Report pages 50–58: 169 claims on pp. 50–58 (fact 1, statement 110, evidence 51, conclusion 1, conjecture 2, definition 4).
One of the most important actions an employee can take to prevent violence is to report concerning behaviors they witness.
One of the most important actions an employee can take to prevent violence is to report any concerning behaviors they witness.
Organizations should ensure all employees are trained to recognize concerning behavior and have avenues to report safety concerns.
Organizations should ensure that all employees are trained to recognize concerning behavior and have avenues through which they can report their safety concerns.
Once a report is received, BTAM teams should process and triage the reports of concern.
Once a report is received, BTAM teams should process and triage these reports of concern
Identifying and processing reports of concern is the first step during a behavioral threat assessment.
Identifying and processing reports of concern is the first step during a behavioral threat assessment.
Organizations must train their workforce to recognize and report concerns when an individual or situation elicits concern for the safety of themselves or others.
Organizations must train their workforce to recognize and report their concerns when an individual or situation elicits concern for the safety of themselves or others.
All employees must understand that threatening statements should be reported.
All employees must understand that threatening statements should be reported
A person may pose a risk of violence without ever making an explicit threat.
a person may pose a risk of violence without making an explicit threat
Concerning behaviors occur along a continuum from contextually concerning to objectively concerning.
concerning behaviors occur along a continuum from contextually concerning to objectively concerning
Concerning behavior is an action or communication by an individual that is objectively or contextually troubling or inappropriate and indicates a potential risk of violence.
Actions or communications by an individual that are objectively or contextually troubling or inappropriate and indicate a potential risk of violence.
Concerning behaviors include both non-criminal and criminal activities.
and include non-criminal and criminal activities
Escalating interpersonal disputes are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
Grievances are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
Concerning social media content is among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
Stalking and harassment are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
Obsessions with violence are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
Idolizing past attackers is among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
Fixating on people or locations is among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
Suicidal ideations are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
Self-harm is among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
Unusual levels of aggression are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
Threats are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
Weapons violations are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
Physical assaults are among the behaviors that may be concerning.
Concerning behaviors may include escalating interpersonal disputes, grievances, concerning social media content, stalking and harassment, obsessions with violence, idolizing past attackers, fixating on people or locations, suicidal ideations, self-harm, unusual levels of aggression, threats, weapons violations, and physical assaults.
Objectively concerning behaviors such as unauthorized weapons, threats, and assaults should warrant immediate action, often including local law enforcement.
Some behaviors are objectively concerning (e.g., unauthorized weapons, threats, assaults) and should warrant immediate action, oftentimes including local law enforcement intervention.
Contextually concerning behaviors, such as rapidly deteriorating performance or angry outbursts, should be assessed in the full context of the person and environment.
Other behaviors are contextually concerning, in that they may not prompt immediate safety concerns but should be assessed in the full context of the individual's situation and their environment
Figure 8 gives examples of concerning behaviors on a continuum from contextually concerning to objectively concerning.
from contextually concerning to objectively concerning (see Figure 8)
Figure 8 lists, under Contextually Concerning, changes in behavior, including decreased productivity, increased absenteeism, decreased attention to personal hygiene and appearance, or withdrawal from social circles.
Changes in behavior, including decreased productivity, increased absenteeism, decreased attention to personal hygiene and appearance, or withdrawal from social circles
Figure 8 lists, under Contextually Concerning, challenges with mental health, such as depressed mood, paranoia, or anxiety.
Challenges with mental health, such as depressed mood, paranoia, or anxiety
Figure 8 lists, under Contextually Concerning, intense or abnormal emotional outbursts.
Intense or abnormal emotional outbursts
Figure 8 lists, under Contextually Concerning, a pattern of strained or conflicted relationships with colleagues.
Pattern of strained or conflicted relationships with colleagues
Figure 8 lists, under Contextually Concerning, questionable activity on work-issued devices, such as attempting to access prohibited sites or searching for inappropriate content.
