6.2 Threat/Hazard–Vulnerability Pairing & Loss Event Profiles
Key Takeaways
- A loss-event profile pairs one specific threat or hazard with one specific vulnerability, then states who/what, how, and consequence
- Unpaired lists—every crime type, every leaky door—cannot justify a countermeasure
- Name consequence in categories: death/injury, downtime, data/privacy, theft, and brand; one profile may carry more than one
- Tailgating plus an unlocked, unattended loading dock is a cargo-theft profile, not a generic theft cell
- Flood plus generators, ACS panels, and VMS servers in a basement is campus electronic-security loss, not a camera-mounting-height problem
Threat/Hazard–Vulnerability Pairing and Loss Event Profiles
A loss-event profile is not a mood about the neighborhood and not a heat-map color. It is a pair: one specific threat or hazard plus one specific vulnerability, then a plain-language statement of who or what is harmed, how the event unfolds, and what consequence follows. Independent OpenExamPrep teaching for published PSP Domain 1 tasks is that unpaired lists—every crime type on one page, every unlatched door on another—cannot justify a countermeasure. Task 5 knowledge on pairing exists so you stop recommending “more security” at a building.
Exam focus: Name the threat or hazard, name the vulnerability, then write who/what, how, and consequence. If any field says only “the warehouse,” you do not yet have a profile.
Why Pairing Beats Two Separate Lists
“Theft” is not a profile. “Unlocked dock” is not a profile. Cargo theft of staged electronics when an unauthorized person tailgates through an unlocked, unattended loading dock during shift change is a profile. The first two phrases describe a threat class and a condition. The third describes a mechanism. Countermeasures attach to mechanisms. Cameras, locks, attendants, and trailer-seal checks either interrupt that how or they do not.
Pairing also stops double-counting. A dock door that is unlatched is one vulnerability. It may pair with tailgating theft, with weather-driven product damage, and with an insider walking a carton to a car. Those are three profiles if the hows differ. They are not thirty profiles because you listed ten crime types against the same leaf.
Who/What, How, and Consequence
Write three fields for every pairing you intend to treat or formally accept.
Who/what names the asset and the actor or force. Weak version: “the warehouse.” Usable version: palletized consumer electronics staged at door 4; opportunistic thief or insider-assisted crew. People belong in this field when injury is plausible. A driver who might tackle a thief is part of who/what, not a footnote.
How is the mechanism that joins the threat or hazard to the vulnerability. Weak version: “someone could get in.” Usable version: walk-in at the 14:00 shift change through a dock door left unlatched, no attendant, no trailer-seal check, apron unsecured to a public lane. If you cannot walk the how in a sentence, you cannot match a measure in 6.3.
Consequence names the harm that actually follows, using categories rather than the word “bad.” Weak version: “bad for security.” Usable version: theft of a pallet; possible injury if a driver intervenes; downtime to rebuild the load; brand harm if customer lot codes appear in online resale.
| Field | Question it answers | Weak version | Usable version |
|---|---|---|---|
| Who/what | Which asset and which actor or force | The warehouse | Staged electronics at door 4; opportunistic thief or collusive driver |
| How | The joining mechanism | Someone could get in | Tailgate at 14:00 through an unlatched, unattended dock to a waiting van |
| Consequence | Harm that follows | Bad for security | Theft, possible injury, rebuild downtime, brand hit from resale lot codes |
Consequence Categories You Should Name on Purpose
Score, or at least name, these categories even when the analysis stays qualitative. They keep a theft-only brain from missing a life-safety pairing, and they keep a brand workshop from substituting for injury.
- Death/injury — people first. You do not “accept” preventable death as residual in a footnote. Workplace violence in an unsecured lobby, vehicle impact through unrated storefront glazing, and fire-plus-locked-egress pairings live here even when Finance wants a theft number.
- Downtime — hours or days the process cannot run. A flooded generator room that kills access control and video is downtime of the electronic security program and often of the occupancy that depended on it.
- Data/privacy — drawings, credentials, visitor logs, badge photos, and packing lists leaving the site. Physical paths still steal information.
- Theft — cash, cargo, tools, metals, pharmaceuticals, copper. Theft is common on PSP items; it is not the only category.
- Brand — public trust, customer flight, license to operate. Brand is often a follower of the first four. It is not a substitute for naming injury or downtime. A social-media rumor with systems still powered is a different profile from a flood that takes the campus dark.
