5 Threat And Risk Assessment Approaches for Security Professionals in 2024
Threat assessment means different things to different people. Security professionals, police officers, judges, psychologists, and school counselors all conduct tasks they describe as threat assessment. These approaches are all predictive in nature, but very different.
Before we dig into threat assessment, a bit of background on this article. This post was first published in late 2019. Since publication, it has been the most popular page on our website. As of January 2024, 82,224 visitors from all over the world have read this post. For a small company like us, this is awesome. We are helping security professionals everywhere identify techniques that can help them secure lives and property.
In the 2024 updates, we are providing access to more outside sources that can support any type of threat assessment. We will also provide updated terminology based on our understanding of the state-of-the-art in these areas.
I hope that you find this resource useful too. Don’t hesitate to reach out if we can help you or your organization.
Threat Assessment Approaches
Take a moment to think about what threat and risk assessment means to you or what problem you are hoping that threat assessment will help you solve.
Are you looking to:
plan for and protect facilities and critical infrastructure against terrorist attacks, insider threats, or natural disasters;
help your security personnel identify and react to threatening individuals, such as active shooters;
protect your computer networks, systems, and servers from attacks by malicious actors;
identify, assess, and intervene with a person who may commit targeted or instrumental violence (e.g., a mass shooting); or
assess a specific individual’s risk for violent behavior.
While we can’t conduct a comprehensive review of each method, this post is meant to define each one and help you identify threat assessment training and resources.
Now, let’s take a deeper dive into each threat and risk assessment approach.
1. The Security Threat and Risk Assessment
For people in the security or protection industry, threat assessment refers to the process of evaluating and analyzing potential risks that could impact the security and safety of critical infrastructure and people associated with a particular site or facility.
It focuses on analyzing existing protective measures and vulnerabilities at facilities and identifying ways to reduce those vulnerabilities and enhance safety. This includes assessing things like physical security, cybersecurity, security management and staffing, to not only safeguard critical infrastructure but any facility – businesses, elementary schools, concert halls.
There are a broad range of threats that can affect a particular site or location, including:
External hazards, such as natural disasters and fires;
Nonviolent and violent criminal threats, such as potential thefts, threats of violence toward staff, active shooter incidents, or terrorist threats;
Potential accidents related to improper building maintenance or unsafe working conditions;
Cyber threats, such as hacking, data breaches, ransomware; and
Any other threats that could impact telecommunications, transportation, or delivery of services at that location.
Threats & Risks at a School
For a security risk assessment, let’s take an example of an elementary or high school. Potential threats to a school could include a natural disaster, an active shooter, or accidental injuries that could result from improper safety precautions. Each of these threats requires a different response.
This security threat risk assessment includes not only identifying potential threats but also assessing the likelihood of their occurrence. Just because something can happen doesn’t mean it will.
The Vulnerability Assessment
Following the security risk threat assessment is the vulnerability assessment, which has two parts. First, it involves a determination of the assets at risk (e.g., people, buildings, equipment). This includes an estimation of the financial loss that would be incurred if the given location was successfully attacked and stopped providing service. Second, it includes an assessment of the level of attractiveness of the target (in the case of intentional attacks) and the level of existing defenses against each threat.
In the case of a school, some common gaps in security include difficulty in securing entry and access points, insufficient security measures (e.g., cameras, security personnel) due to budgetary concerns, and limitations in training and experience among school personnel.
Learn about Security Threat Risk Assessment
If you are interested in learning more about security threat risk assessment, here are some great resources:
Argonne National Laboratory’s protocol for identifying vulnerability and protective measures
Guidance for Conducting a Risk Assessment from Harvard University’s Department of Risk Management and Audit Services
The Cybersecurity and Infrastructure Security Agency’s (CISA) web-based Infrastructure Survey Tool for determining the overall security and resilience of a facility
Guides from the U.S. Department of Homeland Security (DHS):
An overview of threat risk assessment and planning for emergency services personnel
How to sustain public safety services during an emergency
Critical infrastructure vulnerability assessments and mitigation plans
Determining a particular location’s security level
Resource listing for state, local, tribal, territorial, and campus law enforcement
Customizable risk assessment templates from the Ready Campaign:
Printable forms for planning response and recovery efforts for different potential emergencies
Online school-focused risk assessment tools:
The Department of Education’s REMS Site Assess Tool is a free school-based risk assessment available as a mobile app
The School Security Assessment Tool (or SSAT) available from CISA
2. Active Threat Assessment
For security professionals, threat assessment is also used to describe a process of observing, identifying, and reacting to potential imminent and immediate threats. These could be against your clients, their facilities, or your personnel. At Second Sight, we refer to the systematic process of identifying threats as “active threat assessment.”
