TSA Pipeline Security 4.3: 4.3 Security vulnerability assessment (SVA)

An SVA (one of the risk assessment methodologies an operator may choose) supports identifying, evaluating and prioritizing risks and selecting measures for critical facilities, usually through asset characterization (hazards, consequences, surroundings, supporting infrastructure and existing layers of protection), threat assessment (internal and external), security vulnerability analysis (weaknesses and the effectiveness of existing countermeasures), risk assessment (expected effect on each asset and likelihood of attack success) and countermeasures analysis (options, their effectiveness and feasibility). Operators of critical facilities should: conduct an SVA or equivalent at least every 36 months and within 12 months after a significant enhancement or modification; conduct one for newly identified or constructed critical facilities within 12 months of designation or of becoming operational; document and retain findings until no longer valid; implement appropriate findings promptly and no later than 24 months after completion; and document the methodology and make it available to TSA on request.