66 claims on pp. 8–91 (fact 1, statement 42, evidence 20, conjecture 2, definition 1).
An icon panel states the publication is intended to assist managers and supervisors, security, human resources, information technology, cybersecurity and insider threat, law enforcement, mental health professionals, and community safety partners.
THIS PUBLICATION IS INTENDED TO ASSIST...
The commitment can be demonstrated by securing leadership support, providing resources and direction, promoting collaboration between employees, and building outside partnerships.
This commitment can be demonstrated by securing leadership support for workplace safety efforts, providing resources and direction to employees, promoting collaboration and coordination of safety efforts between employees, and building partnerships with others outside of the organization's walls.
Commitment from leaders may also ensure that all employees understand the importance of BTAM and collaborate during the BTAM process.
Commitment from leaders may also ensure that all employees of the organization understand the importance of BTAM and collaborate during the BTAM process.
Why inferred Hedged with 'may also ensure'.
Partnering with personnel from security, HR, and the company's Employee Assistance Program (EAP), the security professional established an infrastructure to assess and manage concerns throughout the company.
Partnering with personnel from security, HR, and the company’s Employee Assistance Program (EAP), the security professional established an infrastructure to assess and manage concerns throughout the company.
Internal personnel resources can include workplace managers, human resource (HR) professionals, or an ombudsman, all of whom can mediate conflict.
These resources can include workplace managers, human resource (HR) professionals, or an ombudsman, all of whom can mediate conflict.
All employees have a role in preventing violence at their workplace.
All employees have a role in preventing violence at their workplace.
Strong collaboration between employees across varying components within an organization can greatly benefit the BTAM process by safeguarding work environments.
Strong collaboration between employees across varying components within an organization can greatly benefit the BTAM process by safeguarding work environments.
Partnerships should be established before a time of need to support streamlined collaboration, information sharing, and crisis response.
Establish partnerships before a time of need to support streamlined collaboration, information sharing, and crisis response.
BTAM processes should incorporate strategies to foster collaboration, starting with building relationships before services are needed.
Build relationships before services are needed.
Navigating complex professional interactions in a new partnership during a critical time can be challenging, which is why partnerships should be built early.
Navigating complex professional interactions in a new partnership during a critical time can be challenging.
Why inferred Hedged with 'can be challenging'; offered as the rationale for early partnership-building.
BTAM processes should incorporate a set of strategies to foster collaboration across the organization.
BTAM processes should incorporate the following strategies to foster collaboration:
HR personnel should know what employee information can and cannot be shared, when, and with whom. HR personnel should also understand the job functions and needs of collaborators on the BTAM team.
personnel should know what employee information can and cannot be shared, when information can be shared, and with whom information can be shared.
The BTAM process will have the most success by reassuring employees that its goal is to help rather than to take over the work of other organizational components.
The BTAM process will have the most success by reassuring employees that the goal of the process is to help, rather than to take over the work of other organizational components.
Clear communication can help parties understand each other's missions, highlight goal alignment, and establish clear roles, responsibilities, and expectations.
Clear communication can help all parties understand each other's mission and function, highlight points of goal alignment, and establish clear roles, responsibilities, and expectations.
One collaboration strategy is to meet audiences where they are.
Meet audiences where they are.
When approaching employees, consider their unique perspectives and what information they need, focusing on the principles of safety, violence prevention, and employee support.
When approaching employees, consider their unique perspectives and what information they need to know, focusing on the principles of safety, violence prevention, and employee support.
Another collaboration strategy is to clarify the capabilities of collaborators.
Clarify the capabilities of collaborators.
Those involved in the BTAM process should have a clear understanding of everyone's role and how they can and cannot contribute.
Those involved in the BTAM process should have a clear understanding of everyone’s role and how they can and cannot contribute.
HR personnel should also understand the job functions and needs of BTAM team collaborators, including how HR can assist them and how they might aid HR in its BTAM role.
HR personnel should also understand the job functions and needs of collaborators on the BTAM team, including how they can assist collaborators, and how collaborators might aid them in their role in the BTAM process.
Another collaboration strategy is to lead with compassion, empathy, and care.
Lead with compassion, empathy, and care.
Another collaboration strategy is to approach prospective partners with humility and the intent to help.
Approach prospective partners with humility and the intent to help.
Reassuring employees that BTAM aims to help rather than take over fosters trust with colleagues and lays the groundwork for long-lasting collaboration.
This approach fosters trust with colleagues and lays the groundwork for long-lasting collaboration.
