An active shooter response plan has to do one job above all else: save lives by giving every person on-site a clear, rehearsed set of options when there’s no time to think. That means documented response choices, a notification chain that reaches everyone in seconds, an accountability process that tells you who’s safe and who isn’t, and a recovery plan for the hours after. The fastest way to have a working plan today, not next quarter, is to download a fillable Emergency Action Plan template from CISA and pull together a four to six person planning team to complete a first draft within two weeks.

A usable plan needs these elements at minimum:

Defined roles for a planning team and incident response leads
A notification method that reaches every occupant, including those with disabilities
Evacuation, lockdown, and shelter-in-place procedures matched to your facility
An accountability and reunification process
A recurring exercise and drill schedule
An audit and update cycle

Pro Tip: Grab the CISA fillable template first, even before you schedule your planning meeting. Having a structured document in front of the team turns a vague “let’s talk about safety” meeting into a working session with actual deliverables.

Key Takeaways

An effective active shooter response plan combines a government-vetted template, clearly assigned roles, redundant notification, and a recurring exercise and audit cycle to keep it current.

Point	Details
Start with a template	Use the CISA fillable EAP template or CDSE template to draft a facility-specific plan in weeks, not months.
Build in redundant alerts	Layer PA, SMS, email, and visual signage so every occupant receives the notification.
Practice on a ladder	Run tabletop exercises annually and escalate to functional and full-scale drills as resources allow.
Audit annually and after change	Review the plan every year and after any major facility or organizational shift, per ASSP TR-Z590.5.
Bring in outside expertise	Hub Security & Investigative Group offers site assessments, EAP drafting, and exercise design to validate your plan against these standards.

Where to Find a Vetted Active Shooter Response Plan Template
What Goes Into a Written Active Shooter Response Plan
Run, Hide, Fight: Making the Right Call in the Moment
Building a Notification Plan That Actually Reaches Everyone
How Often Should You Run Active Shooter Drills?
Keeping Your Plan Current and Legally Sound
The Standards Behind a Defensible Active Shooter Plan
What Security Professionals Wish More Plans Got Right
How Hub Security & Investigative Group Supports Your Plan
Frequently Asked Questions
Sources

Where to Find a Vetted Active Shooter Response Plan Template

Don’t start from a blank page. CISA’s Active Assailant/Shooter Emergency Action Plan Product Suite gives you a fillable EAP template plus an instructional guide built to be tailored to your facility rather than followed generically. The CDSE Active Shooter Response Plan Template offers a leaner, editable alternative if your organization wants a shorter workplace-specific document. Both are free, both are government-vetted, and both save you weeks of drafting from scratch.

Use this quick-start checklist to move from zero to a working draft:

Assign a four to six person planning team with representation from security, HR, facilities, and leadership.
Define the plan’s scope, one building, one campus, or one event.
Choose your base template and decide whether it stands alone or attaches as an annex to an existing Emergency Operations Plan.
Map primary exits, shelter-in-place rooms, and rally points.
Set your notification method and confirm it reaches every occupant.
Schedule your first tabletop exercise on the calendar before you finish the draft.

Most organizations do better treating the active shooter annex as part of a broader emergency operations plan rather than a standalone document. Fragmented plans create confusion when staff have to remember which document covers which emergency; one integrated structure keeps communications and command roles consistent across every crisis type.

What Goes Into a Written Active Shooter Response Plan

Your planning team should write every section in short, active-voice sentences. A stressed reader skimming a laminated card during an emergency doesn’t have patience for paragraphs. Checklists, arrows, and labeled maps outperform prose every time.

The plan itself needs eight core components: a threat assessment specific to your facility, prevention measures, defined roles and responsibilities, a notification protocol, evacuation and lockdown and shelter-in-place procedures, a first responder coordination section, medical triage and victim support guidance, and a business continuity plan for recovery. A physical security risk assessment done ahead of drafting will surface choke points and blind spots you’d otherwise miss until it’s too late.

Facility maps deserve their own attention. Mark every evacuation route, every shelter-in-place room, and every high-risk choke point, stairwells, loading docks, single-entry corridors, where movement bottlenecks under pressure.

