Step 3 - Identifies assets which, if attacked, produce the greatest risks for undesirable outcomes

In this step, criticality (X) and vulnerability (Y) coordinates are calculated for each asset.

The X and Y coordinates define a point for each asset in one of the four quadrants in the Criticality and Vulnerability Matrix. The criticality coordinate (X) is calculated based on the procedure described in Step 1. The vulnerability coordinate is calculated based on the procedure described in Step 2. X and Y coordinates plot the criticality and vulnerability for each critical asset:

X = Criticality = (x/Cmax)*100

Y = Vulnerability = (y/75)*100

where x and y are the raw values of criticality and vulnerability for each asset and Cmaxis the maximum possible Criticality value.

Assets that fall into Quadrant I -upper right - are both critical to the state or region and judged to be vulnerable to the identified threats. The specific consequences of attacks on these assets depend on the nature of the attack and the impact of the loss of the asset to the state or region. Consequences can vary from loss of life and property associated with the attack to loss of an important part of the transportation infrastructure needed to support economic activity, military deployment, or the ability to respond effectively to other emergencies (e.g., loss of an important evacuation route).