2 pages

As we learned after reading the Comprehensive Preparedness Guide (CPG201): “Threat and Hazard Identification and Risk Assessment (THIRA)”, evaluating a community’s capability to

 

withstand a major event or incident can be estimated by completing the following four step process:

1. Identify the Threats and Hazards of Concern. Based on a combination of experience, forecasting, subject matter expertise, and other available resources, identify a list of the threats and hazards of primary concern to the community.

2. Give the Threats and Hazards Context. Describe the threats and hazards of concern, showing how they may affect the community.

3. Establish Capability Targets. Assess each threat and hazard in context to develop a specific capability target for each core capability identified in the National Preparedness Goal. The capability target defines success for the capability.

4. Apply the Results. For each core capability, estimate the resources required to achieve the capability targets through the use of community assets and mutual aid, while also considering preparedness activities, including mitigation opportunities.

 

Submission Instructions – You must use both of the below documents:

Using the 

Threat and Hazard Identification and Risk Assessment (THIRA) Form

, identify and discuss five (5) hazards that would have a significant affect on your community; use the above Form to do so. Use your best estimate for all 4 steps based on the instructions located from Page 5 to 18 in the 

Comprehensive Preparedness Guide (CPG201): Threat and Hazard Identification and Risk Assessment

. Submit the 5 hazards and four steps you completed for each one.

Note my community is Melboure Florida Unites states, so that’s what the information must be on. 2 page.

Threat and Hazard Identification and Risk Assessment

				Threat/Hazard:
				Context Description: (Describe the threat/hazard)
				CORE CAPABILITY:
				Capability Target
				Resource Requirement
				Resources					Number Required

Threat and Hazard Identification and Risk Assessment

Threat/Hazard:

Context Description: (Describe the threat/hazard)

CORE CAPABILITY:

Capability Target

Resource Requirement

Resources

Number Required

Threat and Hazard Identification and Risk Assessment

Threat/Hazard:

Context Description: (Describe the threat/hazard)

CORE CAPABILITY:

Capability Target

Resource Requirement

Resources

Number Required

Threat and Hazard Identification and Risk Assessment

Threat/Hazard:

Context Description: (Describe the threat/hazard)

CORE CAPABILITY:

Capability Target

Resource Requirement

Resources

Number Required

Threat and Hazard Identification and Risk Assessment

Threat/Hazard:

Context Description: (Describe the threat/hazard)

CORE CAPABILITY:

Capability Target

Resource Requirement

Resources

Number Required

1

Threat and Hazard Identification
and Risk Assessment Guide
Comprehensive Preparedness Guide (CPG) 201

Second Edition
August 2013

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

T a b l e o f C o n t e n t s

Forward

…………………………………………………………………………………………………………..

1

Overview

………………………………………………………………………………………………………… 1
THIRA Process………………………………………………………………………………………………………….1
Relationship to Other Risk Assessments……………………………………………………………………..

2

Core Capabilities ……………………………………………………………………………………………………….2
National Preparedness System……………………………………………………………………………………3
Whole Community Involvement …………………………………………………………………………………

4

Updating Previous THIRAs ……………………………………………………………………………………….5

Step 1: Identify the Threats and Hazards of Concern

…………………………………………

5

Types of Threats and Hazards ……………………………………………………………………………………5
Sources of Threat and Hazard Information ………………………………………………………………..

6

Factors for Selecting Threats and Hazards …………………………………………………………………7
Step 1 Output…………………………………………………………………………………………………………….

8

Step 2: Give the Threats and Hazards Context

…………………………………………………..

9

Context Description: Factors to Consider …………………………………………………………………..9
Examples of Context Descriptions …………………………………………………………………………….

10

Step 2 Output…………………………………………………………………………………………………………..10

Step 3: Establish Capability Targets

………………………………………………………………. 10
Impacts and Desired Outcomes ………………………………………………………………………………..11
Developing Capability Targets …………………………………………………………………………………

12

Example Capability Target ………………………………………………………………………………………

14

Step 3 Output…………………………………………………………………………………………………………..14

Step 4: Apply the Results

………………………………………………………………………………. 14
Capability Estimation ………………………………………………………………………………………………15
Resource Typing………………………………………………………………………………………………………

16

Example of a Completed THIRA ……………………………………………………………………………..

18

i

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Applying the THIRA Results to Resource Allocation Decisions and Preparedness
Activities………………………………………………………………………………………………………………….18
Step 4 Output…………………………………………………………………………………………………………..

20

Conclusion

……………………………………………………………………………………………………. 20

Appendix A: THIRA Template

……………………………………………………………………….

A-1

Appendix B: Glossary

…………………………………………………………………………………..

B-1

ii

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

F o r w a r d
Comprehensive Preparedness Guide (CPG) 201, Second Edition provides communities
additional guidance for conducting a Threat and Hazard Identification and Risk Assessment
(THIRA). The First Edition of this Guide (April 2012) presented the basic steps of the

THIRA

process. Specifically, the First Edition described a standard process for identifying community-
specific threats and hazards and setting capability targets for each core capability identified in the
National Preparedness Goal as required in Presidential Policy Directive (PPD) 8: National
Preparedness.1

This Second Edition expands the THIRA process to include estimation of resources needed to
meet the capability targets. The Second Edition also reflects other changes to the THIRA process
based on stakeholder feedback, such as streamlining the number of steps to conduct a THIRA
and providing additional examples. Where appropriate, this Guide highlights key changes from
the First Edition of CPG 201. This Second Edition supersedes the First Edition of CPG 201.