Another collaboration strategy is to establish goal alignment and clear roles.
Establish goal alignment and clear roles.
Different organizational components vary in their goals and functions.
Different organizational components vary in their goals and functions.
A senior-level manager can serve as facilitator, leader, or final decision-maker and can share information across managers and departments.
A senior-level manager can serve in the role of facilitator, leader, and/or final decision-maker
Management can also ensure that information is shared between managers and across departments, as appropriate.
Management can also ensure information is shared between managers and across departments, as appropriate.
An HR professional says HR is among the first to see concerns and that inviting HR onto the team can be more helpful than just asking them for information.
Inviting HR on the team can be more helpful than just asking them for information.
A cybersecurity professional says cyber is typically the last group contacted during a behavioral threat assessment and wants earlier involvement.
Cyber is typically the last group that is contacted during a behavioral threat assessment
A cybersecurity professional said that much cybersecurity work lends itself well to a prevention-based approach.
A lot of cybersecurity work lends itself well to a prevention-based approach.
The HR professional says HR is often cautious about sharing information across departments but also has an obligation to protect the organization, which is the goal of a behavioral threat assessment.
While they are often cautious about sharing information across departments, they also have an obligation to protect the organization, which is the goal of a behavioral threat assessment.
A cybersecurity professional would like to see more bridging of the gap between cybersecurity and threat assessment.
I’d like to see more of a bridging of the gap between cybersecurity and threat assessment.
The BTAM team should engage non-permanent personnel as needed to facilitate information sharing, especially during assessment and management.
the team should engage with these personnel as needed to facilitate information sharing, particularly during the assessment and management processes
Figure 7 illustrates just one example of how an organization may staff a BTAM team and facilitate coordination across personnel and departments.
Figure 7 illustrates just one example of how an organization may staff a BTAM team and facilitate coordination across personnel and departments.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
During regular meetings, BTAM team members may share details of a particular case, discuss specific challenges or successes, or offer information about pertinent resources or organizational changes affecting their work.
During these regular meetings, BTAM team members may share details of a particular case, discuss specific challenges or successes encountered, or offer information about pertinent resources or organizational changes that impact their work.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
The security team says its 30-minute meetings benefit information sharing and show people that they are a team.
Having these 30-minute meetings really benefits information sharing and showing people that we are a team.
A BTAM professional at a major service chain says that when a team member is unsure which route to take, especially in mitigating risk, team members reach out to one another.
So if an individual team member runs into an issue where we feel like we don’t really know which route to take, especially as far as mitigating risk, then we reach out to one another.
A security team at a global technology company says information sharing is what keeps the company safe.
Information sharing is what keeps the company safe.
Some BTAM teams partner with cybersecurity and IT professionals to use specialized technological tools that identify threatening or concerning behavior on organizational networks or devices.
Some organizational BTAM teams partner with cybersecurity and IT professionals to incorporate specialized technological tools to identify threatening or concerning behavior
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
One component may be better equipped to evaluate or address a concern than another, and these differences should be considered when routing reports.
one component of the organization may be better equipped to evaluate and/or address a concern than another component
cite page 57 Step 4: Identify and Process Reports of Concerning Behavior
Systems in a workplace can be internal components, such as security or human resources departments, or external community partners, such as law enforcement and mental health providers.
Systems in a workplace can be internal components, such as security or human resources departments, or external community partners, such as law enforcement and mental health providers.
Figure 10 shows Supervisors & Coworkers as an internal system (orange circle) surrounding the individual of concern.
Supervisors & Coworkers (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Human Resources as an internal system (orange circle) surrounding the individual of concern.
Human Resources (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Physical Security as an internal system (orange circle) surrounding the individual of concern.
Physical Security (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Legal as an internal system (orange circle) surrounding the individual of concern.
Legal (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
Figure 10 shows Information Technology as an internal system (orange circle) surrounding the individual of concern.
Information Technology (orange)
Why inferred figure description: the label is printed in the Figure 10 graphic; the colour and the internal/external grouping are read from the figure legend, not from running text
A BTAM team should have immediate access to internal workplace systems (shown in orange in Figure 10); external systems (blue) lie outside the workplace.
orange circles represent internal systems to which a BTAM team should have immediate access, while blue circles represent external systems outside of the workplace
Internal systems are almost always relevant when assessing an individual who is currently, or has previously been, employed by the organization.
these systems are almost always relevant when assessing and managing an individual of concern who is currently, or has previously been, employed by the organization
For employees, leveraging organizational systems will often be sufficient to assess and manage the risk posed.
leveraging organizational systems will often be sufficient to assess and manage the risk posed
Internal systems can also hold relevant information about other individuals of concern, including customers, clients, visitors, or members of the public.
