Report pages 44–49: 78 claims on pp. 44–49 (statement 52, evidence 25, definition 1).
When developing the BTAM program, organizations should determine the appropriate team composition, set training expectations for members, and set standards for team meetings.
When developing the BTAM program, organizations should invest time in determining the appropriate team composition, establish expectations regarding training for BTAM team members, and set standards for BTAM team meetings.
BTAM in the workplace requires a multidisciplinary team to process reports of concerning behaviors, gather information, and implement interventions.
BTAM in the workplace requires a multidisciplinary team to process reports of concerning behaviors
The responsibility for violence prevention belongs to everyone in a workplace.
The responsibility for violence prevention belongs to everyone in a workplace.
Best practice is to identify personnel who can be routinely dedicated to the important tasks of the BTAM process.
it is best practice to identify personnel who can be routinely dedicated to the important tasks associated with the BTAM process
A multidisciplinary BTAM team can allow members with varied roles to leverage their unique expertise, perspectives, and skills to prevent violence.
Establishing a multidisciplinary BTAM team can allow team members with varied organizational roles and responsibilities to leverage their unique expertise
A healthcare BTAM team moved from assigning members to selecting people interested in joining, and added onboarding to explain the process.
It's important to get the right people.
A healthcare BTAM team reported that members were previously identified because they were told to join.
Previously, team members were identified because they were told to join.
A BTAM team at a major healthcare organization says that once executives understood the program's vision and saw the team's good work, a new hiring process was developed to select people really interested in joining the threat assessment team.
Once the executives knew and understood the vision of the program and saw the good work the team was doing, a new hiring process was developed to select people really interested in joining the threat assessment team.
The healthcare BTAM team developed onboarding processes to get new members up to speed and teach them what the process entails.
We developed onboarding processes to get them up to speed and teach them what the process entails.
The healthcare BTAM team reports that the new selection and onboarding approach has been very helpful.
That has been very helpful.
The BTAM team serves as the primary decision-maker at every stage of the BTAM process.
The BTAM team serves as the primary decision-maker throughout the BTAM process.
A BTAM team should have a core group of dedicated, trained professionals.
BTAM teams should include a core group of dedicated, trained professionals.
Leaders should decide whether team members serve full-time or as a collateral or part-time duty.
leaders should determine if individuals will be assigned to a BTAM team in a full-time capacity, or whether team assignment will be a collateral or part-time duty
A senior-level manager can serve as facilitator, leader, or final decision-maker and can share information across managers and departments.
A senior-level manager can serve in the role of facilitator, leader, and/or final decision-maker
HR can access personnel records, offer insight on employee performance and conduct, utilize safe hiring and firing practices, share knowledge of policies, and assist with employee morale and office culture.
HR professionals can access employee personnel records
Why inferred The quote covers the personnel-records clause; the remaining items are paraphrased from the same HR sentence on the page.
Security personnel can support communication with local law enforcement, information gathering, physical security responses, and safety plans.
Security personnel can provide support in communicating with local law enforcement
IT professionals can access digital records, system access logs, and communication records, and can limit an individual's access to systems and facilities.
IT professionals can also limit an individual's access to systems and facilities
Cybersecurity and insider threat personnel can monitor inappropriate use of employer-issued electronic devices throughout the BTAM process.
Cybersecurity and insider threat personnel can monitor the inappropriate use of employer-issued electronic devices throughout the BTAM process.
Legal personnel can advise the BTAM team on compliance with applicable federal, state, and local laws, including privacy, employee rights, and how to properly handle and store documents.
Legal personnel can provide guidance and advice to the BTAM team to ensure compliance with federal, state, and local laws
EAP personnel can identify available resources to use when developing a plan to manage risk.
EAP personnel can provide insight into available resources to leverage when developing a plan to manage the risk posed by individuals of concern
The BTAM team leader ensures compliance with policies, facilitates team meetings, and helps members reach consensus.
the BTAM team leader is responsible for ensuring compliance with policies and procedures, facilitating team meetings, and helping team members reach consensus
The BTAM team leader communicates information between the team and organizational leadership when necessary.
the BTAM team leader is also responsible for communicating information between the BTAM team and organizational leadership when necessary
The composition of the BTAM team will differ across organizations and is tailored to each organization's characteristics and needs.
The composition of the BTAM team will differ across organizations, as it is tailored to meet the organization's unique characteristics and needs.
Ad hoc participants do not regularly attend BTAM team meetings but can coordinate with the team, share and receive information, and provide ancillary support when appropriate.
Ad hoc participants do not regularly attend BTAM team meetings
Workplace BTAM teams often include personnel from management, human resources, security, information technology, cybersecurity and insider threat, legal, and the employee assistance program.
Workplace BTAM teams often include personnel from the following organizational roles:
Management can also ensure that information is shared between managers and across departments, as appropriate.
Management can also ensure information is shared between managers and across departments, as appropriate.
IT professionals can access relevant digital records, system access logs, and electronic and telephonic communication records.
IT professionals can access relevant digital records, system access logs, and electronic and telephonic communication records.
