Team Composition

The BTAM process is typically conducted by a multidisciplinary team comprised of personnel with diverse backgrounds, experience, and expertise, who take principal responsibility for identifying, assessing, and managing potential individuals of concern.

STEP 3 | Assemble a Multidisciplinary BTAM Team

Establish which organizational department, component, or division (e.g., security, HR) will house the BTAM program and how the BTAM program will be integrated into the organization.

The structure of the BTAM team (see Figure 6) should be based upon organizational needs.

[Name of the BTAM program] will utilize a multidisciplinary team composed of [describe relevant personnel, departments, or units].

The Behavioral Threat Assessment and Management (BTAM) Team will convene twice per month to review and assess potential concerns.

Required attendees will include the team lead, and at least one security manager, human resources representative, legal advisor, and mental health professional.

When developing the BTAM program, organizations should invest time in determining the appropriate team composition, establish expectations regarding training for BTAM team members, and set standards for BTAM team meetings.

it is best practice to identify personnel who can be routinely dedicated to the important tasks associated with the BTAM process

Establishing a multidisciplinary BTAM team can allow team members with varied organizational roles and responsibilities to leverage their unique expertise

It's important to get the right people.

Previously, team members were identified because they were told to join.

Once the executives knew and understood the vision of the program and saw the good work the team was doing, a new hiring process was developed to select people really interested in joining the threat assessment team.

That has been very helpful.

BTAM teams should include a core group of dedicated, trained professionals.

leaders should determine if individuals will be assigned to a BTAM team in a full-time capacity, or whether team assignment will be a collateral or part-time duty

A senior-level manager can serve in the role of facilitator, leader, and/or final decision-maker

Security personnel can provide support in communicating with local law enforcement

IT professionals can also limit an individual's access to systems and facilities

Cybersecurity and insider threat personnel can monitor the inappropriate use of employer-issued electronic devices throughout the BTAM process.

Legal personnel can provide guidance and advice to the BTAM team to ensure compliance with federal, state, and local laws

EAP personnel can provide insight into available resources to leverage when developing a plan to manage the risk posed by individuals of concern

The composition of the BTAM team will differ across organizations, as it is tailored to meet the organization's unique characteristics and needs.

Ad hoc participants do not regularly attend BTAM team meetings

Workplace BTAM teams often include personnel from the following organizational roles:

Management can also ensure information is shared between managers and across departments, as appropriate.

IT professionals can access relevant digital records, system access logs, and electronic and telephonic communication records.

Inviting HR on the team can be more helpful than just asking them for information.

Cyber is typically the last group that is contacted during a behavioral threat assessment

Ad hoc participants can vary by case and across organizations

Representatives from labor relations can provide insight into employee grievances, conflicts, and disputes.

Personnel who specialize in alternative dispute resolution, including an ombudsman or mediator, can help during negotiations between employees

A lot of cybersecurity work lends itself well to a prevention-based approach.

Put someone from HR on the behavioral threat assessment team!

HR are among the first to see concerns or threats in the workplace.

They can also include organizational departments and community partners, such as:

They also offer guidance on contracts between unionized employees and the organization, and support employee due process.

employees need not be core members of a BTAM team to be relevant to the BTAM process

ad hoc participants and other personnel within the organization can be critically important when identifying, assessing, and managing individuals of concern

the team should engage with these personnel as needed to facilitate information sharing, particularly during the assessment and management processes

these structures can be adapted to meet the unique characteristics and needs of an organization

Top side (dark blue, Core Member): Human Resources; Employee Assistance Program; Security; Ombudsman

Left end (dark blue, Core Member): Management

Right end (gray, Ad Hoc Participant): Information Technology

Bottom side (gray, Ad Hoc Participant): Cybersecurity and Insider Threat; Chaplain; Labor Relations; Legal

Including a team member with expertise in open-source investigations can significantly enhance a BTAM team's ability to identify digital and online indicators of concern