O v e r v i e w
Every community should understand the risks it faces. By understanding its risks, a community
can make smart decisions about how to manage risk, including developing needed capabilities.
Risk is the potential for an unwanted outcome resulting from an incident, event, or occurrence, as
determined by its likelihood and the associated consequences.2 By considering changes to these
elements, a community can understand how to best manage and plan for its greatest risks across
the full range of the threats and hazards it faces. The THIRA process helps communities identify
capability targets and resource requirements necessary to address anticipated and unanticipated
risks.

T H I R A P r o c e s s
This Guide describes a four-step process for developing a THIRA:

1. Identify the Threats and Hazards of Concern. Based on a combination of experience,
forecasting, subject matter expertise, and other available resources, identify a list of the
threats and hazards of primary concern to the community.

2. Give the Threats and Hazards Context. Describe the threats and hazards of concern,
showing how they may affect the community.

3. Establish Capability Targets. Assess each threat and hazard in context to develop a specific
capability target for each core capability identified in the National Preparedness Goal. The
capability target defines success for the capability.

4. Apply the Results. For each core capability, estimate the resources required to achieve the
capability targets through the use of community assets and mutual aid, while also considering
preparedness activities, including mitigation opportunities.

1 For additional information on the National Preparedness Goal please visit http://www.fema.gov/national-
preparedness.
2 DHS Risk Lexicon, June 2013.

1

http://www.fema.gov/national-preparedness

http://www.fema.gov/national-preparedness

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

The THIRA process is flexible and scalable and will work for communities of all sizes.
Communities can adapt these four steps, illustrated in Figure 1, to meet their specific needs and
resources.

Figure 1: The THIRA Process

R e l a t i o n s h i p t o O t h e r R i s k A s s e s s m e n t s
The THIRA process standardizes the risk analysis process that emergency managers and
homeland security professionals use every day through the normal course of their work. The
THIRA process builds on existing local, state, tribal, territorial Hazard Identification and Risk
Assessments (HIRAs) by:

 Broadening the threats and hazards considered to include human-caused threats and
technological hazards

 Incorporating the whole community into the planning process, including individuals;
families; businesses; faith-based and community organizations; nonprofit groups; schools
and academia; media outlets; and all levels of government, including local, state, tribal,
territorial, and Federal partners

 Providing increased flexibility to account for community-specific factors.

C o r e C a p a b i l i t i e s
Communities use the core capabilities described in the National Preparedness Goal to organize
their capability targets in the THIRA process (see Table 1). The core capabilities provide a
common language for preparedness across the whole community. The core capabilities are
relevant to all five preparedness mission areas:

 Prevention: Prevent, avoid, or stop an imminent, threatened, or actual act of terrorism.
 Protection: Protect our citizens, residents, visitors, and assets against the greatest threats and

hazards in a manner that allows our interests, aspirations, and way of life to thrive.

 Mitigation: Reduce the loss of life and property by lessening the impact of future disasters.
 Response: Respond quickly to save lives; protect property and the environment; and meet

basic human needs in the aftermath of a catastrophic incident.

2

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

 Recovery: Recover through a focus on the timely restoration, strengthening, and
revitalization of infrastructure, housing, and a sustainable economy, as well as the health,
social, cultural, historic, and environmental fabric of communities affected by a catastrophic
incident.

Table 1: Core Capabilities by Mission Area3

Prevention Protection Mitigation Response Recovery

Planning

Public Information and Warning

Operational Coordination

Forensics and
Attribution
Intelligence and
Information
Sharing
Interdiction and
Disruption
Screening, Search,
and Detection

Access Control
and Identity
Verification
Cybersecurity
Intelligence and
Information
Sharing
Interdiction and
Disruption
Physical
Protective
Measures
Risk Management
for Protection
Programs and
Activities
Screening,
Search, and
Detection
Supply Chain
Integrity and
Security

Community
Resilience
Long-term
Vulnerability
Reduction
Risk and Disaster
Resilience
Assessment
Threats and
Hazard
Identification

Critical Transportation
Environmental
Response/
Health and Safety
Fatality Management
Services
Infrastructure
Systems
Mass Care Services
Mass Search and
Rescue Operations
On-scene Security
and Protection
Operational
Communications
Public and Private
Services and
Resources
Public Health and
Medical Services
Situational
Assessment

Economic
Recovery
Health and Social
Services
Housing
Infrastructure
Systems
Natural and
Cultural Resources

N a t i o n a l P r e p a r e d n e s s S y s t e m
The National Preparedness System is the instrument the Nation employs to build, sustain, and
deliver the core capabilities in order to achieve the goal of a secure and resilient Nation. Figure 2
illustrates the six components of the National Preparedness System.4

3 Planning, Public Information and Warning, and Operational Coordination are core capabilities common to all
mission areas.
4 For additional information on the National Preparedness System please visit http://www.fema.gov/national-
preparedness.

3

http://www.fema.gov/national-preparedness-system

http://www.fema.gov/national-preparedness

http://www.fema.gov/national-preparedness

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Figure 2: Components of the National Preparedness System

The THIRA process supports the first two components of the National Preparedness System:

1. Identifying and Assessing Risk
2. Estimating Capability Requirements.
The THIRA process helps communities answer the following questions:

 What does the community need to prepare for?
 What resources are required in order to be prepared?
 What actions (e.g., mitigation activities) could be employed to lessen or eliminate the threat

or hazard?

 What impacts need to be incorporated into the community’s recovery preparedness planning?
The results of the THIRA process form the foundation for subsequent National Preparedness
System activities.

W h o l e C o m m u n i t y I n v o l v e m e n t
Developing an effective THIRA requires active involvement from the whole community.
Recognizing that preparedness is a shared responsibility, the National Preparedness System calls
for the involvement of everyone—not just government agencies—in preparedness efforts. When
developing and updating THIRAs, jurisdictions should ensure their assessment and planning
effort includes representatives and perspectives of the whole community. An informed public is
the best advocate for building and sustaining required capabilities and creating a secure and
resilient community.

