School Threat Assessment and Management: Best Practices, Legal Issues, and Implementation

Effective school threat assessment requires more than policies, training certificates, and designated teams. It requires trained personnel, sound professional judgment, multidisciplinary coordination, appropriate interventions, and consistent implementation in everyday school operations.

On this page

1. What is threat assessment?
2. Threat assessment teams
3. The CSTAG model
4. Practical principles
5. Digital threat assessment
6. Swatting threats
7. Online radicalization
8. Rumors and communications
9. State mandates
10. Legal liability and litigation
11. Implementation fidelity
12. Questions for school leaders
13. FAQ
14. Resources
15. Consulting support

School threats can emerge in classrooms, hallways, athletic activities, school buses, social media, text messages, online gaming communities, and interactions outside of school. Some involve impulsive statements, inappropriate jokes, or rumors. Others involve serious grievances, escalating concerning behaviors, threats of violence, or evidence of planning and preparation.

For school administrators, the challenge is determining which behaviors warrant concern, how to assess the seriousness of potential threats, who should be involved, and what interventions or protective actions are appropriate.

A well-designed school behavioral threat assessment and management (BTAM) process provides a structured, multidisciplinary approach for identifying, investigating, evaluating, and managing potential threats to students, staff, and school communities.

At National School Safety and Security Services, we emphasize that threat assessment is an ongoing school safety leadership responsibility, not simply a form to complete after receiving a threatening statement.

What Is School Behavioral Threat Assessment and Management?

School behavioral threat assessment and management is a systematic process used by trained school-based teams to evaluate threatening or concerning behaviors, assess their seriousness, and develop appropriate intervention and safety management strategies.

Effective threat assessment focuses on observable behaviors, circumstances, motivation, intent, capability, and potential movement toward violence rather than relying on profiles, stereotypes, or assumptions about students.

Threat assessment is not intended to predict future violence with certainty. Human behavior is complex, particularly among children and adolescents. The objective is to identify concerning circumstances, gather relevant information, make informed judgments, and implement reasonable actions to reduce the potential for harm.

An effective process also recognizes that students experiencing personal crises, behavioral challenges, emotional distress, or conflicts may need assistance rather than automatically being treated as dangerous.

Threat assessment and threat management are related but distinct responsibilities. Assessment involves evaluating the behavior, circumstances, and seriousness of a potential threat. Management involves implementing, coordinating, monitoring, and adjusting interventions and protective measures. Both are essential.

School Threat Assessment Teams: A Multidisciplinary Approach

Effective school threat assessment is a team responsibility. No single administrator, school psychologist, counselor, school resource officer, or security professional should be expected to independently possess every piece of information or all the professional expertise needed to evaluate potentially dangerous behavior.

A multidisciplinary school threat assessment team commonly includes:

• School administrators with appropriate decision-making authority.
• School psychologists, counselors, social workers, or other qualified mental health professionals.
• School resource officers or law enforcement representatives, as appropriate.
• Special education personnel when relevant to the circumstances.
• Other school employees with direct knowledge of a student, behavior, or concerning situation.

Team composition, responsibilities, reporting procedures, and decision-making authority should be clearly established before an incident occurs.

School districts must also determine how building-level teams coordinate with district administrators, law enforcement agencies, mental health providers, and other community resources.

Information sharing is especially important. Teachers, bus drivers, coaches, secretaries, paraprofessionals, and other support staff may observe concerning behavior or receive information not immediately known to administrators.

School leaders should also establish procedures to ensure that relevant threat assessment information follows students as they progress through grade levels and transition between schools within a district. For example, a middle school principal should have appropriate access to information indicating that a student underwent three serious threat assessments during elementary school, particularly if new concerning behaviors emerge. Effective information sharing and continuity of threat assessment records, consistent with applicable privacy laws, can help school leaders recognize patterns of behavior, make more informed decisions, and provide appropriate interventions and ongoing monitoring.

The challenge is often not a complete absence of warning information. It is that different people possess different pieces of information that are never brought together for meaningful consideration.

Schools need clear procedures for recognizing, reporting, evaluating, documenting, and following up on threatening or concerning behaviors.

Dewey Cornell’s CSTAG Model: Our Recommended Evidence-Based Approach

One of the most extensively researched school threat assessment approaches is the Comprehensive School Threat Assessment Guidelines (CSTAG) model developed by Dr. Dewey Cornell and colleagues at the University of Virginia.

CSTAG provides a structured, practical framework for multidisciplinary school teams to evaluate student threats of violence and determine appropriate responses. Its emphasis is on problem-solving, early intervention, student support, and proportionate responses rather than automatically relying on exclusionary discipline or zero-tolerance practices.

Why We Support and Recommend CSTAG

Based on the extensive research, field testing, controlled studies, and evaluations supporting CSTAG, National School Safety and Security Services supports and recommends Dr. Dewey Cornell’s Comprehensive School Threat Assessment Guidelines model as an evidence-based approach to school behavioral threat assessment.

Our recommendation is grounded in the model’s substantial research foundation, structured decision-making procedures, multidisciplinary approach, and emphasis on addressing potential threats while avoiding unnecessarily punitive responses to student behavior.

Cornell and his colleagues have published an extensive body of peer-reviewed research examining the CSTAG model and its predecessor, the Virginia Student Threat Assessment Guidelines (VSTAG).

The research includes field studies, controlled evaluations, and investigations of school practices and student outcomes. Studies have examined disciplinary responses, exclusionary practices, student support, school climate, and consistency in threat assessment decision-making.

These findings support the value of structured procedures that distinguish threats by seriousness and match interventions to individual circumstances.

We consider this research foundation particularly important when school leaders evaluate competing threat assessment approaches, training programs, or commercially marketed systems.

