Threats, Vulnerabilities and Risk Assessment
This domain is the analytical heart of the CPSS. The exam tests whether you can name a threat precisely, find the vulnerability that lets it succeed, size the consequence, and defend a prioritisation - rather than produce a checklist.
Threat taxonomy
- Intentional theft: pilferage, straight theft, hijacking, fictitious pickup, strategic theft of identified high-value loads, warehouse collusion.
- Intentional deception: forged documents, carrier identity theft, double brokering, invoice and payment fraud.
- Intentional other: terrorism, contraband and stowaways, smuggling, counterfeiting and piracy, product adulteration or substitution, extortion, insider sabotage, protest and blockade.
- Unintentional: natural hazards, fire, accidents, documentation error, single-source dependency, supplier insolvency, cyber outage.
Vulnerability and consequence
- Vulnerability is a weakness in design, control or process - not a threat. No vulnerability, no loss, however strong the threat.
- Assess consequence across impact types: people, product, property, information, revenue, reputation, regulatory and contractual penalty.
- Rank assets, lanes and nodes by attractiveness (value, portability, resale demand) and by criticality to the business.
Analysis methods
- Qualitative matrices with defined likelihood and impact criteria; quantitative work using single loss expectancy multiplied by annualised rate of occurrence to give annualised loss expectancy.
- CARVER (criticality, accessibility, recuperability, vulnerability, effect, recognizability) scores target attractiveness for a deliberate adversary.
- Evidence sources: internal incident history, carrier and insurer reports, industry incident services such as TAPA IIS and CargoNet, sector ISACs, customs seizure data, law enforcement, open source.
- Structured challenge: scenario workshops, Delphi rounds, red-team walkthroughs.
Worked example
A pharmaceutical lane moves 2 million of product per shipment, twice weekly. Loss history and industry data suggest a hijack attempt roughly once every two years; a full loss costs 2 million plus about 300,000 in penalties and expediting. Annualised loss expectancy is roughly 1.15 million. That dwarfs the 120,000 annual cost of tracking, high-security seals, driver vetting and escorted final mile, so the treatment is justified even before insurer pressure. Had the same analysis produced a 20,000 expectancy, the control set would need re-scoping rather than automatic approval.
Traps
Naming threats with no actor, method or motive; assigning high, medium or low with no criteria; forgetting that new controls create new vulnerabilities; assessing a generic facility instead of this lane or site; and treating industry statistics as your own loss history.