Getting a vulnerability assessment

Your risk/threat/vulnerability assessment should be a document that identifies threats, vulnerabilities and possible consequences of an attack on your site or people, and using those findings, makes recommendations to enhance deterrence, detection, denial and damage limitation. A central component of the evaluation process will be “findings from previously conducted threat and/or vulnerability assessments.”

A document prepared with a specific facility in mind will inevitably carry more weight than generalized information on the terrorism threat overseas or the threat to Jews internationally. Vulnerability assessments can and should reflect gaps in equipment, training and procedures and make recommendations to bridge them.

The vulnerability assessment is the basis of your work plan. New York State requests applicants to upload their full vulnerability assessment and uses the vulnerability assessment as one factor in the prioritzation of New York applications (although the U.S. DHS only looks at the Investment Justification itself). The New York State panel reviewing your application will look at your vulnerability assessment to determine whether it identifies the threats, vulnerabilities and possible consequences of an attack on your site or people and whether it makes appropriate recommendations to address them. Remember: IMPACT is a significant component of the Investment Justification. A good vulnerability assessment will document the impact and make for a better application.

Relying on an existing survey

While your Investment Justification must be based on a previously conducted assessment, there is no requirement about the age of the assessment. If you have a vulnerability assessment from a previous year you should review it to check whether it still reflects an accurate, up-to-date description of your facilities and operations. Current conditions which can be detailed on a cover sheet that is included with the assessment that is uploaded with your application package.

Be sure to note any change in risk (threat, vulnerability or possible consequences), steps already taken to mitigate or eliminate vulnerabilities or new conditions. For example, if you installed equipment, conducted trainings or changed security policies/procedures, those changes should be noted on your cover sheet update.

Getting a survey

The reviewers will consider any appropriate survey. However, it is likely that current surveys, performed by credentialed and independent professionals and specific to the organization and building , will be considered of greatest value. Each organization is advised to consult any experts it believes necessary. If you want to conduct your own risk assessment and/or better prioritize your prospective purchases, check out the Vulnerability, risk and safety assessments and planning section found on the JCRC-NY Security Resources webpage.

Many police departments will conduct a risk assessment at no cost. While any of “previously conducted risk assessments” is accepted as sufficient for grant purposes, not all risk assessments address the specific threats related to terrorism. In fact, a crime prevention survey basically looks at a single threat: crime (although the vulnerabilities identified in a crime prevention survey often overlap some of the vulnerabilities associated with terrorism) . Applicants who do not secure sophisticated surveys will have to supplement their existing survey to include the various terrorist threats.

Some suggestions for outside assessments:

    1. The NYPD Crime Prevention Section will schedule a crime prevention survey on a first-come, first-served basis. Contact them at or (212) 614-6741. Your local precinct (the name and phone number of the precinct crime prevention officer is usually listed on the precinct webpage here) also has crime prevention officers.
    2. Nassau County organizations can request a survey from the Nassau County Police Department, Community Affairs, at (516) 573-7360.
    3. Contact information for many of the police and sheriff departments in Weschester County are available here.
    4. For many years the Terrorism Vulnerability Assessment Program at John Jay College of Criminal Justice. This program may be reinstated. Email them at to check out the status of the program.
    5. The Nonprofit Security Grant Program will accept self-assessments. For help with risk and vulnerability assessments, see the JCRC-NY Security Resources webpage.
    6. Recently, some security vendors have advertised offering free security assessments:
      • We strongly suggest that you verify the credentials of any vendor. Some vendors have significant training and/or broadly recognized credentials. Be cautious about turning to vendors trained to install specific products (or a range of products). They may not be capable of addressing the entire range of your security needs.
      • Determine whether your vendor has a built-in conflict of interest. We have seen vulnerability assessments from some vendors that simply recommend the products that they sell. Make sure that the person conducting your assessment is competent to recommend the full range of options available on the AEL (authorized equipment list).
      • Remember. New York State requires successful applicants to ask for multiple bids. You cannot promise any vendor that you will buy the equipment from them should your application be successful.