How do you evaluate facility vulnerabilities?

1 Identify your assets

The first step is to identify your assets, which are the resources, functions, or systems that support your facility's mission, goals, or operations. These could include buildings, equipment, utilities, staff, data, processes, or services. You should create an inventory of your assets and categorize them according to their criticality, value, or dependency. For example, you could use a scale of 1 to 5 to rank your assets based on how essential they are for your facility's continuity, performance, or safety.

2 Identify your threats

The next step is to identify your threats, which are the potential sources of harm, damage, or loss to your assets. These could include natural hazards, such as floods, fires, or earthquakes; human-caused hazards, such as vandalism, theft, or sabotage; or technological hazards, such as power failures, cyberattacks, or equipment malfunctions. You should conduct a threat analysis to determine the likelihood, frequency, and severity of each threat, as well as the potential impact on your assets. For example, you could use a matrix to plot your threats based on their probability and consequence.

3 Assess your vulnerabilities

The third step is to assess your vulnerabilities, which are the factors that increase your exposure or reduce your resistance to the threats. These could include physical vulnerabilities, such as structural defects, outdated systems, or inadequate security; operational vulnerabilities, such as inefficient procedures, insufficient training, or poor communication; or human vulnerabilities, such as low morale, high turnover, or lack of awareness. You should perform a vulnerability assessment to identify the gaps, weaknesses, or flaws in your assets, as well as the root causes, contributing factors, or interdependencies that affect them. For example, you could use a checklist to evaluate your vulnerabilities based on their scope, magnitude, or duration.

4 Prioritize your vulnerabilities

The final step is to prioritize your vulnerabilities, which are the ones that require the most urgent or significant attention, mitigation, or improvement. You should use a prioritization method to rank your vulnerabilities based on their risk level, impact level, or cost-benefit ratio. For example, you could use a scoring system to assign weights or scores to your vulnerabilities based on their criteria. You should also consider the feasibility, availability, or effectiveness of the possible solutions or alternatives to address your vulnerabilities. For example, you could use a SWOT analysis to compare the strengths, weaknesses, opportunities, or threats of each option.

By following these steps, you will be able to evaluate your facility vulnerabilities in a systematic and proactive way. This will help you to develop a comprehensive FM emergency and contingency plan that will enhance your facility's resilience, preparedness, and recovery.

5 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?