PWG992393, 394, 395, 396, 400, 401, 402-CS - Threat and Risk Assessment-CS

The TRA process involves defining what requires protection, analyzing the relevant threats, assessing the corresponding risk, and making recommendations for the management of risk.  A complete and current assessment of the threat to information and assets under PSPC’s custodial responsibility is needed at each site to determine the adequacy of existing or proposed safeguards.  The Consultant must conduct Threat and Risk Assessment(s) of the asset(s) as listed above, in accordance with the five steps prescribed in the Policy on Government Security by: Establishing the scope of the assessment and identifying employees and assets to be safeguarded.  Determining the threats to employees and assets and assessing the likelihood and impact of their occurrence. 
Assessing the risk based on adequacy of existing safeguards and vulnerabilities.  Proposing new, modified, or removal of obsolete safeguards, if necessary, to reduce risk.  Identify Residual Risk that will exist following implementation of recommendation.