NFPA 3000

Standard for an Active Shooter/Hostile Event Response (ASHER) Program

Chapter 1 Administration

• The scope of this standard is limited to the neces­sary functions and actions related to preparedness, response, and recovery from an active shooter/hostile event response (ASHER).
• The purpose of this standard is to identify the program elements necessary to develop, plan, coordinate, eval­uate, revise, and sustain an ASHER program.

1.2.1 Determining specific policies, tactics, and protocols shall be the responsibility of the authority having jurisdiction (AHJ).

• Nothing in this standard is intended to prevent the use of systems, methods, or devices of equivalent or superior quality, strength, resistance, effectiveness, durability, and safety over those prescribed by this standard.

1.3.1 Technical documentation shall be submitted to the AHJ to demonstrate equivalency.

1.4* Application. This standard applies to any community, AHJ, facility, or member of any organization that prepares for, responds to, or assists in recovery from active shooter/hostile events (ASHE).

1.4.1* Portions of this standard might not be applicable to every jurisdiction or entity applying the standard, depending on their scope of responsibilities.

1.4.2* This standard does not apply to the prevention of an ASHE incident.

Chapter 2 Referenced Publications

• The documents or portions thereoflisted in this chapter are referenced within this standard and shall be considered part of the requirements of this document.
• NFPA Publications. National Fire Protection Association, 1 Battery march Park, Quincy, MA 02169-7471.

NFPA 72®, National Fire Alarm and Signaling Code®, 2019 edition.

NFPA 101®, Life Safety Code®, 2021 edition.

NFPA 472, Standard for Competence of Responders to Hazardous Materials/Weapons of Mass Destruction Incidents, 2018 edition.

NFPA 473, Standard for Competencies for EMS Personnel Respond­ing to Hazardous Materials/Weapons of Mass Destruction Incidents, 2018 edition.

NFPA 1061, Standard for Public Safety Telecommunications Personnel Professional Qualifications, 2018 edition.

NFPA 1221, Standard for the Installation, Maintenance, and Use of Emergency Services Communications Systems, 2019 edition.

NFPA 1500™, Standard on Fire Department Occupational Safety, Health, and Wellness Program, 2020 edition.

NFPA 1561, Standard on Emergency Services Incident Manage­ment System and Command Safety, 2020 edition.

NFPA 1710, Standard for the Organization and Deployment of Fire Suppression Operations, Emergency Medical Operations, and Special Operations to the Public by Career Fire Departments, 2020 edition.

NFPA 1720, Standard for the Organization and Deployment of Fire Suppression Operations, Emergency Medical Operations, and Special Operations to the Public by Volunteer Fire Departments, 2020 edition.

• Other Publications.

APCO/NENA 2.105.1-2017, NG9-1-1 Emergency Incident Data Document (EDD), National Emergency Number Association, 2017.

C-TECC Tactical Emergency Casualty Care (TECC) Tactical Emergen cy Casualty Care (TECC) Guidelines for First Responders with a Duty to Act, 2017.

C-TECC Tactical Emergency Casualty Care (TECC) Tactical Emergency Casualty Care (TECC) Guidelines for BLS/ALS Medical Providers, 2017.

DOT Emergency Response Guidebook, 2016.

Merriam-Webster’s Collegiate Dictionary, 11th edition, Merriam- Webster, Inc., Springfield, MA, 2003.

National Institute of Justice (NIJ) Guide-0101.06, Selection and Application Guide to Ballistic-Resistant Body Armor for Law Enforcement, Corrections and Public Safety.

National Institute of Justice (NIJ) Standard-0101.06, Ballistic Resistance of Body A rmor.

NENA-STA-004.1-2014, Next Generation United States Civic Location Data Exchange Format (CLDXF), National Emergency Number Association, 2014.

NENA-STA-012.2-2017, NC,9-1-1 Additional Data Standard, National Emergency Number Association, 2017.

2.4 References for Extracts in Mandatory Sec dons.

NFPA 101®, Life Safety Code®, 2018 edition.

