To achieve the “Basic” level for Assess, perform a risk assessment for high consequence assets (i.e., assets that would result in the highest public health and/or economic impacts if attacked or damaged) and the highest likelihood threats. Then evaluate the cost and benefit of additional countermeasures to reduce the risk level of the highest risk assets.

In addition, develop a risk management plan that contains a prioritized list of risk mitigation projects. The list should contain near-term process improvement projects (e.g., emergency response planning, improved security procedures) and long-term capital improvement projects (e.g., enhanced physical or cyber security, back-up power).

Finally, implement low-cost process-focused activities and projects that can be accomplished in the near term with current funding. Integrate the Risk Management Plan into your utility’s long range and capital investment planning for other projects as needed.