"A risk assessment of the Piql Services" by FFI

surrounding the Piql Preservation Services. This comprises the safety requirements which are in place and the security standards and procedures that apply in and around the storage room. We have formulated methods to implement the set of security standards set forth by Piql AS, which should be in place during the production and transportation phases as well. As security must be evaluated as a whole, we touch upon regimes of both physical and computer security. By creating a synthetic reality in this way, we are allowed more control over the different elements which have to be included in the scenarios to make them plausible and realistic. Without such simplifications the scenarios would be too comprehensive to allow them to be part of a larger analysis later. As stated, our perspective in this assessment is user-oriented, meaning that the choices we made in the simplification process which follows, and later when describing the scenarios as well, are made with the demands and needs of the user in mind. The simplifications are also a way of making the scenarios more universally applicable. A potential user of the Piql Preservation Services would then more easily be able to apply the more generic scenarios presented in this report to their own situation than if the scenario descriptions were based on authentic settings and events. In the following sections, we describe the different categories outlined above. The categories are often further divided into different sub-categories. These are outlined while we simultaneously explain the choices that we made which gave the categories their current form. As the Piql Preservation Services is a service which is meant to be employed by users all over the world, it was necessary to break the category world geography into more manageable groupings. We therefore operate with three geographic zones: North, Middle and South. As a way of dividing the world into these zones we chose to base the classification on three indicators: climate, developmental level and political stability. Climate was chosen as the main classifier, as we deem this to be the most stable indicator over time, even considering climate change. The zones will serve to illustrate that a risk to the Piql Preservation Services outlined in a scenario which takes place at one location in a given zone could easily occur in another part or country of that zone. 5 For example, a scenario describing a tunnel fire in China can easily be applied to any other setting with similar conditions. piqlVaults in the same zone would be exposed to many of the same types of natural disasters and many of the same vulnerabilities where it comes to utility supply and issues of political stability. Additionally, we aim for this classification to be useful also to the users of the Piql Preservation Services. By determining which zone a potential new Piql partner belongs to, it can easily see which threats and hazards may threaten their storage facility, and thus get an indication of what to include in its own risk and vulnerability assessments. 5.1 Geography

5 Regional differences will, of course, occur, as the zones are necessarily wide and sweeping to simplify the scenario development.

24

FFI-RAPPORT 16/00707