Experience from the first year of THIRA implementation shows the importance of whole
community involvement. THIRAs developed with whole community involvement are more
comprehensive and measurable.

4

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

U p d a t i n g P r e v i o u s T H I R A s
When reviewing, revising, or updating an existing THIRA, jurisdictions should examine the
success and/or limitations of previous whole community engagement. In particular, jurisdictions
should assess whether partners representing the five preparedness mission areas and 31 core
capabilities participated. Communities are encouraged to engage representatives from different
homeland security and public safety disciplines and from outside government.

For each subsequent THIRA update, communities should also review how the threat and hazard
landscape has changed. In particular, consider the inclusion of new or emerging threats and
hazards, to include future risks (Step 1); updating threat and hazard context descriptions based on
demographic factors (Step 2); and revising capability targets based on current capability levels
(Step 3). Communities should refine resource requirements (Step 4) based on changes made in
previous steps and review how successful preparedness measures, such as protection or
mitigation efforts, affect their THIRAs.

S t e p 1 : I d e n t i f y t h e T h r e a t s a n d H a z a r d s o f
C o n c e r n
In Step 1 of the THIRA process, communities develop a list of community-specific threats and
hazards. This section:

 Defines the types of threats and hazards that communities should consider
 Introduces sources of threat and hazard information
 Describes factors to consider when selecting threats and hazards for inclusion in the

THIRA

 Provides guidance on updating previous THIRA submissions.

Figure 3: Step 1 of the THIRA Process

T y p e s o f T h r e a t s a n d H a z a r d s
Communities face a variety of threats and hazards. The three types of threats and hazards are:

 Natural hazards, which result from acts of nature, such as hurricanes, earthquakes,
tornadoes, animal disease outbreak, pandemics, or epidemics.

5

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

 Technological hazards, which result from accidents or the failures of systems and
structures, such as hazardous materials spills or dam failures.

 Human-caused incidents, which result from the intentional actions of an adversary, such as
a threatened or actual chemical attack, biological attack, or cyber incident.

Table 2 provides examples of each type of threats and hazards.
Table 2: Example Threats and Hazards

Natural Technological Human-caused
 Avalanche
 Animal disease outbreak
 Drought
 Earthquake
 Epidemic
 Flood
 Hurricane
 Landslide
 Pandemic
 Tornado
 Tsunami
 Volcanic eruption
 Wildfire
 Winter storm

 Airplane crash
 Dam failure
 Levee failure
 Mine accident
 Hazardous materials

release
 Power failure
 Radiological release
 Train derailment
 Urban conflagration

 Biological attack
 Chemical attack
 Cyber incident
 Explosives attack
 Radiological attack
 Sabotage
 School and workplace

violence

S o u r c e s o f T h r e a t a n d H a z a r d I n f o r m a t i o n
Communities should consult a number of sources to identify threats and hazards during the
THIRA process. These sources may include:

 State and local homeland security and emergency management laws, plans, policies, and
procedures

 Existing threat and hazard assessments (e.g., HIRAs)
 Records from previous incidents, including historical data
 Local, regional, and neighboring community THIRAs
 Analysis of critical infrastructure interdependencies, including disruptions and failures that

may originate elsewhere but produce cascading effects experienced locally (e.g., an electrical
power disruption that spreads both geographically and across sectors)

 Intelligence fusion center bulletins and assessments
 Whole community partners, such as:

• Emergency management/homeland security agencies

• Local and state hazard mitigation offices

• Local or Regional National Weather Service offices

6

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

• Tribal governments

• Federal Emergency Management Agency (FEMA) Regional Offices

• Private-sector partners

• Local/state fire, police, emergency medical services, and health departments

• Major urban area and state fusion centers

• Infrastructure owners and operators

• U.S. Department of Homeland Security (DHS) Protective Security Advisors

• DHS Regional Cyber Security Analysts

• Volunteer Organizations Active in Disasters

• Colleges/universities, and other research organizations.

Additional Online Sources of Threat and Hazard Information

 National Oceanic and Atmospheric Administration (NOAA) Areal Locations of Hazardous
Atmospheres (http://response.restoration.noaa.gov/aloha)

 DHS OneView (https://gii.dhs.gov/OneView)

 FEMA Hazus-MH (http://www.fema.gov/hazus)

 FEMA Hurrevac (http://www.hurrevac.com)

 U.S. Department of Energy LandScan (http://web.ornl.gov/sci/landscan)

 National Weather Service Sea, Lake and Overland Surges from Hurricanes
(http://www.nhc.noaa.gov/surge/slosh.php)

 NOAA Sea Level Rise and Coastal Flooding Viewer (http://csc.noaa.gov/digitalcoast/tools/slrviewer)

 U.S. Army Corps of Engineers Debris Model
(http://eportal.usace.army.mil/sites/ENGLink/DebrisManagement/default.aspx)

 FEMA Full-Spectrum Risk Knowledgebase (https://riskknowledge.fema.gov)

 FEMA Lessons Learned Information Sharing (https://www.llis.dhs.gov)

F a c t o r s f o r S e l e c t i n g T h r e a t s a n d H a z a r d s
Communities should include only those threats and hazards of significant concern in their
THIRA. To identify threats and hazards of significant concern, consider two key factors:
likelihood of incident and significance of threat/hazard effects.

