Risk and Vulnerability Analyses (ROS Analyses)
A comprehensive picture of what could happen
The ROS analysis identifies undesirable incidents and assesses causes, likelihood, consequences, vulnerabilities and barriers. It may cover natural events, accidents, technical failure, loss of supply, digital incidents and other circumstances that affect people, the environment, operations, finances or trust.
DSB's Analyses of Crisis Scenarios (AKS) are used where needed as a national knowledge base for serious incidents, consequential incidents and cross-sectoral dependencies. The scenarios are assessed for relevance and adapted to the organisation's geography, tasks, assets and emergency preparedness capacity.
Our advisers combine knowledge of the organisation with expertise in analysis, emergency preparedness, continuity and security. The result is more than a risk matrix: we document assumptions and uncertainty and link the findings to specific measures, plans and exercises.
The ROS analysis may include
- clarification of mandate, purpose, object of analysis, scope, participants, method, criteria and documentation requirements
- mapping of the organisation's assets, critical functions, deliverables, inputs and internal and external dependencies
- gathering of a knowledge base through document review, incident and non-conformity data, interviews, workshops, site visits and relevant external assessments
- use of DSB's Analyses of Crisis Scenarios (AKS) as inspiration and reference when identifying serious incidents, consequential incidents, consequences for society and emergency preparedness challenges
- assessment of the relevance of the scenarios and adaptation of relevant AKS assumptions to the organisation's geography, assets, tasks, critical societal functions and dependencies
- identification and selection of undesirable incidents with significant potential consequences for the organisation
- description of scenarios, causes, triggering factors, the course of events and possible consequential incidents
- assessment of likelihood or possibility, justified on the basis of history, exposure, causal factors and available knowledge
- assessment of direct and indirect consequences for life and health, the environment, operations and the ability to deliver, material and financial assets, reputation and trust
- vulnerability assessment of human, technological and organisational factors, capacity, redundancy, dependencies and the ability to recover
- mapping and assessment of existing likelihood-reducing and consequence-reducing barriers
- assessment of intentional undesirable actions as part of the ROS analysis, with relevant threat actors, actions and vulnerabilities where this falls within the scope
- assessment and documentation of assumptions, data quality, strength of knowledge, uncertainty and factors that may affect the conclusions
- compilation and presentation of risk and vulnerability in a risk table, risk matrix, scenario sheets or another suitable format
- identification and prioritisation of preventive, consequence-reducing and emergency preparedness measures
- assessment of the measures' expected effect, cost, feasibility, responsibility, deadline and significance for residual risk
- preparation of a plan for management follow-up, periodic review and revision of the ROS analysis
What does the organisation receive?
The organisation receives a ROS analysis anchored with management, with relevant scenarios, documented assessments and a prioritised action plan. The deliverable may include scenario sheets, a risk register, a risk matrix and links to emergency preparedness plans, action cards, continuity solutions and exercises. Relevant AKS scenarios can be used as a design basis.
← Back to Security Act and Risk Analysis