NFPA 731, Standard for the Installation of Electronic Premises Security Systems, 2017 edition.

NFPA 1221, Standard for the Installation, Maintenance, and Use of Emergency Services Communications Systems, 2019 edition.

NFPA 160(P, Standard on Continuity, Emergency, and Crisis Management, 2019 edition.

Chapter 3 Definitions

• The definitions contained in this chapter apply to the terms used in this standard. Where terms are not defined in this chapter or within another chapter, they should be defined using their ordinarily accepted meanings within the context in which they are used. Merriam-Webster’s Collegiate Dictionary, 11th edition, should be used as the source for the ordinarily accepted meaning.
• NFPA Official Definitions.

3.2.1* Approved. Acceptable to the authority having jurisdic­tion.

3.2.2* Authority Having Jurisdiction (AHJ). An organization, office, or individual responsible for enforcing the requirements of a code or standard, or for approving equipment, materials, an installation, or a procedure.

3.2.3* Listed. Equipment, materials, or services included in a list published by an organization that is acceptable to the authority having jurisdiction and concerned with evaluation of products or services, that maintains periodic inspection of production of listed equipment or materials or periodic evalua­tion of services, and whose listing states that either the equip­ment, material, or service meets appropriate designated standards or has been tested and found suitable for a specified purpose.

• Indicates a mandatory requirement.
• Indicates a recommendation or that which is advised but not required.
• An NFPA Standard, the main text of which contains only mandatory provisions using the word “shall” to indicate requirements and that is in a form generally suitable for mandatory reference by another standard or code or for adoption into law. Non-mandatory provisions are not to be considered a part of the requirements of a standard and shall be located in an appendix, annex, footnote, informational note, or other means as permitted in the NFPA Manuals of

Style. When used in a generic sense, such as in the phrase “standards development process” or “standards development activities,” the term “standards” includes all NFPA Standards, including Codes, Standards, Recommended Practices, and Guides.

3.3 General Definitions.

3.3.1 Access and Functional Needs (AFN). Persons requiring special accommodations because of health, social, economic, or language challenges. [1600, 20191

3.3.2* Active Assailant(s) (AA). One or more individuals actively engaged in harming, killing, or attempting to kill people in a populated area by means other than the use of fire­arms.

• Active Shooter(s) (AS). One or more individuals actively engaged in harming, killing, or attempting to kill people in a populated area by the use of firearm (s).
• Active Shooter/Hostile Event (ASHE). An incident involving one or more individuals who are or have been actively engaged in harming, killing, or attempting to kill people in a populated area by means such as firearms, explo­sives, toxic substances, vehicles, edged weapons, fire, or a combination thereof.
• Active Shooter/Hostile Event Response (ASHER). 

• Active Shooter/Hostile Event Response (ASHER) Program. A community-based approach to preparedness, miti­gation, response, and recovery from an ASHER incident, including public and private partnerships, emergency manage­ment, the medical community, emergency responders, and the public.

3.3.7* After Action Report (AAR). A comprehensive docu­ment to be completed following a review of a planned or spon­taneous operation to include the actions taken (or failures to act and omissions) by personnel and involved individuals, mission results, and any pertinent and relevant information related to same operation, including lessons learned and any identified training recommendations.

3.3.8* Associated Off-Site Operations. Areas of operations that are directly related to the management of the incident but are outside the secured incident perimeter.

3.3.9* Ballistic Protective Equipment (BPE). An item of personal protective equipment (PPE) intended to protect the wearer from threats that could include ballistic threats, stab­bing, fragmentation, or blunt force trauma.

3.3.10* Building Sides. A method of identifying locations in and around a building or structure consistent with the National Incident Management System (NIMS).

