Highly efficient, complex, and interdependent infrastructure systems including electric power, telecommunications, transportation, water utilities, food distribution, housing and shelter, public health, finance and banking are foundations of modern societies. Over the last 3 years, the United States has become acutely aware of the importance of civil infrastructures and their criticality to the nation’s economy and quality of life. Our reliance on these systems makes them especially attractive targets for attack. To understand and correct exploitable susceptibilities of critical infrastructure facilities, infrastructure providers and regional planners need a common, repeatable, systematic methodology to understand the comparative risks and vulnerabilities and determine where to invest scarce resources. The paper proposes and describes a common vulnerability assessment methodology for individual critical infrastructure facilities. It briefly discusses the integration of critical facility results into a regional-scale assessment. The methodology is designed to be comprehensive in terms of accommodating physical and cyber threats against the complete suite of mission-critical systems making up a facility. While the emphasis is on vulnerability assessment, the results provide many of the essential ingredients of a risk assessment. The methodology is applicable for self-assessment by infrastructure service providers or for use by external assessment teams.