Security Threat & Risk Assessment

Document control

Project / development

Client

Assessor / consultant

Document control number

Revision

Issue datee.g. 01/06/2026

Document classificationMarking applied to every printed page and export

Scope of assessment

Design / project stage

Assessment boundary

Governing methodology

Regulatory regime

HCIS facility security classificationSEC-01 Appendix A — determines the applicable directives

Operational status

Cyber security treatment

Threat environment ratings avg —

Regional threat rating

Local threat rating

Site target attractiveness

Threat category ratings

Design basis

Design basis threat (DBT)

National threat level

Response force time

Scoring model

ISPS regime

Aviation security regime

Add asset

Asset category

Asset / facility

Asset reference

Criticality ranking (C)

Security zone

Exposure / setting

Asset register 0

Ref	Category	Asset	Zone	Exposure	C	Severity class	Depends on

Site survey evidence 0

Asset

Survey date

Surveyor

Observed condition

Latitude

Longitude

Photographs (up to 2)

Position

Findings

Adversary profiles

Adversary type	Source	Intent (I)	Capability (C)	Motivation (M)	DBT tier	Confidence	Threat ranking

Personnel security register 0

Role

Area / asset reached

Sensitivity tier

Compartment

Headcount

Access last reconciled

Criticality C—

Vulnerability V—

Attractive A—

Historical H—

Severity S—

Likelihood L—(A + H + V) ÷ 3

Untreated risk—S × L

Residual risk—

Scenario definition

Asset at risk

Security event / undesired act

Threat category

Attributed adversary

Existing countermeasures

Vulnerability rating (V)

Target attractiveness (A)

Historical likelihood (H)

Primary impact

Confidence in this assessment

Undesired act — sequence of events

Risk treatment 0 selected

★ marks measures indicated for this scenario

Adversary path timeline —

Summary

Register 0

#	Security event type	Cat	Asset	C	V	A	H	S	L	R	Untreated	RR	Residual	Treatment

Security risk matrix — untreated

Security risk matrix — residual

Protection objectives coverage

Residual risk statement

Phased residual risk

Implementation roadmap 0

Compliance matrix — submission format 0

Treatment factor coverage

Standards and regulatory basis 0

Risk bands and threat domains

Highest-rated risks 0

Risk maps — untreated and residual

Coverage and gaps

Design basis, confidence and phasing

Roadmap, evidence and integrity

Add a journal entry

Entry type

Recorded by

Reference

Entry

Assessment journal 0

Show

Assessment log — every assessment on this device 0

Save a snapshot of the current assessment here whenever you reach a milestone. Each saved assessment can be reopened, duplicated as the starting point for a new site, or removed. The log lives in this browser; export it to move it between machines.

HARISAGENT.AI