Some of the described roles may have one or more representatives serving as permanent BTAM team members, while other roles may support the BTAM process in an ad hoc capacity.
While some of the roles described above may have one or more representatives that serve as permanent members of the BTAM team, other roles may support the BTAM process in an ad hoc capacity.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
An HR professional says HR is among the first to see concerns and that inviting HR onto the team can be more helpful than just asking them for information.
Inviting HR on the team can be more helpful than just asking them for information.
A cybersecurity professional says cyber is typically the last group contacted during a behavioral threat assessment and wants earlier involvement.
Cyber is typically the last group that is contacted during a behavioral threat assessment
Ad hoc participants can vary by case and across organizations, including departments and community partners.
Ad hoc participants can vary by case and across organizations
State and local law enforcement can assist with information gathering, responding to safety concerns, and supporting management strategies.
Law enforcement can assist with information gathering, responding to safety concerns, and supporting management strategies.
Community mental health professionals can explain how mental health may affect a case and share knowledge of available resources.
Mental health professionals can provide insight into how mental health may impact a case
Labor relations can provide insight into employee grievances, conflicts, and disputes, guidance on union contracts, and support for due process.
Representatives from labor relations can provide insight into employee grievances, conflicts, and disputes.
Alternative dispute resolution personnel, such as an ombudsman or mediator, can help during negotiations between employees, address conflicts and grievances, and offer insight and perspectives about employee behavior.
Personnel who specialize in alternative dispute resolution, including an ombudsman or mediator, can help during negotiations between employees
A cybersecurity professional said that much cybersecurity work lends itself well to a prevention-based approach.
A lot of cybersecurity work lends itself well to a prevention-based approach.
A human resources professional urges organizations to put someone from HR on the behavioral threat assessment team.
Put someone from HR on the behavioral threat assessment team!
The HR professional says HR staff are among the first to see concerns or threats in the workplace.
HR are among the first to see concerns or threats in the workplace.
The HR professional says HR is often cautious about sharing information across departments but also has an obligation to protect the organization, which is the goal of a behavioral threat assessment.
While they are often cautious about sharing information across departments, they also have an obligation to protect the organization, which is the goal of a behavioral threat assessment.
A cybersecurity professional would like to see more bridging of the gap between cybersecurity and threat assessment.
I’d like to see more of a bridging of the gap between cybersecurity and threat assessment.
Beyond the roles described earlier, ad hoc participants can include organizational departments and community partners such as state and local law enforcement, community mental health, labor relations, and alternative dispute resolution.
They can also include organizational departments and community partners, such as:
Labor relations representatives also offer guidance on contracts between unionized employees and the organization, and support employee due process.
They also offer guidance on contracts between unionized employees and the organization, and support employee due process.
Employees need not be core BTAM team members to be relevant to the BTAM process.
employees need not be core members of a BTAM team to be relevant to the BTAM process
Ad hoc participants and other personnel can be critically important when identifying, assessing, and managing individuals of concern.
ad hoc participants and other personnel within the organization can be critically important when identifying, assessing, and managing individuals of concern
The BTAM team should engage non-permanent personnel as needed to facilitate information sharing, especially during assessment and management.
the team should engage with these personnel as needed to facilitate information sharing, particularly during the assessment and management processes
BTAM team structures and the departments involved can be adapted to the unique characteristics and needs of each organization.
these structures can be adapted to meet the unique characteristics and needs of an organization
The body text on p.47 says Figure 7 shows one example in which a manager, a security official, an HR professional, and personnel from the legal department and EAP serve directly on the BTAM team; the team has no permanent representatives from IT, cybersecurity and insider threat, or the offices of the chaplain, ombudsman, or labor relations, but should engage them as needed.
In this example, a manager, a security official, an HR professional, and personnel from the legal department and EAP have representatives that serve directly on the
Why inferred The p.47 body text and the Figure 7 graphic disagree. Text: legal serves directly on the team and the ombudsman is not a permanent member. Figure: Ombudsman is a Core Member and Legal is an Ad Hoc Participant. This claim follows the body text.
Figure 7 illustrates just one example of how an organization may staff a BTAM team and facilitate coordination across personnel and departments.
Figure 7 illustrates just one example of how an organization may staff a BTAM team and facilitate coordination across personnel and departments.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
Figure 7 shows Human Resources, Employee Assistance Program, Security, and Ombudsman as core members seated along the top of the BTAM team table.
Top side (dark blue, Core Member): Human Resources; Employee Assistance Program; Security; Ombudsman
Figure 7 shows Management as a core member at the left end of the BTAM team table.
Left end (dark blue, Core Member): Management
Figure 7 shows Information Technology as an ad hoc participant at the right end of the BTAM team table.
Right end (gray, Ad Hoc Participant): Information Technology
Figure 7 shows Cybersecurity and Insider Threat, Chaplain, Labor Relations, and Legal as ad hoc participants along the bottom of the BTAM team table.
