Active Shooter Response Planning for Employers
The employer's job in an active shooter incident is not to fight the incident - it is to get the right protective-action message to the right people in seconds, coordinate cleanly with law enforcement, and account for every person on site.
Scope of this guide
This is a planning and communication guide for employers. It does not provide tactical training, weapons instruction, or law-enforcement guidance. Refer employees to certified trainers for hands-on practice, and coordinate with local law enforcement for site-specific tactics.
Emergency Overview
An active shooter incident is a life-safety emergency in which one or more people are actively causing or attempting to cause death or serious injury with a firearm. What distinguishes it from other emergencies is speed: most incidents are resolved in minutes, often before law enforcement arrives on scene. That timeline means the employer's communication plan is judged almost entirely by what happens in the first two minutes.
The plan should assume that formal approval chains will not function, that phones will ring unanswered, and that people will act on the first credible message they receive. Everything in this guide is organized around that assumption.
Immediate-Action Command Structure
Rather than a large committee, an active shooter response depends on a small, always-available command team with pre-delegated authority.
On-Call Activator
A trained security, safety, or operations lead - with named 24×7 backups - authorized to activate any preapproved life-safety template without further approval. This role exists solely to remove the approval bottleneck.
Incident Commander
Assumes overall coordination once activation is complete. Interfaces with law enforcement, executive leadership, and the communications lead. Not required to send the first message.
Law-Enforcement Liaison
Meets responders at a preplanned rendezvous point with facility maps, access credentials, and camera feeds if available. Relays tactical guidance about what messaging is safe to send.
Communications Lead
Owns follow-up messages after the initial alert - situation updates, accountability requests, family notification, media response, and the all-clear. Coordinates with legal and executive on public statements.
Accountability Coordinator
Runs the personnel-status process after the immediate threat is contained. Owns visitor and contractor rosters and reconciles them with employee acknowledgements.
HR / Employee Support Lead
Coordinates family notification, employee assistance program access, mental-health resources, and return-to-work communication. Activates before the incident is fully resolved.
Warning Indicators and Escalation Triggers
Many incidents are preceded by observable warning signs, though not all are. The plan should describe how employees report concerns and how those reports are triaged. Public guidance from DHS, CISA, and the FBI on pathways to violence and behavioral warning signs is the appropriate reference - do not invent your own indicators.
- Direct or implied threats of violence, whether verbal, written, or online
- Escalating conflict with a co-worker, supervisor, or ex-partner known to the workplace
- Reported presence of a firearm on site outside of approved policy
- Perimeter security alerts - forced entry, disabled access control, or bypassed screening
- Reports of gunfire or a description matching an active shooter incident
Planning Before the Emergency
Risk and site review
Assess entry points, sightlines, shelter locations, and known-vulnerable areas. Coordinate the review with local law enforcement where possible.
Written procedures
Document activation authority, template inventory, channel matrix, law-enforcement liaison, accountability, and family-notification steps.
Contact-data readiness
Refresh employee contact information on a documented cadence. Include personal-device numbers for life-safety messaging with employee consent.
Accessibility
Plan for employees with mobility, hearing, vision, or cognitive disabilities. Assign buddies where appropriate and confirm shelter locations are accessible.
Visitors and contractors
Use a host-of-record model at check-in. Every visitor and contractor should be reachable through their host or a supervisor listed in the notification system.
Law-enforcement coordination
Share floor plans, access procedures, and rendezvous points with local law enforcement in advance. Update any time the facility changes materially.
Communication Plan
The communication plan for this incident is deliberately minimal. Fewer decisions during the incident means faster protective action.
- Activation authority: On-call activator, no additional approval for the initial protective-action message.
- Audiences: Employees on affected site first; adjacent sites and remote workers next; executives and family communication points third.
- Primary channels: SMS and site public-address system, in parallel.
- Backup channels: Voice, email, Microsoft Teams or Slack, floor-warden cascade.
- Acknowledgement: Requested on the accountability message, not on the initial protective-action message.
- All-clear authority: On-scene law enforcement authorizes the operational all-clear; the incident commander authorizes the employer communication that follows.
Communication Sequence
Initial protective-action message
Sent immediately on activation. Short, direct, references the run-hide-fight framework already taught to employees. No situation detail.
Situation update
Once law enforcement is on scene and it is safe to communicate more, share what is known and what is not, and confirm the protective action still in effect.
Accountability request
After law enforcement clears the immediate area. Requests explicit acknowledgement and status.
Continued-status update
Regular updates on facility status, media presence, family reunification, and next expected communication time.
Operational all-clear
Communicates that law enforcement has authorized re-entry or release, along with next-step instructions.
