“Threat agent” is a term used to describe the root causes or origins of potential danger for a company. Natural disasters, compromises to a data centre power supply, and human actions causing inaccessibility to buildings are all threat agents that can lead to disaster.
When undergoing the Assessment, the following umbrella categories of threat agents are examined:
Geographical location and climate. Where a business operates will largely determine the type of natural threat agents it faces. For example, a company with headquarters on the east coast of Florida would be at risk of affects from hurricanes, whereas an organization in Winnipeg would not have the same concern. That organization, however, would have its own set of issues that the Florida based company would not, such as the threat of an ice storm isolating its headquarters. A third company operating on a fault line in southern California would face the threat of an earthquake, but not likely an ice storm.
Adjacent or attached buildings. If a business operates out of a shared building, the activities of other companies within the structure may pose a threat. For instance, fire in the restaurant on the floor below or construction in the offices above can lead to an IT disaster for other tenants. And it’s not just attached businesses that can be threat agents. An industrial plant prone to explosion and fire hazard next door would pose every bit as much danger as any company sharing a building with an organization.
Human activity. Humans are a threat agent for any business, but some companies are more at risk than others. Employees can make disastrous errors or conduct purposeful sabotage. Terrorists can theoretically target any location of an organization with publicly-accessible locations. Of course, smaller companies outside of a metropolis may have different risks than a multinational corporation in downtown Toronto in terms of terrorism or corporate espionage, but human activity is something that should be accounted for by every organization.
Building access. Like human activity, building access is affected by location, but can be affected by major disruptions to commuter transit such as road closures and derailments. Slow snow removal might be a bigger threat to employees travelling to work in northern Alberta than in Texas, but major metropolises like Dallas are more likely to see street protests and transit strikes that hinder building access.
Determining which agents are most relevant to a particular organization is the key to being prepared when a threat turns into a disaster. Uncovering this knowledge can be done via a Risk and Threat Assessment, which examines potential threats and identifies which are most likely to strike a certain organization.