Questionable activity on work-issued devices, such as attempting to access prohibited sites or searching for inappropriate content
Figure 8 lists, under Objectively Concerning, bullying or harassing others.
Bullying or harassing others
Figure 8 lists, under Objectively Concerning, preoccupation with violent themes, such as terroristic acts or mass shootings.
Preoccupation with violent themes, such as terroristic acts or mass shootings
Figure 8 lists, under Objectively Concerning, intimidating, belligerent, or other aggressive behavior.
Intimidating, belligerent, or other aggressive behavior
Figure 8 lists, under Objectively Concerning, direct or veiled threats.
Direct or veiled threats
Figure 8 lists, under Objectively Concerning, expressions of homicidal or suicidal thoughts.
Expressions of homicidal or suicidal thoughts
Figure 8 lists, under Objectively Concerning, physical violence toward people, animals, or property.
Physical violence toward people, animals, or property
Figure 8 lists, under Objectively Concerning, sexual assault or harassment.
Sexual assault or harassment
Figure 8 lists, under Objectively Concerning, bringing or brandishing a weapon in the workplace.
Bringing or brandishing a weapon in the workplace
A good guiding principle is that employees should be encouraged to report any observed behavior that makes them uncomfortable or concerned for their own or others' safety.
A good guiding principle is that employees should be encouraged to report any observed behavior that prompts them to feel uncomfortable or concerned for their own safety or the safety of others.
Employees should be given specific examples of the types of behavior that may prompt these concerns.
Employees should also be provided with specific examples of the types of behavior that may prompt these concerns.
Figure 8 lists, under Contextually Concerning, fixations on perceived grievances.
Fixations on perceived grievances
IPV is abuse or aggression in a romantic relationship, including current and former spouses and dating partners, and can include physical, psychological, or sexual violence and stalking.
Intimate partner violence (IPV) is abuse or aggression that occurs in the context of a romantic relationship
The frequency and severity of IPV vary, from a single episode to chronic and severe violence spanning multiple years. (endnote 8)
The frequency and severity of IPV varies, ranging from a single episode of violence to chronic and severe instances of violence spanning multiple years.
IPV often starts in the privacy of a residence but can spill out into public spaces.
While IPV often starts in the privacy of a residence, it can spill out into public spaces.
In Mass Attacks in Public Spaces: 2016-2020 (2023), NTAC found that 41% of individuals who engaged in mass attacks in public or semi-public spaces, including workplaces, had a prior history of domestic violence, including intimate partner violence.
Sample (n = undeterminable of undeterminable) · NTAC Mass Attacks in Public Spaces: 2016-2020 (2023), a different study
41% of individuals who engaged in mass attacks in public or semi-public spaces, including workplaces, had a prior history of domestic violence
The 41% and 29% figures come from NTAC's 2023 study Mass Attacks in Public Spaces: 2016-2020.
Sample (n = undeterminable of undeterminable) · NTAC Mass Attacks in Public Spaces: 2016-2020 (2023), a different study
In Mass Attacks in Public Spaces: 2016 – 2020 (2023), NTAC found
In the same 2023 NTAC study, mass attackers in 29% of incidents were motivated at least in part by a domestic grievance.
Sample (n = undeterminable of undeterminable) · NTAC Mass Attacks in Public Spaces: 2016-2020 (2023), a different study
In 29% of the incidents, mass attackers were motivated to carry out their attack, at least in part, by a domestic grievance.
According to the CDC, victims of IPV lose nearly 8 million days of paid work each year in the United States. (endnote 9)
victims of IPV lose nearly 8 million days of paid work each year in the United States
According to the CDC, the estimated total cost of IPV, including medical care, mental health services, and lost productivity, exceeds $8.3 billion per year. (endnote 9)
the estimated total cost of IPV—including medical care, mental health services, and lost productivity—exceeds $8.3 billion per year
Organizations should be aware of warning signs that could indicate an employee is experiencing IPV.