Other school behavioral threat assessment models and frameworks exist, and school districts may reasonably select different approaches based on their needs, resources, and professional judgments. In some states, laws, regulations, or state education agency requirements may prescribe particular frameworks, procedures, or training expectations, limiting local discretion.

Where school districts have discretion, we recommend that they give strong consideration to CSTAG because of its extensive research and evaluation history.

Where a different model is required by law or selected by a district, the essential responsibility remains the same: establish a sound, appropriately supported process and ensure that trained personnel implement it consistently and effectively.

Our endorsement of CSTAG reflects our independent professional assessment of its research and practical value. It does not imply organizational affiliation, sponsorship, or a formal relationship with the model’s developers or training providers.

Understanding Transient and Substantive Threats

A central feature of CSTAG is its distinction between transient threats and substantive threats.

Transient threats are statements or behaviors that do not reflect serious intent to harm. Examples may include impulsive remarks, expressions of frustration, misunderstandings, or inappropriate jokes. These situations still warrant appropriate examination, but many can be resolved through clarification, conflict resolution, counseling, or other supportive interventions.

Substantive threats involve circumstances indicating serious intent to harm or situations that cannot reasonably be resolved as transient. These require more extensive assessment and appropriate protective actions.

CSTAG further distinguishes serious substantive threats from very serious substantive threats, including threats involving killing, sexual violence, or severe injury with a weapon.

This structured distinction helps schools avoid two problematic extremes: dismissing potentially dangerous behaviors without sufficient evaluation or responding to every inappropriate statement with unnecessarily severe disciplinary or law enforcement action.

CSTAG uses a structured decision-making process to guide school teams in gathering information, assessing seriousness, developing interventions, and taking appropriate protective actions.

The model also recognizes that assessment should be accompanied by problem-solving and efforts to address underlying circumstances that contribute to threatening behavior.

CSTAG Is Evidence-Based, but Implementation Still Matters

Our support for CSTAG does not mean that adopting the model automatically produces effective threat assessment practices. Schools must provide appropriate training, engage the necessary multidisciplinary professionals, follow the framework as intended, document decisions, and ensure that interventions are actually implemented.

Research supporting a model establishes an important foundation. It does not guarantee effective implementation in every school. This distinction becomes especially important when evaluating whether a district’s threat assessment program is functioning in practice rather than simply existing on paper.

Additional information is available through Dewey Cornell’s CSTAG Research and Publications and the CSTAG Manual.

Practical School Threat Assessment and Management Principles

Although school districts may use different recognized models or state-required frameworks, several common principles should guide school-based threat assessment practices.

1. Take Reports Seriously and Investigate Promptly

School personnel should promptly report threatening statements, concerning behavioral changes, violent communications, and other indicators of potential harm through established reporting channels.

Taking reports seriously does not mean treating every report as equally dangerous. It means evaluating concerns through a consistent, defensible process.

When evidence indicates an immediate or imminent danger, schools should initiate appropriate emergency and protective actions without delaying those measures to complete a formal threat assessment.

2. Evaluate Behavior, Context, Motivation, and Capability

Threat assessment teams should examine the circumstances surrounding concerning behavior, including the person’s grievances, intentions, capability, access to weapons, evidence of preparation, and other relevant information.

Important considerations include:

• What was communicated or observed, and in what context?
• Is there evidence of intent to harm an identifiable person or group?
• Has the individual demonstrated planning, preparation, or access to the means of carrying out a threat?
• Are there escalating grievances, conflicts, or behavioral concerns?
• What information can be obtained from school personnel, witnesses, family members, or other appropriate sources?
• What protective factors, support systems, and interventions may help reduce the concern?

No single factor should replace a comprehensive evaluation of the circumstances.

3. Coordinate Information Across School Personnel and Community Partners

School threat assessment cannot operate effectively within administrative or professional silos.

Schools should establish procedures for involving appropriate personnel, consulting law enforcement when warranted, and coordinating with qualified mental health and community resources.

Information sharing should comply with applicable legal requirements while supporting appropriate safety decisions.

4. Develop and Monitor Threat Management Plans

Completing an initial assessment does not necessarily resolve a potential threat.

Depending on the circumstances, threat management may require counseling, behavioral interventions, supervision adjustments, parent engagement, safety planning, law enforcement coordination, or additional protective measures.

Teams should identify who is responsible for implementing each intervention, establish appropriate follow-up procedures, and reassess situations when new information or behavioral changes warrant further action.

5. Document Decisions and Verify Follow-Through

Threat assessment documentation should reflect the information considered, team participation, conclusions reached, rationale for decisions, interventions selected, and follow-up actions.

Documentation should be accurate, objective, appropriately secured, and consistent with applicable legal requirements. A completed form does not establish that an appropriate assessment occurred or that a threat management plan was implemented.

The quality of decision-making, communication, and follow-through matters.

Digital Threat Assessment in Schools: Social Media, Online Threats, and Electronic Communications

Today’s school threats may originate or spread through social media, group messaging applications, online gaming communities, discussion forums, anonymous accounts, and other digital communications.

A threatening statement made online can reach hundreds or thousands of students and parents within minutes. Screenshots may circulate without context, anonymous accounts can complicate investigations, and rumors may escalate before administrators have sufficient information to determine what actually occurred.

Digital communications also may provide important information about an individual’s grievances, behavior, intentions, and potential preparation for violence.

Digital threat assessment may be an integral part of a school’s behavioral threat assessment and management process, not a disconnected activity assigned exclusively to technology personnel or law enforcement.

What Is Digital Threat Assessment?

Digital threat assessment in schools refers to the systematic evaluation of threatening or concerning behaviors and communications involving online platforms, electronic messaging, and other digital environments. It involves gathering and evaluating relevant information, determining its meaning and credibility, identifying potential safety concerns, and developing appropriate interventions and protective measures.

