| |
RAMCAP Plus™ - Frequently Asked Questions |
| |
- What is RAMCAP Plus™?
- If I buy and complete the RAMCAP Plus™ process, will I be in compliance with the new DHS chemical security regulations?
- What is the difference between RAMCAP™ and RAMCAP Plus™?
- Why is using the RAMCAP™ methodology for RAMCAP Plus™ important?
- Who owns the data?
- How would I apply RAMCAP Plus™ to evaluate the risk of terrorist threat, natural hazards, and unintentional threats to my facility?
- Many other risk assessment methods and processes already exist. What is the point of adding another?
- If I have already performed an assessment using another method, do I also need to perform a RAMCAP™ assessment using RAMCAP Plus™?
- Why should my company voluntarily comply with a request to do a RAMCAP™ assessment using RAMCAP Plus™?
- What threats should I assume when performing RAMCAP™?
- I can’t believe that my facility will ever be attacked by terrorists. Why should I complete RAMCAP Plus™?
- How can I get involved in the development of guidelines for my sector?
- Can I request DHS funding to carry out the RAMCAP™ assessment?
- Will I receive any formal certification or recognition for having applied RAMCAP™ methodology to my facility from RAMCAP Plus™?
- Will being RAMCAP™ certified lower my insurance rates?
- My facility has less than 10 employees and is located in a rural area. Do I need to perform a RAMCAP™ evaluation?
- How long will the screening process take?
|
| |
| |
|
What is RAMCAP Plus™?
RAMCAP™ stands for Risk Analysis and Management for Critical Asset Protection. RAMCAP Plus™ is an automated and efficient software program that enables users to conduct vulnerability and risk assessments, starting with the identification of critical assets and culminating in the management of risk for the entire facility. RAMCAP Plus™ follows the RAMCAP™ Methodology and allows the user(s) to assess their infrastructure from an all-hazards approach. |
| |
|
|
If I buy and complete the RAMCAP Plus™ process, will I be in compliance with the new DHS chemical security regulations?
The regulations are based on RAMCAP guidance that was developed for the U.S. Department of Homeland Security (DHS) in cooperation with representatives from the chemical sector. Currently, only Tier-4 chemical facilities are able to submit Alternate Security Programs (ASPs) in lieu of an SVA, SSP, or both for DHS compliance. |
| |
|
|
What is the difference between RAMCAP™ and RAMCAP Plus™?
Risk Analysis and Management for Critical Asset Protection (RAMCAP™ ) is a framework for analyzing and managing the risks associated with terrorist attacks against critical infrastructures. RAMCAP™ provides a consistent and technically sound methodology to identify, analyze, quantify and communicate the consequences, vulnerabilities, and threats associated with terrorist attacks. Alion Science and Technology and ASME-ITI developed the RAMCAP Plus™ application. RAMCAP Plus™ (also developed by the ASME-ITI) is specifically designed for private sector owners and operators to perform risk management for internal decision-making purposes. RAMCAP Plus™ adds to RAMCAP™ by incorporating additional terrorist threats, natural hazards, and unintentional hazards. RAMCAP Plus™ also provides a robust cost-benefit tool and assists in analyzing business continuity risk. |
| |
|
|
Why is using the RAMCAP™ methodology for RAMCAP Plus™ important?
The purpose of using the RAMCAP™ Methodology for RAMCAP Plus™ important is two-fold. First, it defines a common risk framework that can be used by the owners and operators of the nation's critical infrastructure to assess terrorist risk to their own assets and systems. Second, it provides guidance on methods that can be used to assess and estimate risk information defined by the common framework. |
| |
|
|
Who owns the data?
You own your data. No one else can view your data without your authority. |
| |
|
|
How would I apply RAMCAP Plus™ to evaluate the risk of terrorist threat, natural hazards, and unintentional threats to my facility?
RAMCAP Plus™ is based on a very simple principle. Risk from an all hazard approach can be evaluated by considering three fundamental variables. In equation form, this is represented as:
Risk = Consequence x Vulnerability x Threat
The problem, of course, is to quantify the consequences of an assumed attack scenario, the vulnerability of the facility to the attack and the likelihood of having such an attack. RAMCAP Plus™ outlines the general approach to the process, and sector specific guidelines are being developed to particularize the method in certain economic sectors that have common characteristics such as chemical plants, refineries, petroleum, electric power generation and transmission, nuclear power plants, etc. |
| |
|
|
Many other risk assessment methods and processes already exist. What is the point of adding another?
All of the other methods that have been investigated by ASME-ITI were developed for a specific purpose and many provide excellent results. What is lacking is a common terminology, common scales of reference and uniform reporting requirements. Without commonality it is impossible to compare the risks for similar types of facilities and especially across diverse sectors. Proper allocation of the limited recourses available to the government depends upon proper ranking of risk. |
| |
|
|
If I have already performed an assessment using another method, do I also need to perform a RAMCAP™ assessment using RAMCAP Plus™?
The answer is yes, but every effort is being made to use the results of previous assessments to reduce the work necessary to perform an RAMCAP™ assessment. Unless the commonality of RAMCAP™ is applied to all assets, it is not possible to compare risks across multiple sectors.
|
| |
|
|
Why should my company voluntarily comply with a request to do a RAMCAP™ assessment using RAMCAP Plus™?
RAMCAP™ is a cooperative effort on the part of government and industry to understand and manage the risk to the nation's critical infrastructure. An asset owner's voluntary participation will provide the data for better decision making on the part of Federal, State, and local governments. In addition, the knowledge gained by the asset owner will help in his/her own internal risk management strategy. |
| |
|
|
What threats should I assume when performing RAMCAP™?
DHS has provided a set of threat scenarios that are used for all assessments. RAMCAP Plus™ incorporates these selected threats and allows the user(s) to use the RAMCAP™ methodology to analyze other hazards. |
| |
|
|
I can’t believe that my facility will ever be attacked by terrorists. Why should I complete RAMCAP Plus™?
While terrorism is unlikely, the consequences can be extensive and in some cases, could put you out of business. RAMCAP Plus™ allows you to systematically go through potential scenarios to calculate your risk with respect to both financial and human losses.
|
| |
|
|
How can I get involved in the development of guidelines for my sector?
As new sectors/modules are initiated in the future, ASME-ITI and Alion will notify interested parties. To express your interest, please contact an RAMCAP Plus™ Representative. |
| |
|
|
Can I request DHS funding to carry out the RAMCAP™ assessment?
No. The process is voluntary and no compensation is provided. |
| |
|
|
Will I receive any formal certification or recognition for having applied RAMCAP™ methodology to my facility from RAMCAP Plus™?
Not at this time, however it is foreseeable that such a program would exist in the near future. |
| |
|
|
Will being RAMCAP™ certified lower my insurance rates?
At this time the insurance companies have not indicated that they will consider RAMCAP™ as a factor in setting rate structure. |
| |
|
|
My facility has less than 10 employees and is located in a rural area. Do I need to perform a RAMCAP™ evaluation?
RAMCAP™ uses a screening process to eliminate facilities that do not pose a high risk from further consideration. This process is sector specific and is usually based upon the worst reasonable scenario for damage. The screening process will eliminate approximately 90% of the facilities in many sectors. The screening process can be completed quickly in most cases and no further work is necessary. |
| |
|
|
How long will the screening process take?
The Top Screening process can usually be performed in less than one day. A complete RAMCAP Plus™ assessment for a chemical facility can take less than two days and it involves several people who are knowledgeable about the facility. |
| |
|
| |
|
|