• Side A (Alpha). Side A, also known as Side Alpha, is normally the front or main entrance/access to the build­ing and usually the side bearing the building address. For buildings with an unusual side A, side A will be identified by the incident commander.
• Side B (Bravo). Side B, also known as Side Bravo, is the adjacent side of the building or structure clockwise from Side A.
• Side C (Charlie). Side C, also known as Side Char­lie, is the adjacent side of the building or structure clockwise from Side B. Generally, this is the back of the building or structure.
• Sicle D (Delta). Side D, also known as Side Delta, is the adjacent side of the building or structure clockwise from Side C.

3.3.11 Casualty. A victim who is physically injured or killed as a result of the incident. (See also 3.3.65, Victim.)

3.3.12* Casualty Collection Point (CCP). A temporary loca­tion used for the gathering, threat-based care, subsequent medical care, and evacuation of nearby casualties.

• A term used to describe the status of an environ­ment determined by law enforcement to have no active threat based on an initial assessment and might or might not be controlled by law enforcement.
• Communications Center. A building or portion of a building that is specifically configured for the primary purpose of providing emergency communications services or public safety answering point (PSAP) services to one or more public safety agencies under the authority or authorities having juris­diction. |1221,20191
• Community Resiliency Center (CRC). A physical or virtual place of healing and support dedicated to serving as a resource and referral center for residents, visitors, and responders affected by an ASHE incident. A CRC will also continue to provide ongoing services and assistance to directly or proximately harmed victims, family members, first respond­ers, and community members.
• Possessing knowledge, skills, and judg­ment needed to perform indicated objectives.

3.3.17* Complex Coordinated Attack. Synchronized attacks conducted by one or more independent teams occurring at multiple locations sequentially or in close succession using multiple attackers and employing one or more weapon systems.

• Hidden from observation. Anything that prevents direct observation from the threat.
• Consensus Standard. A standard that has been adop­ted and promulgated by a nationally recognized and accredited standards-producing organization under procedures whereby it can be determined that persons interested and affected by the scope or provisions of the standard have reached substantial agreement on its adoption, it was formulated in a manner that afforded an opportunity for diverse views to be considered, and it has been designated as such.
• Contact Team/Law Enforcement Entry Team. A team of law enforcement officers tasked with locating the suspect (s) and stopping the threat.
• A law enforcement term that connotes the establishment of a perimeter to control and isolate move­ment.

3.3.22* Control Zones. The areas at ASHE incidents within an established perimeter that are designated based upon safety and the degree of hazard.

3.3.23 Coordination. The process of bringing individuals, stakeholders, and resources from different organizations together to work integrally and harmoniously in a common action or effort.

• Anything capable of physically protecting an individual from the threat (s), such as ballistic rounds and shrapnel.
• Emergency Operations Center (EOC). The physical or virtual location where the coordination of information and resources to support incident management (on-scene opera­tions) activities.
• The process of assessing or judging the effec­tiveness or need of an action or course of action within the training and capabilities of the emergency responder.
• Extraction Team/Litter Bearers. Personnel used to move the injured/uninjured to an area of safety.
• Family Assistance Center. See 3.3.35, Incident Assis­tance Center (IAC).
• Force Protection. Law enforcement or armed security, as authorized by the AHJ, providing armed protection of other responders to achieve tactical objectives.

3.3.30* Functional Task Force (FTF). Separate from a rescue task force, this is any combination of resources, requiring force protection, assembled to meet a specific tactical need. An FTF can have objectives such as information gathering, breaching, utility control, managing building systems, fire control, and additional tasks as needed.

3.3.31 Fusion Center. A focal point within the state, region, and/or major urban area for the receipt, analysis, gathering, and sharing of threat-related information between the federal government and state, local, tribal, territorial, and private sector partners.

3.3.32* Hazardous Device. An object or tool incorporating destructive, lethal, noxious, energetic, or incendiary materials and designed to destroy, incapacitate, harass, or distract.

