ICD 705 Analytical Risk Management Process

The Analytical Risk Management Process course provides a working understanding of how threats, risks, and assets are evaluated to inform the design and construction of a SCIF, and why this process is one of the most important tools for balancing security requirements with cost, schedule, and mission needs. This course is designed for individuals who participate in the planning or accreditation of secure facilities and need to understand how risk-based decisions get made. Students will gain familiarity with the four core elements of the process (threat analysis, vulnerability analysis, probability analysis, and consequence analysis), the stakeholders responsible for the evaluation (primarily the AO and the SSM), and the timing that the IC Tech Spec demands (security begins the moment a SCIF requirement is identified, before drawings are produced or contracts are let). The course covers how the process is used to justify both reduced requirements (when baseline standards exceed the actual risk) and enhanced countermeasures (when conditions warrant them), and how it functions as a guard against fraud, waste, and abuse by requiring every security decision to carry a documented risk-based justification. It also includes a warning about vendor claims that products are pre-certified to SCIF standards, and what the AO actually has to verify. By the end of the course, participants will be better prepared to understand why early risk decisions carry through to cost, timeline, and construction security planning, recognize when a baseline standard can be mitigated or when it must be enhanced, and engage productively in risk conversations with the AO and SSM. Ideal for: • New security professionals • Project managers and capture teams • Owners and security stakeholders • Designers and contractors entering secure work • Anyone responsible for or affected by early-phase SCIF planning decisions