Risk and Capability Assessment That Supports Better Decisions

 

SalTHIRA™ helps leaders understand what can happen, how serious the consequences could be, what their organization must be capable of doing, where meaningful gaps exist, and where limited resources can make the greatest difference.

​

It is a human-led threat, hazard, risk, and capability-assessment methodology informed by national preparedness doctrine and decades of Salus experience across emergency management, security, intelligence, public safety, aviation, critical infrastructure, cybersecurity, investigations, protective operations, crisis communications, and disaster response.

 

SalTHIRA does more than identify problems. It helps leadership understand priorities, compare potential improvements, make defensible decisions, and move from assessment to action.

​

Discuss a SalTHIRA™ Assessment >

Speak With a Salus Expert >

​

Beyond the Traditional Risk Assessment

 

Many assessments identify threats or vulnerabilities and conclude with a long list of recommendations.

​

That information may be useful, but it does not necessarily tell leadership:

• Which conditions could cause the greatest consequences

• What the organization must be capable of doing

• Whether those capabilities currently exist

• Which gaps matter most

• What improvements would meaningfully change the outcome

• Where available resources should be applied first

• What risk may remain after improvements are made

• What risk the organization may be accepting if it does nothing

 

SalTHIRA connects threats and hazards to consequences, consequences to required capabilities, capabilities to current resources, and meaningful gaps to leadership decisions.

​

​

​

​

​

​

​

​

​

 

 

 

 

 

 

 

 

 

The Six-Step SalTHIRA Methodology

 

1. Identify Threats and Hazards

​

Salus professionals work with Protected Members to identify relevant natural, technological, accidental, operational, and intentional conditions that could affect the organization.

​

The objective is not to create an endless catalog of everything that could possibly happen. It is to identify conditions that warrant examination because of their relevance, plausibility, consequences, or importance to the mission.

​

2. Give Threats and Hazards Context

 

A threat or hazard cannot be understood through its name alone.

​

Salus examines how a condition could affect the Protected Member’s actual operating environment, including its people, facilities, information, essential functions, dependencies, responsibilities, geography, resources, and mission priorities.

 

Context transforms a general concern into a situation leadership can meaningfully evaluate.

​

3. Establish Capability Targets

 

SalTHIRA helps define what the organization must be capable of accomplishing before, during, and after the conditions being assessed.

​

Capability targets consider the outcomes, scale, timing, resources, coordination, and performance needed to prevent, protect against, mitigate, respond to, and recover from disruption.

 

The focus is on what the organization must be able to do—not merely what plans or policies say should happen.

 

4. Assess Existing Capabilities

Salus professionals work with leadership, operational personnel, and appropriate subject-matter experts to understand what the organization can accomplish today.

​

The assessment may consider people, authorities, plans, training, equipment, facilities, information, communications, contracts, vendors, partnerships, procedures, and other resources supporting the required capability.

 

Claims of capability should be supported by appropriate evidence, experience, observation, testing, or professional review.

 

5. Identify Risks and Capability Gaps

 

SalTHIRA compares required capability with existing capability to identify meaningful strengths, limitations, dependencies, vulnerabilities, and gaps.

​

Not every difference carries the same consequence. Salus professionals consider how gaps could affect people, operations, mission continuity, response, recovery, and the organization’s ability to meet its responsibilities.

​

The purpose is to focus attention on gaps that materially affect outcomes.

​

6. Describe the Impact of Proposed Changes

​

This step distinguishes SalTHIRA from many conventional assessments.

 

Salus helps leadership understand how proposed improvements could affect capability and risk.

 

This allows decision-makers to compare options and consider:

• What changes if the improvement is made

• What consequences may be reduced

• What capability may be strengthened

• What dependencies or limitations may remain

• Where investment could produce the greatest benefit

• What should be addressed first

• What risk may reasonably be accepted

• What risk remains if no action is taken

 

SalTHIRA supports leadership decisions. It does not make those decisions for the Protected Member.

​

The Questions That Matter

 

SalTHIRA helps leadership answer:

• What can happen?

• Why is it relevant to our organization?

• How serious could the consequences be?

• What people, operations, assets, and missions could be affected?

• What must we be capable of doing?

• What can we actually do today?

• What assumptions are we relying upon?

• Where are our most meaningful gaps?

• Which improvements would change the outcome?

• What should we address first?

• What risk will remain?

• What risk are we accepting if we do nothing?

 

A Whole-Organization View of Risk

 

Organizations do not experience risk in isolated professional categories.

 

A cyber incident may disrupt physical operations. A severe-weather event may affect transportation, utilities, staffing, communications, facilities, vendors, emergency services, and supply chains simultaneously. An insider may use legitimate access to create physical, operational, informational, or reputational harm.

 

SalTHIRA can examine the relationships among:

• Natural hazards

• Accidental and technological failures

• Intentional and adversarial threats

• Physical and personnel security

• Cyber and information dependencies

• Critical infrastructure

• Essential functions and continuity

• Leadership and organizational decision-making

• Vendors, contractors, and supply chains

• Public-safety and community resources

• Readiness, response, and recovery capabilities

• Cascading and common-cause failures

 

This multidisciplinary perspective helps leadership understand how separate vulnerabilities and dependencies can combine to create larger consequences.

​

Built by Practitioners

 

SalTHIRA is not a generic checklist or an assessment performed from a single professional perspective.

