Active Shooter Preparedness at Work: An Employer Plan (2026)

Active shooter preparedness at work is the set of written policies, training, drills and building measures an employer puts in place so staff can recognize a developing threat, act in the first minutes, and survive until responders arrive. The practical version is not a binder on a shelf: it is a named owner, a rehearsed alert, a rehearsed escape route, and a plan for the week after. Most violent incidents at workplaces are over within about ten to fifteen minutes, well before law enforcement can get through the door.

That timing is the whole reason the work matters. Employees who have drilled tend to move on instinct. Everyone else tends to freeze, argue, or walk toward the sound. Below is the plan I would hand to an employer with no program at all — roughly a quarter’s work, done in the order below.

Table of Contents

• What You Need
• Step-by-Step Active Shooter Preparedness at Work
  • Step 1: Assess the workplace and build a prevention team
  • Step 2: Create written prevention and response policies
  • Step 3: Establish warning and communication systems
  • Step 4: Train employees and authorized responders
  • Step 5: Plan facilities and access controls
  • Step 6: Conduct realistic drills and evaluate them
  • Step 7: Prepare for medical, operational and emotional recovery
• Common Mistakes
• Frequently Asked Questions
  • How often should we run active shooter drills?
  • Does OSHA require active shooter training?
  • What should an emergency action plan include?
  • What should employees do if they see an immediate threat?
  • How do we run a drill without traumatizing employees?
  • How should a small business with under 50 employees handle this?
• Conclusion

What You Need

You do not need a consultant to start. You need eight things, and most organizations already own six of them.

• A planning committee with a named lead. One person accountable, plus representatives from human resources, security or facilities, communications, and one or more employee representatives from non-office shifts.
• A written risk assessment. Who enters your building, who works alone, which rooms have a single door, where the nearest safe hiding place is on each floor.
• Your existing policies, gathered in one place. Emergency action plan, evacuation and shelter-in-place procedures, incident reporting, nondisclosure, and any existing violence or weapons policy.
• An emergency contact list for local police, fire and EMS, building management, and — critically — two people outside the company who will be contacted after an incident.
• Communication tools you can reach in under ten seconds: an alert system that works on phones, a PA or speaker system, radios for security and facilities, and a backup such as text groups or a messenger channel.
• Training materials and a trainer. Either an internal person trained and credentialed through an appropriate provider, or an outside instructor. Slides alone are not enough.
• Legal and safety resources. Your state plan status under OSHA, any industry-specific standard, and a relationship with a safety consultant or employment attorney who can review the finished plan.
• Post-incident support in place before you need it. An employee assistance program, a mental health provider or crisis line, and clarity on who pays for counseling after a traumatic event.

Two of these deserve a note. The contact list should exist on paper, not only in a shared drive, because shared drives go down with the network. And the mental health support has to be arranged in advance — searching for a crisis counselor at 11 p.m. on the night of an incident is how well-meaning plans fail.

Step-by-Step Active Shooter Preparedness at Work

Follow the seven steps in order. Each one has a check that tells you it worked, because a plan nobody has verified is just a document.

Step 1: Assess the workplace and build a prevention team

Walk the building with facilities and security. Map every entrance, note which doors lock from inside without a key, find the rooms with a single exit, and mark the gaps in coverage that happen at shift changes, at the loading dock, or in the parking garage at night. You are looking for time and distance, not for a perfect building.

Then put the assessment in front of a committee rather than one manager. HR brings the policy and legal constraints, facilities brings the building, communications brings the alert system, and the employee representatives bring the part you cannot see from an office: which entrance people actually use at 2 a.m., and which employees would not speak up in a meeting.

Write down who decides what. During an event, someone must be able to call an evacuation without asking permission. How you verify it: ask three people, out loud, “who can order a lockdown, and who can override it?” If the answers differ, the plan is not done.

Step 2: Create written prevention and response policies

The practical core of active shooter preparedness at work is two documents. The first is a workplace violence prevention plan covering prevention and reporting: how employees report concerning behavior, a stated no-retaliation policy, who reviews reports, and what the company does when a threat is substantiated. The second is the emergency action plan for an active shooter specifically.

The second document should describe, in plain language, what employees do: how to call 911 and what to say, how to evacuate, how to hide and barricade, when shelter-in-place applies instead, what the alert sounds like, and what is prohibited — such as re-entering the building, gathering in the parking lot, or posting about the incident on social media.

Give everyone the same short version, one page, that they can keep at their desk. How you verify it: hand the page to someone who was hired last month and ask them to explain it back to you. If they cannot, rewrite it.

Step 3: Establish warning and communication systems

Choose one primary alert and at least one backup. The primary should reach every person on site, including visitors, contractors, night-shift staff and anyone working in a basement or a truck. The backup matters because the primary will sometimes be the thing that fails — muted phones, a dead PA amplifier, a building manager who locks out the system.

Agree on exact wording, and keep it short. Code words feel clever in a policy meeting and useless in a real event. Pick language that means one thing and only one thing, and state plainly whether the message is a drill or a real emergency.

Decide now how you reach employees’ families afterward, and who is authorized to speak publicly. A crisis communications plan that is written during the incident is written too slowly. How you verify it: send a test alert and count how many people acknowledge it within two minutes. Anything under ninety percent means the channel needs a second layer.

