NCIER®

BTAM Team

58 claims on pp. 3–98 (fact 1, statement 37, evidence 16, definition 4).

Claims about BTAM Team

Statement [V] p030-09

BTAM is typically conducted by a multidisciplinary team responsible for identify, assess, manage

The BTAM process is typically conducted by a multidisciplinary team of personnel with diverse backgrounds, experience, and expertise, who take principal responsibility for identifying, assessing, and managing potential individuals of concern.

The BTAM process is typically conducted by a multidisciplinary team comprised of personnel with diverse backgrounds, experience, and expertise, who take principal responsibility for identifying, assessing, and managing potential individuals of concern.

p. 30 · NCIER Claim Map
Report page 30 with the cited passage highlighted
Source page 30 · click to enlarge · all claims on this page
Fact [V] p032-07

Interviewees included BTAM team members, executives, and HR and security staff

Participants included professionals directly involved in organizational BTAM teams, as well as executives, managers, supervisors, and personnel in HR, security, insider threat, and cybersecurity.

Participants represented a wide range of roles and disciplines, including professionals directly involved in organizational BTAM teams, as well as organizational executives, managers, supervisors, and personnel in human resources, security, insider threat, cybersecurity, and more.

p. 32 · NCIER Claim Map
Report page 32 with the cited passage highlighted
Source page 32 · click to enlarge · all claims on this page
Evidence [V] p034-08

Threat manager covering thousands of employees was the sole prevention person

Despite the organization having thousands of employees, the threat manager was the sole person managing several important functions across numerous facilities.

Despite the organization having thousands of employees, the threat manager was the sole person managing several important functions

p. 34 · NCIER Claim Map
Report page 34 with the cited passage highlighted
Source page 34 · click to enlarge · all claims on this page
Statement [V] p037-12

BTAM participants should understand each role and what each can and cannot contribute

Those involved in the BTAM process should have a clear understanding of everyone's role and how they can and cannot contribute.

Those involved in the BTAM process should have a clear understanding of everyone’s role and how they can and cannot contribute.

p. 37 · NCIER Claim Map
Report page 37 with the cited passage highlighted
Source page 37 · click to enlarge · all claims on this page
Statement [V] p037-13

HR should understand BTAM collaborators' functions and how each side can aid the other

HR personnel should also understand the job functions and needs of BTAM team collaborators, including how HR can assist them and how they might aid HR in its BTAM role.

HR personnel should also understand the job functions and needs of collaborators on the BTAM team, including how they can assist collaborators, and how collaborators might aid them in their role in the BTAM process.

p. 37 · NCIER Claim Map
Report page 37 with the cited passage highlighted
Source page 37 · click to enlarge · all claims on this page
Evidence [V] p038-11

Healthcare BTAM team: talking with colleagues and community members is vital

A healthcare BTAM team said that talking with colleagues and community members in meetings and conferences is vital for BTAM practice.

Talking with colleagues and community members in meetings, conferences, and sharing knowledge is vital for the practice of behavioral threat assessment everywhere.

p. 38 · NCIER Claim Map
Report page 38 with the cited passage highlighted
Source page 38 · click to enlarge · all claims on this page
Evidence [V] p038-12

Healthcare BTAM team: meetings and a common language proved helpful

A BTAM team in a healthcare environment said that going to meetings, consulting with others, sharing information, and having a common language has been incredibly helpful.

For us, going to meetings, consulting with others, sharing information, and having a common language has been incredibly helpful.

p. 38 · NCIER Claim Map
Report page 38 with the cited passage highlighted
Source page 38 · click to enlarge · all claims on this page
Statement [V] p041-04

A multidisciplinary BTAM team should carry out essential functions as best practice

It is best practice that many of the essential functions of the BTAM program be carried out by a multidisciplinary BTAM team.

It is best practice that many of the essential functions of the BTAM program be carried out by a multidisciplinary BTAM team.

p. 41 · NCIER Claim Map
Report page 41 with the cited passage highlighted
Source page 41 · click to enlarge · all claims on this page
Statement [V] p041-05

Policy should grant the BTAM team authority to act before violence occurs

The policy should establish the BTAM team's authority to perform the functions needed to identify, assess, and manage individuals of concern before violence can occur.

Establish the authority of a BTAM team to perform the necessary functions to allow them to identify, assess, and manage individuals of concern before violence can occur

p. 41 · NCIER Claim Map
Report page 41 with the cited passage highlighted
Source page 41 · click to enlarge · all claims on this page
Statement [V] p041-08

BTAM team structure should be based on organizational needs

The structure of the BTAM team should be based upon organizational needs; Figure 6 sets out three potential structures (central team, local teams, regional teams with support).