​

The methodology draws upon the collective experience of Salus professionals and subject-matter experts from government, emergency management, intelligence, security, law enforcement, military operations, aviation, transportation, critical infrastructure, cybersecurity, engineering, crisis communications, investigations, executive protection, disaster response, finance, behavioral sciences, and organizational leadership.

 

The appropriate professionals are selected according to the operating environment and questions being assessed.

 

Cyber capabilities should be examined by people who understand cyber risk. Aviation capabilities should be examined by aviation professionals. Emergency-management capabilities should be evaluated by people who have developed, exercised, and operated emergency programs.

 

This helps SalTHIRA reflect how organizations actually function—not simply how their plans suggest they function.

 

Experience Behind the Methodology

 

SalTHIRA was developed under the leadership of Marc Duncan, drawing upon more than three decades of work in preparedness doctrine, emergency management, security, intelligence, aviation, critical infrastructure, investigations, protective operations, crisis communications, and real-world response.

​

That experience includes subject-matter and co-author support for national preparedness and

​

THIRA guidance, federally funded applied security research, work supporting the National Academies and Transportation Research Board, and direct involvement in complex public- and private-sector missions.

​

SalTHIRA adapts established threat and hazard identification and risk-assessment principles into a practical methodology that can be applied to the distinct needs of a Protected Member.

 

Protected Members Are Part of the Assessment

 

An effective assessment cannot be performed in isolation.

​

Executives, operational personnel, subject-matter experts, facility representatives, technology professionals, vendors, and other appropriate stakeholders may each possess knowledge needed to understand how the organization actually operates.

​

Salus works with the Protected Member to identify the appropriate participants and obtain relevant context and evidence.

 

This collaborative approach can:

• Improve the accuracy of the assessment

• Identify assumptions that have not been tested

• Reveal dependencies that cross organizational boundaries

• Develop a shared understanding of risk

• Help leadership build consensus around priorities

• Produce recommendations appropriate to available authority and resources

 

The objective is not for Salus to simply tell an organization what to do. It is to provide leadership with a credible and evidence-informed basis for making decisions.

 

Scaled to the Requirement

Not every concern requires the same depth of investigation or assessment. SalTHIRA engagements can be scoped at different levels.

​

Initial Assessment

A focused examination intended to identify major concerns, immediate information gaps, apparent capability limitations, and areas that may require additional attention.

 

Comprehensive Assessment

A broader assessment using stakeholder engagement, document and evidence review, defined scenarios, capability evaluation, gap analysis, and prioritized recommendations.

 

Deep-Dive Investigation and Assessment

 

An intensive examination of complex or high-consequence concerns. It may involve expanded research, additional subject-matter experts, detailed dependency analysis, site or operational review, deeper evidence development, and examination of cascading or adversarial conditions.

​

The agreed scope defines the depth, evidence requirements, participants, deliverables, and limits of the assessment. If new questions exceed that scope, Salus identifies them as potential follow-on requirements rather than allowing the engagement to expand without definition.

​

What SalTHIRA Can Assess

 

SalTHIRA can be applied to an entire organization or to a defined requirement, such as:

• A facility or group of facilities

• An essential function or operational program

• Security and protective capability

• Emergency-management readiness

• Continuity and recovery

• Aviation or transportation operations

• Critical infrastructure

• Cyber-physical dependencies

• Supply chains and vendors

• Executive or personnel protection

• Events and public activities

• Incident-response capability

• Plans, training, and exercises

• A proposed investment or corrective action

• A specific threat, hazard, vulnerability, or operational concern

 

What Protected Members May Receive

 

Depending on the scope, SalTHIRA deliverables may include:

​

• An executive summary

• Defined assessment scope and assumptions

• Threat and hazard context

• Consequence analysis

• Capability targets

• Existing-capability findings

• Identified strengths, vulnerabilities, dependencies, and gaps

• Risk-informed priorities

• Recommendations and potential courses of action

• Discussion of the expected impact of proposed changes

• Identification of residual or accepted risk

• Supporting evidence and documented limitations

• An implementation or improvement roadmap

• Leadership briefing and decision support

 

The specific content and depth are established for each engagement.

 

From Intelligence to Assessment

 

SalINTEL™ can provide qualified intelligence concerning the threats, hazards, activities, locations, people, organizations, and changing conditions relevant to the assessment.

​

That intelligence helps SalTHIRA remain connected to the Protected Member’s actual environment rather than relying only on generic assumptions.

​

Explore SalINTEL™ >

​

From Findings to Decisions

 

SalTHIRA findings, priorities, and recommendations can be delivered and coordinated through SalCAPA™.

 

SalCAPA helps Protected Members and Salus professionals review relevant information, coordinate questions, document leadership decisions, assign approved responsibilities, and monitor follow-through.

​

Explore SalCAPA™ >

​

From Decisions to Capability

 

When a Protected Member approves action, SalOPS™ can help implement, sustain, test, and improve the required capability.

 

This may include planning, program development, training, exercises, protective services, incident support, recovery assistance, corrective action, or other authorized operational support.

​

SalTHIRA identifies and prioritizes the need. SalOPS helps turn the approved priority into practical capability.

​

Explore SalOPS™ >

​

A Defensible Basis for Action

 

SalTHIRA helps leaders identify risk, define required capability, understand meaningful gaps, compare potential improvements, and decide what should be addressed first.

 

The result is not merely another report. It is a clearer and more defensible basis for protecting people, sustaining operations, strengthening readiness, and directing limited resources toward the actions most likely to improve outcomes.

 

Discuss a SalTHIRA™ Assessment >

Speak With a Salus Expert >

 

Next: Explore SalOPS™ >