The fundamental principles of behavioral threat assessment remain the same whether concerning behavior occurs in person or online. A digital communication should be examined within the broader circumstances surrounding the individual, including relevant behavior, motivation, potential targets, capability, and evidence of planning or preparation.

Digital threat assessment is not synonymous with widespread surveillance of students or automated monitoring of every online interaction.

Why Digital Threat Assessment Presents Unique Challenges

Digital environments create several difficulties for school administrators and multidisciplinary threat assessment teams:

• Anonymity and false identities. Threats may originate from anonymous accounts, impersonated profiles, or individuals outside the school community.
• Incomplete or misleading information. Screenshots may omit earlier messages, dates, context, or subsequent communications.
• Rapid amplification. Students and parents may forward threats, rumors, or misleading information before investigators can establish their credibility.
• Cross-platform communication. Relevant information may be scattered across messaging applications, gaming platforms, social media accounts, and private group discussions.
• Difficulty determining intent. Threatening language, violent imagery, humor, role-playing, and genuine expressions of intent may be difficult to distinguish without additional investigation.
• Artificial intelligence and manipulated content. AI-generated text, fabricated screenshots, synthetic audio, or altered images may complicate the authentication of digital evidence.
• Privacy and legal limitations. Schools must recognize the boundaries of their authority to access, monitor, preserve, and share digital information.

Digital evidence may be an important component of an assessment, but its reliability, origin, context, and relevance must be carefully considered.

Practical Steps for School Leaders

School districts should establish procedures that enable threat assessment teams to:

1. Receive and evaluate digital threat reports. Students, parents, teachers, and support staff should know how to report threatening communications, including screenshots, links, and other relevant information.
2. Preserve information appropriately. School personnel should know how to document what was observed, retain relevant information, and coordinate with law enforcement when specialized digital investigation or evidence preservation may be necessary.
3. Distinguish verified information from rumors. A forwarded screenshot, anonymous message, or viral social media post should not automatically be accepted as authentic or accurately interpreted.
4. Assess digital behavior within a broader context. Teams should consider available information about the individual’s behavior, grievances, relationships, intentions, and potential movement toward violence.
5. Coordinate with appropriate professionals. Administrators, student services personnel, school resource officers, technology staff, and external law enforcement may have different but complementary responsibilities.
6. Determine appropriate interventions and protective measures. Decisions should be based on the available evidence, seriousness of the concern, and professional judgment rather than online attention or public pressure alone.
7. Communicate accurately and promptly. Schools should address relevant safety concerns and misinformation without unnecessarily disclosing confidential information or compromising investigations.

Specialized Digital Threat Assessment Training for School Teams

School threat assessment teams may wish to pursue specialized digital threat assessment training from qualified external providers, particularly in identifying and evaluating concerning online behavior, verifying digital information, preserving electronic evidence, understanding social media platforms, and recognizing the legal and privacy limitations of online investigations.

This specialized training can complement a school’s established behavioral threat assessment framework, including CSTAG. School leaders should evaluate potential training providers for professional qualifications, instructional quality, legal safeguards, and practical application to K–12 settings.

Digital Monitoring Technology: Effectiveness, Privacy, and Accountability

Commercial digital monitoring platforms may advertise capabilities to identify threatening language, violent content, self-harm references, or other concerning communications.

Although some technologies may help schools identify and organize information, their effectiveness should not be assumed simply because a product uses artificial intelligence, automated alerts, or sophisticated marketing claims.

School leaders should examine whether such systems produce meaningful, actionable information and whether staff have sufficient capacity to investigate alerts in a timely manner.

Important questions include:

• What information does the system actually monitor, and what is outside its capabilities?
• What independent evidence demonstrates its accuracy and effectiveness in school environments?
• How frequently does it generate false alarms or miss meaningful concerns?
• Who reviews alerts, including after school hours, during weekends, and over school breaks?
• How is relevant information transferred to the multidisciplinary threat assessment team?
• How are student privacy, data security, record retention, vendor access, and legal compliance addressed?
• What occurs when an alert is received but no one takes appropriate action?

Technology can assist in detecting and communicating concerns. It does not replace professional assessment, decision-making, intervention, and accountability.

Schools should be cautious about purchasing systems that generate large quantities of alerts without demonstrating how those alerts translate into better decisions and effective follow-through.

The real test is not whether a monitoring system identifies keywords or produces notifications. It is whether school personnel recognize meaningful concerns and respond appropriately.

School leaders should also recognize the growing scrutiny and pushback surrounding digital student monitoring and surveillance technologies. Increased investigative media coverage, legal challenges, academic research, and advocacy by student privacy and civil liberties organizations have raised concerns about intrusive monitoring, student data collection and retention, algorithmic bias, false alarms, and the potential infringement of student privacy and constitutional rights. Some technologies have become the subject of litigation, public records requests, and organized opposition from students, parents, and privacy advocates.

These concerns should not automatically disqualify digital monitoring tools from consideration, but they warrant careful examination before purchasing or implementing such systems. School boards and administrators should demand independent evidence of effectiveness, transparency regarding what is monitored and how information is used or shared, meaningful safeguards against misuse, and clear accountability for vendor and school personnel actions.

School boards should establish policies regarding these issues consistent with local, state, and federal laws, and approved by their legal counsel, should they pursue these areas.

The question is not simply whether technology can monitor student activity, but whether its demonstrated safety benefits justify the financial, operational, legal, privacy, and community trust implications of its use.

School Swatting Threats: Assessing Credibility and Managing the Response

School swatting presents a particularly challenging form of school threat assessment and emergency response. Swatting involves intentionally reporting a fabricated emergency, such as an active shooter, bomb threat, or other violent incident, to trigger a significant law enforcement response. These reports may originate through anonymous calls, spoofed telephone numbers, digital communications, or other technologies.

