1. CAIRA is a quantitative vulnerability assessment tool for examining the physical security of energy systems (electrical, natural gas, steam and water) supporting an organization’s inhabited facilities and uninhabited structures. The protection of personnel by reducing the effects of a terrorist act and criminal activity against the asset and its people was the key premise for the development of ABRA. By using ABRA, decision makers can allocate funds on countermeasures that are actually effective in providing the biggest reduction of risk to the greatest number of personnel first. Critical Asset and Infrastructure Risk Analysis (CAIRA) Fact Sheet ENERGY SYSTEMS: Electrical Natural Gas Steam (environmental control) Water Ventura, CA 93003-6213 (805) 509-8655 www.hainessecuritysolutions.com The Purpose The primary purpose of CAIRA is to quantitatively measure threats, assets, vulnerabilities, and risks associated with energy systems supporting large and/or small government or private facilities. It establishes a security baseline, explores upgrades, recalculates vulnerabilities and risks, and recommends optimized features or improvements for facilities. In essence, CAIRA identifies current levels of vulnerability and risk and then identifies improved levels with the implementation of specified countermeasures. Basically, a snapshot of where the organization is today and where it could be after countermeasures are implemented. In addition, CAIRA identifies the associated cost and impact of the improvements. Analysis is divided into five sub- sets: Hazards Assessment Physical Protection Risk Reduction Functional Area Analysis Cost Benefit Analysis Analysis is divided into five sub- sets: Hazards Assessment Physical Protection Risk Reduction Functional Area Analysis Cost Benefit Analysis

2. Capabilities Calculates threat likelihood (probability of attack) Calculates effectiveness of attack (probability of success) Final threat likelihood can be adjusted, if necessary Compares baseline vulnerability level (current state) with Optimized vulnerability level (after countermeasures have been implemented) Recommends mitigation strategies based on risk reduction and costs Capabilities Calculates threat likelihood (probability of attack) Calculates effectiveness of attack (probability of success) Final threat likelihood can be adjusted, if necessary Compares baseline vulnerability level (current state) with Optimized vulnerability level (after countermeasures have been implemented) Recommends mitigation strategies based on risk reduction and costs Life-time training & support Life-time training & support Ventura, CA 93003-6213 (805) 509-8655 www.hainessecuritysolutions.com Unlike standard compliance based assessments, CAIRA; Predicts likelihood of occurrence Quantifies vulnerabilities and risks Determines the cost effectiveness of specific improvements and helps prioritize countermeasures Unlike standard compliance based assessments, CAIRA; Predicts likelihood of occurrence Quantifies vulnerabilities and risks Determines the cost effectiveness of specific improvements and helps prioritize countermeasures