The National Fire Protection Agency’s newly-released active shooter guidance gives 21 characteristics of facilities that officials should include in any building risk assessment checklist.
The NFPA guidance, titled Standard for an Active Shooter//Hostile Event Response (ASHER) Program, includes details on many aspects of the process of preparing for and responding to active attacker situations.
One of the first chapters of the 48-page guidance discusses facility risk assessments, which the NFPA says should involve identifying areas where an active shooter could cause damage, disruptions, injuries or death.
The guidance states that building risk assessments should include consideration of the probability of attack and the consequences of such an attack at each location. Facilities should then be ranked based on those factors.
[promo_content slug=”nfpa-john-montes”]
According to the NFPA, the following information shall be considered for each at-risk building and made available to the authority having jurisdiction:
- Occupant/attendee preparedness measures
- Building owner or owner representative
- Name of area
- Number of occupants/attendees at maximum capacity
- Age groups of occupants/attendees
- Security capabilities of venue (ie. details on cameras or other security systems)
- Ingress points
- Egress points
- Area accessibility
- Access control measures
- Details on facility/area use
- Alarm systems
- Existence of fire protection systems
- Building construction type (including materials used, design)
- Availability of building map and/or site plan
- Known intelligence on building/area
- Distance to and capabilities of medical facilities
- Relevant nearby structures
- Seasonal weather conditions
- Emergency responder accessibility
- Other relevant information
Other Factors for Building Risk Assessment Checklists
The NFPA’s guidance also encourages officials to consider factors such as population demographics, critical infrastructure, transportation, environmental conditions and positions that would provide a tactical advantage to an attacker or responder.
NFPA 3000 also states that officials should identify “at-risk locations that are considered targets, have large numbers of people, are of national significance, are of public significance, or have been the target of threats as gathered by intelligence groups…”
The Department of Homeland Security’s website ready.gov breaks risk assessments down into three parts: Assessing potential hazards, considering which assets are at risk due to those hazards then conducting an impact analysis. That process is pictured on their website and included below:

Source: ready.gov/risk-assessment
John Montes, an NFPA emergency services specialist who helped write NFPA 3000 and who will be presenting on NFPA 3000 at Campus Safety Conference East in Virginia this summer, says officials can always improve their building risk assessments by bringing in area first responders.
“Include your response community as part of the risk assessment,” Montes says. “Bring in the experts that have that tactical knowledge. They can tell you where your vulnerabilities are because they have that mindset.”
Montes also encourages officials to include the local fire marshal and other code enforcement officials in the building risk assessment because they can identify potential problems with the construction and design of the building.
“The worst thing you can do is make a plan without including these people and then have something go wrong and second-guess yourself,” Montes says.