Dealing with Workplace Violence Tabletop Exercise

1. Dealing with Workplace Violence Tabletop Exercise For Exercise Use Only

2. For Exercise Use Only For Exercise Use Only: This exercise and all exercise-related documents and discussions are intended FOR EXERCISE USE ONLY. All documents should be safeguarded, handled, transmitted, and stored in accordance with the appropriate security directives. 2

3. Opening Remarks [Add name and title here] 3

4. Participants • [List participants here] 4

5. Introductions • Please state your name and organization. • Please restate your name and organization when speaking. 5

6. Agenda [make changes as necessary] • 0800 – 0830: Registration • 0830: Welcome, Introductions and Guidelines • 0845: Objectives • 0855: Module 1 • 0925: Break • 0935: Module 2 • 1105: Module 3 • 1205: Hot Wash • 1225: Closing Comments • 1230: End Exercise • 6

7. Administration • Classification Level:This exercise and all exercise-related documents and discussions are unclassified and intended FOR EXERCISE USE ONLY. • Cell Phone Use:Please turn your phones off during the exercise. If you need to make a call or check e-mail, please kindly move to the lobby area. • Materials: Situation Manual (SitMan), seating chart, participant roster [add any other materials the facility may use] • Safety & Evacuation

8. Exercise Summary The Dealing with Workplace Violence Tabletop Exercise provides owners and operators with a useful exercise planning template to address and discuss gaps, issues, and concerns. The exercise allows exercise participants the opportunity to address key issues through a series of facilitated discussions. The focus of this exercise is on preparedness; to increase effective information sharing and coordination between the facility, first responders, and relevant stakeholders. 8

9. Exercise Structure • Module 1 – Pre-Incident Phase Module 2 – Incident and Response Phase Module 3 – Assessment Phase • Each module will begin with a scenario key event update. • Participants will then engage in issue-based discussions. • Facilitator will manage time allotted to each discussion period. • Participants are encouraged to use the Situation Manual as a reference. 10

10. Exercise Purpose Exercise design objectives are focused on improving information sharing, the understanding of incident management activities, developing recommended actions, and procedural adjustments to address potential problem areas in advance of a potential threat to the facility, and in accordance with relevant plans and procedures. 11

11. Exercise Objectives (1 of 2) • Identify and evaluate plans for response and mitigation of potential workplace violence. • Assess the roles and effectiveness of coordination between public safety officials and owners/operators in reacting to an adversarial event in accordance with existing plans and Standard Operating Procedures (SOPs) (e.g. Site Security Plans, Emergency Action Plans, Emergency Response Plans, Memorandums of Agreement, Memorandums of Understanding). • Examine the effectiveness of overall emergency response procedures in a no-notice adversarial event in regards to the Incident Command System (ICS) and logistical coordination among on-scene authorities. • Examine and evaluate facility incident response plans (e.g. Site Security Plans, Emergency Action Plans, Emergency Response Plans, or other appropriate plans) used during an adversarial event. 12

12. Exercise Objectives (2 of 2) • Assess the methods and effectiveness of internal and external communications during an adversarial event in accordance with existing plans and SOPs. • Identify and evaluate response, mitigation, and recovery actions associated with an adversarial event at the facility. • Review information and threat sharing procedures and challenges between Federal, State, and local government to and from owners/operators. • Identify gaps, redundancies, developmental activities, and best practices in standard procedures in response to an adversarial situation. 13

13. Scenario Questions • Each module of the tabletop exercise will be followed by a facilitated discussion utilizing a set of discussion questions related to the module scenario. • Module questions will focus on different elements of incident management and provide a framework for discussion. • Discussion questions in the Situation Manual are supplied as catalysts. Participants are not required to answer every question, nor are they meant to limit topics that can be discussed. • Facilitator may ask additional, pertinent questions to stimulate further discussions. 14

14. Exercise Guidelines • Open, low-stress, no-fault environment. • Non-attribution, “Chatham House” rule. • Responses should be based on knowledge of your current plans, capabilities (i.e. use only existing capabilities), and insights derived from training. • Decisions are not precedent setting and may not reflect an organization’s final position on a given issue. • Assume cooperation and support from other organizations. • Problem-solving efforts should be the focus - issue identification is not as valuable as suggestions and recommended actions. • The situation updates, written material, and resources provided are the basis for discussion. 15