Even when a threat proves to be a hoax, the consequences can be very real. Armed police responses, lockdowns, evacuations, frightened students and staff, anxious parents, and rapidly spreading misinformation can create substantial safety and operational challenges.

School leaders must avoid two dangerous extremes: dismissing potentially serious threats as hoaxes and automatically implementing unnecessarily disruptive responses to every unverified threat.

Our guiding principle remains: Assess and then react. Don’t react and then assess. This does not mean delaying immediate protective measures when danger may be imminent. It means preparing school leaders to make informed, timely, and proportionate decisions under uncertainty.

Effective swatting preparedness rests on three essential elements:

1. Threat assessment teams, protocols, and training to evaluate threatening information and coordinate with law enforcement.
2. Reasonable protective security measures that can be implemented while an investigation is ongoing.
3. Crisis communications strategies to address rumors, misinformation, and understandable community anxiety.

Anonymous swatting incidents may require specialized law enforcement investigations beyond the scope of a school’s behavioral threat assessment team. Nevertheless, established threat assessment processes, emergency preparedness procedures, and effective communications are essential to a coordinated response.

For detailed recommendations, federal resources, legal considerations, and practical steps for school administrators, see our comprehensive guide: School Swatting Threats: Assess First, Respond Strategically.

Online Radicalization, Violent Extremism, and School Threat Assessment

An evolving concern for school safety leaders involves the potential influence of online radicalization, violent extremist content, and digital communities that encourage or glorify violence.

Students may encounter these influences through social media, online discussion forums, messaging applications, gaming communities, video-sharing platforms, and other digital environments.

Some online communities promote ideological violence, hatred toward particular groups, conspiracy-driven grievances, or admiration for individuals who have committed mass violence. Others may encourage violent behavior without a coherent political, religious, or ideological framework.

School administrators and multidisciplinary threat assessment teams should understand these developments without assuming that exposure to disturbing online material or unconventional beliefs automatically indicates that an individual poses a threat.

What Is Online Radicalization?

Online radicalization generally refers to a process through which individuals encounter, adopt, or increasingly identify with extremist beliefs or narratives through digital environments.

For school safety purposes, the primary concern is not the mere expression of controversial, unpopular, or extreme ideas. It is the potential progression toward endorsing, threatening, preparing for, or carrying out violence.

Radicalization does not follow one predictable pathway. Individuals may be influenced by a combination of personal grievances, social relationships, emotional circumstances, online interactions, and experiences outside the digital environment.

Research from the National Institute of Justice emphasizes that the relationship between online activity and radicalization is complex. The internet may contribute to radicalization, reinforce existing beliefs, or facilitate connections with others, but online exposure alone does not establish an intent to engage in violence.

Schools must distinguish between protected beliefs and expression, offensive or inappropriate behavior, and observable conduct indicating a potential threat of violence.

This distinction is essential to responsible threat assessment and the protection of students’ legal rights.

How Online Environments May Influence Concerning Behavior

Digital platforms can expose students to harmful narratives and communities that reinforce grievances, normalize violence, or encourage identification with violent actors.

Potential concerns may involve:

• Online communities that promote or celebrate targeted violence.
• Repeated expressions of admiration for school attackers or individuals responsible for mass violence.
• Escalating threats against identifiable individuals or groups.
• Online discussions suggesting plans, preparation, or intentions to commit violence.
• Attempts by others to encourage, recruit, manipulate, or pressure young people into violent behavior.
• Communications indicating that personal grievances are increasingly being connected to violent solutions.
• Digital activity that, when considered with other information, suggests movement from fascination or rhetoric toward preparation or action.

These circumstances require careful interpretation.

Exposure to hateful material, interest in controversial issues, participation in gaming communities, or even disturbing online statements does not independently establish that a student is dangerous.

Similarly, mental health challenges, social isolation, disability status, religious beliefs, political views, or cultural identity should not be treated as substitutes for evidence of threatening behavior.

The relevant concern is the individual’s behavior, context, capability, intent, and any observable movement toward violence.

Schools should distinguish situations that warrant education, counseling, family engagement, student support, or behavioral intervention from circumstances involving threats, evidence of preparation, or other serious safety concerns.

Specialized expertise or consultation with appropriate law enforcement and behavioral health professionals may be necessary in complex cases.

Threat assessment should focus on concerning behavior and potential violence, not serve as a mechanism for policing students’ personal beliefs or lawful expression.

Practical Steps for School Leaders

School districts should consider incorporating online radicalization awareness into existing school safety, behavioral threat assessment, digital citizenship, and student support efforts.

Practical actions include:

1. Educate key personnel. Administrators, counselors, school psychologists, school resource officers, and other relevant employees should understand how concerning online influences may intersect with student behavior and threats of violence.
2. Encourage early reporting. Students and families should know how to report online threats, attempts to encourage violence, or other serious concerns without fear that every report will automatically trigger punitive discipline.
3. Focus on behavioral evidence. Threat assessment teams should evaluate specific conduct, communications, circumstances, and potential movement toward violence rather than relying on ideological labels or stereotypes.
4. Strengthen student connections and support. Positive relationships with trusted adults, appropriate counseling, constructive peer relationships, and family engagement can provide opportunities to recognize concerns and intervene early.
5. Coordinate with qualified partners. School personnel may need assistance from law enforcement, behavioral health, or other specialists when concerns extend beyond their expertise.
6. Maintain appropriate follow-through. When an assessment identifies concerning behaviors or safety needs, teams should develop, implement, and monitor individualized intervention and management plans.
7. Protect student rights. Policies and practices must respect applicable constitutional, privacy, civil rights, disability, and education laws.

School leaders should also recognize that online communities and digital platforms change rapidly. Staff awareness and professional training should evolve accordingly.