The Active Threat Assessment Methodology
Active threat assessment involves a focused observation of behaviors and actions. In this methodology, an observer (such as one of your security officers) systematically observes their environment, identifies potentially suspicious individuals (also known as persons of interest), and assesses the potential threats posed by these individuals.
A person of interest (POI) is an individual who is a target for further observation. They may become a target due to suspicious activity or a display of threatening behavior.
Further observation of the POI involves an assessment of threat indicators, which are visual behaviors that indicate a potential threat. For example, a POI might be trying to avoid notice, or they could show visible signs that they are carrying a weapon.
These assessments, in combination, allow for the identification of active threats.
Potential Users of Active Threat Assessment
A wide spectrum of security professionals can use Second Sight's active threat assessment approach, including:
Executive and personal protection specialists;
Uniformed security personnel who provide foot and vehicle patrol at a range of facilities (churches, airports, schools, public events, gaming facilities, etc.);
Camera surveillance personnel; or
Security personnel who conduct access control or respond to incidents.
To learn more about active threat assessment, check out our companion posts:
“Active Threat Assessment: Identify Potential, Immediate, and Imminent Threats,” which describes our active threat assessment process in detail;
“The 4 Benefits of Situational Awareness,” which describes situational awareness, the first step of active threat assessment;
“Situational Awareness in the Workplace,” which shows how anyone can be aware to help identify security of threats;
“Context in Threat Identification and Assessment,” which explains how to systematically observe your environment;
“Identifying Active Threats Through Behavioral Change,” which provides detail on identifying behavioral threat indicators; and
“Identifying Concealed Weapons at Protests,” which shows how active threat assessment can be applied in mass gatherings, such as protests.
You can also join our mailing list or enroll in one of our online active threat assessment training courses.
3. The Cybersecurity Threat and Risk Assessment
The same threat risk assessment and analysis process can be applied to cybersecurity, which is a key component of overall risk assessment. A cybersecurity threat risk assessment focuses on protecting access to information (e.g., data, personal information), access to networks (e.g., the internet at your offices), software (e.g., telecommunications systems, electronic data management systems), and hardware (e.g., the laptops and mobile phones of your employees).
A cyberattack refers to any purposeful attempt to obtain unauthorized access to a network, computer system, or device. Typically, these attacks are carried out with the intention of stealing, modifying, exposing, or destroying data or other assets. Perpetrators employ a range of techniques in carrying out these attacks.
One type of cyberattack that is becoming increasingly common is ransomware. Ransomware is a type of malware that is installed on a system without the user’s knowledge or permission, often via websites, emails, or file attachments. Once infected, the ransomware locks and encrypts a victim’s data, files, and systems, rendering them unusable until a sum of money is paid to the attacker.
Ransomware can have dire consequences. Once the data gets into someone else’s hands, there’s no guarantee that the victim will get it back. Unless they pay the ransom, which still doesn’t guarantee that cybercriminals will return the files. In recent years, there has been a significant increase in the number of ransomware attacks, with several high-profile incidents affecting diverse entities ranging from hospitals to schools and government agencies. For example, researchers estimate that 6 in 10 health care companies were hit by ransomware attacks in the last year. These attacks disrupt services, put patients’ lives at risk and cost hospitals millions of dollars.
The basic steps of a cybersecurity threat risk assessment are:
characterize the type of system that is at risk;
identify specific threats to that system (e.g., unauthorized access, misuse of information, data leakage or exposure, loss of data, disruption of service);
determine inherent risks and impacts;
analyze and identify existing controls that may prevent, mitigate, detect, or compensate for potential threats;
assess the extent to which existing controls successfully mitigate the threats;
determine the likelihood of a threat occurring based on current controls; and
calculate a risk rating based on a combination of impact and likelihood of occurrence.
After the assessment, you will have a better idea of what cybersecurity controls are in place and where vulnerabilities still exist. Then, you can begin implementing security controls to mitigate any potential risks.
