Active shooter response procedures are coordinated actions that help people recognize an ongoing armed attack, reach safety, deny access to danger, notify emergency services, and support lifesaving care after the threat passes. For most civilians, the central framework is Run, Hide, Fight, applied according to the location of the shooter, available exits, and immediate danger.
Key Facts at a Glance
The U.S. Department of Homeland Security defines an active shooter as “an individual actively engaged in killing or attempting to kill people in a confined and populated area.”
Run, Hide, Fight is a decision framework, not a rigid sequence that requires every person to complete all three actions.
Evacuate when a viable route leads away from the threat; leave belongings behind and keep hands visible when police arrive.
If escape is unavailable, lock and barricade a room, silence devices completely, and stay out of sight.
Fight is a last-resort action when a person faces imminent harm and cannot safely run or hide.
Call 911 when safe, provide the location and direction of the threat, and follow dispatcher instructions.
What Are Active Shooter Response Procedures?
Active shooter response procedures are emergency actions for an ongoing attack in which a person is shooting or attempting to shoot people in a populated area. The procedures address individual survival, emergency communications, law-enforcement access, medical response, organizational coordination, and recovery.
The DHS definition describes the event rather than the offender’s motive. A robbery, domestic-violence incident, barricaded suspect, or hostage situation may require different instructions, so responders should not assume that every armed-person report is an active shooter event. People should act on observable danger, not wait for authorities to confirm the label.
The FBI’s Active Shooter Attack Prevention and Preparedness resource emphasizes preparation, rapid reporting, and practical response options. No civilian procedure guarantees survival, and no training program can predict the attacker’s movement, weapon, intent, or access to a building.
How Does the Response Timeline Work?
The response usually has four overlapping phases: recognize and report, escape or secure a location, law-enforcement intervention, and medical support or recovery. The phases overlap because a person may receive new information, change routes, or move from hiding to evacuation as conditions change.
The often-repeated claim that incidents last exactly 5-12 minutes or that police arrive within 3-5 minutes is not a universal planning standard. Response time depends on geography, dispatch, building access, staffing, traffic, and whether responders receive accurate information. Treat the first minutes as a period in which occupants may need to act independently.
What Should You Do During an Active Shooter Event?
During an active shooter event, move away from the threat if a safe route exists, otherwise secure a defensible room, and resist only when immediate danger leaves no safer option. Contact 911 as soon as doing so will not expose you, then follow instructions from emergency dispatchers and responding officers.
Step 1: Recognize and Report
Treat repeated loud bangs, visible gunfire, screaming, people fleeing, or a credible emergency alert as possible evidence of an attack. Do not spend time proving whether a sound is a firearm, fireworks, or construction noise when people nearby are running or injured.
When safe to communicate, tell 911:
- The exact building address and floor.
- The location where the threat was last seen.
- The direction of movement.
- The number of attackers, if known.
- A description of clothing or equipment.
- The type and number of weapons, if observed.
- The number and location of injured people.
- Your name and callback number, if requested.
Do not approach danger to obtain information. A partial, accurate report is more useful than a detailed report that delays evacuation.
Step 2: Run if You Have a Safe Route
Evacuate through an accessible route that moves away from the sound, attacker, or likely line of approach. Leave bags, coats, phones, and other property behind, and encourage nearby people to leave without waiting for unanimous agreement.
Use exits that do not force you toward the threat. Avoid gathering at the main entrance, because arriving responders may use that route and the attacker may also know it. Continue moving until you reach a location that is separated from the building and does not block emergency vehicles.
When police arrive, keep empty hands visible, avoid sudden movements, and follow commands. Do not run toward officers, grab them, point, or hold an object that could be mistaken for a weapon.
Step 3: Hide and Deny Access
If evacuation would expose you to immediate danger, enter a room or protected area that places substantial barriers between you and the attacker. Lock the door, turn off lights, silence phones and other devices completely, close blinds if available, and keep people quiet and away from windows or door openings.
A barricade should resist entry rather than merely obscure the room. Use heavy furniture, door wedges, or other available objects without creating noise that reveals your location. Stay behind substantial structural features when possible.
Cover can reduce the chance of being struck by bullets or fragments. Concealment only hides a person from view. A cubicle panel, curtain, hollow door, or thin furniture may conceal someone but may not stop projectiles.
Do not open the door because someone shouts that they are police, maintenance staff, or a coworker. Follow your organization’s verification procedure and official emergency instructions. Police may use keys, tools, or other methods to gain entry, but local tactics vary.
Step 4: Fight Only Against Imminent Danger
Fight is a last-resort survival action when an attacker is physically attacking your location and running or hiding cannot protect you. The objective is to create an opportunity to escape, not to pursue, investigate, or confront a suspected attacker.
