Risk and Vulnerability Analysis of Critical Infrastructures

This chapter presents an approach for a cross-sector risk and vulnerability analysis (RVA) of critical infrastructures. The RVA is an extended version of a preliminary hazard analysis (PHA) and can be applied to any complex system with only minor adaptations. The analysis has three phases described below: (1) analysis preparation, (2) preliminary risk analysis and (3) detailed risk analyses. The objective of the RVA is to identify hazardous events related to the activity/system as thorough as reasonably practicable. In phase 2, risk is assessed by the analysis group from direct assessments of probabilities and consequences on a semi-quantitative scale, such as low (L), medium (M) and high (H). This is in line with a standard PHA, which aims to identify and assess all major risks, and provide risk-reducing measures, without including detailed risk calculations or analyses. The preliminary risk analysis is then used for screening, and the most critical events are investigated further for various detailed analyses and quantifications. The RVA described here intends to give a complete overview of all risks elements related to the systems under investigation.