If you are interested in learning more about cybersecurity threat risk assessments, check out the following resources:
International Association of Chiefs of Police’s (IACP) Law Enforcement Cyber Center
FEMA’s detailed overview of different cyberattacks and how to mitigate their impacts
Resources from the Cybersecurity and Infrastructure Security Agency (CISA)
Framework and guidance for conducting a Cyber Resilience Review (CRR) assessment
Guidance for protecting mobile devices and securing wireless networks.
Ransomware-specific resources:
CISA’s StopRansomware.gov
2023 #StopRansomware Guide by CISA, NSA, and the FBI
Quick start guide to combating ransomware
Protecting against ransomware attacks
What to do if you are hit by ransomware
4. Threat Assessment for Instrumental Violence
Instrumental violence is when someone commits or threatens to commit a specific attack, such as a mass shooting. In your case, it could involve an employee who has made threats against other staff members or has been involved in recent altercations at work. For executive and personal protection, it could involve individuals who have made threats against your protectee.
Threat assessment for instrumental violence is incident- and subject-specific, meaning that it assesses the likelihood that a specific individual will commit a specific attack. This is a growing area and is often referred to as Behavioral Threat Assessment and Management (or BTAM) or Threat Assessment and Management.
The National Association of School Psychologists (NASP) describes a broad spectrum of activities for identifying and intervening with potentially violent individuals who exhibit risk factors for instrumental violence.
A noted authority on this approach is the U.S. Secret Service National Threat Assessment Center (NTAC). In a 2023 report titled “Mass Attacks in Public Places,” they noted that many mass attackers often have similarities, including: a personal grievance; a history of criminal behavior; substance abuse or mental health symptoms; or other stressors (such as financial instability). Many of these attackers also made statements or exhibited certain behaviors prior to the attack that elicited concern from others. These situational and behavioral factors can serve as flags for individuals who may commit instrumental violence.
For information on threats of mass attacks in public places, see the following resources:
Our companion post, “Threat Assessment and Active Shooter Prevention”
DHS’ guidance for first responders regarding securing public gatherings and active shooter preparedness
The NCTC’s First Responder Tool Box on Threat Assessment and Management
Behavioral Approach to Violence Prevention, developed by the National Threat Evaluation and Reporting Program
Training resources available from the National Threat Evaluation and Reporting (NTER) Program Office at the Department of Homeland Security:
Behavioral Threat Assessment and Management (BTAM) Train-the-Trainer program for public entities
RAND’s framework for preparing for and responding to mass attacks:
Detecting and assessing the extent of the threat posed
Follow-up actions to implement should such an attack occur
Databases where authorized personnel can access information about a specific person to assess their potential risk
Threat Assessment in Schools
Instrumental violence is often associated with schools, for which a more nuanced approach specific to the school setting can be used. This threat assessment process focuses on a range of factors, including but not limited to motives, communications, weapons access, stressors, emotional and developmental issues, and protective factors. For more information on that approach, see our post on school behavioral threat assessment.
One alarming trend that has been on the rise is the false reporting of attacks at schools and universities. More than 500 schools across the country have received these hoax calls, which are now considered to be part of a coordinated “swatting” campaign exploiting prevalent fear over school shootings. Swatting is when people falsely report violent situations like bomb threats, hostages, and active shooters to trigger a police response, preferably by a SWAT team, to a particular address.
Swatting incidents can be dangerous, putting the lives of the individuals at the reported location at risk. Law enforcement might respond aggressively, not knowing that the situation is a hoax. The fear and trauma associated with a sudden, intense police response can also cause lasting psychological effects for targeted individuals. These incidents also occupy limited emergency services in a community and can cause delayed responses to genuine emergencies.
Proactive mitigation strategies are essential to preventing and limiting the impact of these incidents. For information on how to identify and respond to a potential swatting incident, see this guide from the state of Washington’s School Safety Center.
For more information on instrumental violence threat assessment in schools, see the resources below:
Our companion posts: “Identifying Active Threats in Schools” and “School Behavioral Threat Assessment”
Resources to prevent and mitigate targeted violence by SchoolSafety.gov
The National Behavioral Intervention Team Association (NABITA)’s behavioral threat assessment tool and rubric
Template for conducting student threat assessment inquiries, courtesy of the U.S. Secret Service (USSC)
University of Illinois Chicago (UIC) Violence Prevention Plan
5. The Violence Threat Risk Assessment
Violence threat risk assessments are typically used to estimate the likelihood that an individual will exhibit violent behavior in the future. They are used to help practitioners and intervention providers make informed decisions about risk mitigation, supervision, and treatment options for potentially dangerous individuals.
