May/June 2024 - 23

PT-RAM Requirements
Until the current FY, FEMA permitted transit agencies to
voluntarily complete and submit PT-RAM results as part of
a TSGP request. Agencies were encouraged (not required)
to utilize PT-RAM materials to allow the agency to develop
and implement effective risk mitigation projects. Although
submission of the materials was not mandatory to justify
funding, PT-RAM provided a methodology to holistically
and internally evaluate vulnerabilities and potential threats
targeting transit.
In FY 24, FEMA has solidified the requirement to mandate
PT-RAM performance within three years of, or in conjunction
with, the award of TSGP funding. This new mandate
makes PT-RAM obligatory to receive funding while maintaining
the intent of the methodology: Addressing security
vulnerabilities in transit systems and preparing to combat
physical and cyber threats.
PT-RAM is designed to assess risks across a range of
asset types and threat scenarios, utilizing inputs from subject-matter
experts within the transit agency. The PT-RAM
process compels agencies to submit the PT-RAM tool output
provided by FEMA, conduct a gap analysis to assess current
capabilities and develop an implementation plan outlining
strategies and measures to mitigate risks.
TVA Process
For compliance with the new FEMA requirements, transit
agencies must conduct (internally or via a third-party) a
comprehensive Threat and Vulnerability Assessment (TVA).
A TVA involves analyzing and evaluating vulnerabilities,
consequences and mitigation measures associated with essential
operations, capabilities, systems, information, policies
and internal controls that can be exploited by a broad range
of threats and hazards.
The primary purpose of a TVA is to ensure operational
survivability in the face of threats, encompassing five pillars:
Redundancy, resiliency, endurance, diversity and capacity.
Redundancy ensures the availability of multiple systems
or components to provide critical services while resiliency
describes the ability of a facility or system to sustain operations
despite damaging events. Endurance denotes the peSurvivability
of operations, functions and assets
Redundancy Resiliency
Endurance
Diversity
The five pillars of operational survivability in the face of threats.
Graphic: Ensco
A TVA involves
analyzing and
evaluating vulnerabilities,
consequences and mitigation
measures associated
with essential operations,
capabilities, systems,
information, policies and
internal controls that can be
exploited by a broad range of
threats and hazards. "
Erin Plemons,
Director, Center for Critical
Infrastructure Protection (CCIP)
riod for which backup systems provide
critical services and diversity refers to
the physical separation of redundant
systems to reduce the probability of
damage. Finally, capacity measures
the output that a system or component
can provide. With survivability as a
goal, transit agencies can uphold these
tenants by conducting a thorough TVA
and executing a mitigation strategy.
Conducting a robust TVA is crucial
in today's complex security landscape.
The foundational step involves
understanding and documenting the
organization's mission and essential
functions. This clarity helps to identify
assets that need protection, setting the
stage for a focused assessment.
After the mission is defined, critical
Capacity
assets must be identified, in collaboration
with operations owners, to assist in
formulating the scope and direction of
the assessment. A comprehensive threat
and hazard analysis identifies potential
events or circumstances that could
harm the organization, ranging from
adversarial actions to natural
disasters. Once critical assets
and potential threats are
identified, the next step is
to assess vulnerabilities in
an integrated and multidisciplinary
approach.
This involves the examination
of weaknesses, gaps
and strengths surrounding critical
MAY/JUNE 2024 | MassTransitmag.com 23
Photo: 1650637333 | everythingforall | Shutterstock
http://www.MassTransitmag.com
May/June 2024

Table of Contents for the Digital Edition of May/June 2024