15. Assumptions and Artificialities • The scenario is plausible and events occur as they are presented. • There is no “hidden agenda” nor any trick questions. • All players receive information at the same time. • The scenario for this exercise is artificial. • Assume cooperation and support from other organizations. • The actions of law enforcement need to be addressed and understood, but are not the focus of this exercise. 16

16. Scenario Video VIDEO LINK 17

17. Scenario: Module 1 (1 of 5) Pre-Incident Phase • 0820: Several employees arrive at work and pull into the parking lot. A disagreement begins between Mark and Sharon after Mark gets upset because Sharon took a parking place he planned to use. Mark steps out of the car and a verbal altercation ensues when Brian steps in to try to calm Mark down. Mark eventually storms off, parks his car in a separate parking spot, and quickly enters the building. • Should any action be taken by Sharon, Brian, or other coworkers who witnessed this incident take place? • Are plans or procedures available to guide employees in their actions/decisions? • Is there a system in place for reporting signs of potentially aggressive/violent behavior in the workplace? 18

18. Scenario: Module 1 (2 of 5) Pre-Incident Phase • 0945: Sharon and Brian are in the break room discussing the fact that Mark seems to be disgruntled lately, while going through a divorce. Mark’s boss, Angela, walks into the break room and asks Sharon if she is alright, as she heard about the incident in the parking lot by others in the office. Angela tells Sharon and Brian that she intends to speak with Mark. • Being the supervisor, should Angela have spent more time with Sharon or Brian regarding what took place that morning in the parking lot or should she have asked additional questions about the recent interactions with Mark? • Should Sharon and Brian have volunteered information about Mark’s personal situation? 19

19. Scenario: Module 1 (3 of 5) Pre-Incident Phase • 1050: Angela requests a meeting with Mark in her office. Angela informs Mark that she heard about the incident in the parking lot and that she has received consistent complaints from other employees regarding his aggressive behavior. She also addresses ongoing issues with Mark’s performance and informs him that he will be placed on a probationary period. Angela tells Mark that his behavior will not be tolerated and that if his work does not improve there could be serious consequences. The discussion becomes heated when Mark abruptly ends the meeting, not wishing to discuss anything further with his boss. Mark is visibly angry and upset when he leaves Angela’s office. • At this point, what actions, if any, should Angela take after the meeting that just took place with Mark in her office? • What response could have been applied toward reducing disruptive, threatening, or potentially violent behaviors? 20

20. Scenario: Module 1 (4 of 5) Pre-Incident Phase • Should Mark’s behavior be reported to security? • Did any of the actions taken by Angela potentially increase workplace violence risk factors? • Are there counseling services available to employees who show signs of stress or aggression/violence? 21

21. Scenario: Module 1 (5 of 5) Pre-Incident Phase • 1105: Mark exits the building and walks out to the parking lot. He goes to his car and retrieves a large, heavy, dark duffel bag out of the trunk, throws it over his shoulder, and walks back toward the building. • Should Mark have been escorted after the heated confrontation with his boss in which he left visibly upset? • If an escort is recommended, who would be sent to accompany Mark? • Are facility/company policies adequate to deescalate this from proceeding into a violent incident? Do amendments to current procedures need to be considered to ensure safety for workers? 22

22. Scenario: Module 2 (1 of 3) Incident and Response Phase • 1115: A telephone call is received by the local 911 operator from an employee at the facility. In the midst of audible gunshots, the frantic caller reports that there is a man, with what appears to be a gun, in the facility, and two injured victims in the hallway. The caller also reports that the apparent assailant seems to be moving throughout the office and is firing at any employees in his path. • 1117: Shortly after receiving the telephone call from the distressed employee, the local 911 center notifies local and State law enforcement of a potential active shooter incident occurring at the facility. In addition, a message is broadcast to all surrounding law enforcement agencies to notify them of the situation. The 911 center also contacts emergency medical services. The 911 operators subsequently attempt to communicate with the facility’s security personnel. 23

23. Scenario: Module 2 (2 of 3) Incident and Response Phase • 1120: The operations manager for the facility is reached and notified of the incident by a facility employee. The local 911 center and facility security are receiving additional telephone calls from individuals hearing gunshots. • 1122: Local law enforcement and emergency medical services arrive at the scene of the incident and request facility maps. • 1123: Law enforcement officers onsite assemble a contact team and access the facility. To secure the facility, they enter the building to search for the assailant and any potential victims. Concurrently, other law enforcement officers establish a command post to direct responding personnel. Considerations are also being made to close nearby roads and request businesses and residents in the immediate area to shelter-in-place until the situation is contained. 24