If forced to act, commit to protective action, use available objects to create distance or disruption, and coordinate with people nearby when communication is possible. Avoid detailed assumptions about a weapon, attacker, or group response because conditions change rapidly and improvised actions carry substantial risk.
Run, Hide, Fight training is not a substitute for professional law-enforcement instruction. Civilian guidance should focus on escape, barriers, communication, and survival rather than teaching offensive tactics.
Which Response Protocol Should an Organization Use?
Run, Hide, Fight is the most recognizable public framework, while ALICE and Avoid, Deny, Defend provide alternative terminology and decision models. The best organizational protocol is the one employees can recall under stress, practice in the actual facility, and apply consistently across security, facilities, disability-access, and emergency-management teams.
| Protocol | Core terms | Main advantage | Main limitation | Suitable use |
|---|---|---|---|---|
| Run, Hide, Fight | Run, Hide, Fight | Three memorable options | “Hide” may sound passive without barricade training | General public, offices, mixed workplaces |
| ALICE | Alert, Lockdown, Inform, Counter, Evacuate | Encourages information-based choices | Requires recurring scenario training | Schools and large campuses |
| Avoid, Deny, Defend | Avoid, Deny, Defend | Direct language with low verbal complexity | Less familiar outside trained organizations | Workplaces and institutional programs |
| Site-specific EAP | Local alert, evacuate, secure, report | Matches building hazards and roles | Requires maintenance after changes | Every employer covered by an emergency plan |
ALICE is a branded training program, not a universal government standard. Avoid, Deny, Defend is associated with ALERRT training and uses “deny” to describe preventing access to a protected area. Organizations should not mix phrases from different programs unless the resulting policy defines each term clearly.
How Should You Choose a Protocol?
Choose Run, Hide, Fight for broad public communication, ALICE where staff can receive reliable location information and make dynamic decisions, and a site-specific emergency action plan for the details that no generic acronym can provide. The site plan must identify exits, secure areas, accessible procedures, notification methods, and responder access.
A hospital may need a variation because staff cannot instantly evacuate patients connected to equipment or unable to walk. A school needs age-appropriate instructions, substitute-teacher coverage, reunification planning, and accessible communication. A factory needs controls for machinery, hazardous materials, shift changes, and large noisy spaces.
How Should Organizations Build a Preparedness Plan?
Organizations should build preparedness around a written Emergency Action Plan, a threat-reporting process, layered physical controls, accessible communication, and repeated exercises. OSHA’s emergency action plan rule, 29 CFR 1910.38, identifies elements such as emergency reporting, evacuation procedures, accountability, rescue or medical duties, and designated contacts.
A practical planning cycle includes:
- Assign ownership: Name an executive sponsor, plan administrator, facilities lead, security contact, human-resources representative, and communications owner.
- Map the site: Record public entrances, controlled doors, stairwells, accessible exits, safe outdoor areas, utility hazards, and rooms that can be secured.
- Define alerts: Specify who can issue an alert, which channels carry it, and how staff respond when systems fail.
- Coordinate externally: Give local police, fire, and emergency medical services current floor plans, access information, and contact details.
- Include every worker: Address visitors, contractors, remote staff, night shifts, language needs, hearing or vision access, mobility limitations, and children.
- Exercise and revise: Conduct discussion-based exercises before live drills, document failures, and update the plan after staffing, construction, or security changes.
What Security Measures Provide the Most Value?
Security upgrades should reduce unauthorized access, improve information speed, and preserve safe evacuation options. A locked door is useful only if occupants can operate it quickly, emergency responders can access it, and the lock complies with fire and accessibility requirements.
| Measure | Typical planning range | Implementation time | Primary control |
|---|---|---|---|
| Emergency action plan review | $0-$5,000 | 1-4 weeks | Roles, reporting, evacuation |
| Mass notification platform | $1,000-$15,000 annually | 2-8 weeks | Rapid messages |
| Badge access for one entrance | $2,000-$15,000 | 2-8 weeks | Entry control |
| Door hardware or locking upgrade | $500-$5,000 per door | 2-10 weeks | Deny access |
| Security film for selected glazing | $8-$25 per square foot | 4-12 weeks | Fragment reduction |
| Tabletop exercise | $500-$5,000 | 2-6 weeks | Decision testing |
| Staff training session | $1,500-$10,000 annually | 1-4 weeks | Recall and coordination |
These are typical U.S. planning ranges, not mandated prices. Local labor rates, building codes, union requirements, technology integration, and the number of doors can change the total substantially.
How Do Schools, Offices, and Hospitals Adapt the Procedure?
