25 claims on pp. 45–83 (statement 23, evidence 2).
IT professionals can access digital records, system access logs, and communication records, and can limit an individual's access to systems and facilities.
IT professionals can also limit an individual's access to systems and facilities
Cybersecurity and insider threat personnel can monitor inappropriate use of employer-issued electronic devices throughout the BTAM process.
Cybersecurity and insider threat personnel can monitor the inappropriate use of employer-issued electronic devices throughout the BTAM process.
Figure 8 lists, under Contextually Concerning, questionable activity on work-issued devices, such as attempting to access prohibited sites or searching for inappropriate content.
Questionable activity on work-issued devices, such as attempting to access prohibited sites or searching for inappropriate content
cite page 51 Step 4: Identify and Process Reports of Concerning Behavior
Some BTAM teams partner with cybersecurity and IT professionals to use specialized technological tools that identify threatening or concerning behavior on organizational networks or devices.
Some organizational BTAM teams partner with cybersecurity and IT professionals to incorporate specialized technological tools to identify threatening or concerning behavior
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Such tools are autonomous and continuous and can be used with human monitoring to detect and prevent risk of harm. (endnote 13)
can be used in conjunction with human monitoring to detect and prevent risk of harm
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Cybersecurity and IT professionals may set up mechanisms that alert the BTAM team to anomalous digital behaviors.
Cybersecurity and IT professionals may set up mechanisms to alert the BTAM team to anomalous digital behaviors
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Alerts may flag employees who visit blocked or forbidden websites on multiple occasions or log onto devices at unusual times.
employees who visit blocked or forbidden websites on multiple occasions or log onto their devices at unusual times
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
These tools can perform keyword monitoring of browser searches or internal communications.
These tools can also be used to perform keyword monitoring of browser searches or internal communications
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Keyword monitoring can flag words related to hate speech, weapons, violence, and concerning, inappropriate, or extremist language.
flagging keywords related to hate speech, weapons, violence
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
BTAM teams can use these tools to proactively identify concerning behaviors and intervene.
BTAM teams can use these tools to proactively identify concerning behaviors and intervene.
cite page 56 Step 4: Identify and Process Reports of Concerning Behavior
Dedicated analysts routinely monitor digital platforms, including social media, to assess and respond to threats and harassment targeting executives.
Dedicated analysts routinely monitor digital platforms, including social media, to assess and respond to threats, harassment, or other concerning behaviors targeting executives.
cite page 58 Step 4: Identify and Process Reports of Concerning Behavior
Assessing risk is a dynamic and continuous process, so the team should routinely reassess changes or new information.
Assessing risk is a dynamic and continuous process
The BTAM team should routinely assess any changes or new information that may increase, decrease, or contextualize the risk of harm.
The BTAM team should routinely assess any changes or new information that may increase, decrease, or contextualize the risk of harm posed by the individual of concern
BTAM teams should adopt a phased approach to continually assess risk and need, implement appropriate strategies, and monitor their impact until case closure is appropriate.
BTAM teams should adopt a phased approach to continually assess risk and need, identify and implement appropriate risk management strategies, and monitor the impact of these interventions until case closure is appropriate.
Strategies can include referrals for services and supports, monitoring electronic activity, placing an underperforming employee on a performance improvement plan, or encouraging prosocial interests.
Case management strategies vary but can include making referrals for services and supports, monitoring an individual's electronic activities
During evaluation, the BTAM team should check in with the individual and/or relevant partners to determine whether strategies are having the intended impact.
the BTAM team should check in with the individual of concern and/or relevant partners to determine whether risk management strategies are having the intended impact
The team should consider whether the individual is complying with interventions, engaging with programming, and showing changes in mood, mental state, or behavior.
The BTAM team should also consider whether the individual is complying with interventions, engaging with programming, and exhibiting any changes in mood, mental state, or behavior.
BTAM teams should be able to articulate the rationale for closing a case, document the decision, and check in with relevant stakeholders, including the individual of concern as deemed appropriate, to ensure no concerns return and no new concerns arise.
BTAM teams should be able to articulate the rationale for closing a case, document the decision, and conduct a check-in with relevant stakeholders
The case management plan form should record the interventions pursued, referral timelines, the person monitoring compliance, and the outcome of each intervention.
This form should document the specific interventions pursued and implemented, detailed timelines for providing referrals, the person designated to monitor response and compliance with interventions, and the outcome of each referral or intervention
Best practices for managing concerning employee behavior include monitoring and support and assistance.
Best practices in managing concerning behavior displayed by employees include
Monitoring can include observing behavior and communications, check-ins, tracking physical movement, and monitoring online activity on a company device or network.
Monitoring can include observing the employee's behavior, interactions, and communications with coworkers and clients; check-ins; tracking physical movement throughout a workplace; and monitoring online activities while on a company device or network.
When deemed necessary, coordinated outreach through appropriate channels may be used to evaluate, assess, and intervene with former employees to reduce the risk of violence.
When deemed necessary, coordinated outreach through appropriate channels may be used to evaluate, assess, and intervene with former employees to reduce the risk of violence.
Why inferred Conditional recommendation hedged with 'may be used'; classified as a statement.
Separations can create other problems, such as exacerbating existing grievances and/or limiting the organization's ability to monitor the employee's behavior.
Separations can create other problems, such as exacerbating existing grievances and/or limiting the organization's ability to monitor the employee's behavior.
Organizations should develop a strategy for continued monitoring, such as allocating staff to search public court records and monitor open-source online activity.
Develop a strategy for continued monitoring. This can include allocating staff to search public court records and monitor open-source online activity and social media accounts.
Community partners may also assist with searches of an individual's property, monitoring their behavior, or filing criminal charges.
These community partners may also assist with searches of an individual’s property, monitoring their behavior, or filing criminal charges.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Find the Perfect Training Class For You
