For years, federal, state and local government agencies have been preparing first responders for active shooter and other hostile incidents. Several agencies, including the Federal Emergency Management Agency (FEMA) and the Department of Homeland Security (DHS), have issued guidance on the need for planning at all levels of government as well as at other entities, including businesses, campuses, public places and houses of worship.
However, the National Fire Protection Association (NFPA) is the first organization to publish a comprehensive standard for Active Shooter/Hostile Event Response (ASHER). The NFPA 3000 Standard for an ASHER Program provides a framework for communities, facilities and other entities that have the need to prepare for, respond to and recover from these shattering incidents. The standard is designed for use by organizations ranging from a small, privately-owned business to an entire community. It emphasizes sharing and coordinating plans at all levels, because such an event places heavy demands on multiple local, state and federal response agencies.
Active shooter/hostile incidents are events “capable of causing death, injury, property or environmental damage and system disruptions” [NFPA 3000, 5.2.1]. They might involve consequences in any or all of the following areas:
- Human (civilian and responder injuries and deaths)
- Economic (property loss, both direct and indirect)
- Psychological (public confidence)
- Functional (continuity of operations) [NFPA 3000, 188.8.131.52]
Conducting a thorough risk assessment will identify areas of exposure and possible locations for active shooter or hostile events. Facilities, public spaces and communities are likely to have varying vulnerabilities that will require unique response plans. For example, a county’s plan will be more comprehensive than that for a small facility.
Communities can use the NFPA 3000 standard to enhance their existing emergency management and response plans. Facilities can do the same with an existing Emergency Action Plan (EAP). For each area that is at risk, the plan should document the following:
- The number of people likely to be present throughout the day
- Common uses (manufacturing, storage, classroom, etc.)
- Demographics such as occupants’ ages and levels of training
- Control, security and alarm measures or procedures in place
- Accessibility and routes in and out
- Lockable spaces
Plans should also include useful general information such as the name of the facility owner, building maps or site plans, distance to medical facilities and logistical considerations for events that happen during extreme weather conditions [NFPA 3000, 5.4.2]. Gathering this information early in the planning process makes it easier to create plans. Other valuable planning elements include communication lists and notification procedures. You will also want to document available resources, incident management and other support functions such as crisis counseling and family reunification. Effective plans will outline the steps that building occupants should take to evacuate the building or those to take for sheltering in place if necessary. Plans should also clearly define how occupants will be notified if an event is occurring and how they can protect themselves [NFPA 3000, 9.3 and 9.4]. Exercising plans annually helps reinforce training and ensure that procedures are still appropriate [NFPA 3000, 9.5.1].
Active shooter events are very chaotic and disturbing. Response efforts are likely to demand coordination of multiple resources – both internal and external. This goes better when, as soon as possible, event responders establish and use unified command procedures to improve accountability and ensure that everyone can perform their necessary functions. All active shooter/hostile events are considered crime scenes [NFPA 3000, 8.6.2]. This being the case, anyone responding to the incident needs to understand how actions might affect investigations and how to preserve evidence. Building occupants need instruction on how to alert others of the need to evacuate and/or respond. If they assist community responders, they might need to know how to use bleeding control kits and how to perform triage. It’s essential to assign a Public Information Officer (PIO) to assist during response. The PIO needs training on providing information and correcting misinformation about actions underway, who to contact for family reunification and when and where to seek further details.
A facility or community might choose to pursue recovery within plans that already adhere to a framework such as the NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity/Continuity of Operations Programs. Regardless, the NFPA 3000 standard organizes recovery into three types: immediate, early and continued.
- During immediate recovery (the operational period immediately following threat mitigation), event responders secure the site. Priorities include completing preliminary damage assessments, reuniting families and notifying victim’s families. The response team will also communicate public information to the media and gathers witness accounts.
- The early recovery period involves assisting victims, maintaining security at the site and coordinating all agencies involved. Site officials will assess resource needs and manage the process for volunteers and donations.
- Continued recovery begins as stability comes to the site of the location. Personnel can evaluate the effect on businesses and the community and make plans to restore the areas involved, reopen facilities and provide long-term services to victims. Post-response action reports will help you document lessons learned.
Planning for active shooter and hostile events, offering training and conducting regular drills will help everyone know what to do during one of these devastating events. You will maximize readiness with a planning framework that aligns with community response plans, allowing easier coordination of outside resources that provide assistance during emergencies.