• Microsoft Word Download

TABLE OF CONTENTS

• 1. SECURITY RISK MANAGEMENT (SRM)
  • 1.1. When referring to SRM
    • 1.1.a. Program risk
    • 1.1.b. Speculative risk
    • 1.1.c. Pure risk
• 2. SRM TEAM

STEP 1

• 3. ASSET IDENTIFICATION
  • 3.1. Identification of the assets to be safeguarded
  • 3.2. Each asset must be identified and quantified
  • 3.3. Until all assets have been identified and quantified the program
  • 3.4. The SRM team determines the specific assets

STEP 2

• 4. DETERMINATION OF THE ASSET CRITICALITY
  • 4.1. Human life
  • 4.2. Specific cost factors
  • 4.3. The "Impact of Loss" formula
  • 4.4. The individual weighting factors

STEP 3

• 5.  ASSIGNING A CRITICALITY RATING

STEP 4

• 5. IDENTIFICATION OF THE THREATS ASSOCIATED WITH EACH ASSET
  • 5.1. All threats to an asset must be identified
  • 5.2. Every threat associated with an asset
  • 5.3. When a loss event does occur
  • 5.4. The threat identification process incorporates

STEP 5

• 6. IDENTIFICATION AND ASSESSMENT OF EXISTING COUNTERMEASURES WITH REFERENCE TO THE IDENTIFIED THREATS.
  • 6.1. Countermeasures are those actions taken to eliminate
  • 6.2. Existing countermeasures must be identified

STEP 6

• 7. ASSIGNMENT OF AN ASSET VULNERABILITY RATING
  • 7.1. Each asset which has been prioritized according to criticality
  • 7.2. Vulnerabilities are those physical, technical, administrative, procedural, or human characteristics
  • 7.3. With regard to any asset the level of risk is directly related to
  • 7.4. An alphabetical rating from "A" through "D" is assigned to each asset

STEP 7

• 8. DETERMINE THE LEVEL OF RISK, (RISK LOGIC).
  • 8.1. At this point in the SRM process each asset
    • 8.1.a. The first designator, numerical designator
    • 8.1.b. The second designator, letter designator
    • 8.1.c. The combinations of the two designators
    • 8.1.d. The assets are reprioritized
  • 8.2. Using the Risk Level Values assigned, each asset is entered into a risk logic matrix as shown below
  • 8.3. Unacceptability and Acceptability – Risk

STEP 8

• 9. DECISION MAKING
  • 9.1. The goal of the SRM process is to provide
  • 9.2. The risk logic matrix presentation permits
  • 9.3. For example, the risk levels reflected in the risk logic table

STEP 9

• 10. USING THE MATRIX
  • 10.1. The term managing risk is significant
  • 10.2. The process can be applied equally effectively to any asset provided
  • 10.3. When the process has been completed to the stage where the risk logic matrix
  • 10.4. This process ensures that the criticality and impact of loss
  • 10.5. Decision makers will be able to use the most cost effective measures that can be employed
  • 10.6. Risk reduction measures include physical modification
  • 10.7. Decision makers shall ensure that established minimum FAA security
  • 10.8. The overall risk severity for a given threat or loss

STEP 10

• 11. DETERMINE APPROPRIATE RISK REDUCTION METHODS AND THEIR ASSOCIATED COSTS.
  • 11.1. Identify all required countermeasures
  • 11.2. Identify cost effective countermeasure alternative approaches

STEP 11

• 12. COST BENEFIT ANALYSIS (CBA).
  • 12.1. All of the essential elements in the SRM process
  • 12.2. CBA shall be applied to the results of the SRM process
  • 12.3. Decision makers use the results of CBA as necessary