This Technical Specification is based on an all-hazards approach, with a specific focus on terrorism and other security related risks. Looking at the combination of threats, vulnerabilities and values to be protected, threats may be terrorist attacks with chemical, explosive and biological agents, or nuclear waste materials, or with conventional means on CBRN plants, causing a similar devastating effect on a potentially large scale. Major CBRN incidents may jeopardise critical infrastructure, while emergency services may have great difficulty performing their response tasks. The scope excludes the vulnerability assessment of some specific systems that comply, at the European and Member State level, with existing sets of legal measures: network for drinking water distribution, food chain supply and cosmetics and pharmaceutical products production and distribution chains. The objective of this Technical Specification is to strengthen common understanding and a common frame of reference for all organisations with an interest and involvement in CBRN. It does so by providing a number of considerations and tools that can be used in the development of a semi-quantitative conceptual framework for vulnerability assessment, awareness and management. The vulnerability assessment covers all members of the population at risk including the requirements of children, the elderly and those with disabilities.