Like the instrumental violence approach described above, this approach also involves identification of risk factors and intervention strategies. The difference, though, is that violence threat risk assessment focuses on assessing an individual’s predilection for violence more generally and is not related to a specific attack against a specific target.
This is often referred to as a violence risk assessment or just a risk assessment. A critical difference between this risk assessment and the threat assessment for instrumental violence is the former measures the likelihood that an individual will commit some sort of violent act in the future, while the latter is focused on predicting a specific targeted act.
This approach may not be something you or your personnel perform directly. Typically, these assessments are conducted by qualified clinical professionals. There are different types of violence threat risk assessments that predict different types of risks, ranging from domestic violence to terrorism. Some of these rely on the judgment of professionals, while others are actuarial-based.
One recommendation is the shift toward structured professional judgment (SPJ) approaches. The SPJ approach involves a systematic evaluation of risk factors by professionals who use their expertise and judgment to reach a conclusion about an individual's level of risk. Some of the commonly known SPJ approaches are the Violent Extremism Risk Assessment (VERA), the Extremism Risk Guidance 22+ (ERG 22+), the Spousal Assault Risk Assessment (SARA), and the Historical Clinical Risk Management-20 (HCR-20).
In contrast, actuarial-based risk assessment instruments (RAIs) predict risk by using statistical methods and a scoring system informed by historical data and criminological theory. Using the scoring system, RAIs screen for predetermined risk indicators, which are used to generate a numerical risk score. The risk score reflects the likelihood of a future event, such as recidivism or targeted violence. Some of the most commonly used RAIs are the Violence Risk Appraisal Guide (VRAG), the Virginia Pretrial Risk Assessment Instrument (VPRAI), the Level of Service Inventory-Revised (LSI-R), the Ohio Risk Assessment System (ORAS), and the Public Safety Assessment (PSA).
Each approach has pros and cons. In the SPJ approach, professionals examine a wide range of aggravating and mitigating factors and can offer more personalized assessments, especially in unique circumstances. However, some criticize the SPJ approach for being too subjective and inconsistent when making risk evaluations due to variations in professional judgment and individual biases.
In contrast, RAIs are consistent in making predictions based on the same inputs, as they rely on predetermined formulae to assess risk. However, there are concerns about their potential to outperform human judgment, as RAIs don’t adapt well to uncommon circumstances, and they often include static factors (such as being a male) that cannot be changed. Relatedly, if historical data is biased, the algorithm might perpetuate biases.
Ultimately, selecting a risk assessment tool involves considering the specific nature of the risk being assessed (e.g., violent extremism, general violence, sexual offending), the characteristics of the population being assessed (e.g., age, gender, cultural background), the setting or context of the assessment (e.g., forensic mental health, correctional facility), and the availability of empirical evidence supporting the tool's reliability and validity.
The Public Risk Innovation, Solutions, and Management (PRISM) framework by the Public Entity Risk Institute (PERI) provides a comprehensive approach to risk management for public entities. While it is not an actuarial-based tool, PRISM encompasses various aspects of risk identification, assessment, and management. The framework includes various modules and resources that assist organizations in understanding, preventing, and responding to a range of risks, from financial and operational risks to strategic and reputational risks.
For more information on violence threat risk assessment, check out the following resources:
Open-access digital book Violent Extremism: A Handbook of Risk Assessment and Management by Caroline Logan, Randy Borum, and Paul Gill, published in 2023
The American Psychological Association (APA)’s Guidelines for Psychological Evaluation and Assessment
The Department of Defense’s report on predicting violent behavior
Risk Assessment Database, courtesy of the Berkman Klein Center
What’s Next?
All of these approaches are essential to protecting our community and keeping people safe. Depending on your needs, any of these approaches to threat and security assessment may be relevant to you or your personnel.
As a next step, take a deeper dive into some of these resources or check out our recently updated online program: Active Threat Assessment for Security Professionals.
-
Alathari, L., Drysdale, D., Blair, A., McGarry, J., Camilletti, C., Snook, A., & Driscoll, S. (2018). Enhancing school safety using a threat assessment model: An operational guide for preventing targeted school violence.