A Leadership Challenge, Not Just a Technology Problem

Online radicalization presents challenges that cannot be resolved simply through internet filtering, keyword searches, or commercial monitoring software.

The school safety concern is not merely what content a student has viewed. It is whether available information indicates concerning behavior, escalating grievances, threats, or movement toward violence.

Multidisciplinary threat assessment teams should be prepared to recognize such circumstances, gather relevant information, consult appropriate professionals, and develop proportionate responses.

As with other school safety concerns, the effectiveness of the process depends on professional judgment, coordinated intervention, and fidelity of implementation, not merely the existence of policies or technological tools.

School Threats, Rumors, and Crisis Communications

School violence threats and rumors can circulate rapidly through social media, group texts, messaging applications, and student conversations.

A vague online statement may generate widespread anxiety before school officials can determine its origin or credibility. Screenshots may circulate without context, older threats can be reposted as current incidents, and rumors involving other communities may be mistakenly attributed to a local school district.

School leaders must balance prompt protective action with careful evaluation of available information.

The goal is to make informed, proportionate decisions rather than allowing rumors, social media pressure, or fear to dictate operational responses.

Not every rumor requires a school closure or major security response. Conversely, a threat should not be dismissed simply because it originated online, appeared vague, or was described as a joke.

Assess and Then React. Don’t React and Then Assess.

One of our longstanding messages to school administrators is the importance of making cognitive, analytical decisions rather than reacting emotionally to threatening situations.

Our guiding principle has been: Assess and then react. Don’t react and then assess.

This principle does not mean delaying necessary protective actions when an immediate danger exists. It means establishing procedures that help administrators make informed, timely decisions rather than responding reflexively to rumors, public pressure, or incomplete information.

Schools should have procedures for evaluating threats while investigations are ongoing and for implementing appropriate protective measures when warranted.

Threat assessment and emergency response procedures must work together, not operate as competing processes.

Communicating with Parents and Staff About School Threats

School leaders should establish crisis communication procedures before confronting a threatening incident or rapidly spreading rumor.

Our longstanding guidance emphasizes three essential principles:

• Authentic and Transparent. Provide information that is verified to the extent reasonably possible. Avoid speculation or premature assurances.
• Timely. Communicate promptly when circumstances warrant and provide appropriate updates as new information becomes available.
• Redundant. Use multiple communication channels to reach families, employees, and other affected stakeholders.

Administrators should coordinate communications with law enforcement and responding agencies when appropriate, protect confidential student information, and explain the general steps being taken without compromising investigations or protective measures.

School leaders should also avoid promising that a school is completely safe or that no danger exists when uncertainty remains.

Threat assessment and crisis communications should be practiced together through realistic discussion-based exercises and leadership training.

Learn more through our Strategic School Safety Communications Guide.

State-Mandated School Threat Assessment Teams: Benefits, Limitations, and Leadership Responsibilities

Many states have enacted laws or adopted policies requiring or encouraging school districts to establish behavioral threat assessment teams and related procedures. These initiatives reflect growing recognition that schools need structured, multidisciplinary approaches to identifying, evaluating, and managing potentially threatening behaviors.

However, state requirements raise an important school safety leadership question: Does mandating threat assessment programs improve school safety, or does it risk creating another compliance-driven process that looks stronger on paper than it performs in practice?

The answer depends significantly on how these requirements are designed, supported, implemented, and evaluated.

Potential Benefits of State Threat Assessment Mandates

State requirements can provide an important foundation for more consistent school threat assessment practices.

Potential benefits include:

• Establishing minimum expectations. Requiring schools to establish teams and formal procedures can help make threat assessment a recognized school safety responsibility rather than an optional activity.
• Improving consistency. State frameworks can establish common terminology, training expectations, reporting procedures, and operational guidelines across districts.
• Strengthening accountability. Requirements can encourage school boards and superintendents to assign responsibilities, document procedures, and provide oversight.
• Supporting training and resources. States may accompany mandates with technical assistance, professional training, funding, or access to qualified specialists.
• Encouraging early intervention. Formalized processes can help schools identify concerning behaviors and intervene before situations escalate.

Research suggests that state involvement can positively influence the establishment and development of threat assessment programs.

A November 2025 research report sponsored by the U.S. Secret Service’s National Threat Assessment Center and conducted by the RAND-operated Homeland Security Operational Analysis Center found that schools in states with earlier mandates or policy encouragement generally had more established implementation practices, including standardized meeting schedules and written procedures.

These findings suggest that state requirements and support can be beneficial, although they do not establish that mandates alone produce improved school safety outcomes.

Potential Limitations and Unintended Consequences

State mandates may also create challenges, particularly when lawmakers establish requirements without sufficiently considering local staffing, resources, expertise, and operational capacity.

Potential concerns include:

• Compliance replacing effectiveness. Schools may focus on establishing teams, completing training, and filing required documentation primarily to demonstrate compliance.
• Insufficient staffing and resources. Smaller, rural, or financially constrained districts may struggle to provide the expertise, training, and ongoing support necessary for effective threat assessment.
• One-size-fits-all approaches. Requirements may provide insufficient flexibility for districts with different organizational structures and community resources.
• Inconsistent implementation. Personnel may complete initial training without adequate continuing education, supervision, or opportunities to practice and improve their skills.
• Overidentification and unnecessary disciplinary consequences. Poorly designed or implemented programs may result in excessive referrals, stigmatization, or disproportionate responses to student behavior.
• Unfunded administrative responsibilities. Requirements that lack sufficient financial or technical support can place additional burdens on school administrators and student services personnel.

There is also the potential for district leaders to incorrectly assume that compliance with a state mandate provides sufficient assurance of safety or protection from legal liability. Neither assumption is necessarily justified.