Organizations should be aware of certain warning signs that could indicate an employee is experiencing IPV
A decrease in work performance can be a warning sign of IPV. (endnotes 10, 11)
decrease in work performance
Uncharacteristic absenteeism or lateness can be a warning sign of IPV. (endnotes 10, 11)
uncharacteristic absenteeism or lateness
Changes in appearance that could conceal injuries, such as clothing unsuited to the season or changed makeup use, can be a warning sign of IPV. (endnotes 10, 11)
changes in appearance that could conceal injuries
Increased reluctance to socialize with coworkers can be a warning sign of IPV. (endnotes 10, 11)
increased reluctance to socialize with coworkers
An abrupt change in address or living situation can be a warning sign of IPV. (endnotes 10, 11)
abrupt change in address or living situation
Sudden requests to move away from open and public areas in the workplace can be a warning sign of IPV. (endnotes 10, 11)
sudden requests to move away from open and public areas in the workplace
Disruptive visits, phone calls, or messages from a current or former partner can be a warning sign of IPV. (endnotes 10, 11)
disruptive visits, phone calls, or messages from their current or former partner
Organizations must take immediate action if an employee is believed to be experiencing violence in a relationship.
Organizations must take immediate action if an employee is believed to be experiencing violence in a relationship
Organizations can provide victims with parking spaces near the door of the workplace building.
Provide victims with parking spaces near the door of the workplace building
Organizations can offer internal and third-party services, including counseling and mental health care, to victims.
Offer internal and third-party services, including counseling and mental health care
Organizations can allocate funds for financial support to victims.
Allocate funds for financial support to victims
Organizations can grant victims flexibility in using sick days and personal leave.
Grant flexibility to victims for using sick days and personal leave
Organizations can coordinate with local shelters to identify available openings for victims.
Coordinate with local shelters to identify available openings for victims
Organizations can offer relocation services to help victims move to a new residence.
Offer relocation services to help victims move to a new residence
Organizations can use anonymized work schedules to decrease the risk of abusers locating victims.
Use anonymized work schedules to decrease risk of abusers locating victims
Organizations can increase physical security presence in locations affected by IPV.
Increase physical security presence in impacted locations
Intimate partner violence can include physical violence, psychological aggression, sexual violence, stalking, and other behaviors.
IPV can include physical violence, psychological aggression, sexual violence, stalking, and other behaviors.
A therapist who supports IPV victims calls IPV one of the leading causes of workplace violence.
IPV is one of the leading causes for workplace violence.
The therapist says IPV cases tend to be more severe when IPV spills over into the workplace.
IPV cases tend to be more severe when IPV bleeds over into the workplace.
The therapist says stalking and monitoring behaviors tend to be the most common red flags when someone is reporting IPV at work.
Stalking and monitoring behaviors tend to be the most common red flags when someone is reporting IPV at work.
The therapist says coming forward about abuse requires power and confidence.
Coming forward requires power and confidence.
The therapist says it is important to give victims a lot of voice and choice: give them the information, then let them make their own choices.
It's important to give victims a lot of voice and choice.
The therapist calls trauma-informed care the most successful strategy for managing IPV, using a nonjudgmental, recovery-oriented stance.
The most successful strategy is trauma-informed care
For safety planning, the therapist asks what victims have already done, what has worked, and what has not.
For safety planning, we ask them what they've done already and what has worked, and what hasn't.
Anyone experiencing domestic violence can get help through the National Domestic Violence Hotline at 1-800-799-SAFE (7233) or by texting START to 88788.
help is available via the National Domestic Violence Hotline
A therapist who supports IPV victims says that in an abusive relationship, victims have little control.
In an abusive relationship, victims have little control.
The therapist says victims have usually tried many approaches already, so making assumptions and listing tips wastes time.
Usually, they've tried a plethora of things already, and you'd be wasting your time by making assumptions and listing off tips.
A therapist who supports IPV victims says to give victims the information and then let them make their own choices.
You give them the information, then let them make their own choices.
The therapist says letting victims make their own choices gives them the power that their abuser is taking from them.
That's giving them the power that their abuser is taking from them
When victims do come forward, the therapist's practice follows the victim's lead with safety in mind.