Role	Primary responsibility
Incident Liaison	Coordinates directly with arriving law enforcement and shares floor plans
Communications Lead	Sends internal alerts and manages the 911 call
Floor Warden	Directs occupants on their floor toward exits or shelter locations
Accountability Officer	Tracks headcounts at rally points and flags missing individuals

Accessibility can’t be an afterthought written in after a lawsuit. Build in visual alerts for staff with hearing loss, designated exit assistance for people with mobility limitations, and alternate rally points reachable without stairs. A solid emergency evacuation plan already accounts for these accommodations, and folding that work into your active shooter annex avoids rebuilding it twice.

Run, Hide, Fight: Making the Right Call in the Moment

Run, Hide, Fight isn’t a sequence to memorize step by step. It’s a decision framework, and the insight from CISA’s preparedness guidance is that training should build judgment, not rote habit. Running works when there’s a clear, safe path out. Hiding works when escape isn’t available, behind a locked door, out of the shooter’s line of sight, silent. Fighting is the last resort, used only when confrontation is unavoidable and survival depends on it.

When law enforcement arrives, behavior matters as much as location. Keep your hands visible and empty. Follow verbal commands immediately, even if they seem abrupt. Avoid sudden movements toward officers. Only describe the shooter’s appearance and location if you can do so without exposing yourself further.

Keep hands raised and visible when officers enter your area
Do not attempt to hold onto belongings while evacuating past law enforcement
Wait for instructions rather than moving toward the nearest exit on your own
Report shooter location and description only when it’s safe to speak

Pro Tip: Rehearse recognition cues during drills, not just movement patterns. Staff who practice noticing early warning signs and communicating them calmly perform far better under real stress than staff who only memorized an exit route.

More than 60% of active shooter incidents end before police arrive, according to the FBI’s guide for businesses. That statistic alone should shape every training decision: your plan has to work in the first few minutes, without waiting for outside help.

Building a Notification Plan That Actually Reaches Everyone

Notification has to move fast and reach every person, not just the ones near a PA speaker. The flow runs from incident detection to an internal alert, then 911 and first responders, then staff and visitors, then external stakeholders and media, in that order and without skipped steps.

Keep your alert scripts blunt and specific:

“Evacuate now. Active threat in the building. Proceed to your nearest exit.”
“Lockdown now. Active threat on-site. Shelter in place and lock doors.”
“All clear. The threat has been contained. Please await further instructions.”

Accessibility matters here too: pair audible alerts with visual strobes, text messages, and signage, and arrange for interpreters when your workforce or visitor base includes non-English speakers. Redundancy protects you when one channel fails, so layer PA announcements with SMS, email, and posted signage rather than relying on a single system.

After the incident, your communications checklist shifts:

Notify affected families directly and promptly
Assign a single public information officer for all media contact
Maintain an ongoing liaison with law enforcement
Connect victims and witnesses with support contacts immediately

How Often Should You Run Active Shooter Drills?

Exercises need to escalate in realism, not jump straight to a full-scale drill. Start with a tabletop exercise, a discussion-based walkthrough where your team talks through a scenario around a table. Move to a physical walk-through of the facility, then a functional exercise testing specific systems like notification or lockdown mechanisms, and finally a full-scale exercise involving outside responders.

Run a tabletop exercise at least once a year
Schedule targeted functional drills twice a year where resources allow
Conduct a full-scale exercise with local responders when budget and staffing allow
Scale down frequency for smaller organizations, but never skip the annual tabletop

CISA’s guidance recommends aligning exercise design with FEMA’s HSEEP principles, which standardize how exercises are planned, conducted, and evaluated. Inviting local police, fire, and EMS into your exercises does more than check a box. Responders who’ve walked your facility ahead of time navigate it faster and with fewer costly assumptions during a real incident.

Pro Tip: After every exercise, no matter how small, write an after-action report while the details are fresh. Capture what worked, what stalled, and exactly who is responsible for fixing each gap before the next drill.

Keeping Your Plan Current and Legally Sound

The Interagency Security Committee’s guidance sets a baseline: review your plan at least annually, and again after any major organizational or facility change. ASSP’s TR-Z590.5-2019 standard goes further, treating the plan as a living document that needs formal, recurring audits rather than a one-time sign-off.