Bottom side (gray, Ad Hoc Participant): Cybersecurity and Insider Threat; Chaplain; Labor Relations; Legal
Training is essential for team members to build and maintain their BTAM knowledge and skills.
Training is essential for ensuring that team members build and maintain their knowledge and skills with BTAM practices.
Team members should receive recurring training on the organization's BTAM process so they understand their roles.
Team members should receive recurring training on the organization's BTAM process
Team members should engage in comprehensive skill-building to promote program fidelity and build expertise for effective assessment and management.
They should also engage in comprehensive skill-building to promote program fidelity and build expertise for effective assessment and management.
Training should include an overview of the BTAM process, team roles and responsibilities, how the team operates, and information sharing.
Overview of the BTAM process. This should include information about the BTAM process, including roles and responsibilities
Team members should be well trained on what and how behaviors of concern should be reported and how to respond to reports.
BTAM team members should be well-trained in what and how behaviors of concern should be reported in their organization
BTAM team members should be knowledgeable about risk management resources within the organization and in the broader community.
BTAM team members should be knowledgeable about the risk management resources available, both within the organization and the broader community.
Training should describe when it is appropriate to contact law enforcement and the procedures to follow once they are contacted.
Training for BTAM members should describe when it is appropriate to contact law enforcement
Training should give an overview of BTAM policies and procedures and related policies such as disciplinary procedures and the emergency response plan.
an overview of the policies and procedures that guide the BTAM team's day-to-day operations
BTAM team members should be aware of municipal, state, and federal laws, rules, and regulations that apply to their work.
BTAM team members should also be aware of municipal, state, and federal laws, rules, and regulations that apply to their work.
Other training, such as mental health, de-escalation, mediation, trauma-informed care, and tabletop exercises, can be valuable to team members.
Other training can be valuable to BTAM team members, including training on mental health
NTAC offers free recurring virtual trainings delivered by NTAC staff on research findings and BTAM practice.
The U.S. Secret Service NTAC offers free recurring virtual trainings delivered by NTAC personnel.
NTAC's free recurring virtual trainings share findings from decades of research on targeted violence and guidance on using the BTAM process to prevent violence.
During these presentations, NTAC staff share findings from decades of research on targeted violence and guidance on how the BTAM process can be used to prevent future tragedies in our communities.
Training content for team members should address an overview of the BTAM process, reporting mechanisms, risk management, contacting law enforcement, BTAM policies and procedures, documentation and records management, and legal and privacy considerations.
Training content for team members should address the following:
Documentation training should include when forms are recommended versus required, who must complete the forms, and how the forms should be completed, shared, and/or stored.
This should include when forms are recommended as opposed to when they are required, who must complete the forms, and how the forms should be completed, shared, and/or stored.
To learn more about or register for NTAC's virtual training events, readers can visit https://www.secretservice.gov/ntac/virtual.
To learn more or to register for one or more of these training events, visit: https://www.secretservice.gov/ntac/virtual.
BTAM team meetings should be intentional and structured.
BTAM team meetings should be intentional and structured.
The BTAM team should meet whenever a concerning individual is identified, to conduct the assessment, share information learned, and develop an individualized case management plan if necessary.
The BTAM team should meet whenever a concerning individual has been identified to conduct the assessment
The team should hold scheduled meetings regularly to build cohesion, receive training, conduct case reviews, and refine policies.
The BTAM team should also hold scheduled meetings on a regular basis to build cohesion, receive training, conduct case reviews
Regular meetings provide an opportunity for discussion and tabletop or role-playing scenarios so members are prepared to apply BTAM best practices.
conduct tabletop or role-playing scenarios
During regular meetings, BTAM team members may share details of a particular case, discuss specific challenges or successes, or offer information about pertinent resources or organizational changes affecting their work.
During these regular meetings, BTAM team members may share details of a particular case, discuss specific challenges or successes encountered, or offer information about pertinent resources or organizational changes that impact their work.
Why inferred Typed statement, not conjecture: the 'may'/'might'/'can' is permissive guidance (what a team may do), not speculation about what is the case.
A security team at a global technology company says its Chief Compliance Officer holds quarterly meetings in every region to discuss what people are seeing, promote a "see something, say something" culture, and talk about active cases.
The Chief Compliance Officer holds quarterly meetings in every region where we discuss what people are seeing, promote a “see something, say something” culture, and talk about active cases.
The global technology company's security team relies on its personnel globally to report concerning information.
We rely on our personnel globally to report concerning information.
The security team says its 30-minute meetings benefit information sharing and show people that they are a team.
Having these 30-minute meetings really benefits information sharing and showing people that we are a team.
A BTAM professional at a major service chain says that when a team member is unsure which route to take, especially in mitigating risk, team members reach out to one another.
So if an individual team member runs into an issue where we feel like we don’t really know which route to take, especially as far as mitigating risk, then we reach out to one another.
The service chain BTAM team meets regularly as a team to brainstorm and collaborate.
We meet regularly as a team to brainstorm and collaborate.
A security team at a global technology company says information sharing is what keeps the company safe.
Information sharing is what keeps the company safe.
Find the Perfect Training Class For You