Internal systems can also have relevant information about other individuals of concern, including customers, clients, visitors, or members of the broader public
A retail organization assessing a disruptive customer may get valuable insight into the individual's background by speaking with the physical security staff who dealt with them.
may get valuable insight into the individual's background and behaviors by speaking with their physical security professionals
In the fictional software-company example, the Systems Approach surfaced a supervisor's report of a sharp decline in performance and demeanor, coworkers' reports that he said he might snap if things did not improve, and HR's report of a coworker's complaints about his rude and combative nature.
During their assessment, the BTAM team uses the Systems Approach to identify several concerns about the employee
Through coordinated outreach by the BTAM team, the supervisor, and HR, the fictional employee's workload was temporarily reduced and he was referred to the company's EAP for counseling and support.
Through coordinated outreach between the BTAM team, his supervisor, and HR, the employee has his workload reduced temporarily and is referred to the company's EAP so that he may receive counseling and support.
BTAM teams should gather and examine information from a variety of internal systems that bear on concerning or mitigating information.
BTAM teams should gather and examine information from a variety of internal systems
Employees who interact with the individual may offer observations about past interactions, perceived behavioral changes, and escalating stress or hostility.
Employees who interact with the individual of concern may offer observations and information about past interactions, perceived behavioral changes, and indicators of escalating stress or hostility
Why inferred Descriptive 'may' about information sources; typed as guidance.
HR professionals may offer information on employment history, work performance, conduct, grievances, conflicts, disciplinary actions, accolades, and attendance records.
professionals may offer information pertaining to the individual's employment history
Physical security personnel may offer behavioral observations, details of security incidents, witness statements, access logs, and security footage.
Physical security personnel may offer behavioral observations, details about security incidents, witness statements, building or facility access logs, and security footage
Why inferred Descriptive 'may' about information sources; typed as guidance.
Legal personnel may offer records of legal filings or complaints, such as harassment claims, restraining orders, and prior violent incidents, and legal rights or protections.
Legal personnel may offer records of legal filings or complaints—such as claims of harassment, restraining orders, and prior violent incidents
IT may assist with access to system records, including login history, email communications, and internet usage.
IT may assist with access to system records, including login history, email communications, and internet usage
Why inferred Descriptive 'may' about information sources; typed as guidance.
Cybersecurity and insider threat professionals may offer data from user activity monitoring, including anomalous digital behaviors such as unauthorized or failed access attempts to restricted systems or files.
Cybersecurity and insider threat professionals may offer data from user activity monitoring
Collaboration between insider threat and BTAM programs can enable each to perform its functions more effectively.
Collaboration and partnership between these programs can enable each to perform their functions more effectively
Both insider threat and BTAM programs are specifically designed to detect early behavioral red flags, aggregate data from multiple sources, and facilitate cross-functional collaboration.
However, both insider threat and BTAM programs are specifically designed to detect early behavioral red flags, aggregate data from multiple sources, and facilitate cross-functional collaboration.
If an individual of concern is bullied in the workplace, the employee's supervisor, HR, and/or EAP services may work together to address and intervene with the bullying, create safeguards for reporting bullying behavior, and provide access to counseling and emotional support services.
if an individual of concern is bullied in the workplace
The decision to terminate an employee must be clearly communicated in advance to relevant parties such as security, IT, HR, management, and legal so access can be revoked, work reassigned, and the organization can ensure it is following state and federal guidelines regarding termination.
The decision to terminate an employee must be clearly communicated to relevant parties within the organization (e.g., security, IT, HR, management, legal) in advance
The healthcare network's BTAM team can leverage partnerships with other personnel in the organization to assess and manage patients of concern.
The BTAM team can leverage partnerships with other personnel in their organization to assess and manage patients of concern.
A global organization's BTAM team ran awareness sessions with HR, legal and other teams, teaching staff to act on a cluster of behaviors rather than wait for harm. The team says it still receives requests about these sessions four or five years later.
if you start seeing behaviors, especially a cluster of behaviors, you take action then.
A BTAM team at a global organization said it ran successful awareness sessions with specific teams, including human resources and legal, identifying the concerns it looks for.
We did very successful awareness sessions where we got in front of specific teams—human resources, legal, and others—and we identified concerns we're looking for.
Find the Perfect Training Class For You
