New York City Police Department

Engineering Security | Protective Design for High Risk Buildings

APPENDIX A: CALCULATING A BUILDING’S RISK TIER

The three steps set out in this Appendix can be used to determine whether a building falls into a Low, Medium, or High Tier. The attached worksheet can be used to perform the calculations described below.

STEP ONE: Calculating Sub-Factor Scores and Factor Ratings

The first step in arriving at a building’s overall risk tier is determining a rating for each factor - threat, vulnerability, and impact. Based on the definitions outlined below, assign a score of 1, 2, or 3 to each sub-factor.Add the sub-factor scores within each factor to determine the ratings for threat, vulnerability, and impact. The NYPD has defined each factor and sub-factor as follows:

Threat

A building's threat rating is the sum of the scores of two sub-factors: threat profile and target attractiveness. Because threat consists of only two sub-factors, the threat rating should range from 2 to 6. Scores for each threat sub-factor should be allocated as follows:

Threat Profile

  1. Limited - the building has no general or credible specific threats and no threat history.
  2. Moderate - the building falls into a category that is the subject of a past or present general threat but is not and has not been the target of a credible specific threat.
  3. Significant - the building currently is, or has been, the target of one or more credible specific threats.
Target Attractiveness
  1. Limited - neither the building’s architectural design nor its occupants or operations is nationally recognizable.
  2. Moderate - the building’s occupants and/or operations are nationally recognizable.
  3. Significant - the building’s architectural design is nationally recognizable.
Vulnerability

A building's vulnerability rating is the sum of the scores of three sub-factors: adjacency, accessibility, and structural performance. Because vulnerability consists of three sub-factors, the vulnerability rating should range from 3 to 9. Scores for each vulnerability sub-factor should be allocated as follows:

Adjacency1
  1. Limited - the building has no High Tier buildings located within 300 feet of it.
  2. Moderate - the building has at least one High Tier building located less than 300 feet, but more than 150 feet from it.
  3. Significant - the building has at least one High Tier building located within 150 feet of it.
Accessibility
  1. Limited - the movement of people in the building is controlled to a significant degree, including limited access to sensitive areas, and vehicles cannot enter the building and must be screened or otherwise obstructed before approaching.
  2. Moderate - the movement of people in the building is controlled; or vehicles are screened or otherwise obstructed before approaching. If vehicles are able to enter the building (e.g., through an internal parking garage or, in a handful of cases, on a street that cuts through the building), vehicles are screened prior to entry.
  3. Significant - the movement of people in the building is not controlled, or is controlled only to a limited degree, and vehicles are neither obstructed nor screened before approaching or entering.
Structural Performance
  1. Limited - for threats from the true perimeter, the building's primary structural elements satisfy M3 standards; and for threats from a contact charge, the building’s columns satisfy M1 standards.
  2. Moderate - for threats from the true perimeter, the building's primary structural elements satisfy M3 standards; or for threats from a contact charge, the building’s columns satisfy M1 standards.
  3. Significant - for threats from the true perimeter, the building's primary structural elements do not satisfy M3 standards; and for threats from a contact charge, the building's columns do not satisfy M1 standards.
Impact

A building's impact rating is the sum of the scores of four sub-factors: maximum occupancy or height, economic criticality, transportation criticality and proximity, and critical infrastructure proximity. Because impact consists of four sub-factors, the impact rating should range from 4 to 12. Scores for each impact sub-factor should be allocated as follows:

Maximum Occupancy or Height

  1. Limited - the building has a maximum occupancy level of less than 5,000 people and is shorter than 600 feet.
  2. Moderate - the building has a maximum occupancy level between 5,000 and 10,000 people or measures between 600 and 800 feet.
  3. Significant - the building has a maximum occupancy level of more than 10,000 people or is taller than 800 feet.
Economic Criticality