The structure of the BTAM team (see Figure 6) should be based upon organizational needs.

p. 41 · NCIER Claim Map
Report page 41 with the cited passage highlighted
Source page 41 · click to enlarge · all claims on this page
Definition [V] p041-16

Figure 6 central team: one BTAM team handles all reports, suited to modest report volume

In a central team structure, one BTAM team assesses and manages all incoming reports in an organization; for example, an organization with a modest volume of reports has one team stationed at headquarters.

CENTRAL TEAM | One BTAM team assesses and manages all incoming reports in an organization. | An organization with a modest volume of incoming reports has one BTAM team stationed in the organization's headquarters.

p. 41 · NCIER Claim Map
Report page 41 with the cited passage highlighted
Source page 41 · click to enlarge · all claims on this page
Definition [V] p041-17

Figure 6 local teams: decentralized teams each handle reports from local facilities

In a local teams structure, multiple decentralized teams each assess and manage incoming reports from local facilities; for example, local BTAM teams across several geographic regions respond to reports at numerous facilities in their area.

LOCAL TEAMS | Multiple decentralized teams each assess and manage incoming reports from local facilities. | An organization has local BTAM teams across several geographic regions to respond to reports at numerous facilities in their area of responsibility.

p. 41 · NCIER Claim Map
Report page 41 with the cited passage highlighted
Source page 41 · click to enlarge · all claims on this page
Definition [V] p041-18

Figure 6 regional teams with support: regional teams backed by a central team for hard cases

In a regional teams with support structure, multiple regional teams assess and manage reports while a centralized team consults and supports on difficult cases; for example, a large organization with a high report volume uses regional teams with coordination and assistance from a headquarters BTAM team.

REGIONAL TEAMS WITH SUPPORT | Multiple regional teams assess and manage incoming reports while a centralized team consults and supports with difficult cases. | A large organization with a high volume of reports uses regional teams, each serving several facilities in their region, with coordination and assistance available from a centralized BTAM team at the organization's headquarters.

p. 41 · NCIER Claim Map
Report page 41 with the cited passage highlighted
Source page 41 · click to enlarge · all claims on this page
Statement [V] p042-06

Sample policy defines a BTAM team mission to identify, assess, and manage risk

A sample policy statement, established within or under a named overseeing department or division, gives the BTAM team the mission to identify, assess, and manage individuals who may pose a risk of harm to themselves or others in the workplace, either currently or in the future.

the mission of the [name of the BTAM team] is to identify, assess, and manage individuals who may pose a risk of harm to themselves or others in the workplace, either currently or in the future.

p. 42 · NCIER Claim Map
Report page 42 with the cited passage highlighted
Source page 42 · click to enlarge · all claims on this page
Statement [V] p042-08

Written SOPs give team members a shared understanding of expectations

Memorializing detailed SOPs can allow all BTAM team members to share an understanding of what is expected of them and what they can expect from others.

Memorializing detailed SOPs can also allow for all BTAM team members to have a shared understanding of what is expected of them and what they can expect from others on the team.

p. 42 · NCIER Claim Map
Report page 42 with the cited passage highlighted
Source page 42 · click to enlarge · all claims on this page
Evidence [V] p042-19

Sample policy: team receives, investigates, assesses, and manages concerns before harm

Under the sample policy, the BTAM team will receive, investigate, and assess workplace concerns and provide direction, management, support, and follow-up to address them before potential violence escalates to physical harm.

To achieve this mission, the [name of the BTAM team] will receive, investigate, and assess reports of concerns within the workplace, and provide direction, management, support, and follow-up to address concerns before the risk of potential violence escalates to physical harm.

p. 42 · NCIER Claim Map
Report page 42 with the cited passage highlighted
Source page 42 · click to enlarge · all claims on this page
Evidence [V] p043-05

Sample language sets twice-monthly BTAM meetings with required attendees

Sample language says the team convenes twice per month, with the team lead and at least a security manager, HR representative, legal advisor, and mental health professional.

The Behavioral Threat Assessment and Management (BTAM) Team will convene twice per month to review and assess potential concerns.

p. 43 · NCIER Claim Map
Report page 43 with the cited passage highlighted
Source page 43 · click to enlarge · all claims on this page
Statement [V] p044-01

Organizations should plan team composition, training, and meeting standards

When developing the BTAM program, organizations should determine the appropriate team composition, set training expectations for members, and set standards for team meetings.

When developing the BTAM program, organizations should invest time in determining the appropriate team composition, establish expectations regarding training for BTAM team members, and set standards for BTAM team meetings.

p. 44 · NCIER Claim Map
Report page 44 with the cited passage highlighted
Source page 44 · click to enlarge · all claims on this page
Statement [V] p044-05

Multidisciplinary teams can let varied roles bring unique expertise

A multidisciplinary BTAM team can allow members with varied roles to leverage their unique expertise, perspectives, and skills to prevent violence.

