The U.S. Department of Energy (2002) provided a standard three-step model for conducting vulnerability assessments. The model includes steps for pre-assessment, assessment, and post-assessment. (See Figure 2.) While the model was designed to support vulnerability assessments for electric power infrastructure, it is easily transferable to other infrastructure systems, including those that support health care delivery systems, and should serve as your point of reference throughout this course.

Figure 2: Vulnerabilty Assessment Model

(U.S. Department of Energy, 2002)

Pre-Assessment

"The pre-assessment phase involves defining the scope of the assessment, establishing appropriate information protection procedures, and identifying and ranking critical assets. Each of these activities is critical in ensuring the success of the assessment" (U.S. Department of Energy, 2002).

Assessment

The assessment methodology consists of ten sub-steps as detailed below:

1. Network architecture
2. Threat environment
3. Penetration testing
4. Physical security
5. Physical asset analysis
6. Operations security
7. Policies and procedures
8. Impact analysis
9. Infrastructure interdependencies
10. Risk characterization

Post-Assessment

"The post-assessment phase involves prioritizing assessment recommendations, developing an action plan, capturing lessons learned and best practices, and conducting training. The risk characterization element results provide the basis for the post-assessment by providing prioritized lists of recommendations that are ranked by key criteria" (U.S. Department of Energy, 2002).