When they do come forward, we follow the victim's lead with safety in mind.
The therapist describes abusive relationships, in which victims have little control, as disempowering by design.
It's disempowering by design.
A therapist who supports IPV victims says IPV is always a huge risk factor.
It's always a huge risk factor
A therapist who supports IPV victims says that when victims come forward, the practice makes a safety plan with them to achieve their goals.
We make a safety plan with them to achieve their goals.
A therapist who supports IPV victims says hearing the person out with a nonjudgmental stance gives them the space to talk about these things and allows for honesty.
It gives them the space to talk about these things and allows for honesty
A therapist who supports IPV victims says that, because abusive relationships are disempowering, practitioners must do the opposite in small ways and provide feedback on what victims are doing well.
we must do the opposite, and provide feedback on what they're doing well
A BTAM team leader at a global corporation says common cases include suicidal ideation, individual crises, difficulty managing work, and domestic violence.
A lot of what we tend to see are cases involving suicidal ideation, someone going through an individualized crisis
It is essential for organizations to keep a low threshold of concern and not limit focus solely to explicit threats of violence.
It is essential for organizations to maintain a low threshold of concern for initiating a behavioral threat assessment and not limit their focus solely to explicit threats of violence.
A low threshold of concern allows BTAM teams to identify individuals eliciting safety concerns before their behavior escalates to imminent risk of harm.
Utilizing a low threshold of concern allows BTAM teams to identify individuals eliciting safety concerns before their behavior escalates to the point where there is an imminent risk of harm.
A hypothetical, previously above-average employee misses deadlines, is described by coworkers as distant and moody, denies any performance problems when his supervisor asks, calls in sick more often, and appears increasingly unkempt; the scenario is illustrative, not a real case.
Consider this scenario: An employee has recently demonstrated performance problems at work.
The scenario's behaviors may illustrate individual or environmental factors that, if unaddressed, could raise the possibility of harm to self or others.
may illustrate individual or environmental factors that, if unaddressed, could contribute to an increased possibility of harm to self or others
Why inferred Hedged with 'may illustrate' and 'could contribute', so typed as conjecture.
It is best practice to use a low threshold of concern during the BTAM process, not to label someone a potential threat, but to allow early intervention.
It is best practice to use a low threshold of concern during the BTAM process, not to label an individual as a potential threat, but to allow for early intervention.
Early intervention lets organizations identify, assess, and manage the possibility of a negative outcome long before violence becomes imminent.
Early intervention enables organizations to identify, assess, and manage the possibility of a negative outcome long before violence becomes imminent.
In the hypothetical scenario, an above-average employee has begun to miss deadlines and the quality of his work has declined.
Although he was previously an above-average employee, he has begun to miss deadlines, and the quality of his work has declined.
Coworkers report he has been "distant" and "moody" lately and might be having problems at home.
The employee's work acquaintances report he has been "distant" and "moody" lately and might be having problems at home.
A BTAM team leader at a global corporation says the team also sees issues with domestic violence and intimate partner violence in all of its regions across the globe.
We also see issues with domestic violence and intimate partner violence in all of our regions across the globe.
In the low-threshold scenario, the employee's supervisor asked the employee in a recent meeting what was happening.
In a recent meeting, the employee's supervisor asked the employee what was happening.
The employee said he did not know what the supervisor meant by the question and denied seeing any problems with his recent performance.
The employee remarked that he did not know what the supervisor meant by the question and denied seeing any problems with his recent performance.
In the weeks after the meeting, the employee began calling in sick with increasing frequency, and when he does come to work his appearance has become increasingly unkempt.
In the weeks since that meeting with his supervisor, the employee has begun to call in sick to work with increasing frequency, and when he does show up for work, his appearance has become increasingly unkempt.
In the scenario, the supervisor is worried about the wellness and safety of the employee.
The supervisor is worried about the wellness and safety of the employee.
Individuals who recognize concerning behaviors must have multiple avenues available to report them.
Individuals who recognize concerning behaviors must have multiple avenues available to report it.
