The Bay Area Urban Areas Security Initiative

Threat and Hazard Identification and Risk Assessment (THIRA) and Stakeholder Preparedness Review (SPR) Overview

THIRA and SPR are designated by the Department of Defense as For Official Use Only documents. Governmental agencies within our jurisdiction may contact Amy Ramirez at to view the documents.



The THIRA helps communities understand their risks and determine the level of capability they need to address those risks. The outputs from this process lay the foundation for determining a community’s capability gaps during the SPR process. The THIRA is a three-step risk assessment completed every three years. It helps answer the following questions:


  • What threats and hazards can affect our community?
  • If they occurred, what impacts would those threats and hazards have on our community?
  • Based on those impacts, what capabilities should our community have?

The THIRA follows a three-step process, as described in Comprehensive Preparedness Guide 201, Third Edition:


  1. Identify Threats and Hazards. Based on a combination of experience, forecasting, subject matter expertise, and other available resources, a list of threats and hazards that could affect the community are developed. When deciding what threats or hazards to include in the THIRA, communities consider only those that challenge the community’s ability to deliver at least one core capability more than any other incident; the THIRA is not intended to include less-challenging threats and hazards.
  2. Give Threats and Hazards Context. Describe the threats and hazards identified in Step 1, showing how they may affect the community and create challenges in performing the core capabilities. Identify the impacts a threat or hazard may have on a community.
  3. Establish Capability Targets. Using the impacts described in Step 2, determine the level of capability that the community plans to achieve over time to manage the threats and hazards it faces. Using standardized language, create capability targets for each of the core capabilities based on this desired level of capability by identifying impacts, objectives, and timeframe metrics. A core capability is comprised of several functional areas in which a community may have a gap. Each required standardized target addresses one or more functional areas.

The SPR is an annual three-step self-assessment of a community’s capability levels based on the capability targets identified in the THIRA. It helps answer the questions:

  • What are our current capability levels and how have our capabilities changed over the last year?
  • What gaps exist between the capabilities we want to achieve and the capabilities we currently have?
  • What do we need to do to close the capability gaps or sustain the capabilities?
  • What impact did different funding sources—including grants—have on building or sustaining the capabilities assessed by the capability targets over the last year?

The SPR follows a three-step process as described in Comprehensive Preparedness Guide 201, Third Edition

  1. Assess Capabilities. Based on the language from the capability targets set in THIRA Step 3, identify the community’s current capability and how that capability changed over the last year, including capabilities lost, sustained, and built. Then, provide additional context to explain the reported data and its sources. 
  2. Identify Capability Gaps and Intended Approaches to Address Them. Determine the causes of the capability gap between the capability target and the current capability identified in SPR Step 1. Then, describe the actions and investments needed to close the capability gap or sustain the capability.
  3. Describe the Impacts of Funding Sources. Identify how relevant funding sources, including but not limited to grant programs and the community’s own resources, helped to build or sustain the capabilities assessed by the capability targets and describe how those capabilities were used in a real-world incident(s) over the past year.  

A core capability is comprised of several functional areas in which a community may have a gap. Each required standardized target addresses one or more functional areas. In addition to the three-step process described above, communities also identify gaps in planning, organization, equipment, training, and exercises for functional areas not addressed by the standardized targets.