Alathari, L., Drysdale, D., Driscoll, S., Carlock A., & Cutler, M. (2023). Mass attacks in public spaces: 2016-2020. NTAC: DHS. https://www.secretservice.gov/sites/default/files/reports/2023-01/usss-ntac-maps-2016-2020.pdf
Arnold Ventures. (2017). Public Safety Assessment: A risk tool that promotes safety, equity, and justice. https://www.arnoldventures.org/stories/public-safety-assessment-risk-tool-promotes-safety-equity-justice/
CISA. (2014). Emergency services sector roadmap to secure voice and data systems. DHS. https://www.cisa.gov/sites/default/files/publications/emergency-services-sector-roadmap-to-secure-voice-and-data-systems-032014-508.pdf
CISA. (2015). Emergency services sector-specific plan: An annex to the NIPP 2013. DHS. https://www.cisa.gov/sites/default/files/publications/emergency-services-sector-specific-plan-112015-508_0.pdf
CISA. (2017). A guide to securing networks for wi-fi: Version 1.0. DHS. https://www.cisa.gov/uscert/sites/default/files/publications/A_Guide_to_Securing_Networks_for_Wi-Fi.pdf
CISA. (2017). Active shooter emergency action plan. DHS. https://www.cisa.gov/sites/default/files/publications/active-shooter-emergency-action-plan-112017-508v2.pdf
CISA. (2019). “Protecting Against Ransomware.” DHS. https://www.cisa.gov/news-events/news/protecting-against-ransomware
CISA. (2019). A guide to critical infrastructure security and resilience. https://www.cisa.gov/sites/default/files/publications/Guide-Critical-Infrastructure-Security-Resilience-110819-508v2.pdf
CISA. (2019). Emergency services sector landscape. DHS. https://www.cisa.gov/sites/default/files/publications/emergency-services-sector-landscape-082019-508.pdf
CISA. (2020). Cyber Resilience Review (CRR) question set with guidance. DHS. https://www.cisa.gov/sites/default/files/publications/3_CRR_4.0_Self-Assessment_Questions_%26amp%3B_Guidance_April_2020.pdf
CISA. (2021). “ISC Standard: Risk Management Process.” https://www.cisa.gov/resources-tools/resources/isc-standard-risk-management-process
CISA. (2022). Ransomware response checklist. DHS. https://www.cisa.gov/sites/default/files/publications/Ransomware_Response_Checklist_508.pdf
CISA. (2023). “Infrastructure Survey Tool (IST).” DHS. https://www.cisa.gov/resources-tools/services/infrastructure-survey-tool-ist
CISA. (N.d). “Critical Infrastructure Assessments.” DHS. https://www.cisa.gov/critical-infrastructure-assessments
CISA. (N.d). “Emergency Services Sector Continuity Planning Suite.” DHS. https://www.cisa.gov/emergency-services-sector-continuity-planning-suite
CISA. (N.d). “Managing Insider Threats.” DHS. https://www.cisa.gov/topics/physical-security/insider-threat-mitigation/managing-insider-threats
CISA. (N.d). “School Security Assessment Tool (SSAT).” DHS. https://www.cisa.gov/school-security-assessment-tool
CISA. (N.d). “Securing Public Gatherings.” DHS. https://www.cisa.gov/topics/physical-security/securing-public-gatherings
CISA. (N.d.). “State, Local, Tribal, and Territorial Authorities, Government, and First Responders.” DHS. https://www.cisa.gov/state-local-tribal-and-territorial-authorities-government-and-first-responders
Cornell, D.G. (2020). Threat assessment as a school violence prevention strategy. Criminology & Public Policy, 19(1), 235-252. https://onlinelibrary.wiley.com/doi/abs/10.1111/1745-9133.12471
Criminal Intelligence Coordinating Council (CICC). (2016). Understanding digital footprints: Steps to protect personal information, A guide for law enforcement. Global Advisory Committee: Department of Homeleand Security (DHS). https://bja.ojp.gov/sites/g/files/xyckuh186/files/media/document/Understanding_Digital_Footprints-09-2016.pdf
Dipshan, R., Hudgins, V., Ready, F., & Warren, Z. (2020). “The Most Widely Used Risk Assessment Tool in Each U.S. State.” https://www.law.com/legaltechnews/2020/07/13/the-most-widely-used-risk-assessment-tool-in-each-u-s-state/?slreturn=20230019150826
Douglas, K. S., Hart, S. D., Webster, C. D., & Belfrage, H. (N.d.). HCR-20 Version 3. http://hcr-20.com/