Factor #1: Likelihood of Incident
Likelihood is the chance of something happening, whether defined, measured, or estimated
objectively or subjectively. Communities should consider only those threats and hazards
that could plausibly occur.
As a starting point, communities should consider the threats and hazards that have historically
affected them, as well as those threats and hazards that exist regardless of historical occurrence
(e.g., earthquakes, industrial accidents, or intelligence-driven assessments of potential terrorist
attacks). This should include analyzing after-action reports and information about the root causes
of threats and hazards (e.g., major floods caused by inadequate levees), as well as consultation

7

http://response.restoration.noaa.gov/aloha

https://gii.dhs.gov/OneView

http://www.fema.gov/hazus

Home

http://web.ornl.gov/sci/landscan

http://www.nhc.noaa.gov/surge/slosh.php

http://csc.noaa.gov/digitalcoast/tools/slrviewer

http://eportal.usace.army.mil/sites/ENGLink/DebrisManagement/default.aspx

https://riskknowledge.fema.gov/

https://www.llis.dhs.gov/

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

with scientists and appropriate subject matter experts. Communities may also consider looking at
historical archives (e.g., at the local library) for reports of disasters in the community.

For threats and hazards for which it is difficult to estimate the likelihood of an incident (e.g.,
terrorism), communities should consider available intelligence data to determine inclusion in the
THIRA. Engaging state/local law enforcement or a major urban area or state fusion center can
provide the necessary insight into these types of events in order to focus on plausible threats.
Local public health and medical personnel can also offer insight about health-related concerns
such as pandemics.

Communities should take care to not over-rely on historical averages or patterns that may give a
false sense of likelihood. For example, many severe natural hazards (such as earthquakes or
floods) occur with such low frequency that relying on historical records alone may be
misleading. High-magnitude earthquakes, though rare, can have severe consequences and
therefore should be considered if the community is at risk for earthquake damage. Communities
should also consider the threats and hazards that similar communities include in their planning
processes or have recently responded to.

The scale and severity of disasters are growing and will likely pose systemic threats. Increasing
changes in demographic trends and technology are making the effects of disasters more complex
to manage. Population shifts to vulnerable areas and other demographic changes will affect
future disaster management activities and should be considered when selecting threats and
hazards.

Factor #2: Significance of Threat/Hazard Effects
The threat/hazard effects represent the overall impacts to the community. Communities should
consider only those threats and hazards that would have a significant effect on them.
Consider that different incidents present different types of challenges. In some cases the sheer
magnitude of the incident may be substantial; others may involve coordination complexities,
political sensitivities, or economic and social challenges.

Communities should not limit their THIRA to threats and hazards that they would be able to
manage, but should also consider threats and hazards resulting in large-scale disasters or
catastrophic incidents. Conversely, communities should exclude from the THIRA threats and
hazards with only minor impacts, regardless of likelihood.

Although incidents may have wider regional or national effects, communities should focus
strictly on the impacts within their jurisdiction. In some cases, it may be useful to include threats
and hazards that occur in other locations if they trigger local effects. For example, an industrial
accident at a chemical plant located in one particular community could affect people in another
community who are downwind from the accident.

S t e p 1 O u t p u t
The output of Step 1 is a list of the community’s threats and hazards of concern. These threats
and hazards will serve as the basis for Step 2.

8

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

S t e p 2 : G i v e t h e T h r e a t s a n d H a z a r d s C o n t e x t
In Step 2 of the THIRA, communities add context descriptions to each threat and hazard
identified in Step 1. Context descriptions outline the conditions, including time and location,
under which a threat or hazard might occur. This section:

 Identifies factors to consider when developing context descriptions
 Provides examples of a completed threat/hazard context description.

Figure 4: Step 2 of the THIRA Process

C o n t e x t D e s c r i p t i o n : F a c t o r s t o C o n s i d e r
To develop threat and hazard context descriptions, communities should take into account the
time, place, and conditions in which threats or hazards might occur. Communities can use
expert judgment or analysis of probability and statistics to inform the descriptions of the different
threat and hazard conditions. Consider the following types of questions when developing context
for each threat and hazard:

 How would the timing of an incident affect the community’s ability to manage it? What time
of day and what season would be most likely or have the greatest impacts?

 How would the location of an incident affect the community’s ability to manage it? Which
locations would be most likely or have the greatest impacts? Populated areas? Coastal zones?
Industrial or residential areas?

 What other conditions or circumstances make the threat or hazard of particular concern?
Atmospheric conditions (e.g., wind speed/direction, relative humidity)? Multiple events
occurring at the same time?

Threats and hazards can have different impacts depending on the time, place, and conditions in
which they occur. As such, communities may need to develop more than one context description
for a threat or hazard. For example, a hurricane-prone community may need multiple context
descriptions to account for varying storm intensities, landfall locations, and landfall times.

For any given community, there are countless combinations of threat and hazard conditions that
lead to slightly different contexts. Communities need not consider every combination; rather they
should include those details that affect what the community needs to be prepared for. For
example, a jurisdiction identified an Enhanced-Fujita Scale 3 tornado as a hazard in Step 1. The

9

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

jurisdiction should consider the time of day and the path of the tornado when developing the
context statement because the effects and resulting impacts may be different during the day than
at night. Effective context descriptions should provide an overall sense of scale for the impacts of
a threat or hazard.

Communities should recognize that past experience with threats and hazards may differ from the
future threat and hazard environment. Factors such as demographics, climate, and the built
environment are subject to change. Communities should consider these factors when developing
threat and hazard context descriptions.

E x a m p l e s o f C o n t e x t D e s c r i p t i o n s
Table 3 provides two examples of context descriptions for a community. The community
included the following two threats and hazards in its THIRA: an earthquake (natural) and a
terrorist attack using an improvised explosive device (human-caused). Each of these threats and
hazards includes a context description outlining the conditions, including time and location, that
are most relevant to the community. These two threats and hazards are for example purposes
only; a community may elect to analyze any number of threats and hazards of significant
concern.

