9.2 Active Assailant Preparedness & Response Standards

9.2 Active Assailant Preparedness & Response Standards

Active assailant incidents represent low-frequency, extremely high-consequence events that require immediate, practiced tactical responses and physical security controls. The ANSI/ASIS Active Assailant Supplement / Standard (2020) provides security managers with standardized frameworks for developing active assailant policy, facility design, operational drills, and post-incident organizational recovery.

ANSI/ASIS Active Assailant Standard (2020) Overview

The ANSI/ASIS Active Assailant Standard emphasizes that survival during an active shooter event depends on pre-incident preparation, robust physical security infrastructure, rapid notification, and empowered individual decision-making. Key requirements include:

• Policy and Protocol Integration: Establishing clear, non-discretionary emergency action plans (EAP) aligned with national response guidelines.
• Threat Mitigation Infrastructure: Incorporating physical security engineering controls that impede unauthorized access, delay assailant progression, and protect occupants.
• Realistic Drills and Exercises: Conducting regular, multi-option training exercises for all personnel and Joint Response Exercises with local law enforcement and emergency medical services (EMS).
• Comprehensive Recovery Framework: Preparing long-term support systems for psychological trauma, family management, media relations, and business resumption.

The Tactical Response Framework: Run, Hide, Fight

The security industry and ASIS APP body of knowledge adopt the Run, Hide, Fight response framework developed by the U.S. Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This framework guides individual decision-making during an active attack:

+---------------------------------------------------------------------------------+
|                             ACTIVE ASSAILANT EVENT                              |
+---------------------------------------------------------------------------------+
       |                                       |                                 |
       v                                       v                                 v
+--------------+                       +--------------+                  +----------------+
|   1. RUN     | --------------------> |   2. HIDE    | ---------------> |    3. FIGHT    |
| (Evacuate)   | (If path is blocked)  | (Shelter/Lock| (If directly     | (Take Action/  |
| Escape primary|                       | In Place)    |  confronted)     | Incapacitate)  |
+--------------+                       +--------------+                  +----------------+

1. RUN (Evacuate)

• Primary Option: Evacuation is always the first and best option if an accessible escape path exists.
• Actions: Leave belongings behind; warn others against entering the danger zone; keep hands visible with fingers spread for law enforcement; follow police instructions unconditionally.
• Leadership Role: Security officers and staff leaders should direct occupants toward secondary emergency exits away from the sound of gunfire.

2. HIDE (Shelter-in-Place / Lock-In)

• Secondary Option: If evacuation is impossible or dangerous, locate a secure shelter zone immediately.
• Actions: Lock and heavy-barricade interior doors using furniture, desks, or door-stop wedges; turn off all lights; silence cell phones (including vibration mode); hide behind large, dense objects that provide ballistic cover (e.g., concrete pillars, heavy metal cabinets) rather than mere visual concealment; remain silent.
• Denial Tactics: Keep out of sight of door windows and glass side-lites.

3. FIGHT (Incapacitate Assailant)

• Last Resort: To be executed ONLY when directly confronted in a life-threatening situation where running or hiding is impossible.
• Actions: Act as aggressively as possible; commit fully to disabling the assailant; improvise weapons (fire extinguishers, heavy objects, scissors, chairs); throw items at the attacker's eyes to disrupt aim; work collectively with others to swarm, tackle, and disarm the perpetrator.

Physical Security Controls for Active Assailant Mitigation

Physical security engineering plays a critical role in slowing an assailant's momentum, providing precious time for law enforcement arrival (which typically averages 3 to 5 minutes for first responders).

Emergency Communications & Notification Systems

Rapid notification saves lives by reducing the time occupants take to initiate response actions:

• Mass Notification Systems (MNS): Multi-channel delivery systems that transmit clear, unambiguous emergency alerts via SMS text, email, desktop pop-ups, public address (PA) speakers, and visual strobe lights.
• Pre-Scripted Emergency Messages: Automated alert templates (e.g., "Active Assailant reported on Floor 3. Execute Run, Hide, Fight protocols immediately.") to eliminate delay and human panic during message creation.
• Integration with First Responders: Duress systems directly integrated with local Public Safety Answering Points (PSAP / 911) transmit precise building floor plans, CCTV video feeds, and GPS coordinates to arriving law enforcement officers.

Post-Incident Recovery & Business Resumption

Following the neutralization of an active assailant threat, the security organization transitions to critical crisis recovery operations:

• Scene Preservation and Police Liaison: Securing the crime scene, facilitating law enforcement evidence collection, and coordinating witness interviews.
• Family Assistance Center (FAC): Establishing a designated, off-site facility staffed by HR, legal, red cross, and mental health professionals to unify family members, provide verified information, and deliver compassionate support.
• Trauma Counseling & Psychological First Aid (PFA): Deploying Employee Assistance Programs (EAP) and Critical Incident Stress Debriefing (CISD) teams immediately to mitigate long-term Post-Traumatic Stress Disorder (PTSD) among survivors and responders.
• Business Resumption Planning: Assessing structural/property damage, biohazard remediation, temporary site relocation, media relations management, and structured return-to-work protocols.