Establishing a multidisciplinary BTAM team can allow team members with varied organizational roles and responsibilities to leverage their unique expertise

p. 44 · NCIER Claim Map
Report page 44 with the cited passage highlighted
Source page 44 · click to enlarge · all claims on this page
Statement [V] p045-11

Team leader ensures compliance, facilitates meetings, and builds consensus

The BTAM team leader ensures compliance with policies, facilitates team meetings, and helps members reach consensus.

the BTAM team leader is responsible for ensuring compliance with policies and procedures, facilitating team meetings, and helping team members reach consensus

p. 45 · NCIER Claim Map
Report page 45 with the cited passage highlighted
Source page 45 · click to enlarge · all claims on this page
Statement [V] p045-12

Team leader communicates between the BTAM team and leadership

The BTAM team leader communicates information between the team and organizational leadership when necessary.

the BTAM team leader is also responsible for communicating information between the BTAM team and organizational leadership when necessary

p. 45 · NCIER Claim Map
Report page 45 with the cited passage highlighted
Source page 45 · click to enlarge · all claims on this page
Statement [V] p045-15

Workplace BTAM teams often include personnel from roles ranging from management to EAP

Workplace BTAM teams often include personnel from management, human resources, security, information technology, cybersecurity and insider threat, legal, and the employee assistance program.

Workplace BTAM teams often include personnel from the following organizational roles:

p. 45 · NCIER Claim Map
Report page 45 with the cited passage highlighted
Source page 45 · click to enlarge · all claims on this page
Statement [I] p045-18

Some roles may hold permanent BTAM seats while others support the process ad hoc

Some of the described roles may have one or more representatives serving as permanent BTAM team members, while other roles may support the BTAM process in an ad hoc capacity.

While some of the roles described above may have one or more representatives that serve as permanent members of the BTAM team, other roles may support the BTAM process in an ad hoc capacity.

p. 45 · NCIER Claim Map

Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.

Report page 45 with the cited passage highlighted
Source page 45 · click to enlarge · all claims on this page
Evidence [I] p047-05

Figure 7 example BTAM team with manager, security, HR, legal, and EAP seats

The body text on p.47 says Figure 7 shows one example in which a manager, a security official, an HR professional, and personnel from the legal department and EAP serve directly on the BTAM team; the team has no permanent representatives from IT, cybersecurity and insider threat, or the offices of the chaplain, ombudsman, or labor relations, but should engage them as needed.

In this example, a manager, a security official, an HR professional, and personnel from the legal department and EAP have representatives that serve directly on the

p. 47 · NCIER Claim Map

Why inferred The p.47 body text and the Figure 7 graphic disagree. Text: legal serves directly on the team and the ombudsman is not a permanent member. Figure: Ombudsman is a Core Member and Legal is an Ad Hoc Participant. This claim follows the body text.

Report page 47 with the cited passage highlighted
Source page 47 · click to enlarge · all claims on this page
Evidence [V] p047-11

Figure 7 ad hoc participants: Cybersecurity/Insider Threat, Chaplain, Labor Relations, Legal

Figure 7 shows Cybersecurity and Insider Threat, Chaplain, Labor Relations, and Legal as ad hoc participants along the bottom of the BTAM team table.

Bottom side (gray, Ad Hoc Participant): Cybersecurity and Insider Threat; Chaplain; Labor Relations; Legal

p. 47 · NCIER Claim Map
Report page 47 with the cited passage highlighted
Source page 47 · click to enlarge · all claims on this page
Statement [V] p055-14

Every BTAM member should receive report alerts, even after hours

Every BTAM team member should be able to view received reports and be notified of them automatically, even outside normal hours, if possible.

Every member of the BTAM team should have the capability to view received reports and should automatically be notified of incoming reports, even outside of normal operating hours, if possible.

p. 55 · NCIER Claim Map
Report page 55 with the cited passage highlighted
Source page 55 · click to enlarge · all claims on this page
Statement [V] p065-12

Insider threat programs are well-positioned to help BTAM teams mitigate risk before violence

Because of these shared features, insider threat programs are well-positioned to support BTAM teams in identifying and mitigating risk before it escalates to violence.

These similarities make insider threat programs well-positioned to support BTAM teams in identifying and mitigating risk before it escalates to violence.

p. 65 · NCIER Claim Map
Report page 65 with the cited passage highlighted
Source page 65 · click to enlarge · all claims on this page
Statement [V] p066-10

Open-source investigations expertise can significantly enhance BTAM teams

Including a team member with open-source investigations expertise can significantly enhance a BTAM team's ability to identify digital and online indicators of concern.