• Health Care Receiving Facilities. Locations that are in their normal course of business expected to receive ambulance and emergency patients.
• A building or portion thereof used on a 24-hour basis for the medical, psychiatric, obstetrical, or surgi­cal care of four or more inpatients. \101, 20181

3.3.35* Incident Assistance Center (IAC). A physical or virtual center where victims, family members, and loved ones can seek referrals and services for mental health counseling, health care, and child care; legal, travel, creditor, employee, and financial planning assistance; information on insurance benefits, IRS and tax policies, social security and disability; and other victim services established after the immediate recovery operations have taken place. The IAC is typically established following the closure of the notification center.

• Incident Command Post. A stationary work location used by the incident commander or a unified command for the purpose of command and control.
• Incident Command System (ICS). A specific compo­nent of an incident management system (IMS) designed to enable effective and efficient on-scene incident management by integrating organizational functions, tactical operations, incident planning, incident logistics, and administrative tasks within a common organizational structure.
• Incident Commander (IC). The individual, regardless of rank, responsible for all incident activities, including the development of strategies and tactics and the ordering and the release of resources.
• Incident Management System (IMS). A process that defines the roles and responsibilities to be assumed by person­nel and the operating procedures to be used in the manage­ment and direction of emergency operations to include the incident command system (ICS), unified command, multi- agency coordination system, training, and management of resources.

3.3.40* Individual First Aid Kit (IFAK). A component of the responder’s personal protective equipment (PPE).

• Joint Information Center (JIC). A location used to coordinate critical emergency information, crisis communica­tions, and public affairs functions. This is also the central loca­tion that facilitates operation of the joint information system (JIS).
• Joint Information System (JIS). The mechanism to organize, integrate, and coordinate information to ensure timely, accurate, accessible, and consistent messaging across multiple jurisdictions or disciplines, including private sector and nongovernment organizations.

3.3.43* Loading Zone. One or more geographic locations where transport vehicles are available to load victims.

3.3.44 Logistics. Coordination of a complex operation involv­ing many people, facilities, or supplies.

3.3.45* Mutual Aid. When agencies and/or jurisdictions assist one another on request by furnishing personnel, equipment, and/or expertise in a specified manner. This is frequently based on previously agreed upon plans, memorandums of understanding, contracts, or agreements.

National Incident Management System

comprehensive, national approach to incident management that is applicable at all jurisdictional levels and across func­tional disciplines. It is intended to be applicable across a full spectrum of potential incidents, hazards, and impacts, regard­less of size, location, or complexity; improve coordination and cooperation between public and private entities in a variety of incident management activities; and provide a common stand­ard for overall incident management.

3.3.47* Notification Center. A secure facility in a centralized location that provides information about injured, missing, unaccounted for, or deceased persons and initial services for victims, family members, and designated points of contact. The notification center also helps displaced survivors, including children, to re-establish contact or be reunited with their family and friends after a period of separation. The notification center is not intended for the general public, media, or unaffi­liated individuals.

• A victim receiving medical evaluation and treatment, which can include physical and mental health serv­ices.
• Personal Protective Equipment (PPE). Equipment designed and approved to be worn for identified risk(s) to minimize exposure to hazards that cause injuries and illnesses. PPE includes BPE.
• Typically any diagram or list of steps with details of timing and resources, used to achieve an objective to do something. It is commonly understood as a temporal set of intended actions through to achieve a goal.
• Emergency Action Plan (EAP). A document to facili­tate and organize employer and employee actions during workplace emergencies.
• Emergency Operations Plan (EOP). A document that assigns responsibility to organizations and individuals, sets forth lines of authority and organizational relationships, describes how people and property are protected, identifies personnel, equipment, facilities, supplies, and other resour­ces, and reconciles requirements with other jurisdictions. An EOP includes prevention, preparedness, response, miti­gation, and recovery functions.
• Incident Action Plan (LAP). A verbal plan, written plan, or combination of both that is updated throughout the incident and reflects the overall incident strategy, tactics, risk management, and member safety requirements approved by the incident commander. [1600, 20191
• Premises Security System. A system or portion of a combination system that consists of components and circuits arranged to monitor or control activity at or access to a protec­ted premises. [731, 20171

3.3.52* Public Access Trauma Kits. These kits are readily available to the public. They are designed to give the public access to medical supplies that can be used to address preventa­ble causes of death due to trauma.

