Risk basis of FEMA's plans, doctrine, and requirements
Risk-based Core Capabilities
DHS 2011 National preparedness goal 1st edition, pp. 3-4
DHS 2015 National preparedness goal 2nd edition, pp. 4-5
National planning frameworks
DHS 2016 National prevention framework 2nd edition, pp. 4-5, 23, 25
DHS 2016 National protection framework 2nd edition, pp. 5-6
DHS 2016 National mitigation framework 2nd edition, pp. 6-7
DHS 2019 National response framework 4th edition, p. 12, 48 (Core Capabilities)
DHS 2016 National disaster recovery framework 2nd edition, pp. 8-9, 24 (superseded)
The recently updated National Disaster Recovery Framework, 3rd edition (December 10, 2024) does a good job of purging nearly every connection to the "risk-based" concepts and constructs which claim the SNRA [or anything that could be seriously confused with "risk"] as evidence. Whether that is a good thing or a bad thing in itself, it does mitigate the most serious issues (for applications that depend on this document, at least) relating to science and political accountability (March 2019 SNRA FAQ page 6 1st column (Information Quality Act)) that most of the letters in this repository concern themselves with. I don't know whether that retreat from risk and those problematic claims is sustainable for DHS/FEMA, but it's a good sign.
Federal Interagency Operational Plans (FIOPs)
DHS 2016 Protection Federal Interagency Operational Plan 1st edition, pp. 5-6
DHS 2016 Mitigation Federal Interagency Operational Plan 2nd edition, pp. 5-6
The 2016 Response and Recovery FIOPs which referenced the SNRA have since been replaced with a combined Response-Recovery FIOP which does not (March 2023).
Requirements on enterprise partners
DHS 2024 Preparedness grants manual pp. 8-9, 15-16, 29, 55, 94 (Core Capabilities).