Behavioral Threat Assessment Checklist

ISPI-branded title page with the standards it is built on, version and date, fill-in fields for your organization, document owner and local version, and the disclaimer.

• Before the first case, complete Part 1 (program readiness) and keep it with the team’s policy.
• Open a new copy of Parts 2 to 7 for each case. Use the case number on every page and keep the file in a restricted location.
• Record facts and their sources. Separate what was observed from what was inferred.

Plus purpose, scope, who it is for and 3 more how-to steps.

Table with an assigned-to field for each role: Team lead or case manager, Security, Human resources or school administration, Mental health professional, Legal counsel, Law enforcement liaison, Target support liaison, Supervisor, teacher or other source.

Basis: NTAC workplace guide Steps 1 to 3; NTAC school guide Steps 1 to 4; ANSI/ASIS WVPI AA-2020 (program and threat management team)

Complete once, before the first case, and review annually.

Fill-in fields: Organization or school; Team lead; Policy reference (workplace violence or threat assessment policy); Date team established.

• Leadership has committed in writing to a safe and supportive workplace or school and to the threat assessment program.
• A written policy defines prohibited behaviors (threats, violence, weapons rules) and concerning behaviors that warrant a look, and states a non-retaliation commitment.
• A multidisciplinary team is appointed with a designated lead, backups and authority to gather information and recommend actions.

+ 6 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NTAC workplace guide Step 4 (identify and process reports); NTAC school guide Step 3; BTAU guide Step 3

Complete on the day a report is received. Record the report as closely as possible to the words used by the reporting person.

Fill-in fields: Case number; Date and time received; Received by; Reporting person (name or anonymous) and contact; Relationship to person of concern; Person of concern (name, role, affiliation); Possible target or targets; Behavior or communication reported; Date and place of the behavior; Witnesses or others aware; Evidence received (messages, screenshots, documents).

• Ask first: does the report involve an imminent threat to life? If yes, start emergency response and call emergency services now.
• Take immediate protective steps for any identified target where needed.
• Notify the team lead and, where policy requires, legal counsel.

+ 2 more checklist items, each with Done and N/A boxes and a notes field.

Triage decision: Emergency response initiated / Open preliminary inquiry / Refer to alternative resource (HR, employee assistance, student services) / No further action, reason documented.

Basis: NTAC workplace guide Step 5 (preliminary inquiry and the Systems Approach); NTAC school guide Step 5

Gather information from multiple sources to decide whether there is a safety concern. Use the Systems Approach: look across the internal and external systems in which the person lives, works or studies.

Table: Information sources contacted (columns: Source, Contacted by, Date, Summary of information). Rows include Reporting person, Supervisor, teacher or coworkers, HR, student or personnel records, Security and incident records, IT and acceptable-use records (per policy), Law enforcement records and protective orders and more.

• The reporting person has been interviewed and the original report preserved.
• Information has been sought from more than one system, internal and external.
• Any interview of the person of concern is planned with HR and legal input, with safety precautions.

+ 2 more checklist items, each with Done and N/A boxes and a notes field.

Preliminary inquiry decision: No safety concern: close or refer, reason documented / Safety concern: proceed to full assessment.

Basis: NTAC workplace guide Step 5 (assessment themes); NTAC school guide Step 5 (investigative themes); BTAU guide Step 4

Explore each assessment theme and record what was found and its source. Themes are areas of inquiry, not a checklist score. Mark whether the information raises concern, reduces concern or is still unknown.

Assessment themes table (information found, source, and raises concern / reduces concern / unknown): Stressors, Home life, Mental health, Criminal history, Interpersonal difficulties, Lack of consequences, Concerning or threatening communications, Interest in violent topics, History of violence, Stalking, harassing or bullying, Extreme beliefs, Fixations, Behavior changes, Desperation or despair, Intense anger or aggression, Inconsistency, Planning and final acts, Elicited concern in others, Motive, Access to weapons.