Step 4: Train employees and authorized responders

Keep two things separate in your training, because most programs blur them. Prevention behavior is what you do every day: noticing a colleague whose behavior has changed sharply, knowing where to report it, understanding that retaliation for a good-faith report is a policy violation. Emergency action is what you do in ninety seconds: evacuate if the path is clear, hide and barricade if it is not, and treat physical confrontation as an absolute last resort.

Pick one response framework and teach it consistently. Run, Hide, Fight, developed from FBI and CISA guidance, is the most widely recognized. ALICE adds a distinct counter step. What matters is that employees can recite the same three or five steps in the same words, and that nobody is confused about whether fighting back is permitted — for most organizations, it is described as a last resort when escape is not possible and the threat is life-threatening.

Train role-specific groups separately: reception and front desk, anyone who works alone or drives alone, managers, and security. Then cover the workforce your building training misses. Remote and hybrid staff need the same framework, the same alert instructions for their area, and a clear route for checking in on a partner site. How you verify it: score a short unannounced quiz before and after training. If the post-training score is not materially higher, change the format — a talking-head module that everyone ignores is worse than no module, because it produces a false record.

Step 5: Plan facilities and access controls

Work through the building with someone qualified. Look at door hardware that cannot be locked from inside, windows that break easily, blind corners in hallways and stairwells, camera coverage of entrances and parking, and lighting that fails or switches off when power drops.

Identify at least one shelter location per floor that can be barricaded, and confirm it works for employees with mobility, hearing, or vision needs. Then document the changes you want, with costs and lead times, and bring structural, electrical, and access-control work to licensed professionals.

Keep floor plans and equipment shut-off locations on a phone or tablet, not in a facilities office. Facility managers report that responders need building information they can pull up while they are still walking in. How you verify it: hand a phone to a volunteer and ask them to find the fire riser shut-off in under thirty seconds.

Step 6: Conduct realistic drills and evaluate them

Practitioners are consistent about this: hands-on drills with movement and sound build muscle memory, and slide decks do not. Plan a mix — announced tabletop exercises for the plan itself, and periodically an unannounced drill of the response, announced far enough in advance that nobody is injured by panic but not far enough to become theatre.

No realistic weapons, no fake blood, no staged confrontations with volunteers, and no ambush of a single employee. A drill that surprises one person and informs the rest teaches the wrong lesson. Tell people in advance that a drill is planned, tell them how long it runs, and tell them what happens afterward, or you will lose trust you will not get back quickly.

Measure it. Time how long it takes to notice, to decide, to reach the exit, and to reach 911. Record what people did, not who was slow. Assign corrective actions with an owner and a date, then run the next drill. How you verify it: you have a written after-action report with dated actions, and those actions were closed out before the next exercise.

Step 7: Prepare for medical, operational and emotional recovery

The first hour after the event determines whether injuries become deaths. Many organizations have bleeding kits on site and nobody has been trained to use them. Have someone certified in first aid and Stop the Bleed, know where the kits and AED are on each floor, and plan how responders will reach injured people.

On the business side: an alternate work location, a communications hold line, a way to reach employees who were not in the building, and clarity on who notifies insurers, workers’ compensation, regulators, and families.

On the human side, this is where programs are thinnest, and where a [guide to preventing secondary traumatic stress at work](https://workhealthresearchnetwork.org/how-to-prevent-secondary-traumatic-stress-at-work/) becomes relevant for the colleagues who respond, not just the people involved. Provide psychological first aid in the first hours, offer support to everyone exposed, keep participation confidential under your existing privacy practices, and plan the return to work deliberately. More on supporting the wider team in our piece on [supporting employee mental health at work](https://workhealthresearchnetwork.org/how-to-support-employee-mental-health-at-work/), and on lowering everyday strain in [how to reduce stress at work without quitting](https://workhealthresearchnetwork.org/how-to-reduce-stress-at-work-without-quitting/).

Common Mistakes

Almost every weak program I have seen has the same handful of problems, and each has a straightforward fix.

• The policy is generic. A binder that names no room, no door and no person. Fix: rewrite it against your own floor plan.
• Nobody knows who decides. Managers waiting for permission while an event unfolds. Fix: state the authority in one sentence, in writing.
• Only one communication channel. An alert system that does not reach phones, basements or contractors. Fix: a primary plus a backup, tested separately.
• Systems have never been tested. A door that does not lock, a PA that does not carry, a camera feed nobody can pull up. Fix: a physical walk-through with a checklist and a stopwatch.
• Drills are theatrical. Loud, disruptive, and designed to impress leadership. Fix: drill the response, not the volume, and write the after-action report.
• Accessibility is an afterthought. Alerts that rely on sound alone, evacuation plans that ignore employees who cannot use stairs. Fix: multi-modal alerts and a named assistance plan per floor.
• No aftercare. The program ends when the police leave. Fix: line up support before the first drill, not after the first incident.
• Training happens once. A session at orientation and never again. Fix: at least twice a year for staff, refreshed after every organizational change and every incident.
• Night shift and remote staff are skipped. The people on site when the building is emptiest train least. Fix: deliver the same content to every shift and include remote staff in policy updates.

Frequently Asked Questions

Conclusion

Start with the first five moves, and do them this month. Appoint one named lead with real authority. Walk the building and write down what you find. Turn those findings into a one-page response sheet everyone can reach without a login. Test the alert once and count the acknowledgments. Schedule the first drill and put the aftercare plan in writing before you run it.

Active shooter preparedness at work is not a large project. It is a small set of decisions made in advance, written down, rehearsed, and revised. Organizations that do those things have a measurably better first fifteen minutes, and the first fifteen minutes are the whole event.