Healthcare and Public Health Sector Site Assessment Risk Analysis' (SARA) Integrated Toolkit Feedback Form

Form Approved

OMB No. 0990-0379

Exp. Date XX/XX/20XX

Healthcare and Public Health (HPH) Sector

Integrated Risk Toolkit

Pilot Activity Participant Survey Form

U.S. Department of Health and Human Services (HHS)

Critical Infrastructure Protection Program

[email protected]

Introduction

The Healthcare and Public Health (HPH) Sector consists of physical, cyber, and human elements that are critical to the day-to-day health and safety of all Americans. A broad diversity of assets exists across the sector, including publicly-accessible direct patient care facilities, research centers, suppliers and manufacturers, laboratories, and vast and complex public-private information and communications technology systems. As part of a holistic risk management approach, HHS and its partners within the National Infrastructure Protection Plan (NIPP) Partnership are collaborating in the development of a suite of risk assessment tools intended for Sector-wide utilization.

Accurate, quantitative risk analysis is necessary to underpin planning and investments to reduce vulnerabilities and build critical infrastructure resilience in any sector. Risk analysis includes determination of the probability that a given threat or hazard will occur; the extent to which that threat or hazard is able to impact performance of a facility, system, or function (i.e., vulnerability); and the consequences of facility, asset, or function degradation or failure, including cascading effects and key internal and external dependencies and interdependencies. The suite of risk assessment tools currently under development represents an effort to employ an automated, user-friendly approach to assess HPH Sector risk— including its threat/hazard, vulnerability and consequence components—at the facility, system, coalition, and regional level in a consistent and objective way.

Pilot Project Purpose

HHS and its partners have collaborated in the development of an Integrated Risk Toolkit, consisting of three distinct modules—the Threat Hazard Assessment Module (THAM), the Rapid Infrastructure Survey Tool-Vulnerability Module (RIST-V), and the RIST-Consequence Module (RIST-C). A pilot was previously conducted to collect end-user feedback at the facility, system, coalition, and regional levels regarding content, functionality, reporting of results, user interface, and user friendliness of the individual modules. Adjustments to the modules were made based on the feedback received, and the three modules were connected into a single Integrated Risk Toolkit which automatically combines the results of each module to allow risk-based prioritization of threats and hazards. In the current pilot activity, we are seeking feedback on the user interface of the Integrated Toolkit, the presentation of risk results, and the calculations used to combine the three modules.

Pilot Project Survey Questionnaire

The intent of the survey questions that follow below is to capture specific feedback on the Integrated Risk Toolkit as a whole based on interactive use of the tools as part of planned pilot activities. The respondent is requested to provide specific comments/recommendations wherever possible. User feedback will be used to make necessary adjustments/refinements to the toolkit. Please complete the online version of this survey at [web address TBD].

Respondent Information

Please provide the following information so that the HHS CIP office may follow up on comments and questions provided in the survey response.

1. Name

2. Organization

3. Healthcare Coalition (if applicable)

4. Phone Number

5. Email

Survey Questions

Toolkit User Interface and Flow

1. How clear were the instructions for downloading and installing the Toolkit?
   (1 – Very unclear | 5 – Very clear)

2. How clear were the instructions for downloading and installing the Toolkit?
   (1 – Very unclear | 5 – Very clear)

3. How clear was the organization of the Toolkit (i.e., the purpose of each module and how they relate to each other)?
   (1 – Very unclear | 5 – Very clear)

4. Rate the overall user interface of the Integrated Toolkit.
   (1 – Very poor | 5 – Very good)

5. Rate the ease of navigation through the Integrated Toolkit.
   (1 – Very poor | 5 – Very good)

6. If you responded 4 or lower to any of the above questions, please describe your concerns or provide suggestions in the space below.
   (Free response)

7. How sufficient were the instructions in the Toolkit? (i.e., did they adequately cover every step of the process, from start to finish?)
   (1 – Very insufficient | 5 – Very sufficient)

8. In which areas is more instruction needed?
   (Free response)

9. How clear were the instructions in the Toolkit?
   (1 – Very unclear | 5 – Very clear)

10. In which areas does the clarity of instructions need to be improved?
    (Free response)

11. What additional functionality or improvements to existing functionality would make the Integrated Toolkit more user-friendly and/or easier to navigate?
    (Free response)

12. Provide any additional comments about the user interface of the THAM Tool in the space below.
    (Free response)

Toolkit Reporting – Risk

13. Rate the overall organization and presentation of risk results in the Dashboard.
    (1 – Very poor | 5 – Very good)

14. How useful is the information provided in the Dashboard risk results table? Consider the Risk Rating as well as individual components (T, V, T × V).
    (1 – Not useful | 5 – Very useful)

15. If you responded 4 or lower to any of the above questions, please describe your concerns or provide suggestions in the space below.
    (Free response)

16. What additional information or metrics would you like to see in the Toolkit results? Consider individual modules as well as the Dashboard.
    (Free response)

17. Provide any additional comments about the risk reporting format of the Toolkit in the space below. Consider individual modules as well as the Dashboard.
    (Free response)

Toolkit Reporting – Criticality

18. Rate the overall organization and presentation of criticality results in the Dashboard.
    (1 – Very poor | 5 – Very good)

19. How useful is the information provided in the Dashboard criticality results?
    (1 – Not useful | 5 – Very useful)

20. How well do you feel you understand the concept of criticality as opposed to risk?
    (1 – Not at all | 5 – Very well)

21. If you responded 4 or lower to any of the above questions, please describe your concerns or provide suggestions in the space below.
    (Free response)

22. Provide any additional comments about the criticality reporting format of the Toolkit in the space below.
    (Free response)

Toolkit Results and Calculations

23. How easy are the risk results to interpret?
    (1 – Very difficult | 5 – Very easy)

24. What information would help you better interpret or use the risk results?
    (Free response)

25. Looking at your risk results, do you feel the threats/hazards were ranked appropriately?
    (1 – Not appropriate | 5 – Very appropriate)

26. Looking at your risk results, do you feel the risk categories (Low, Moderate, High, Very High) are appropriately aligned with the Risk Ratings?
    (1 – Not appropriate | 5 – Very appropriate)

27. If you responded 4 or lower to any of the above questions, please describe your concerns or provide suggestions in the space below.
    (Free response)

28. Please provide feedback on the presentation of results, including the display and separation of external and local hazards.

(Free response)

29. In the Reference Guide, review the hazard-vulnerability mapping methodology (Section 3.2.1) and the mapping table (Appendix A). Provide any comments or suggestions regarding the mapping of threats/hazards to vulnerabilities in the space below.
    (Free response)

30. Provide any additional comments about the results and calculations of the Toolkit in the space below.
    (Free response)

Toolkit Use-case

31. Rate the overall usefulness of the Toolkit for your risk management activities.
    (1 – Not useful | 5 – Very useful)

32. How do you foresee using the Toolkit in your risk management activities?
    (Free response)

33. What additional functionality would you like to see in the Toolkit to better support your risk management activities?
    (Free response)

Additional Comments

34. Provide any additional comments and suggestions about the Toolkit in the space below.
    (Free response)

According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number. The valid OMB control number for this information collection is 0990-0379. The time required to complete this information collection is estimated to average 20 minutes per response, including the time to review instructions, search existing data resources, and gather the data needed, and complete and review the information collection. If you have comments concerning the accuracy of the time estimate(s) or suggestions for improving this form, please write to: U.S. Department of Health & Human Services, OS/OCIO/PRA, 200 Independence Ave., S.W., Suite 336-E, Washington D.C. 20201, Attention: PRA Reports Clearance Officer