A state-mandated threat assessment program that is poorly implemented can create a false sense of security among administrators, school boards, parents, and the community.

What About Schools Without State Threat Assessment Mandates?

School leaders should not interpret the absence of a state mandate as a reason to postpone developing appropriate threat assessment capabilities.

Schools do not need to wait for a state legislature to mandate sound prevention and intervention practices.

Districts without specific threat assessment team mandates should consider establishing a structured behavioral threat assessment and management process consistent with recognized professional practices, applicable law, and local needs.

At a minimum, school leaders should examine whether their districts have:

• Clear procedures for reporting and evaluating threats and concerning behaviors.
• An appropriately trained multidisciplinary team or access to qualified professionals.
• Established relationships with law enforcement and behavioral health resources.
• Procedures for documenting assessments, decisions, interventions, and follow-up.
• Training for administrators, teachers, support staff, and other personnel who may observe or receive concerning information.
• Processes for evaluating implementation and periodically reviewing team effectiveness.

School boards and superintendents should consult qualified legal counsel regarding applicable state and federal requirements, including student rights, privacy, disability protections, and other relevant obligations.

Ultimately, schools should establish effective threat assessment processes because they represent sound school safety practices, not solely because a statute requires them.

State mandates may establish a starting point. Local school leadership determines whether those expectations translate into meaningful practices.

School Threat Assessment, Legal Liability, and Lessons from Litigation

School behavioral threat assessment is not only a violence prevention responsibility. Failures in the assessment and management process can also have significant legal consequences.

Important legal disclaimer: This discussion is provided for general educational and school safety leadership purposes only. National School Safety and Security Services is not providing legal advice or legal opinions. Laws, legal duties, governmental immunity protections, and standards of liability differ among jurisdictions and depend on the facts of each situation. School boards and administrators should consult qualified legal counsel regarding applicable laws, responsibilities, policies, and potential liability.

School district leaders should recognize that legal scrutiny following a serious violent incident may examine much more than whether the district had a written threat assessment policy or designated team.

Questions may involve what school employees knew, what information was reported, how the team evaluated available information, whether relevant personnel participated, and whether appropriate preventive actions were taken.

Two examples illustrate the importance of operational practices, professional judgment, and accountability.

Cleveland v. Taft Union High School District: When a Threat Assessment Team Fails to Function

In Cleveland v. Taft Union High School District (California Court of Appeal, 2022), a student injured in a 2013 school shooting brought a negligence action arising from the district’s handling of information and its threat assessment practices.

The litigation examined deficiencies in communication, team participation, information sharing, and threat management involving the student who carried out the shooting.

Expert testimony identified multiple alleged failures, including the absence of a meaningful collective assessment process, the exclusion of the school resource officer from the core team, insufficient communication, and inadequate monitoring and reassessment.

The jury allocated 54 percent of the responsibility for the plaintiff’s injuries to district employees, resulting in a judgment of approximately $2 million against the district.

The California Court of Appeal affirmed the judgment, concluding that the particular administrative failures identified in the threat assessment process were not protected by the statutory immunity asserted by the district.

This case illustrates an important operational concern: Simply having a threat assessment team and completing an assessment does not demonstrate that the team operated effectively or fulfilled its responsibilities.

The broader leadership lesson extends beyond the specific circumstances of the California case. Schools should examine whether their multidisciplinary teams are genuinely sharing information, making informed collective decisions, implementing appropriate interventions, and following through on unresolved concerns.

Read the California Court of Appeal decision in Cleveland v. Taft Union High School District.

Colorado’s Claire Davis School Safety Act: Foreseeability, Reasonable Care, and Accountability

Following the 2013 shooting at Arapahoe High School in Colorado, which resulted in the death of student Claire Davis, Colorado enacted the Claire Davis School Safety Act in 2015.

The law recognizes a duty for school districts, charter schools, and their employees to exercise reasonable care to protect students, faculty, and staff from reasonably foreseeable harm caused by another person in covered school settings and activities.

It also establishes a limited waiver of governmental immunity for certain claims involving serious bodily injury or death resulting from school violence, subject to statutory requirements, exceptions, and limitations.

The law does not impose automatic liability whenever violence occurs at a school. Negligence must be established, and the statute expressly provides that a school cannot be found negligent under the Act solely because it did not suspend or expel a student.

Although this law is specific to Colorado, it raises broader questions for school leaders nationally about recognizing warning information, making reasonable decisions, documenting significant actions, and implementing appropriate prevention and protective measures.

The statute also underscores the importance of balancing school safety responsibilities with student rights and appropriate educational responses.

Read Colorado Revised Statutes § 24-10-106.3, the Claire Davis School Safety Act.

Legal and Governance Considerations for School Boards and Superintendents

School safety legal obligations are not uniform across the United States. Specific duties, standards of care, governmental immunity protections, student rights, and procedural requirements vary by jurisdiction and circumstances.

Nevertheless, these cases highlight several operational considerations.

School boards and superintendents should be prepared to explain how their districts identify, communicate, assess, document, and manage threats. They should also understand how administrators verify that designated threat assessment teams are functioning as intended.

Adopting a recognized threat assessment model or complying with a state mandate should not be confused with immunity from legal scrutiny. School leaders should work with qualified legal counsel to understand their responsibilities while ensuring that legal compliance is supported by sound, demonstrable school safety practices.

The Critical Challenge: Fidelity of Implementation in School Threat Assessment

Perhaps one of the most important questions facing school boards, superintendents, and school safety leaders is not whether their schools have adopted a threat assessment model.

It is whether that model is being implemented as intended, consistently and competently, in actual school operations.

This is the issue of implementation fidelity.

A school may have a board-approved threat assessment policy, a designated multidisciplinary team, annual training certificates, electronic documentation forms, and a commercially purchased threat assessment platform.

