Publications

An existing shared risk framework designed for assessing and comparing threat-based risks to water utilities is being extended to incorporate electric power. An important differentiating characteristic of this framework is the use of a system-centric rather than an asset-centric approach. This approach allows anonymous sharing of results and enables comparison of assessments across different utilities within an infrastructure sector. By allowing utility owners to compare their assessments with others, they can improve their self-assessments and identification of "unknown unknowns". This document provides an approach for extension of the framework to electric power, including treatment of dependencies and interdependencies. The systems, threats, and mathematical description of associated risks used in a prototype framework are provided. The method is extensible so that additional infrastructure sectors can be incorporated. Preliminary results for a proof of concept calculation are provided.

The MELCOR Accident Consequence Code System (MACCS) is used by Nuclear Regulatory Commission (NRC) and various national and international organizations for probabilistic consequence analysis of nuclear power accidents. This User Guide is intended to assist analysts in understanding the MACCS/WinMACCS model and to provide information regarding the code. This user guide version describes MACCS Version 4.0. Features that have been added to MACCS in subsequent versions are described in separate documentation. This User Guide provides a brief description of the model history, explains how to set up and execute a problem, and informs the user of the definition of various input parameters and any constraints placed on those parameters. This report is part of a series of reports documenting MACCS. Other reports include the MACCS Theory Manual, MACCS Verification Report, Technical Bases for Consequence Analyses Using MACCS, as well as documentation for preprocessor codes including SecPop, MelMACCS, and COMIDA2.

Risk assessment plays a vital role in protecting our nation's critical infrastructure. Traditionally, such assessments have been conducted as a singular activity confined to the boarders of a particular asset or utility with little external sharing of information. In contrast other domains, e.g., disaster preparedness, cyber security, food-borne hazards, have demonstrated the benefits of sharing data, experiences and lessons learned in assessing and managing risk. Here we explore the concept of a Shared Risk Framework (SRF) in the context of critical infrastructure assessments. In this exploration, key elements of an SRF are introduced and initial instantiations demonstrated by way of three water utility assessments. Results from these three demonstrations were then combined with results from four other risk assessments developed using a different risk assessment application by a different set of analysts. Through this comparison we were able to explore potential challenges and benefits from implementation of a SRF. Challenges included both the capacity and interest of local utilities to conduct a shared risk assessment; particularly, wide scale adoption of any SRF will require a clear demonstration that such an effort supports the basic mission of the utility, adds benefit to the utility, and protects utility data from unintended access or misuse. In terms of benefits, anonymous sharing of results among utilities could provide the added benefits of recognizing and correcting bias; identifying ‘unknown, unknowns’; assisting self-assessment and benchmarking for the local utility; and providing a basis for treating shared assets and/or threats across multiple utilities.

This document summarizes the current state of Sandia 911 modeling capabilities and then addresses key aspects of Next Generation 911 (NG911) architectures for expansion of existing models. Analysis of three NG911 implementations was used to inform heuristics ,associated key data requirements, and assumptions needed to capture NG911 architectures in the existing models. Modeling of NG911 necessitates careful consideration of its complexity and the diversity of implementations. Draft heuristics for constructing NG911 models are pres ented based on the analysis along with a summary of current challenges and ways to improve future NG911 modeling efforts. We found that NG911 relies on E nhanced 911 (E911) assets such as 911 selective routers to route calls originating from traditional tel ephony service which are a majority of 911 calls. We also found that the diversity and transitional nature of NG911 implementations necessitates significant and frequent data collection to ensure that adequate model s are available for crisis action support.

Central to protecting our nation's critical infrastructure is the development of methodologies for prioritizing action and supporting resource allocation decisions associated with risk-reduction initiatives. Toward this need a web-based risk assessment framework that promotes the anonymous sharing of results among water utilities is demonstrated. Anonymous sharing of results offers a number of potential advantages such as assistance in recognizing and correcting bias, identification of 'unknown, unknowns', self-assessment and benchmarking for the local utility, treatment of shared assets and/or threats across multiple utilities, and prioritization of actions beyond the scale of a single utility. The constructed framework was demonstrated for three water utilities. Demonstration results were then compared to risk assessment results developed using a different risk assessment application by a different set of analysts.