In response to the events of September 11, many companies stepped up security efforts in chemical process facilities and other installations. Since resources are limited, a system for ranking relative risk would be useful in establishing priorities for implementing physical-security infrastructure and programs. This paper presents the elements of a relative risk assessment that can augment conventional process hazard analysis (PHA). This assessment is based on categorizing threat, vulnerability, and the consequences of deliberate actions by terrorists, disgruntled employees, and others.