs mentioned here, schools should workmight impact the school. Buildingwith members of the local community toinspectors can help to identify structuralassess community hazards. The Capistranoor building grounds hazards and violations Unified School District (USD) in SanJuan Capistrano, Calif., worked with theof building codes, and fire personnel cancommunity in their hazard assessment andhelp to identify potential fire hazards asplanning. Because the San Onofre Nuclearwell as violations of fire codes. Other local Power Pl

planning—ongoing vulnerability assessment—and is intended to assist schools with the implementation of an effective vulnerability assessment process, to include choosing an appropriate vulnerability assessment tool. Vulnerability assessment