Fisher, R. E., Buehring, W. A., Whitfield, R. G., Bassett, G. W., Dickinson, D. C., Haffenden, R. A., Klett, M. S., & Lawlor, M. A. (2009). Constructing vulnerability and protective measures indices for the enhanced critical infrastructure protection program. Argonne National Laboratory, Department of Energy. https://publications.anl.gov/anlpubs/2009/10/65406.pdf
Harvard University Risk Management and Audit Services. (2024). Conducting a risk assessment. https://rmas.fad.harvard.edu/files/rmas/files/conducting_a_risk_assessment_guidance.pdf
International Association of Chiefs of Police (IACP). (2017). Managing cybersecurity risk: A law enforcement guide. https://www.iacpcybercenter.org/wp-content/uploads/2015/04/Managing_Cybersecurity_Risk_2017.pdf
Kropp, P. R., & Hart, S. D. (2000). The Spousal Assault Risk Assessment (SARA) guide: Reliability and validity in adult male offenders. https://emerge.ucsd.edu/r_1plrabytih9j494/
Kropp, P. R., Hart, S. D., Webster, C. D., Eavs, D. (1999). Spousal Assault Risk Assessment guide (SARA): Assessment of the likelihood of domestic violence. https://downloads.mhs.com/saRA/SARA_TechBrochure.pdf
Levi, R. (2023). “Ransomware Attacks Against Hospitals put Patients' Lives at Risk, Researchers Say.” Interview Transcript. National Public Radio. https://www.npr.org/2023/10/20/1207367397/ransomware-attacks-against-hospitals-put-patients-lives-at-risk-researchers-say
Logan, C., Borum, R., & Gill, P. (Eds.). (2023). Violent extremism: A handbook of risk assessment and management. UCL Press. https://www.uclpress.co.uk/products/185116
MacDonald, D. (2017). “Using the Violence Risk Appraisal Guide (VRAG).” https://dustinkmacdonald.com/using-violence-risk-appraisal-guide-vrag/
Mayorkas, A.N. (2022). Summary of resources for state, local, tribal, yerritorial, and campus law enforcement partners. DHS. https://www.dhs.gov/sites/default/files/2022-04/22_0407_OSLLE_LE-resource-guide-signed_508.pdf
Multi-State Information Sharing and Analysis Center (MS-ISAC). (2023). #StopRansomware Guide. CISA, FBI, and National Security Agency (NSA). https://www.cisa.gov/sites/default/files/2023-10/StopRansomware-Guide-508C-v3_1.pdf
National Association for Behavioral Intervention and Threat Assessment (NABITA). (2014). Threat Assessment Rubric. http://nabita.moatusers.com/Rubric/21-Questions_0518.pdf
NABITA. (2014). Threat Assessment Tool. https://cdn.nabita.org/website-media/nabita.org/wordpress/wp-content/uploads/2014/04/2014-NaBITA-Threat-Assessment-Tool.pdf
National Institute of Standards and Training (NIST). (2022). Getting started with cybersecurity management: Ransomware. https://csrc.nist.gov/files/pubs/other/2022/02/24/getting-started-with-cybersecurity-risk-management/final/docs/quick-start-guide--ransomware.pdf
National Threat Evaluation and Reporting (NTER). (2023). Behavioral Threat Assessment Master Trainer Program. https://www.dhs.gov/mtp
NTER. (2023). Foundations of Targeted Violence Prevention eLearning. https://www.dhs.gov/foundations-targeted-violence-prevention
Occupational Safety and Health Administration (OSHA). (N.d). “Evacuation Planning Matrix.” U.S. Department of Labor (DOL). https://www.osha.gov/emergency-preparedness/evacuation-matrix
Ohio Risk Assessment System. (2018). Pretrial Risk Assessment. https://cjdata.tooltrack.org/sites/default/files/2018-10/ORAS%20Scoring%20Assessment.pdf
Powis, B., Randhawa-Horne, K., & Bishopp, D. (2019). The structural properties of the extremism risk guidelines (ERG22+): A structured formulation tool for extremist offenders. Ministry of justice analytical series. https://assets.publishing.service.gov.uk/media/5d274ad140f0b61119a41cf1/the-structural-properties-of-the-extremism-risk-guidelines-ERG22.pdf
Public Risk Innovation, Solutions, and Management: PRISM. (2024). https://www.prismrisk.gov/
Readiness and Emergency Management for Schools (REMS). (2023). “SITE ASSESS: A Site Assessment Tool for Planning Team Members and Safety Leaders.” Department of Education. https://rems.ed.gov/SITEASSESS.aspx?
