ABSTRACT
To maintain consistency, given that conditions of some of the initiating events identified for security risk assessment are random and others are not, the likelihood of initiating events for all threats of the spectrum will be assessed in terms of the threat environment rather than a likelihood of occurrence. In this way, relative conditional security risk is estimated for the threat spectrum. This risk level is relative in that it is interpreted in relation to the other values rather than as an absolute value. The risk level is conditional in that it is evaluated given that the initiating event occurs. The threat environment is judged to be either high or low. If the threat environment is judged to be high, the initiating event is judged credible to occur; if the threat environment is judged to be low, the initiating event is assessed to be not credible at this time. Security risk assessments are conducted for events judged to be credible to occur. If the threat changes and the threat environment are judged to be high, a risk assessment should be completed.