24. Scenario: Module 2 (3 of 3) Incident and Response Phase • 1124: Additional gunshots are heard and law enforcement officers direct evacuated facility personnel to a more secure location. • 1126: Reports from employees who fled the facility indicate the assailant is an employee, Mark Smith, and he is headed towards the East side of the facility. Local news media arrive on scene to report the incident. Additional emergency medical services and law enforcement officers also arrive. • 1133: Law enforcement informs facility personnel that the assailant has been located with a self inflicted wound. Law enforcement continues to conduct additional search and rescue missions of the facility and begin evacuating remaining employees. 25

25. Scenario Questions: Module 2 (1 of 10) • 1. Do owners/operators have the necessary security capability to protect personnel and the facility during an incident while waiting for law enforcement to formally respond? • Do facility incident response plans (e.g. Site Security Plans, Emergency Action Plans, Emergency Response Plans, or other appropriate plans) contain protocol for properly responding to similar incidents described in the module? • Have security personnel been trained to provide guidance to employees for this type of incident? • Are employees trained for this type of emergency incident? Is emergency contact information made available to the call desk? Do procedures exist for sheltering-in-place versus evacuation? • If your facility has security personnel, are they clearly identifiable upon arrival of law enforcement? • Do owners/operators have a notification system in place to warn employees on and offsite during such an incident? • What instructions will be given to the employees (e.g., evacuation, shelter-in-place, lockdown)? 26

26. Scenario Questions: Module 2 (2 of 10) • 2. Does the facility maintain security technology that can assist law enforcement in response efforts? • Can security personnel assist in locating victims and assailants via closed-circuit television or similar capabilities? • Are there access control capabilities at the facility in order to facilitate entry of first responders, prevent entry of visitors or additional employees, and manage contractors on site? • Does the facility have the ability to remotely control access to critical components or activate/deactivate card readers, including the capability to deactivate a specific card? • Is there appropriate emergency lighting capability at the facility to deal with a night time incident? 27

27. Scenario Questions: Module 2 (3 of 10) • 3. Do State and local officials effectively coordinate to respond to an incident at the facility? • Are the necessary Memorandums of Understanding (MOU) and Memorandums of Agreement (MOA) in place for external jurisdictions to assist in response efforts? • Do local, county, and State law enforcement have incident response plans (e.g. Site Security Plans, Emergency Action Plans, Emergency Response Plans, or other appropriate plans) for an active shooter situation? If so, who leads the response? • What would State and local officials need from owners/operators during an incident similar to that detailed in this module? 28

28. Scenario Questions: Module 2 (4 of 10) • 4. How is an emergency response coordinated? • Are any of the facility’s incident response plans (e.g. Site Security Plans, Emergency Action Plans, Emergency Response Plans, or other appropriate plans) regularly provided to first responders in preparation for potential incidents? • Upon arrival of law enforcement, is there a “go bag” available to them containing desired items such as facility map/floor plans, access swipe cards, elevator keys, etc? • Are there any safety concerns that need to be addressed (e.g., entering restricted or hazardous areas)? • How do emergency response personnel access the buildings? • Have local law enforcement/first responders participated in exercises and/or training at the facility? 29

29. Scenario Questions: Module 2 (5 of 10) • 5. How is emergency communication handled? • Are critical telephone calls getting through? If not, is an alternate means of communication available? • How will owners/operators interact with media representatives and control media access to the facility? • Are there procedures in place to manage the media if they arrive? • Should additional emergency announcements be made to the public? If so, by whom? 30

30. Scenario Questions: Module 2 (6 of 10) • 6. Do the facility’s incident response plans cover emergency coordination activities described in the module? • How is response coordinated and who maintains decision-making authority when facility management is not available? • Is delegation of authority captured in the security plan? • If doors to critical facility components are locked, how does law enforcement obtain access? • Is there a safe location identified for personnel who are evacuating the immediate area? 31

31. Scenario Questions: Module 2 (7 of 10) • 7.What are the local law enforcement’s policies and procedures regarding active shooter incidents? • What personnel resources do they have available to handle the situation and establish a secure perimeter? • 8. In what manner will command and control of the situation be established in order to comply with the Incident Command System? 32

32. Scenario Questions: Module 2 (8 of 10) • 9. Do owners/operators have a sufficient existing security capability to protect staff and the facility during an emergency? • Is there a way to account for employees (i.e., those who reported for work that day versus those on leave)? • How is media access to the facility and staging areas managed? • What access control is or should be in place? • What are the procedures for safely securing any critical component or operation of the facility? • What other life safety issues should be considered? 33