One profile may carry several categories. Flood water that kills generators is downtime; if delayed-egress hardware or emergency lighting depend on that power path, it is also death/injury; if drives die with no backup, it is data; if the outage is public, brand follows.
Worked Profile: Tailgating Plus Unlocked Loading Dock Equals Cargo Theft
- Threat: opportunistic thief or collusive driver who already knows when staging happens.
- Vulnerability: dock door unlatched, no attendant, cameras that record to an NVR nobody watches at shift change, no trailer-seal check, apron open to a public lane.
- Who/what: palletized consumer electronics staged at door 4; also the driver who might intervene.
- How: walk-in during the 14:00 swap; roll a pallet to a waiting van; gone before the next scan.
- Consequences: theft (primary), injury if challenged, downtime to reconstruct the load, brand if the customer SKU hits resale with your lot codes.
Notice what this profile is not. It is not “theft in the metro area.” It is not “the dock needs cameras.” Cameras without a dock procedure do not break this how. An unlocked door plus an unwatched recording is still an open path.
Worked Profile: Flood Plus Generators in the Basement Equals Total ACS/VSS Loss
- Hazard: storm-drain backup or overland flood; the parcel has history, which Task 3 should already have recorded.
- Vulnerability: emergency generator, ACS panels, and VMS servers share the same basement with no flood barrier, no elevated pads, and no alternate recording path off-site.
- Who/what: electronic access, video, and lock power for the campus; occupants who depend on those systems in an emergency.
- How: a few inches of water; generators fault; UPS dies; readers and maglocks go to whatever fail state the hardware actually has; the NVR never records the looting or the medical emergency in the dark.
- Consequences: downtime of ACS and VSS (primary), death/injury if egress hardware is now in the wrong state, data/privacy if drives are destroyed without backup, brand when the outage is public.
Raising camera heads on the first floor does not treat this pairing if the brains and the power sit in the water. The profile forces a different treatment conversation: relocate power and servers, flood-protect, or avoid putting critical electronics in that basement.
Five Profiles on One Campus (Use This Shape, Not a 200-Row Grid)
| Profile | Threat or hazard | Vulnerability | Who/what | How | Primary consequence |
|---|---|---|---|---|---|
| Dock cargo theft | Opportunistic thief or collusive driver | Unlatched, unattended dock at shift change | Staged electronics; intervening driver | Tailgate and roll a pallet to a van | Theft; injury; downtime; brand |
| Basement flood | Storm-drain backup / flood | Generators, ACS, VMS in the same basement | Campus electronic security; occupants | Water kills power and recording | Downtime; possible death/injury; data; brand |
| Insider drawings | Trusted contractor after hours | Unlocked lateral files in engineering | Tool drawings; customer process know-how | Badge in, fill a backpack, walk out | Data/privacy; brand; later theft of product |
| Lobby violence | Aggrieved visitor or former employee | Unsecured reception desk, no duress, glass not rated | Receptionist; waiting patients | Walk straight to the desk with a weapon | Death/injury; downtime; brand |
| Storefront ram | Vehicle as tool | Unrated glazing, no bollards on a straight approach | Occupants near glass; high-value display | Vehicle through the leaf, smash and grab | Death/injury; theft; brand |
Trap: Pairing Everything With Everything
A matrix of every threat class against every door is not analysis. It is combinatorial explosion that hides the five pairings that would actually stop operations. Profile the pairings that are credible for this site given Task 3 threats and Task 4 vulnerabilities. Depth beats a 200-row spreadsheet. If a row cannot state a how, delete the row. If two rows share the same how, merge them.
A second trap is copying another campus’s profiles. A coastal clinic’s flood-plus-basement pairing may be irrelevant on a hilltop plant. A hilltop plant’s vehicle-ram pairing may be irrelevant in a pedestrian mall with no approach speed. Site-specific pairing is the same discipline Chapter 2 required of assessment models.
The output of 6.2 is a short, defensible set of profiles. Section 6.3 matches countermeasures to those profiles instead of to a vendor shopping list.
A loss-event profile is formed by which of the following?
Tailgating through an unlocked loading-dock door that has no dock attendant is best written as which profile?
Generators, ACS panels, and VMS servers sharing a basement with a history of storm-drain backup primarily pair with which consequence first?