The questions found in the RIST-V come from major discipline-specific standards and best practices identified for the Healthcare and Public Health Sector, along with input from subject matter experts. The sources include:
ASIS International (2009), Facilities Physical Security Measures Guideline
ASIS International (2012), Security Management Standard: Physical Asset Protection
U.S. Department of Health and Human Services, Office of the Assistant Secretary for Preparedness and Response (2012), Healthcare Preparedness Capabilities: National Guidance for Healthcare System Preparedness
Centers for Medicare & Medicaid Services, Emergency Preparedness Rule
Centers for Disease Control and Prevention, Office of Public Health Preparedness and Response (2011), Public Health Preparedness Capabilities: National Standards for State and Local Planning
U.S. Department of Homeland Security (2013), Infrastructure Survey Tool and Rapid Survey Tool and Supporting Reference Manuals
California Emergency Medical Services Authority (2014), Hospital Incident Command System Guidebook
Borten, K. (2016), Combat Visual Hacking in Healthcare
National Fire Protection Association (2015), NFPA 1600: Standard on Disaster/Emergency Management and Business Continuity/Continuity of Operations Programs
New Jersey Hospital Association (2004), Emergency Preparedness Hospital Security Readiness Assessment Tool
The Joint Commission (2011), Comprehensive Accreditation Manual for Hospitals
National Institute of Standards and Technology (2014), Framework for Improving Critical Infrastructure Cybersecurity
Many terms have been defined, as indicated by a light blue underlined text; click on these terms to display a pop-up window containing the definition. If you have identified additional terms that you believe should be formally defined, please send your request to hphrisc@hhs.gov.
Many questions in the tool have the option to select Not Applicable (N/A). If you have identified an additional question that does not apply to your facility type, please report this to hphrisc@hhs.gov
. Provide the question number and your facility type and the question will be reviewed for possible modification in future versions of the RIST-V.
These narrative responses are not used in the Vulnerability Score or subsequent risk calculations. They are intended to function as institutional memory and be used by the facilities themselves to track their answers.
The questions in this tool cover a wide range of topics that will require diverse expertise and disparate information to complete; therefore, it is anticipated that the tool will be completed by a group of experts rather than a single individual. While the tool may be completed by a single individual, it is recommended that users collaborate with the relevant individuals and departments within their organization with the appropriate operational knowledge (e.g., CFO, IT Department, Emergency Manager), as well as with external agencies as needed.
The Vulnerability Scores reported in the RIST-V represent the overall facility vulnerability as well as the vulnerability for each major section and subsection of the tool. These scores depict the extent of the facility’s vulnerability to the entire all-hazards landscape (i.e., are not hazard-specific) based on the policies, plans, procedures, and capabilities in place at a facility. The Vulnerability Scores are calculated on a scale from zero to one; a score closer to zero indicates the facility or asset being assessed has low overall vulnerability and is highly resistant.
In the Dashboard, the overall Vulnerability Score is adjusted to reflect only the vulnerabilities relevant to each specific threat or hazard. For example, physical security training will play a role in mitigating the risk associated with an active shooter event, but will not affect the risk associated with a hurricane. These scores are on a scale of zero to one and are analogous to the RIST-V Vulnerability Scores divided by 100 (i.e., a 0.23 in the Dashboard is similar to a 23 in the RIST-V).
The RIST-V report provides an overall Vulnerability Score for the facility as well as Vulnerability Scores for each major section and subsection of the tool. All Vulnerability Scores are on a scale of 0–100, with a score closer to zero indicating less vulnerability. The scores reflect the number of protective measures and procedures in place as reflected in your answers to the survey questions. Users can review sections with high vulnerability scores to determine what actions can be taken to reduce vulnerability.
The results of the RIST-V can be used on their own or in combination with existing planning and preparedness activities in your organization. However, a risk-based approach to preparedness planning also incorporates information on likelihood and consequence of individual threats or hazards. Using the RIST-V as part of the HPH RISC Toolkit will provide additional information and calculate Risk Ratings specific to individual threats or hazards, allowing risk-based prioritization of corrective actions.
A larger Vulnerability Score indicates a greater level of vulnerability; thus, follow-on actions after performing a vulnerability assessment with the RIST-V should be designed to reduce your scores. Notably, Vulnerability Scores are based on all survey questions regardless of facility type, size, or other characteristics. Therefore, some procedures or mitigations that could be implemented to reduce vulnerability may not be desirable or feasible for your facility (for example, screening and badging all visitors in a large hospital). The end goal of this assessment should be to identify ways to minimize vulnerabilities, not to reduce all vulnerability to zero.
An initial step to improve Vulnerability Scores is to identify those sections and subsections with the highest vulnerability scores. Users can then review those sections to identify responses that increased vulnerability, thus identifying specific actions to improve scores. A handful of general resources regarding vulnerability are provided in the introduction page of the RIST-V module that can be accessed for ideas on improving mitigation strategies and reducing vulnerability.