None of these, individually or collectively, guarantees that effective threat assessment and management are occurring.

What Recent National Research Tells Us

The November 2025 report, The State of Behavioral Threat Assessment and Management in K–12 Public Schools, provides particularly relevant findings.

Sponsored by the U.S. Secret Service’s National Threat Assessment Center and conducted by the RAND-operated Homeland Security Operational Analysis Center, the research examined behavioral threat assessment practices through a nationally representative survey of 1,746 school leaders.

The findings indicate that threat assessment teams or alternative teams performing similar functions have become nearly universal among American public schools.

However, important challenges remain:

• Fewer than half of schools reported providing annual training for behavioral threat assessment team members.
• Only approximately half of schools with BTAM teams reported having explicit written policies establishing and defining their programs.
• Only approximately half reported written standard operating procedures guiding team functions.
• Team structures, meeting schedules, information gathering, case reviews, interventions, and evaluation practices varied considerably.
• Some schools blended elements of recognized threat assessment models with local practices, potentially creating inconsistencies in implementation.
• Many schools lacked sufficiently systematic methods for evaluating effectiveness and improving operations.

The research also identified encouraging practices, including schools’ emphasis on individualized interventions and supportive measures rather than relying primarily on exclusionary discipline.

Because the findings are based largely on school leaders’ self-reported practices, they should not be interpreted as direct independent measurements of each school’s operational competency.

Nevertheless, the report reinforces the need to look beyond the widespread adoption of threat assessment programs and examine the quality and consistency of their implementation.

The challenge has increasingly shifted from convincing schools to adopt threat assessment programs to ensuring that those programs function as intended.

Read the 2025 U.S. Secret Service / RAND Behavioral Threat Assessment and Management Research Report.

Evaluating Actual School Threat Assessment Performance

School leaders should look beyond written policies and training records and examine how their threat assessment processes operate in practice.

Important questions include:

• Do teachers, secretaries, coaches, transportation personnel, and other support staff recognize concerning behaviors and understand how to report them?
• Are reports reaching the appropriate personnel promptly, including during staff absences and outside regular school hours?
• Are multidisciplinary teams meeting, sharing relevant information, and applying their selected framework as intended?
• Are decisions being made collectively, or is one administrator informally handling cases that warrant broader professional involvement?
• Are teams appropriately distinguishing levels of seriousness rather than assigning categories simply to complete documentation?
• Are interventions implemented as documented, and does someone verify that they occur?
• Are student reentry, supervision, safety planning, parent communication, and ongoing monitoring appropriately coordinated?
• Can teams appropriately evaluate digital threat information, including verifying online communications and recognizing when specialized investigative assistance is necessary?
• Are administrators and school boards evaluating implementation quality rather than relying primarily on the number of assessments completed or personnel trained?

These questions go to the heart of effective threat assessment.

Training is not the same as demonstrated competency. Policy adoption is not the same as implementation. Documentation is not the same as effective threat management.

Even evidence-based approaches such as CSTAG can lose effectiveness when schools modify procedures without sufficient justification, fail to engage essential team members, neglect follow-up responsibilities, or reduce the process to a paperwork exercise.

Technology may help organize information, support workflow, and facilitate documentation. However, no software platform can substitute for trained professionals, effective information sharing, sound judgment, and accountable leadership.

School districts should periodically evaluate their actual practices through structured case reviews, administrative oversight, appropriately designed tabletop exercises, and independent assessments when warranted.

The objective should be to determine not simply whether procedures exist, but whether school personnel understand and carry them out effectively when circumstances require action.

This reflects a broader principle of Strategic School Safety Leadership: School safety programs should be judged by demonstrated operational performance, not merely by written policies, purchased products, training certificates, or compliance documentation.

Practical Threat Assessment Questions for School Boards and Superintendents

School district leaders should periodically ask their administrative and threat assessment teams:

1. Are we using a clearly defined, research-supported threat assessment framework, and do team members understand how to apply it?
2. Have we evaluated the research supporting our selected model, including CSTAG, and confirmed that our practices align with applicable state requirements?
3. Are responsible personnel adequately trained, including new administrators and replacement team members?
4. Can employees at every level explain how they would report concerning student behavior or threats?
5. Do we have reliable processes for gathering and sharing relevant information across buildings, departments, and appropriate external agencies?
6. Are our teams prepared to assess digital threats and recognize potential online influences associated with concerning behavior?
7. How do we verify that safety interventions and follow-up actions are completed?
8. How do we evaluate the quality, consistency, and fidelity of our threat assessment practices?
9. Have we tested our procedures against realistic situations involving incomplete information, conflicting accounts, staff absences, digital rumors, and rapidly changing circumstances?

These questions should be part of routine school safety governance, not discussions that occur only after a tragedy or highly publicized threat.

School Threat Assessment and Management: Frequently Asked Questions

What is the purpose of school behavioral threat assessment?

The purpose is to identify, evaluate, and manage threatening or concerning behaviors through a structured process that supports violence prevention, reasonable protective measures, and appropriate student interventions. Threat assessment does not predict future violence with certainty.

What is the CSTAG threat assessment model?

The Comprehensive School Threat Assessment Guidelines model, developed by Dr. Dewey Cornell and colleagues at the University of Virginia, is an evidence-based approach that helps trained multidisciplinary school teams evaluate student threats, distinguish transient from substantive threats, and develop proportionate responses and interventions.

What school threat assessment model does National School Safety and Security Services recommend?

Based on its extensive research and evaluation history, National School Safety and Security Services supports and recommends Dewey Cornell’s CSTAG model. Other models exist, and school districts may select different approaches when permitted by applicable law. Some states establish requirements that influence or determine which frameworks and procedures schools must use. Whatever model is selected, effective training, multidisciplinary coordination, and implementation fidelity remain essential.