Student of concern (NTAC school guide): Motives, Communications, Inappropriate interests, Weapons access, Stressors, Emotional and developmental issues, Desperation or despair, Violence as an option, Concerned others, Capacity to carry out an attack, Planning, Consistency, Protective factors.

Table: Protective or mitigating factors (columns: Factor found, Source, How it can be supported).

• Information covers all three categories of themes: contextual, behavioral and summative.
• Gaps in information are listed with a plan to fill them.
• For a student of concern, the NTAC school investigative themes listed below have also been considered.

+ 1 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NTAC workplace guide Step 5 (make an assessment of risk); ANSI/ASIS WVPI AA-2020

Using everything gathered, decide whether the person poses a risk of harm to themselves or others, and record the reasoning. Teams may use their own levels; keep definitions written in the team policy.

Fill-in fields: Date of determination; Team members participating; Summary of reasoning (facts relied on).

Determination: No identified risk of violence at this time / Concern present: management and monitoring needed / Risk of violence: immediate management and safety measures needed.

Basis: NTAC workplace guide Step 6 (phases and elements of risk management); NTAC school guide Step 6; BTAU guide Step 5

Build the plan in four phases: planning, implementation, evaluation and closure. Base strategies on four elements: address factors of concern and promote positive factors, redirect potential motives for violence, create a situation less prone to violence, and use the Systems Approach.

Table: Management strategies (columns: Strategy, Concern it addresses, Responsible, Start date, Review date, Status).

• A safety plan exists for any identified target, developed with that person where possible.
• Access changes (physical, system or schedule) are in place where needed.
• Referrals for support (counseling, employee assistance, financial, legal, housing or substance use services) are made and followed up.

+ 4 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NTAC workplace guide Step 6 (closure)

Close a case only when the team determines that the person no longer poses a risk of harm to themselves or others, and can explain why.

Fill-in fields: Date closed; Closure rationale; Planned check-in date after closure; Record location and retention period.

• All relevant stakeholders, including organizational leaders, were consulted on closure.
• A check-in with relevant people is scheduled to confirm no concerns return.
• The case file is complete, restricted and retained under the records schedule.

+ 1 more checklist items, each with Done and N/A boxes and a notes field.

Basis: NTAC workplace guide Steps 7 and 8; NTAC school guide Steps 7 and 8; BTAU guide Step 6

A threat assessment program works best in an organization where people feel safe to report and supported when they struggle.

Table: Training and awareness plan (columns: Audience, Content, Frequency, Owner). Rows include All employees or students and staff, Supervisors and teachers, Threat assessment team, Leadership.

• All employees, or students, staff and parents, are told how to recognize and report concerning behavior.
• The team reviews closed cases at least annually to improve procedures.
• Organizational climate measures (for example connection, fairness and support) are reviewed with leadership.

+ 1 more checklist items, each with Done and N/A boxes and a notes field.

Name, signature and date for: Team lead or case manager, Legal counsel, Human resources or school administrator, Mental health professional, Security.

Version, date, description of change, changed by and approved by, starting with version 1.0 (October 30, 2026).

1. National Threat Assessment Center. Preventing Targeted Workplace Violence: A U.S. Secret Service Guide to Behavioral Threat Assessment and Management. U.S. Secret Service, Department of Homeland Security (October 2026). Source
2. National Threat Assessment Center. Enhancing School Safety Using a Threat Assessment Model: An Operational Guide for Preventing Targeted School Violence. U.S. Secret Service, Department of Homeland Security (July 2018). Source
3. National Threat Assessment Center. Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence. U.S. Secret Service, Department of Homeland Security (October 2024). Source
4. ASIS International. ANSI/ASIS WVPI AA-2020, Workplace Violence and Active Assailant: Prevention, Intervention, and Response Standard (approved May 7, 2020; revision and redesignation of ASIS/SHRM WVPI.1-2011). Source
5. U.S. Secret Service National Threat Assessment Center, publications and resources. Source
6. Cybersecurity and Infrastructure Security Agency (CISA), Insider Threat Mitigation Guide (November 2020), for workplace violence as an insider threat. Source