What to Do After a Threat Vulnerability Assessment

After a threat vulnerability assessment, the step before approving controls is to mark which routes each threat actor could use to reach the assets being protected. The findings become purchase requests, with a named owner beside each proposed fix. Before those requests are signed, compare the routes assessed with the access the operation will actually allow.

A threat vulnerability assessment examines how identified threats could exploit weaknesses in a system and recommends measures to protect its assets.

A remediation plan keeps the assessment’s access model

A useful assessment connects a threat to an asset and explains how that threat could cause harm. It records the controls already in place. Its recommendations identify where additional protection is needed. This gives the person approving security work something more useful than an undifferentiated list of equipment to buy.

The Whole Building Design Guide places threat assessment and vulnerability analysis before the choice of countermeasures. Its threat categories include unauthorized entry and insider threats. A properly framed assessment can consider both. The problem arises when the approval relies on broader protection than the actual assessment established.

For each recommendation, a remediation plan can record the expected result and the evidence needed to confirm completion. A gate modification might need a practical check under the conditions in which vehicles arrive. A change to access rights needs confirmation that the live permissions match the approved rule. Signing a purchase order completes neither check. After a penetration test, agree the authorized retest evidence needed before accepting a technical fix.

Keep the connection between each recommended control and the route it is meant to address. If that connection disappears, completion becomes a matter of whether equipment was installed. The reader needs to know whether the intended threat can still reach the asset, using the access available during normal work.

This is useful work. A documented finding gives an owner a specific defect to correct. A test gives the approver evidence about the correction. The distinction also matters after risk evaluation, when ranked findings must become decisions about action.

Keep the original assessment beside the remediation plan, rather than reducing it to a tracking sheet. Record any conditions attached to its conclusions. A closed finding supports the decision only while the assessed access conditions still apply. Confirm those conditions before the revised operation starts, including any new permissions granted for the work.

Which access routes did the assessment actually test?

Start with the proposed operation, rather than its security diagram. Who needs to enter, and what can each person reach after admission? Check the access register against the assessment. Include access given to contractors for maintenance. Separate a person arriving without permission from a person arriving with permission who could misuse it.

A perimeter check can confirm that an entrant has a valid pass. The decision to admit that person may be correct under the rule. It does not establish that every action available beyond the entrance is safe. Authorization to enter is one condition of the decision, not evidence that all permitted activity is harmless.

This changes the frame of the approval. “Does the entrance reject unauthorized people?” asks about an admission control. “Can the proposed operation protect its assets when an authorized person misuses access?” asks about the operating system. An answer to the first question cannot settle the second without further evidence.

Make this distinction on the assessment itself. Against each relevant threat, record whether the actor needs to bypass a control or can use an existing permission. Then check which asset the route reaches. A route that ends at reception differs from one that reaches an occupied work area or a critical system.

CISA’s September 2026 insider threat guide defines the problem through authorized access or special understanding that can be used to harm an organization. It also requires attention to privacy and civil rights. Considering this route means examining permissions and safeguards, rather than treating everyone with a pass as suspicious.

The same check helps after a vendor risk assessment: the relevant question includes what the supplier can actually reach. It also improves the next step after risk identification. Naming a threat is incomplete until its feasible route is stated.

Before approving the plan, identify any relevant access route for which the assessment provides no evidence. Mark it as unresolved. Do not assign it the protection claimed for a different route simply because both routes cross the same site entrance.

Keep the marked access register with the approval papers so the decision maker can see which routes remain unresolved.

Use the Walk to check whether your threat vulnerability assessment covers the access the operation will allow. Start the Walk →

Valid passes admitted the Washington Navy Yard attacker

On 16 September 2013, Aaron Alexis entered the Washington Navy Yard and Building 197 using authorized access. He was a contractor employee working for The Experts, a subcontractor to Hewlett-Packard Enterprise Services. The attack killed twelve civilian and contractor employees. The access mechanism is central to this case.

The Department of Defense internal review records that Alexis held a valid Common Access Card and building pass. The FBI’s account accompanying security footage independently confirms legitimate contractor access and entry using a valid pass. He did not need to defeat the admission rule by arriving without credentials.

The review found general compliance with installation access policies, while identifying deficiencies in random vehicle or bag inspections. It expressly states that nobody can know whether more frequent inspections would have revealed the weapon. The account therefore does not justify a claim that one additional perimeter measure would certainly have prevented the attack.

The case shows why valid entry and safety after entry must be examined separately. A credential answers a question about permission. The harm arose within the area that permission allowed the attacker to reach. An approval framed only around rejecting unauthorized entrants would leave that route outside its stated test.

This is an application of the case, not a claim that the Navy completed a formal threat vulnerability assessment and ignored it. Nor does the access evidence diagnose the attacker. The DoD review warns that identified process vulnerabilities do not establish culpability for the shooting. Its recommendations extend beyond the perimeter to insider threat capability and continuous evaluation.

A completed workplace risk assessment also needs to cover how the work actually operates. Here, the lesson concerns the access model behind the security decision. Check the actor who can cause the relevant harm, even when that actor can satisfy the entrance rule. Then choose protection for that route using evidence appropriate to the proposed operation.

Reframe the approval before choosing further controls

Return to the decision being requested. Is the approver authorizing a control purchase, opening a facility, or permitting a contractor task? State what must be protected while that activity takes place. Use the risk assessment to inform that decision, including the conditions under which its conclusions apply.

The Universal Decision-Making Method provides a sequence for doing this. Apply its five steps to the actual approval:

1. Frame: state the purpose and the operation being approved.
2. Tentative Elements: identify feasible controls for the relevant access routes.
3. Assumptions: name the conditions those controls rely on.
4. Sufficient Certainty: decide what evidence justifies relying on those conditions.
5. Implement+Monitor: assign the checks that keep the decision valid during operation.

Use the table to direct a focused check, not to order a wider surveillance program. Restrict access where the task does not need it. Where a safeguard is necessary, obtain evidence that it works for the route concerned. Involve qualified specialists when the consequences require their judgment.

Approve the operation against the access it will actually allow. Record unresolved conditions alongside the decision, with a person responsible for checking them. This is also a practical follow-up to a governance audit: the approval should make its limits visible.

Revisit that record before granting access for a changed task. Set a further review when permissions expand or a control test fails. The result is a specific approval whose protection claims can be checked against the work taking place.

---

Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.