• Public Information Officer (PIO). An individual (s) who gathers, verifies, coordinates, and disseminates public information and enables effective communications with various target audiences. The PIO coordinates closely with unified command and the JIC throughout the incident.
• Continuity of services and support to restore the equilibrium and meet the needs of the whole community, affected businesses, and direct or proximate victims who have been physically, psychologically, or otherwise affected in the short- or long-term following the incident.
• Recovery Coordinator. A person designated for incor­porating recovery and mitigation considerations into the early decision-making processes. The recovery coordinator monitors the impacts and results of such decisions and evaluates the need for additional assistance and resources to enhance resil­iency.
• Risk Assessment. The process of identifying threats and hazards to life, property, operations, the environment, and entities, and the analysis of probabilities, vulnerabilities, and

impacts. [1600, 2019|

• A sequence or synopsis of actual or imagined events used in the field or classroom to provide information necessary to meet student competencies; can be based upon threat assessment.

3.3.58* Secured. A location that is determined to have no continuing threat and is controlled by law enforcement.

3.3.59 Specialized Teams. A law enforcement unit or team responsible for specialized tactics at high-risk incidents; also known as law enforcement special response team (SRT) or special weapons and tactics (SWAT).

3.3.60* Threat-Based Care. Medical care provided as deter­mined by the hazard or risk present.

• Treatment Area. Location for the treatment of victims after extraction and sorting, prior to loading for transport to definitive care.
• A continuous process of determining the prior­ity of casualty based upon the severity of their condition and resources available.
• Unified Command. An application of the ICS that allows all stakeholders with responsibility for an incident or planned event, either geographical or functional, to manage an incident or planned event by establishing a common set of inci­dent objectives and strategies. Depending on the needs of an ASHE incident, this consists of law enforcement, fire, EMS, a location representative, or others as dictated by the AHJ and needs of the incident.

3.3.64* Unified Command Post. The physical location where the primary tactical level, on-scene unified incident command functions are performed.

3.3.65* Victim. Person(s), including responders, who are directly or proximately harmed by the incident as the result of a criminal offense.

3.3.66* Vicdm Advocate. Professionals trained to directly assist victims and families with resources, information, emotional support, and other services.

3.3.67* Vicdm Navigator. Serves as the point of contact for victims and families impacted by ASHE incidents.

• Warm Zone Response Models. The models in3.68.1 through 3.3.68.4 represent four warm zone operational tactics that can be employed by an AHJ for the purposes of integrated medical response to ASHE incidents.

3.3.68.1* Rescue Task Force (RTF). A team of law enforce­ment or armed security, as authorized by the AHJ, and any combination of fire and EMS personnel that provides threat-based care and victim extraction. This group moves within the warm zone.

• Protected Island Operations. A warm zone response concept in which law enforcement or armed security, as authorized by the AHJ, forms a secure perimeter around fire and EMS responders in order for them to provide threat-based care until extraction and egress is available.
• Protected Corridor Operations. A warm zone response concept in which law enforcement or armed secur­ity, as authorized by the AHJ, forms a secure path through which fire and EMS responders provide threat-based care and extract victims.
• Law Enforcement/Armed Security Rescue. A warm zone response modality in which law enforcement officers or private security, if authorized by the AHJ, form teams for the purpose of threat-based care and extraction of victims.
• A person who has information or evidence regarding an event or incident.

3.3.70 Witness Interview/Debrief Area. A location where individuals with knowledge of or involvement in the incident assemble for interviews.

3.3.71* Zones. Dynamic locations during an incident.

3.3.71.1* Hot Zone. An area where there is a known hazard or direct and immediate life threat.

3.3.71.2* Warm Zone. An area where there is the potential for a hazard or an indirect threat to life.

3.3.71.3* Cold Zone. Areas where there is little or no threat due to geographic distance from the threat or the area has been secured by law enforcement.