Reporting concerning behavior should be seen as a collective responsibility.
Reporting concerning behavior should be seen as a collective responsibility
Organizations should strive to make bystander reporting part of an overall safe and positive work climate.
organizations should strive to make bystander reporting part of an overall safe and positive work climate
It is important that employees feel confident reporting without fear of retaliation or punishment.
It is also important that employees feel confident in reporting without fear of retaliation or punishment.
All workplaces should have a means to collect information about concerning behavior.
while all workplaces should have a means to collect information about concerning behavior
The reporting mechanisms employees use may vary based on organization size, type, industry, and other aspects of the work environment.
the reporting mechanisms used by employees may vary based upon a variety of factors, such as the organization size, type, industry
The report gives a hypothetical example: a reporting option that suits a small food service business may not suit a large multinational corporation.
a reporting option that works for a small food service business may not be an appropriate solution for a large multinational corporation
Organizations must consider available resources, workforce needs, and the unique context of their environment when choosing a reporting solution.
organizations must consider the resources available, the needs across their workforce, and the unique context of their environment
A 2023 joint toolkit from the Secret Service and CISA outlines strategies for establishing and enhancing school bystander reporting programs. (endnote 12)
Improving School Safety Through Bystander Reporting: A Toolkit for Strengthening K-12 Reporting Programs (2023)
The toolkit's principles are research-based and broadly applicable to reporting mechanisms in other environments, including workplaces.
the principles presented therein are research-based and are broadly applicable to reporting mechanisms established in other environments, including workplaces
Organizations should offer simple and accessible means for individuals to share concerns, using more than one reporting avenue.
Organizations should offer simple and accessible means for individuals to share concerns.
Smaller organizations may use a dedicated email address for concerns, while larger organizations may need a phone hotline, mobile app, or online form.
Smaller organizations with few employees may consider using a dedicated email address where employees can express concerns
Training and awareness campaigns should instruct stakeholders on how and what to report, using posters, brochures, online resources, and training events.
Training and awareness campaigns should be utilized to instruct relevant stakeholders on how and what to report.
Every BTAM team member should be able to view received reports and be notified of them automatically, even outside normal hours, if possible.
Every member of the BTAM team should have the capability to view received reports and should automatically be notified of incoming reports, even outside of normal operating hours, if possible.
Some organizations partner with law enforcement or a third-party dispatch center with 24/7 availability to receive reports outside work hours.
partnerships with law enforcement agencies or a third-party dispatch center that has 24/7 availability
Why inferred Describes a practice some organizations use; typed as statement rather than fact.
The more frequently reports are checked, the faster teams can respond to concerns.
The more frequently reports are checked, the faster teams can respond to concerns.
Anonymity and confidentiality can encourage reporting throughout an organization by making employees feel their privacy is protected.
Anonymity and confidentiality can encourage reporting throughout an organization
In some cases, organizations may be able to establish two-way messaging that allows follow-up without requiring the reporter to disclose a name.
organizations may be able to establish two-way messaging that allows follow-up communication without requiring an individual to disclose their name
Other options include anonymous or confidential reporting forms, hotlines, or mobile applications that safeguard the reporter's identity.
Other options include anonymous or confidential reporting forms, hotlines, or mobile applications that safeguard the reporter's identity
The report states that reporting can be accomplished through a variety of avenues.
Reporting can be accomplished through a variety of avenues.
Offering multiple avenues for reporting can increase the likelihood that employees will share their concerns, which enhances the organization's opportunity to take appropriate action.
Offering multiple avenues for reporting can increase the likelihood that employees will share their concerns, thereby enhancing the opportunity for organizations to take appropriate action.
A listed best practice for workplace reporting systems is to set operating hours that improve availability.
Set operating hours that improve availability.
The report notes that reports of concern can be received at any time.
Reports can be received at any time.
A listed best practice for workplace reporting systems is to consider an anonymous or confidential reporting option.
Consider an anonymous or confidential reporting option.
Some employees may be hesitant to report behaviors and communications of concern in the workplace because they fear retaliation.