33. Scenario Questions: Module 2 (9 of 10) • 10. Does the facility have physical security measures that may be relevant to this scenario? • What types of perimeter security does this facility have (e.g., fences, doors, gates)? • What type of vehicle control checkpoints are present (e.g., barriers, driveways, parking lots)? • Does the public have access to the facility? 34

34. Scenario Questions: Module 2 (10 of 10) • 11. How does law enforcement determine that the scene is cleared and there are no additional shooters? • Once an all clear is given, how is that information communicated to all personnel sheltered-in-place? • 12. For a prolonged incident with a known assailant, law enforcement will need as much information on the assailant as soon as possible. Can that information be provided if law enforcement requests it? 35

35. Scenario: Module 3 (1 of 3) • Module 3: Assessment Phase • 1145: Law enforcement informs facility personnel that there are no additional assailants. Law enforcement also reports approximately four additional fatalities and eight wounded. Law enforcement announces that they are going to initiate a controlled employee evacuation for all remaining employees. At this time, the incident commander provides a statement to all personnel and the public informing them of the conclusion of the incident. • 1150: Law enforcement notifies facility owners/operators that the facility is a crime scene until further notice. 36

36. Scenario: Module 3 (2 of 3) • Module 3: Assessment Phase • 1155: Emergency medical services enter the facility and reports that there are currently five fatalities and seven wounded. The wounded are being transported to a local hospital—the extent of the injuries are unknown. This information is relayed to the facility’s emergency coordinator. Neighboring facilities are notified that the facility has been secured. • 1205: Emergency medical services relay information to law enforcement and facility personnel that all seven gunshot victims are in critical condition. Law enforcement is asking the facility and personnel for help in identifying three of the injured individuals. The remaining four have been identified through personal identification cards. 37

37. Scenario: Module 3 (3 of 3) • Module 3: Assessment Phase • 1235: The names of the five deceased victims are provided to the facility owners/operators. Law enforcement is evacuating the facility on an area-by-area basis. Security personnel are excluded from this evacuation and will remain onsite to provide support, as necessary. • 1300: Family notification of the deceased and injured begin. • 1330: Law enforcement reminds the facility owners/operators that the facility is a crime scene and that it will take an undetermined amount of time to process the scene. • 1350: The facility releases an official media statement about the incident. 38

38. Scenario Questions: Module 3 (1 of 4) • 1. Do current security plans sufficiently address coordination of emergency response personnel? • What does the facility emergency coordinator need to consider (e.g., casualties, evacuation routes, hospitals)? • Where are the pre-determined locations of the facility command post and staging area(s)? • Is there a process to assist law enforcement with victim identification? 39

39. Scenario Questions: Module 3 (2 of 4) • 2. What information sharing mechanisms are in place that could be relevant for an incident such as the one described in this scenario? • Would owners/operators be able to share information in order to pass pertinent information to help prevent potential attacks at other facilities? • Would owners/operators be able to relay information to Federal, State, and local authorities, including Fusion Centers? • Would owners/operators be able to receive information from their Federal, State, and local officials, including Fusion Centers? • Would owners/operators share information with families of employees in order to keep them apprised of the situation? 40

40. Scenario Questions: Module 3 (3 of 4) • 3. How will personnel accountability and communication be coordinated? • Who makes a list of the evacuees? • How do employees leave when the employee parking lot is a crime scene and cannot be accessed? • How is information communicated with personnel and families during the days following the incident? • Will counseling for employees and family members be available? • 4. How can owners/operators prepare to handle the public messaging/media in the aftermath of such an occurrence? 41

41. Scenario Questions: Module 3 (4 of 4) • 5. How will law enforcement coordinate the future handling of the facility as an active crime scene? • How will law enforcement communicate status with owners/operators? • How will the facility work with this impediment? • Will law enforcement be able to estimate the duration the facility will be considered a crime scene? • 6. How will the ramifications of such an event be addressed in regards to business continuity planning or rapid recovery operations? • Does the facility have a continuity of operations plan in place? • Will owners/operators face liability issues? 42

42. Hot Wash Review exercise objectives and assess their accomplishment. What are the identified issues we need to take for immediate action? What are other key issues we need to consider and review? What did you get out of this exercise? What are our next steps for addressing any issues that arose during the exercise? If there were any major issues, do we start a working group to address them? If yes, who would participate in this group? 43

43. Closing Remarks [Add name and title here]

44. Thank you