Table 3: Example Context Descriptions

Threat/Hazard Earthquake Terrorism

Context
Description

A magnitude 7.8 earthquake along the
Mainline Fault occurring at
approximately 2:00 PM on a weekday
with ground shaking and damage
expected in

19

counties, extending from
Alpha County in the south to Tau
County in the north, and into the Zeta
Valley.

A potential threat exists from a
domestic group with a history of using
small IEDs in furtherance of hate
crimes. There are a number of large
festivals planned during the summer at
open air venues that focus on various
ethnic and religious groups. These
events draw on average 10,000
attendees daily.

S t e p 2 O u t p u t
The output of Step 2 is context descriptions for each threat and hazard identified in Step 1. These
context descriptions will be used to develop impacts and desired outcomes for Step 3.

S t e p 3 : E s t a b l i s h C a p a b i l i t y Ta r g e t s
In Step 3, communities establish capability targets for each core capability. Capability

targets

define success for each core capability based on the threat and hazard contexts developed in Step
2. Communities apply the capability targets from Step 3 to generate resource requirements and
consider preparedness activities, including opportunities for mitigation in Step 4. This section:
 Describes impacts and desired outcomes and how they support development of capability

targets

 Provides guidance on how to develop capability targets
 Provides examples of completed capability targets.

10

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Figure 5: Step 3 of the THIRA Process

Changes from the First Edition of CPG 201

Step 3 combines two steps from the First Edition of CPG 201: Step 3 (Examine the Core Capabilities
Using the Threats and Hazards) and Step 4 (Set Capability Targets). Communities still produce one
capability target per core capability in Step 3.

I m p a c t s a n d D e s i r e d O u t c o m e s
Capability targets should be specific and measurable. To develop specific and measurable
targets, communities should consider impacts and desired outcomes for each threat and hazard.

Impacts
Impacts describe how a threat or hazard might affect a core capability. Impacts are linked to
the size and complexity of threats and hazards. Larger, more complex threats and hazards might
cause larger, more complex impacts.

 For the Response and Recovery mission areas, impacts often describe actions that a
community would take to manage an incident after it has occurred (e.g., rescue 500 people;
provide food and shelter for 1,000 evacuees; provide long-term housing for 200 displaced
families).

 For the Prevention, Protection, and Mitigation mission areas, impacts often describe
actions a community would take prior to an incident to stop it from occurring or to reduce its
effects (e.g., screen 80,000 event attendees for weapons; receive situation reports from four
partner agencies).

Impacts should be specific and include quantitative descriptions as much as possible to allow
jurisdictions to gain an understanding of what is needed to manage risk. Communities may seek
to express impacts using the following types of categories:

 Size of geographic area affected
 Number of displaced households
 Number of fatalities
 Number of injuries or illnesses
 Disruption to critical infrastructure

11

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

 Intelligence requirements and needs
 Amount of direct economic impacts
 Economic effects of supply chain disruption.
Communities can use a range of inputs, including expert judgment and advanced modeling, to
consider impacts. Given the breadth of preparedness mission areas and core capabilities,
communities should work with the full range of whole community partners to develop, review,
and validate impacts.

Desired Outcomes
Desired outcomes describe the timeframe or level of effort needed to successfully deliver
core capabilities. Capabilities are only useful if communities can deliver them in a timely and
effective manner. For example, success in the Response and Recovery mission areas often
requires communities to deliver capabilities within a certain timeframe (e.g., complete search
and rescue operations within 72 hours). Other mission areas may be better presented in terms of
percentages (e.g., ensure 100% verification of identity to authorize, grant, or deny physical and
cyber access to specific locations).

When considering desired outcomes, communities should not be constrained by current ability to
meet timeframes or other conditions of success. Communities should consider various types of
time-based desired outcomes as shown in Table 5.

Table 4: Example Time-based Desired Outcomes

Outcome Type Example Outcome Description

Completing operations Complete evacuation of neighborhood within four hours

Establishing services Establish feeding and sheltering operations for displaced populations within 24 hours

Service duration Maintain behavioral screening checks for affected population for one month

Combination Establish feeding and sheltering operations within 24 hours and maintain services for a period of two weeks

D e v e l o p i n g C a p a b i l i t y T a r g e t s
Capability targets define success and describe what the community wants to achieve for each
core capability. Communities should combine quantitative details from impacts and desired
outcomes to develop capability targets.

Straightforward Example
For some core capabilities, forming the capability target may be as simple as combining the
largest impacts with corresponding desired outcomes. As an example, consider a community
developing a capability target for the Fatality Management Services core capability (see Figure
6).

12

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Figure 6: Straightforward Example of Developing Capability Targets

Complex Example
For some capabilities, developing capability targets may be more complicated. Different threats
and hazards may stress different facets of a core capability. As an example, consider a
community developing capability targets for the Critical Transportation core capability (see
Figure 7).

 The community reviews its Critical Transportation impacts and desired outcomes:
• A fire threatens a chemical plant which could release toxic gases, thereby requiring the

community to evacuate several city blocks in the direction that the toxic cloud is
estimated to disperse. The affected area is over three square miles, and houses 20,000
residents who must be evacuated in three hours.

• An earthquake requires the delivery of vital response personnel, equipment, and services
within 12 hours. 150 miles of major highway need to be assessed and repaired.

Figure 7: Complex Example of Developing Capability Targets

By developing capability targets that account for the range of impacts and desired outcomes
associated with their different threats and hazards, communities will develop a “meta-scenario.”

13

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

A meta-scenario combines the context statements developed in Step 2 and includes the most
stressing aspects of each threat and hazard. This approach leads to capability targets that increase
at each level of government, specifically: a state needs to prepare for the worst impacts across
multiple counties and a region needs to prepare for the worst impacts across multiple states.