Some employees may be hesitant to report behaviors and communications of concern in the workplace due to fear of retaliation.
Some BTAM teams partner with cybersecurity and IT professionals to use specialized technological tools that identify threatening or concerning behavior on organizational networks or devices.
Some organizational BTAM teams partner with cybersecurity and IT professionals to incorporate specialized technological tools to identify threatening or concerning behavior
Such tools are autonomous and continuous and can be used with human monitoring to detect and prevent risk of harm. (endnote 13)
can be used in conjunction with human monitoring to detect and prevent risk of harm
Cybersecurity and IT professionals may set up mechanisms that alert the BTAM team to anomalous digital behaviors.
Cybersecurity and IT professionals may set up mechanisms to alert the BTAM team to anomalous digital behaviors
Alerts may flag employees who visit blocked or forbidden websites on multiple occasions or log onto devices at unusual times.
employees who visit blocked or forbidden websites on multiple occasions or log onto their devices at unusual times
These tools can perform keyword monitoring of browser searches or internal communications.
These tools can also be used to perform keyword monitoring of browser searches or internal communications
Keyword monitoring can flag words related to hate speech, weapons, violence, and concerning, inappropriate, or extremist language.
flagging keywords related to hate speech, weapons, violence
BTAM teams can use these tools to proactively identify concerning behaviors and intervene.
BTAM teams can use these tools to proactively identify concerning behaviors and intervene.
BTAM teams should ensure reports are routed to the correct party so appropriate action can be taken in a timely manner.
BTAM teams should ensure reports are routed to the correct party so appropriate action can be taken in a timely manner.
Transparency in communications, including describing actions taken or planned, can build trust and credibility in the BTAM process.
can be an important strategy to build trust and credibility in the BTAM process
A listed best practice for workplace reporting systems is to field reports in a timely and transparent manner.
Field reports in a timely and transparent manner.
It is important to establish how reports of concern will be initially processed upon receipt.
It is important to establish how reports of concern will be initially processed upon receipt.
The triage approach may vary with organization characteristics such as size and staffing.
The approach may vary based upon the organization's characteristics, including organizational size, staffing, and other factors.
Small organizations may have reports sent directly to the BTAM team for screening and assessment.
small organizations may have reports sent directly to the BTAM team for screening and assessment
Large organizations that receive many reports can use a more complex triage process that preliminarily evaluates imminence and relevance to the BTAM team.
large organizations that receive many reports can utilize a more complex triaging process in which reports undergo a preliminary evaluation of their imminence and relevance to the BTAM team
Reports should be received by trained individuals who know the BTAM process and understand that even an isolated report may indicate larger risk.
Reports should be received by trained individuals who are familiar with the BTAM process
Even an isolated report may be indicative of a larger risk.
even an isolated report may be indicative of a larger risk
One component may be better equipped to evaluate or address a concern than another, and these differences should be considered when routing reports.
one component of the organization may be better equipped to evaluate and/or address a concern than another component
Once a report is received, an initial screening should be completed.
Once a report is received, an initial screening should be completed.
Reports describing emergencies, such as a terminated employee brandishing a weapon on site, are not appropriate for a BTAM and should prompt an immediate call to security, emergency dispatchers, or local law enforcement.
Reports that describe emergency situations, such as a terminated employee brandishing a weapon on site, are not appropriate for a BTAM
A credible report appears accurate, is submitted in good faith, and includes specific details about the individual of concern and the threat.
The report should appear to be accurate, be submitted in good faith, and include specific details about the individual of concern and the nature of the threat or concern.
If the BTAM team is unsure about a report's credibility, the team should gather additional information until a determination can be made.
If the BTAM team is unsure about the credibility of a report, the team should commence additional information gathering until a determination can be made.
A report is actionable if it contains enough detail to facilitate investigation and is relevant to the purpose and scope of the BTAM program.