The core decisions remain the same across environments, but occupants, duties, building layouts, and legal requirements change the implementation. A generic poster is inadequate when teachers supervise children, clinicians manage dependent patients, or employees work around machinery.
| Environment | Planning priority | Special complication | Practical adaptation |
|---|---|---|---|
| Office | Access control and alerts | Visitors and open floor plans | Badge audits, room maps, manager call tree |
| School | Student accountability | Age, mobility, substitutes | Classroom plans, reunification, plain language |
| Hospital | Patient protection | Immobile or connected patients | Unit-specific secure areas and staff roles |
| Manufacturing | Hazard control | Noise, machinery, chemicals | Shift coverage, shutdown rules, alternate alerts |
| Retail or venue | Public movement | Unfamiliar visitors | Staff code words, exit signage, crowd routing |
What Changes in a Healthcare Facility?
Healthcare facilities need unit-level procedures that protect patients who cannot run, staff who must move medication or equipment, and visitors who may not understand the building. “Secure, preserve, fight” or similar local adaptations may complement Run, Hide, Fight, but each facility must define the terms through clinical and security leadership.
Plans should identify patient-priority groups, transport equipment, safe rooms, access-controlled corridors, operating-room procedures, pharmacy controls, and communication with emergency medical services. Staff should never improvise a patient evacuation route that conflicts with fire, infection-control, or life-support requirements without facility direction.
What Changes in a School?
Schools need classroom-level procedures that substitute teachers and students can understand without relying on a specific adult. Plans should cover attendance, accessible evacuation, communication with families, reunification sites, transportation, language access, and the possibility that an alert may be incomplete or delayed.
Schools should avoid drills that use realistic weapons, simulated gunfire, fake blood, surprise participation, or forced confinement without careful safeguards. The U.S. Department of Education and local authorities may impose additional requirements, and trauma-informed planning should include advance notice, opt-out procedures where appropriate, and support after exercises.
What Happens When Police Arrive?
When police arrive, officers generally prioritize locating and stopping the threat before organized rescue and treatment operations begin. The FBI’s public guidance instructs people to remain calm, keep hands visible, avoid quick movements, and follow instructions; injured people may receive care after the threat area is made safer.
Do not stop officers to provide a long explanation. If asked, identify the attacker’s last known location, your location, the number of people with you, and any injuries. Keep your hands empty and visible, and avoid touching weapons or objects near the scene.
Police may direct evacuees to a holding area, search them, separate witnesses, or prevent immediate return for property. Those actions support scene control and evidence preservation. Follow commands even when the building alarm, social media, or another person gives conflicting information.
What If the Fire Alarm Sounds?
A fire alarm does not automatically mean that a normal evacuation route is safe during a suspected armed attack. First assess whether there is visible smoke, heat, fire, or another immediate hazard, then use the safest available route based on threat information and official instructions.
Attackers can exploit predictable movement, but occupants must not ignore a genuine fire. The correct response is conditional: avoid a route leading toward the attacker, use another exit if available, and follow the building’s emergency plan when fire conditions are present.
What If Someone Is Injured?
Do not attempt to carry an injured person through an exposed area if doing so places you and the injured person in immediate danger. If you can reach an injured person without entering the threat area, move to safety and provide care only when the scene is reasonably safe.
Tell 911 the injured person’s exact location. After emergency personnel authorize or reach the area, use gloves if available, apply firm direct pressure to severe bleeding, and follow dispatcher instructions.
The American College of Surgeons’ Stop the Bleed program teaches control of life-threatening bleeding through direct pressure, wound packing when appropriate, and tourniquet use for severe limb bleeding. A tourniquet should follow trained instruction and manufacturer guidance, and the application time should be reported to responders.
What If You Have a Disability or Support a Dependent Person?
People with mobility, hearing, vision, cognitive, or medical needs should have individualized options identified before an emergency. A personal plan may include accessible exits, communication formats, assistance partners, medication needs, service-animal considerations, and a fallback location when elevators are unavailable.
No coworker or teacher should be expected to lift someone without training. Organizations should provide evacuation equipment, trained assistance teams, and procedures for accountability without separating people from essential devices or animals unnecessarily.
What Are the Most Common Response Failures?
The most common failures involve delayed recognition, poor information, unsecured rooms, conflicting instructions, and drills that test performance without testing the plan. Preparedness improves when organizations examine why a decision failed rather than blaming people for not behaving perfectly during an unpredictable attack.
- Normalizing warning signs: People dismiss bangs, threats, or reports as jokes. Fix this with clear reporting channels and a stated “report first, investigate second” rule.