E x a m p l e C a p a b i l i t y T a r g e t
Table 5 provides an example of a capability target for the Mass Search and Rescue Operations
core capability for a community. The capability target includes the following impacts: the
numbers of buildings to be searched, people to be rescued, and families to be sheltered. The
target also describes the desired outcomes: completing collapse search and rescue within 72
hours. Communities should produce such a table for each core capability.

Table 5: Example Capability Target Statement

Threat/Hazard Earthquake Terrorism
Context
Description
A magnitude 7.8 earthquake along the
Mainline Fault occurring at
approximately 2:00 PM on a weekday
with ground shaking and damage
expected in 19 counties, extending from
Alpha County in the south to Tau
County in the north, and into the Zeta
Valley.
A potential threat exists from a
domestic group with a history of using
small IEDs in furtherance of hate
crimes. There are a number of large
festivals planned during the summer at
open air venues that focus on various
ethnic and religious groups. These
events draw on average 10,000
attendees daily.

Core Capability: Mass Search and Rescue Operations

Capability
Target

Within 72 hours, rescue:
 5,000 people in 1,000 completely collapsed buildings
 10,000 people in 2,000 non-collapsed buildings
 20,000 people in 5,000 buildings
 1,000 people from collapsed light structures.

S t e p 3 O u t p u t
The output of Step 3 is a minimum of one capability target for each core capability listed in the
National Preparedness Goal. These capability targets will be used to identify resource
requirements in Step 4. Additionally, communities can begin to identify preparedness activities
to reduce future resource requirements.

S t e p 4 : A p p l y t h e R e s u l t s
In Step 4, communities apply the results of the THIRA by estimating the resources required to
meet capability targets. Communities express resource requirements as a list of resources needed
to successfully manage their threats and hazards. Communities can also use resource

14

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

requirements to support resource allocation decisions, operations planning, and mitigation
activities.5 This section:

 Introduces capability estimation
 Discusses resource typing, including National Incident Management System (NIMS)-

typed resources and other standardized resource types
 Provides an example of a completed resource requirement list
 Identifies how communities may apply these results to resource allocation decisions and

mitigation activities.

Figure 8: Step 4 of the THIRA Process

Changes from the First Edition of this Guide

Step 4 retains the activities from the First Edition of CPG 201 and adds capability estimation to establish
resource requirements lists.

C a p a b i l i t y E s t i m a t i o n
To estimate resource requirements, communities should consider the resources needed to achieve
the capability targets from Step 3. As a first step, communities can identify the major actions
needed to achieve their capability targets. Communities should avoid developing very detailed,
tactical-level task lists. Rather, communities should strive to identify mission-critical activities.
Communities can draw mission-critical activities from current community-level plans, as well as
from the National Planning Frameworks.6

Communities should consider the quantity and types of resources needed to complete each
mission-critical activity in support of the capability targets. To identify quantity and types of
resources, communities can use existing tools and information sources, such as:

 Strategic, operational, and/or tactical plans
 Resource typing data, including standardized resource characteristics
 Existing capacity analysis and capability calculators

5 CPG 101, Version 2, Developing and Maintaining Emergency Operations Plans discusses how to incorporate
resource requirements and capability estimates into emergency operations planning. For more information, please
see http://www.fema.gov/pdf/about/divisions/npd/CPG_101_V2 .
6 For more information, please visit http://www.fema.gov/national-planning-frameworks.

15

http://www.fema.gov/national-planning-frameworks

http://www.fema.gov/pdf/about/divisions/npd/CPG_101_V2

http://www.fema.gov/national-planning-frameworks

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

 Data regarding resources frequently requested through mutual aid.
Through this process, communities should identify the resources from across the whole
community needed to meet capability targets.

Each community should decide which combination of resources is most appropriate to achieve
its capability targets. While any number of combinations may achieve success, communities
should consider costs, benefits the resources provide, and the ability to manage the risks
associated with each potential solution. Different solutions may fit best within different
communities’ political and economic frameworks.

R e s o u r c e T y p i n g
Resource typing is categorizing, by capability, the resources requested, deployed, and used in
incidents. Resource typing helps communities request and deploy needed resources through the
use of common terminology. Communities should develop resource requirements expressed as a
list of NIMS-typed resources or other standardized resources.

Tier I NIMS-Typed Resources
FEMA categorizes and describes several types of standardized, deployable resources.
Measurable standards identifying resource capabilities and performance levels serve as the basis
for these categories. These NIMS-typed resource definitions include the composition and
capabilities of teams, personnel, equipment, and supplies commonly deployed in incidents.
FEMA refers to NIMS-typed resources as Tier I resources. The complete list of Tier I resource
types can be found at http://www.fema.gov/resource-management.

Step 4 of the THIRA process enables communities to estimate how many resources—
including FEMA’s Tier I NIMS-typed resources—are needed to achieve capability targets.
As FEMA and the emergency management community continue to define additional Tier I
NIMS-typed resources, the THIRA process will provide a more accurate and complete picture of
community-level resource needs.

Tier II Resources and Other Standardized Resources
Communities should also consider resources standardized by entities other than FEMA when
developing their resource requirements. For example, state, tribal, and local governments
sometimes establish standardized definitions of deployable resources. FEMA refers to these
state, tribal, and local-typed resources as Tier II-typed resources. Tier II-typed resources refer to
resources defined and inventoried by local, state, tribal, and territorial jurisdictions that are
specific and limited to intrastate mutual aid requests and regional mutual aid assistance. FEMA
does not play a role in defining these local types or standards, unlike NIMS-typed resources
(Tier I resources).

Mission Ready Packages (MRPs) available through the Emergency Management Assistance
Compact (EMAC) describe other types of standardized resources, including credentialed
personnel. EMAC MRPs describe resources available for deployment for intrastate and interstate
mutual aid.