Recovery and support message
Details on employee assistance, counseling, flexible work arrangements, and the timeline for facility reopening.
Sample Alert Messages
Examples only. Customize with your organization's terminology, sites, and legal review before use.
Initial protective action (SMS)
Situation update
Accountability request
Family communication point
Operational all-clear
Employee Accountability
Accountability is not the first priority - protective action is. Once law enforcement has stabilized the scene, the accountability coordinator sends the accountability request, tracks per-recipient responses, and escalates non-responders to supervisors and in-person checks. Visitor and contractor rosters are reconciled against sign-in records rather than expected in the same acknowledgement pool. Do not release names, injury status, or personal information outside the incident-command channel.
Law-Enforcement Coordination
Coordination is easier when the relationship exists before the incident. Invite local law enforcement to walk the site, share floor plans and access procedures, and identify the on-scene liaison from your team. During the incident, follow tactical guidance about what messaging is safe to send - for example, do not broadcast responder positions or entry paths through employee channels.
Training and Exercises
- Employee orientation includes reporting warning signs and the run-hide-fight framework, delivered by qualified trainers.
- Supervisors receive additional training on activating the notification system and running local accountability.
- Annual tabletop exercises with executive leadership, security, HR, communications, and legal counsel.
- Periodic functional exercises with local law enforcement where they will participate.
- System tests of the notification platform on a regular cadence, including the emergency-bypass procedure.
Recovery and Continuity
Recovery begins during the incident. Employee assistance, mental-health resources, and flexible work arrangements should be communicated within hours, not days. Facility assessment, evidence preservation, and reopening timelines are coordinated with law enforcement. Continued updates keep employees and families informed and reduce reliance on media reporting for basic facts.
After-Action Review
An after-action review is essential after any activation, real or exercised. Reconstruct the timeline, review activation-to-first-message time, delivery and acknowledgement rates by group, and any confusion or delays. Assign corrective actions with owners and due dates, and re-test any procedure that failed. See the foundational guide on how to conduct an after-action review for the full process.
How Safeguard Signal Fits
Safeguard Signal can send the initial protective-action message across SMS, voice, email, Microsoft Teams, and Slack in a single activation, target site-specific groups so remote workers are not paged for a site incident, and record per-recipient acknowledgement for the accountability step. Saved templates match the exact wording your security, HR, and legal teams approved. Delivery analytics feed the after-action review. The platform does not replace trained activators, law-enforcement coordination, or the plan itself.
Related Guides
- Safeguard Signal Resource Center
- Emergency Preparedness hub
- How to Build an Emergency Communication Plan
- How to Create an Emergency Response Team
- Workplace Fire and Evacuation
- Chemical Spill Response
- Safeguard Signal multi-channel alerting
Authoritative Sources
- U.S. Department of Homeland Security - Active Shooter Preparedness (cisa.gov/active-shooter-preparedness)
- FBI - Active Shooter Resources (fbi.gov/how-we-can-help-you/safety-resources/active-shooter-safety-resources)
- FEMA - Emergency Management Guide for Business and Industry (fema.gov)
- OSHA - Workplace Violence (osha.gov/workplace-violence)
- Ready.gov - Active Shooter (ready.gov/active-shooter)
Frequently Asked Questions
Who should be authorized to issue an active shooter alert?
Any trained on-call role identified in the plan should be able to activate a preapproved life-safety template without further approval. Requiring executive sign-off for the initial protective-action message is a common cause of delay.
What should the first message say?
A preapproved short message that names the incident type, the location if known, and the immediate protective action, using plain language. Detail and updates follow later; the first message exists to get people to act.
How should we coordinate with law enforcement?
Establish the relationship before an incident by inviting local law enforcement to review your site plans, share access information and floor maps in advance, and identify a single on-scene liaison from your team. During an incident, follow their direction on messaging that could affect their tactics.
Should we tell employees to run, hide, or fight?
Public-safety guidance from DHS, CISA, and the FBI describes the run-hide-fight framework. Employers typically reference this training rather than authoring their own tactical instructions, and refer employees to certified trainers for hands-on practice.
How do we account for people after an incident?
Send an accountability request through the notification system once it is safe to do so, escalate non-responders to supervisors and a documented in-person check, and share the roster status with the on-scene incident commander and law enforcement.
What communication is owed to families?
Establish a single approved family-notification channel and a designated spokesperson before the incident. Never confirm or release personal information about affected employees through general channels.
How do we support employees afterward?
Coordinate with your employee assistance program, mental-health providers, and HR to offer voluntary counseling, flexible return-to-work arrangements, and clear updates about facility status and investigation progress.