- Evacuating by habit: Occupants use the main entrance despite threat information. Fix this with route maps and alternate-exit practice.
- Hiding without denying access: People enter an unlocked room and remain near the door. Fix this by practicing locks, wedges, silence, and sightline reduction.
- Overloading alerts: Staff receive long messages with unverified details. Fix this with short alerts that state location, action, and update status.
- Running toward responders: Evacuees approach officers or hold phones and bags. Fix this with repeated visible-hands instruction.
- Using traumatic drills: Realistic simulations create panic or disengagement. Fix this with announced, progressive, discussion-based exercises.
- Ignoring recovery: Organizations reopen without supporting witnesses, employees, and families. Fix this with a documented crisis-communication and behavioral-health plan.
One practitioner rule deserves emphasis: every security measure must be tested from the occupant’s perspective. A badge reader that delays evacuation, a text alert that fails in a basement, or a barricade that blocks an accessible route can create a new hazard.
How Long Does Preparedness Take and Cost?
A basic written plan can take 1-4 weeks, staff training commonly takes 2-4 hours per session, and physical security projects often require 1-3 months. A small organization may spend under $5,000 on planning and training, while access control, glazing, notification, and door work can raise implementation costs above $50,000.
| Program stage | Typical duration | Typical cost | Completion measure |
|---|---|---|---|
| Initial risk and route review | 1-2 weeks | $0-$2,500 | Map and hazard register |
| EAP drafting and approval | 1-4 weeks | $0-$5,000 | Signed plan and role list |
| Staff orientation | 2-4 hours | $1,500-$10,000 | Attendance and knowledge check |
| Tabletop exercise | 2-3 hours | $500-$5,000 | Action log and owners |
| Hardware installation | 1-3 months | $2,000-$50,000+ | Tested doors and alerts |
| Annual revision | 1-2 weeks | $500-$5,000 | Updated plan and drill record |
The figures are typical U.S. planning estimates. Compliance obligations may add costs, and organizations should consult local fire officials, accessibility specialists, labor representatives, and law enforcement before changing locks, exits, or drills.
How Can People Prepare Before an Attack?
People can prepare by noticing two exits, learning how doors lock, identifying areas with substantial barriers, keeping emergency contact information current, and taking a recognized bleeding-control course. Preparation should improve decisions without encouraging constant fear or unsafe confrontation.
Before entering an unfamiliar venue, note the main exit and at least one alternate route. At work or school, learn the emergency notification method and understand whether the organization uses Run, Hide, Fight, ALICE, or another defined vocabulary.
Employees should report specific threats, stalking, weapon displays, or concerning behavior through the organization’s designated channel. Reporting a concern is not the same as diagnosing a person or spreading an accusation. Immediate danger requires 911.
Frequently Asked Questions
Should I call 911 or send a text during an active shooter event?
Call 911 when speaking will not reveal your location or expose you. A text-to-911 service may help when voice communication is unsafe, but availability varies by jurisdiction, and voice calls generally provide faster two-way clarification when they can be made safely.
Should I use an elevator to escape?
Use stairs or another safe accessible route when an elevator could stop, open near the threat, or lose power. People who cannot use stairs should follow their facility’s preplanned accessible evacuation procedure, which may include protected areas, evacuation chairs, trained assistance, or responder guidance.
Can I return for my phone, medication, or identification?
Do not delay escape to retrieve property. If essential medication, mobility equipment, or identification remains inside, tell responders after reaching safety and follow their instructions rather than reentering the building independently.
Should an organization conduct an active shooter drill every year?
Organizations should provide recurring preparedness education and periodically test the plan, but the frequency and format should match local law, risk, workforce needs, and trauma-informed practice. Discussion-based exercises and announced functional tests often reveal planning failures without simulating violence.
What should families do after a school or workplace evacuation?
Families should avoid calling the facility repeatedly, remain away from the scene, monitor official messages, and use the designated reunification process. Social media rumors can conflict with verified instructions, while an established reunification site helps protect children, witnesses, and emergency operations.
Are active shooter procedures useful for other violent threats?
Many principles also help during an armed intruder, workplace violence, or violent-person emergency, especially rapid reporting, distance, barriers, and visible hands. The correct response still depends on the hazard, so fire, hazardous-material, hostage, and severe-weather procedures should remain distinct.
The Bottom Line
Active shooter response procedures give people a short decision framework for an attack: recognize danger, report it, run when a safe route exists, hide behind a locked and barricaded barrier when escape is unsafe, and fight only against imminent harm. Organizations must add site-specific exits, alerts, accessibility measures, responder coordination, medical training, and recovery support. The most effective plan is one people can recall, practice, and adapt without waiting for perfect information.