The report should contain enough details about the situation that elicited concern to facilitate further investigation
Most non-imminent reports that are credible and actionable should be routed to the appropriate party, usually the organizational BTAM team, for inquiry and assessment.
should be routed to the appropriate party, usually the organizational BTAM team, for inquiry and assessment (see Step 5)
Some cases may need no further BTAM action and may be appropriate for other services or systems.
Other cases may require no further action from the BTAM team, but they may be appropriate for other services or systems.
When a report is referred elsewhere, the reason for referral should be documented and records preserved under the organization's retention policy.
the reason for referral should be documented, and the records should be preserved based on the organization's records retention policies
The report gives requests for reasonable accommodations as an example of a report outside the BTAM team's responsibilities.
requests for reasonable accommodations
During the initial screening of a report, three determinations should be made about it: whether it describes an emergency, whether it is credible, and whether it is actionable.
During the initial screening, three determinations should be made about the report:
The first initial-screening determination is whether the report describes an emergency.
Is the report describing an emergency?
The third initial-screening determination is whether the report is actionable.
Is the report actionable?
The second initial-screening determination is whether the report is credible.
Is the report credible?
Executives' high visibility can present unique safety challenges when individuals harbor grievances against the organization and focus their hostilities on its leadership, making executives vulnerable to stalking, harassment, and targeted attacks.
This visibility can present unique safety challenges when individuals harbor grievances against an organization
A 2025 report by the Security Executive Council and Mercyhurst University examined 424 incidents targeting executives.
A report published in 2025 by the Security Executive Council and Mercyhurst University examined 424 incidents
A 2025 Security Executive Council and Mercyhurst University report that examined 424 incidents found that physical and cyber incidents targeting executives have doubled since 2024, resulting in record numbers (endnote 14).
physical and cyber incidents targeting executives have doubled since 2024, resulting in record numbers
Executives and high-ranking officials have experienced a gradual increase in threats of violence over the past decade, with sharper increases in recent years.
Executives and high-ranking officials have experienced a gradual increase in threats of violence over the past decade, with sharper increases in recent years.
The guidance in this publication is intended to help prevent targeted workplace violence from affecting all personnel, including executives.
The guidance in this publication is intended to help prevent targeted workplace violence from impacting all personnel, including executives.
Some organizations use additional strategies to protect high-ranking officials because of the unique characteristics of threats to executives.
some organizations use additional strategies to protect high-ranking officials
Dedicated analysts routinely monitor digital platforms, including social media, to assess and respond to threats and harassment targeting executives.
Dedicated analysts routinely monitor digital platforms, including social media, to assess and respond to threats, harassment, or other concerning behaviors targeting executives.
Specially trained security teams can provide physical protection for executives at home, in the office, or during travel.
Specially trained security teams provide physical protection for executives while they are at home, in the office, or during travel.
Teams of analysts and security personnel gather intelligence and coordinate security and transportation logistics before an executive's trip and support during it.
Teams of analysts and security personnel gather reliable intelligence and coordinate security and transportation logistics before an executive takes a domestic or international trip
Some organizations implement physical security enhancements at an executive's home to bolster protective efforts. (endnote 16)
Some organizations implement physical security enhancements at an executive's home to bolster protective efforts
Because of the high visibility of their positions, executives and high-ranking officials can attract a lot of attention from the general public.
Due to the high visibility of their positions, executives and high-ranking officials can attract a lot of attention from the general public.
A 2026 security report found that 42% of more than 2,000 surveyed chief security officers reported that the threat of violence toward executives had increased within the previous two years. (endnote 15)
Sample (n = undeterminable of undeterminable) · chief security officers surveyed for a 2026 security report (over 2,000)
a 2026 security report found that 42% of over 2,000 chief security officers who were surveyed reported that the threat of violence toward executives had increased within the previous two years.
During an executive's trip, the travel advance team provides real-time support.
During the trip, the team provides real-time support.
Physical security enhancements at an executive's home can include surveillance systems, alarms, access controls, and on-site security staff. (endnote 16)
These enhancements can include surveillance systems, alarms, access controls, and on-site security staff.
Find the Perfect Training Class For You