Including a team member with expertise in open-source investigations can significantly enhance a BTAM team's ability to identify digital and online indicators of concern

p. 66 · NCIER Claim Map
Report page 66 with the cited passage highlighted
Source page 66 · click to enlarge · all claims on this page
Statement [V] p075-01

BTAM teams must act to reduce risk when an individual poses a risk of harm

When BTAM teams determine that an individual of concern poses a risk of harm to themselves or others, they must take appropriate action to reduce the risk of violence.

When BTAM teams determine that an individual of concern poses a risk of harm to themselves or others, they must take appropriate action to reduce the risk of violence.

p. 75 · NCIER Claim Map
Report page 75 with the cited passage highlighted
Source page 75 · click to enlarge · all claims on this page
Statement [V] p075-09

BTAM teams should use assessment information to develop a risk management plan

Using information gathered during an assessment, BTAM teams should develop a plan to manage any risk posed by the individual of concern.

Using the information gathered during an assessment, BTAM teams should develop a plan to manage any risk posed by the individual of concern.

p. 75 · NCIER Claim Map
Report page 75 with the cited passage highlighted
Source page 75 · click to enlarge · all claims on this page
Statement [V] p076-07

Closure decisions should involve all relevant stakeholders

The decision to close a case should involve all relevant stakeholders, including the BTAM team and organizational leaders.

The decision to close a case should involve all relevant stakeholders, including the BTAM team and organizational leaders.

p. 76 · NCIER Claim Map
Report page 76 with the cited passage highlighted
Source page 76 · click to enlarge · all claims on this page
Statement [V] p081-05

BTAM teams should weigh interventions against the full case context

BTAM teams should carefully consider these intervention methods in the full context of what is known about the individual and their environment.

BTAM teams should carefully consider these intervention methods in the full context of what is known about the individual and their environment.

p. 81 · NCIER Claim Map
Report page 81 with the cited passage highlighted
Source page 81 · click to enlarge · all claims on this page
Statement [V] p082-06

BTAM teams should work with employers on a plan that may or may not be punitive

BTAM teams should work with the employer to develop and implement a case management plan to effectively address the factors of concern for the employee, which may or may not involve punitive measures.

BTAM teams should work with the employer to develop and implement a case management plan to effectively address the factors of concern for the employee, which may or may not involve punitive measures.

p. 82 · NCIER Claim Map
Report page 82 with the cited passage highlighted
Source page 82 · click to enlarge · all claims on this page
Evidence [V] p082-08

BTAM leader: getting people together reveals community resources

A BTAM team leader at a healthcare agency says getting people together helps teams learn which community resources are available.

Generally speaking, it's helpful to get people together so that they know what resources are available in the community.

p. 82 · NCIER Claim Map
Report page 82 with the cited passage highlighted
Source page 82 · click to enlarge · all claims on this page
Statement [V] p083-01

Inconsistent contact with non-employees may limit risk assessment

Inconsistent or indirect contact can make it difficult for the BTAM team to determine the extent of risk and may limit available strategies and resources.

The inconsistent or indirect contact between these individuals and the organization can make it difficult for the BTAM team to determine the extent of the risk

p. 83 · NCIER Claim Map
Report page 83 with the cited passage highlighted
Source page 83 · click to enlarge · all claims on this page
Evidence [V] p084-11

Tech company assesses whether threats are a trend and indicate violent intent

After a threat is received and prior contacts are queried, the multinational technology company's BTAM team assesses whether this behavior is a trend and whether it is indicative of violent intent.

assesses whether this behavior is a trend and whether it is indicative of violent intent

p. 84 · NCIER Claim Map
Report page 84 with the cited passage highlighted
Source page 84 · click to enlarge · all claims on this page
Statement [V] p090-17

BTAM teams should set refresher frequency by size, turnover and resources

BTAM teams should determine refresher frequency based on organization size, turnover rate, and available resources, and fit it into the wider training schedule.

BTAM teams should determine the frequency of these refresher trainings based upon organization size, turnover rate, and available resources

p. 90 · NCIER Claim Map
Report page 90 with the cited passage highlighted
Source page 90 · click to enlarge · all claims on this page
Statement [V] p098-01

Endnote 17: NTAC Behavioral Threat Assessment Units guide (2024)

National Threat Assessment Center. (2024). Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence. U.S. Secret Service, Department of Homeland Security. www.secretservice.gov/ntac.

Behavioral Threat Assessment Units: A Guide for State and Local Law Enforcement to Prevent Targeted Violence.

p. 98 · NCIER Claim Map
Report page 98 with the cited passage highlighted
Source page 98 · click to enlarge · all claims on this page

Top

Find the Perfect Training Class For You