Communities should identify resources at a manageable level of detail. Identifying teams or
“packages” of people, equipment, and associated training allows for comparison across
jurisdictions. These resources handle specific tasks within specified timeframes. The second

16

http://www.fema.gov/resource-management

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

column in Table 7 shows a recommended level of resource detail. The “Case Management
Team” represents a distinct resource package.

Table 6: Desired Level of Detail for Other Standardized Resources

Too Broad Recommended Too Detailed

All adequate personnel to meet
the outcome

1 Type 3 Case Management
Team

1 operations manager
1 team leader
1 case management supervisor
1 case manager
1 community coordination
specialist

For some capabilities, communities can calculate resource requirements by considering:
capability targets; the operational capacities of resources; and available time. The following
example demonstrates this approach:

Example: Calculating Resource Requirements

Consider a community trying to estimate the number of Urban Search and Rescue (US&R) Task Forces needed for
its Mass Search and Rescue Operations resource requirement. The community should first consider the types of
buildings located within the affected area (e.g., high-rise buildings, non-combustible, mid-rise). This information helps
determine the level of effort and skill required to conduct effective search and rescue. For example, if the community
can estimate the number of buildings in each category, the average number of floors per building in each category,
and the average area per floor in each category, the community can derive rough estimates of the number of floors
and total square footage first responders would need to search in response to a major incident. The community’s
firefighters, public works staff, building owners, or building inspectors can provide this information to planners.

The community is planning for mass search and rescue in its downtown area. An examination of the area’s building
stock finds that most buildings are high-rise structures constructed of concrete and protected steel. In consideration
of their building stock and the occupancy of the buildings, the community reaches out to its existing search and
rescue expertise as well as that from other jurisdictions to get a recommendation of possible solutions. As a result of
their analysis, the community determines that highly skilled Type I US&R Task Forces are needed to deal with the
requirements while other resources can be used more efficiently and effectively to deal with less challenging search
and rescue needs.

Specialized knowledge can be instrumental in helping to address the following types of questions that arise when
estimating resource requirements:

 What resources are appropriate for achieving capability targets?
 What are the typical performance characteristics of those resources?
 How might performance vary depending on the local conditions?
The community could use the following calculation to estimate resource requirements.

This example calculation highlights the importance of including subject matter experts from the whole community in
the THIRA process.

17

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

E x a m p l e o f a C o m p l e t e d T H I R A
Table 7 shows the progression from capability target to resource requirement for the Mass
Search and Rescue Operations core capability. The community uses subject matter expertise,
existing plans, and simple calculations to determine the key resources necessary to meet
capability targets.

Table 7: Example Completed THIRA

Threat/Hazard Earthquake Terrorism
Context
Description
A magnitude 7.8 earthquake along the
Mainline Fault occurring at
approximately 2:00 PM on a weekday
with ground shaking and damage
expected in 19 counties, extending from
Alpha County in the south to Tau
County in the north, and into the Zeta
Valley.
A potential threat exists from a
domestic group with a history of using
small IEDs in furtherance of hate
crimes. There are a number of large
festivals planned during the summer at
open air venues that focus on various
ethnic and religious groups. These
events draw on average 10,000
attendees daily.
Core Capability: Mass Search and Rescue Operations
Capability
Target
Within 72 hours, rescue:
 5,000 people in 1,000 completely collapsed buildings
 10,000 people in 2,000 non-collapsed buildings
 20,000 people in 5,000 buildings
 1,000 people from collapsed light structures.

Resource Requirement

Resources Number Required

Type I US&R Task Forces 10

Type II US&R Task Forces 38

Collapse Search and Rescue (S&R) Type III Teams 100

Collapse S&R Type IV Teams 20

Canine S&R Type I Teams 20

A p p l y i n g t h e T H I R A R e s u l t s t o R e s o u r c e A l l o c a t i o n D e c i s i o n s a n d
P r e p a r e d n e s s A c t i v i t i e s
Communities can apply their THIRA results to allocate resources and inform preparedness
activities, including opportunities for mitigation.

18

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Resource Allocation Decisions
A community can use its THIRA results to make decisions about how to allocate limited
resources. By establishing resource requirements, a community determines the resources needed
to achieve capability targets.

In some cases, THIRA results may indicate a need to sustain existing capabilities. In other cases,
results may identify resource shortfalls and capability gaps. Communities can use this
information to guide capability investment decisions and to brief community leaders, senior
officials, and the public on resource requirements. Communities have several options available to
build or sustain capabilities, including:

 In some cases, communities may rely upon the resources of other levels of government to
achieve a capability target. Accordingly, cities, counties, states, tribes, and regions should
work collaboratively to build and sustain capabilities. For example, if states require national
resources to meet a capability target, they should collaborate with FEMA Regional Offices
and other Federal agencies.

 Communities can build capabilities and fill gaps in a variety of other ways. For example,
communities can:

• Establish mutual aid agreements with surrounding communities

• Work with whole community partners (e.g., faith-based organizations) to augment
capabilities

• Invest community or grant dollars

• Request technical assistance for planning or exercises to help deploy resources more
effectively.

Regardless of how a community chooses to make resource allocation decisions, the THIRA
process provides a framework to establish resource requirements and monitor progress towards
building, sustaining, and delivering capabilities.

Preparedness Activities
THIRA results can also inform preparedness activities, including mitigation opportunities that
may reduce the amount of resources required in the future. Through the THIRA process,
communities can identify opportunities to employ mitigation plans, projects, and insurance to
reduce the loss of life and damage to property. In this way, communities can reduce the impacts
they need to manage, and hence reduce the resources needed to achieve capability targets. Table
8 shows examples of mitigation activities and associated effects and outcomes.