  1. Limited - a successful attack on the building could impact the local or regional economy, with limited or no effect on the national economy (total economic losses estimated at less than $1 billion).
  2. Moderate - a successful attack on the building could considerably impact the local or regional economy, or affect the national economy in the immediate aftermath of the attack (total economic losses ranging from $1 billion to $10 billion).
  3. Significant - a successful attack on the building could severely impact the local or regional economy, or affect the national economy for an appreciable period of time, beyond the immediate aftermath of the attack (total economic losses in excess of $10 billion).
Transportation Criticality and Proximity

  1. Limited - the building sits atop as many as one set of transit lines, or is located adjacent to the footprint of a transportation station servicing as many lines.
  2. Moderate - the building sits atop two to four sets of transit lines, or is located adjacent to the footprint of a transportation station servicing as many lines.
  3. Significant - the building sits atop five or more sets of transit lines, or is located adjacent to the footprint of a transportation hub or transfer point servicing as many lines; or, the building sits atop a vehicular tunnel or is adjacent to the entrance to a bridge.
Critical Infrastructure Proximity
  1. Limited - the building is not located so close to critical infrastructure that a successful attack against the building would have implications for service beyond the building itself.
  2. Moderate - the building is located so close to critical infrastructure that a successful attack against the building would have implications for - but would not severely disrupt – service beyond the building itself.
  3. Significant - the building is located so close to critical infrastructure that a successful attack against the building would severely disrupt service beyond the building itself.


STEP TWO: Calculating the Final Risk Score

The second step in arriving at a building's overall risk tier is determining the final risk score. Multiply the impact, vulnerability, and threat ratings to determine the final risk score. The final risk score should range from 24 to 648.

Figure 5: Distribution of Buildings by risk tier

STEP THREE: Determining the Risk Tier

Finally, to determine the overall risk tier of a particular building, use the worksheet provided in this Appendix. Generally, Low Tier buildings achieve a final risk score between 24 and 79;Medium Tier buildings achieve a final risk score between 120 and 197; and High Tier buildings achieve a final risk score between 288 and 648. There are two zones in which the appropriate tier may be determined by further analysis and consultation with the NYPD Counterterrorism Bureau: buildings that achieve scores between 80 and 119 may qualify as Low orMedium Tier; and buildings that achieve scores between 198 and 287 may qualify as Medium or High Tier. The NYPD protective security design recommendations outlined in Chapters Three through Seven apply to Medium and High Tier buildings.

Step One:

For each sub-factor, list the value (1-3) that most accurately describes your building.
Sum sub-factor scores to determine factor ratings.

Threat Threat Rating: _____

Threat Profile     _____

  1. Limited
  2. Moderate
  3. Significant

Target Attractiveness     _____

  1. Limited
  2. Moderate
  3. Significant
Vulnerability Vulnerability Rating: _____

Adjacency _____
  1. Limited
  2. Moderate
  3. Significant
Accessibility _____
  1. Limited
  2. Moderate
  3. Significant
Structural Performance _____
  1. Limited
  2. Moderate
  3. Significant
 
Impact Impact Rating: _____

Maximum Occupancy / Height _____
  1. Limited
  2. Moderate
  3. Significant
Economic Criticality _____
  1. Limited
  2. Moderate
  3. Significant
Transportation Criticality/Proximity _____
  1. Limited
  2. Moderate
  3. Significant
Critical Infrastructure Proximity _____
  1. Limited
  2. Moderate
  3. Significant
 
Step Two:
Multiply the factor ratings to arrive at the final risk score.

Threat x Vulnerability x Impact = Risk Score

______ x ___________ x ______= _________

Step Three:

Determine the building’s NYPD Risk Tier using the tier chart.

Risk Score
288 - 648
198 - 287
120 - 197
80 - 119
24 - 79
NYPD RISK TIER
High
Medium / High
Medium
Low / Medium
Low

NYPD RISK TIER:    _____________

Table of ContentsNext: Appendix B - New York City Building Code & NIST Recommendations