Build your audit around four elements: defined scope, a named responsible reviewer, measurable metrics, and documented evidence of what changed. Loop in legal counsel to confirm your evacuation and lockdown procedures meet ADA requirements and local building codes before you finalize anything.

Set a recurring annual review date on the calendar, not just “when we get to it”
Trigger an off-cycle review after any exercise, incident, or major renovation
Maintain version control with a distribution list so outdated copies don’t circulate

Pro Tip: Date-stamp every printed copy of your plan and set a refresh trigger tied to staff turnover, not just the calendar. A plan that’s technically current but unread by half your new hires isn’t current at all.

The Standards Behind a Defensible Active Shooter Plan

CISA’s templates and the ISC’s policy guidance form the foundation most organizations build on, and ASSP TR-Z590.5 backs that up with a technical framework for risk assessment, prevention, and ongoing audits. The FBI’s research on incident duration reinforces why speed matters more than perfection in the first few minutes.

CISA fillable EAP template and instructional guide
ISC policy on annual reviews and required plan elements
ASSP TR-Z590.5 audit and living-document standard
FBI data on how quickly incidents typically resolve

Hub Security & Investigative Group applies these standards directly in site assessments and workplace security consulting, helping organizations validate plans against the same government frameworks referenced above.

What Security Professionals Wish More Plans Got Right

Mark two alternate evacuation routes, not just one, because the obvious exit is often the first one blocked. Pre-stage basic trauma kits near high-occupancy areas rather than in a single central closet. Keep alert language simple: “lockdown now” beats a paragraph of instructions nobody reads under stress.

Drills should feel real enough to build muscle memory without traumatizing staff who may carry their own histories with violence. Trauma-informed design, advance notice that a drill is coming, an opt-out path for anyone who needs it, matters as much as realism.

Bringing local police and fire into planning early, not after the plan is finished, consistently produces the fastest, most coordinated response when it counts.

How Hub Security & Investigative Group Supports Your Plan

Hub Security & Investigative Group gives you what a template alone can’t: someone who’s walked hundreds of facilities and can tell you exactly where your evacuation routes bottleneck before an auditor or, worse, an incident does. That’s the real gap between downloading a CISA template and having a plan that survives contact with reality.

Our team offers site risk assessments that feed directly into your plan’s threat assessment section, custom EAP drafting built around your actual floor plan, and tabletop through full-scale exercises that follow HSEEP design principles. We also coordinate directly with local law enforcement ahead of exercises, which shortens their familiarization time if a real incident ever happens, and we document every audit so your legal team has evidence of due diligence on file.

If your organization is still working from a generic template or hasn’t run a drill in over a year, a scoping call is the natural next step. Reach out to schedule a site risk assessment and find out exactly where your current plan falls short.

Frequently Asked Questions

How long should it take to draft an active shooter response plan?

A small to mid-size organization using the CISA fillable template can produce a working first draft within two weeks with a four to six person planning team. Full validation, including legal review and a first tabletop exercise, typically takes another month.

Does an active shooter response plan need to be a standalone document?

It can stand alone, but most organizations get better results treating it as an annex to their broader emergency operations plan. That keeps notification, command roles, and communications consistent across every type of crisis rather than duplicating them.

How often should we run active shooter drills?

Run a tabletop exercise at least annually, add functional drills twice a year where possible, and schedule a full-scale exercise with local responders when budget allows. Smaller organizations can scale down frequency but shouldn’t skip the annual tabletop.

Who should be involved in writing the plan?

A core planning team of four to six people spanning security, HR, facilities, and leadership, plus legal counsel to confirm ADA and local code compliance, and local law enforcement and fire officials brought in during the review and exercise phases.

What’s the biggest mistake organizations make with active shooter plans?

Treating the plan as a one-time document instead of a living one. ASSP TR-Z590.5 specifically calls for regular, formal audits, and a plan that hasn’t been reviewed since it was written is often out of date the moment a facility layout or staff roster changes.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

E-Mail Us

(617) 857-1200

What a Complete Active Shooter Response Plan Requires