Using THIRA results to inform mitigation activities aligns with the traditional mitigation
planning process of identifying hazards, assessing losses to the community, and setting
mitigation priorities and goals for the community.

19

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

Table 8: Example Mitigation Activities and Associated Effects/Outcomes

Mitigation Activity Effect Outcome
Seismic retrofitting on utility
buildings

Increased utility resilience Key emergency services retain
100% power during incidents

Installing safe rooms in
residential and commercial
buildings for areas affected by
tornados

Increased ability for individuals to
shelter in place during disasters

100% preservation of life safety
for occupants taking shelter in
safe rooms designed to FEMA
P-320/361 standards

S t e p 4 O u t p u t
In Step 4, communities develop a list of resource requirements (e.g., NIMS-typed resources,
EMAC MRPs) to meet the capability targets while also considering preparedness activities that
may reduce future resource requirements.

C o n c l u s i o n
Understanding the risks faced by communities and the Nation as a whole is essential to national
preparedness. This Guide provides a common and consistent approach for communities to
support the first two components of the National Preparedness System: 1) Identifying and
Assessing Risk; and 2) Estimating Capability Requirements. It expands on existing local, state,
tribal, and territorial hazard identification and risk assessment processes.

The THIRA is complemented by a Strategic National Risk Assessment (SNRA) that analyzes the
greatest risks to the Nation, and contributes to a shared understanding of the full range of risks,
including long-term trends that face our Nation.7 THIRAs and the SNRA, along with other
specialized risk assessments, provide an integrated national risk picture, which in turn helps to
achieve the National Preparedness Goal of “a secure and resilient Nation with the capabilities
required across the whole community to prevent, protect against, mitigate, respond to, and
recover from the threats and hazards that pose the greatest risk.”

Achieving the National Preparedness Goal requires participation by the whole community.
Consistent application of THIRAs provides an important tool for integrating whole community
contributions toward achieving the National Preparedness Goal. Through the THIRA process,
communities are better able to educate individuals, families, businesses, organizations,
community leaders, and senior officials about the risks they face and their roles in and
contributions to prevention, protection, mitigation, response, and recovery.

7 For more information, please see http://www.dhs.gov/xlibrary/assets/rma-strategic-national-risk-assessment-
ppd8 .

20

http://www.dhs.gov/xlibrary/assets/rma-strategic-national-risk-assessment-ppd8

http://www.dhs.gov/xlibrary/assets/rma-strategic-national-risk-assessment-ppd8

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

A p p e n d i x A : T H I R A Te m p l a t e
The following table illustrates one possibility for how communities may organize the information in their THIRAs.

Threat/Hazard

Context
Description

Core Capability

Capability
Target

Resource Requirement
Resources Number Required

A-1

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

This page intentionally left blank.

A-2

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

A p p e n d i x B : G l o s s a r y
Capability Target: Capability targets define success for each core capability and describe what
the community wants to achieve by combining detailed impacts with basic and measurable
desired outcomes based on the threat and hazard context statements developed in Step 2 of the
THIRA process.

Context: A community-specific description of an incident, including location, timing, and other
important circumstances.

Core Capability: Defined by the National Preparedness Goal, 31 activities that address the
greatest risks to the Nation. Each of the core capabilities is tied to a capability target.

Desired Outcome: The standard to which incidents must be managed, including the timeframes
for conducting operations or percentage-based standards for performing security activities.

Human-caused Hazard: A potential incident resulting from the intentional actions of an
adversary.

Impact: How a threat or hazard might affect a core capability.
Likelihood: The chance of something happening, whether defined, measured, or estimated
objectively or subjectively, or in terms of general descriptors (e.g., rare, unlikely, likely, almost
certain), frequencies, or probabilities.

Natural Hazard: A potential incident resulting from acts of nature.
NIMS-typed Resource: A resource categorized, by capability, the resources requested,
deployed and used in incidents.

Resource Requirement: An estimate of the number of resources needed to achieve a
community’s capability target. A list of resource requirements for each core capability is an
output of the THIRA process.

Technological Hazard: A potential incident resulting from accidents or failures of systems or
structures.

Threat/Hazard Effect: The overall impacts to the community were an incident to occur.
Whole Community: An approach to emergency management that reinforces the fact that FEMA
is only one part of our Nation’s emergency management team. We must leverage all of the
resources of our collective team in preparing for, protecting against, responding to, recovering
from and mitigating against all hazards; and that collectively we must meet the needs of the
entire community in each of these areas.

B-1

CPG 201: Threat and Hazard Identification and Risk Assessment Guide—Second Edition

This page intentionally left blank.

B-2

Forward
Overview
THIRA Process
Relationship to Other Risk Assessments
Core Capabilities
National Preparedness System
Whole Community Involvement
Updating Previous THIRAs
Step 1: Identify the Threats and Hazards of Concern
Types of Threats and Hazards
Sources of Threat and Hazard Information
Factors for Selecting Threats and Hazards
Factor #1: Likelihood of Incident
Factor #2: Significance of Threat/Hazard Effects
Step 1 Output
Step 2: Give the Threats and Hazards Context
Context Description: Factors to Consider
Examples of Context Descriptions
Step 2 Output
Step 3: Establish Capability Targets
Impacts and Desired Outcomes
Impacts
Desired Outcomes
Developing Capability Targets
Straightforward Example
Complex Example
Example Capability Target
Step 3 Output
Step 4: Apply the Results
Capability Estimation
Resource Typing
Tier I NIMS-Typed Resources
Tier II Resources and Other Standardized Resources
Example of a Completed THIRA
Applying the THIRA Results to Resource Allocation Decisions and Preparedness Activities
Resource Allocation Decisions
Preparedness Activities
Step 4 Output
Conclusion
Appendix A: THIRA Template
Appendix B: Glossary