Ready Campaign. (2022). “Business Impact Analysis.” https://www.ready.gov/business/planning/impact-analysis
Ready Campaign. (2022). “Disasters and Emergencies.” https://www.ready.gov/risk-assessment
Ready Campaign. (2022). “Employee Training.” https://www.ready.gov/business/training/employee-training
Ready Campaign. (2022). “Risk Assessment.” https://www.ready.gov/business/planning/risk-assessment
Reeves, M., Conolly, C., & Woitaszewski, S. (2020). Behavior threat assessment and management: Best practice considerations for K-12 schools, Brief Overview. National Association of School Psychologists (NASP): Department of Education. https://www.nasponline.org/resources-and-publications/resources-and-podcasts/school-safety-and-crisis/systems-level-prevention/threat-assessment-at-school/behavior-threat-assessment-and-management-(btam)-best-practice-considerations-for-k%E2%80%9312-schools
Renfroe, N. A., & Smith, J. L. (2016). “Threat / Vulnerability Assessments and Risk Analysis.” Applied Research Associates. https://www.wbdg.org/resources/threat-vulnerability-assessments-and-risk-analysis.
Robinson, P. (2024). “15 Most Common Cyber Attack Types and How to Prevent Them.” https://www.lepide.com/blog/the-15-most-common-types-of-cyber-attacks/
Romano, S.J., Levi-Minzi, M.E., Rugala, E.A., & van Hasselt, V.B. (2011). Workplace violence prevention. FBI: Department of Justice. https://www.fbi.gov/file-repository/stats-services-publications-workplace-violence-workplace-violence/view
Ruggiero, P., & Foote, J. (2011). Cyber threats to mobile phones. U.S. Computer Readiness Team: DHS. https://www.cisa.gov/uscert/sites/default/files/publications/cyber_threats_to_mobile_phones.pdf
Savage, T. A., & Woitaszewski, S. A. (2018). School-based threat assessment: Best practices and resources. Presentation at the Minnesota School Psychologists Association: Plymouth, MN. https://www.mspaonline.net/resources/Documents/past%20conference%20materials/2018/School-Wide%20Practices/School-Based%20Threat%20Assessment_%20Best%20Practices%20and%20Resources%20-%20Savage,%20Woitaszewski.pdf
Serin, R. C., Lowenkamp, C. T., Johnson, J. L., Trevino, P. (2016). Using a multi-level risk assessment to inform case planning and risk management: Implications for officers. Federal Probation, 80(2), 10. https://www.uscourts.gov/sites/default/files/80_2_2_0.pdf
Slater, J. (2023). “Coordinated ‘Swatting’ Effort May be Behind Hundreds of School Shooting Hoaxes.” Washington Post. https://www.washingtonpost.com/nation/2023/10/04/school-swatting-hoax-active-shooter/
Sokolow, B.A., Lewis, W.S., Schuster, S.K., Swinton, D.C., van Brunt, B.J. (2014). Threat Assessment in the Campus Setting. National Behavioral Intervention Team Association (NABITA). http://nabita.moatusers.com/Rubric/2014%20NaBITA%20Whitepaper.pdf
South Dakota Department of Corrections. (2015). “Level of Service Inventory-Revised (LSI-R) and Case Planning.” ttps://doc.sd.gov/documents/about/policies/LSI-R%20Assessment%20and%20Case%20Planning.pdf
University of Illinois Chicago Office of Preparedness and Response. (2023). “Violence Prevention Plan.” https://ready.uic.edu/planning/violence-prevention/
Violent Extremism Risk Assessment 2 Revised (VERA-2R). https://www.vera-2r.nl/
Virginia Department of Criminal Justice Services. (2018). Virginia pretrial risk assessment instrument (VPRAI) instruction manual: Version 4.3. https://www.dcjs.virginia.gov/sites/dcjs.virginia.gov/files/publications/corrections/virginia-pretrial-risk-assessment-instrument-vprai_0.pdf
Washington School Safety Center. (N.d.) “Swatting: Mitigation Strategies and Reporting Procedures.” https://rems.ed.gov/docs/WA_Swatting.pdf
Whole Building Design Guide (WBDG). (2017). “Natural Hazards Mitigation. Secure/Safe Committee.” https://www.wbdg.org/design-objectives/secure-safe/natural-hazards-mitigation