What is digital threat assessment in schools?

Digital threat assessment involves evaluating threatening or concerning behavior communicated or discovered through social media, messaging applications, online platforms, and other digital environments. It includes understanding context, verifying information, assessing seriousness, coordinating with appropriate professionals, and developing interventions or protective measures.

Should school threat assessment teams receive specialized digital threat assessment training?

School teams may benefit from specialized training in recognizing concerning online behaviors, verifying digital information, preserving electronic evidence, understanding social media platforms, and respecting legal and privacy limitations. Such instruction should complement established behavioral threat assessment training and be obtained from appropriately qualified providers.

How does online radicalization relate to school threat assessment?

Online radicalization may involve exposure to or engagement with extremist beliefs, violent narratives, or digital communities that encourage violence. Schools should focus on observable behaviors, threats, and potential movement toward violence rather than treating beliefs, affiliations, or exposure to content alone as evidence of dangerousness.

Are schools required by law to have threat assessment teams?

Requirements vary by state. Some states mandate multidisciplinary school threat assessment teams, training, reporting procedures, or related practices, while others encourage their use through guidance or policy. School leaders should review applicable requirements with qualified legal counsel. Regardless of whether a specific mandate exists, districts should consider establishing structured threat assessment and management processes.

Should every student threat result in suspension, expulsion, or arrest?

No. Responses should be proportionate to the circumstances and consistent with applicable law, school policy, and the district’s selected threat assessment framework. Some situations may be resolved through clarification or student support, while more serious threats may require protective measures, intensive intervention, disciplinary action, or law enforcement involvement.

Who should serve on a school threat assessment team?

Teams generally include school administrators, mental health professionals, and law enforcement representatives as appropriate, with participation from other qualified personnel based on the circumstances. Team composition and training requirements may also be governed by state law.

Can school districts be held legally responsible for failures in threat assessment?

Potentially. Legal duties, negligence standards, and immunity protections vary by jurisdiction and circumstances. Litigation such as Cleveland v. Taft Union High School District and legislation such as Colorado’s Claire Davis School Safety Act illustrate the importance of appropriate information sharing, reasonable decisions, documented actions, and effective operational practices. School districts should obtain legal advice from qualified counsel.

What is implementation fidelity in school threat assessment?

Implementation fidelity refers to how consistently and accurately school personnel follow the intended procedures and principles of their selected threat assessment model. It includes team participation, information gathering, decision-making, intervention planning, documentation, monitoring, and follow-through.

How can districts evaluate whether their threat assessment programs work?

School districts can review completed cases, examine team readiness and training, assess reporting and information-sharing practices, verify intervention follow-through, conduct realistic tabletop exercises, and evaluate whether operational practices match established procedures. Independent school safety assessments may also help identify gaps between policies and actual implementation.

Additional School Threat Assessment Resources

School leaders seeking additional information on behavioral threat assessment, digital threats, online radicalization, research-supported approaches, and implementation practices may find the following resources helpful.

CSTAG and Behavioral Threat Assessment Research

• Comprehensive School Threat Assessment Guidelines (CSTAG), Dewey Cornell and Associates. Information about Cornell’s evidence-based model, training, and structured threat assessment procedures.
• CSTAG Research and Publications. Peer-reviewed studies and evaluations of CSTAG and its predecessor, the Virginia Student Threat Assessment Guidelines.
• The State of Behavioral Threat Assessment and Management in K–12 Public Schools, U.S. Secret Service / RAND, November 2025. National research examining school threat assessment adoption, training, team operations, implementation challenges, and opportunities for improvement.
• SchoolSafety.gov: Threat Assessment and Reporting. Federal information and resources addressing school threat assessment, reporting, and violence prevention.

Digital Threat Assessment and Online Threats

• Developing Practical Responses to Social Media Threats Against K–12 Schools, RAND Corporation, 2024. Research examining social media threats affecting schools and practical challenges involving investigation, response, communication, and coordination.
• Anonymized Threat Response Guidance: A Toolkit for K–12 Schools, CISA, 2024. Federal guidance addressing anonymous threats, social media threats, school response considerations, and coordination with law enforcement and community partners.

Online Radicalization and Violent Extremism

• Five Things About the Role of the Internet and Social Media in Domestic Radicalization, National Institute of Justice, 2023. Research findings addressing the complex relationship between online activity, extremist content, individual circumstances, and radicalization.
• Five Things About the Role of Social Networks in Domestic Radicalization, National Institute of Justice, 2023. Research examining how personal relationships and online or offline social networks may contribute to radicalization or provide opportunities for prevention and intervention.

Independent School Safety Consulting and Threat Assessment Support

National School Safety and Security Services provides independent school safety, security, and emergency preparedness consulting to public, private, charter, and faith-based schools nationwide.

Led by Kenneth S. Trump, Ed.D., our work draws upon more than 40 years of professional school safety experience, strategic school safety leadership research, and extensive experience in civil litigation involving school violence, wrongful death, and other serious school safety incidents.

Our approach emphasizes organizational practices, human factors, professional judgment, implementation fidelity, and the real-world challenges facing school leaders.

We do not sell school security hardware, software, weapons detection systems, or other security products. Our recommendations are not shaped by vendor sponsorships or product sales.

School leaders seeking additional support may explore our:

• Independent School Safety and Security Assessments
• School Safety, Security, and Crisis Preparedness Training
• Strategic School Safety Leadership Guide
• Strategic School Safety Communications Guide

The fundamental question for school leaders is not simply whether their district has a threat assessment program, whether they have selected a recognized model, or whether their program complies with state requirements. It is whether the program functions effectively when students and staff depend upon it.

For additional information about independent school safety consulting and training, contact National School Safety and Security Services.

Top of Form

Bottom of Form