A practical booklet for Safety Managers, Security Directors, and Physical Security Leaders, organized by industry for immediate use.

How to use this booklet

1. Build the common “core plan” once (applies to every industry).
2. Add industry annexes (what changes by environment, people-flow, equipment, and regulation).
3. Train, drill, and measure like it’s an operations program, not a binder on a shelf.

---

1) The Core Plan Every Organization Needs

1.1 Command, Control, and Decision Rights (Day 1 foundation)

Your plan fails when “who decides” is unclear.

Establish three command layers:

• Strategic (Executive Crisis Leadership Team – CLT): CEO/COO, Legal, HR, Comms, Risk, Security exec
• Operational (Emergency Management Team – EMT): Security, Safety/EHS, Facilities, IT, Medical, Logistics
• Tactical (On-scene Incident Commander – IC): Site Security Supervisor / Facilities Lead / EHS Lead (varies by site)

Non-negotiables:

• One Incident Commander per incident (no dual command).
• Clear triggers for escalation (site → regional → corporate).
• Written authority for site leaders to act immediately (evacuate, lock down, halt operations).

Deliverable: 1-page “Authority & Escalation Matrix.”

---

1.2 Hazard & Threat Assessment (All-hazards, not just “active shooter”)

Use a simple model that a busy leadership team will actually follow:

A. List your hazards

• Life safety: medical emergencies, violence, crowd surge
• Operational: power loss, IT outage, supply interruption
• Environmental: earthquake, flood, extreme heat, wildfire
• Technical/industrial: hazmat release, fire, confined space, machinery
• Reputation/legal: high-profile incident, media pressure, litigation risk

B. Score each hazard

• Likelihood (1–5)
• Impact on life safety (1–5)
• Impact on operations (1–5)
• Detectability / warning time (1–5)
• Preparedness gap (1–5)

C. Select “Top 10 scenarios”
Those become your Annexes and drill schedule.

Deliverable: Risk Register + Top 10 Scenario List.

---

1.3 Plan Structure That Scales (Core + Annexes)

Core Emergency Operations Plan (EOP)

• Purpose, scope, assumptions
• Roles, command structure, call trees
• Notification and communications procedures
• Evacuation / Shelter / Lockdown decision logic
• Medical response + AED program
• Fire/life safety basics
• Accountability & reunification
• Business continuity handoff (BCP)
• Training & exercise program
• After-action review (AAR) and improvement plan

Annexes (scenario playbooks)
Each annex is 2–5 pages, written like a checklist:

• Triggers & initial actions (first 5 minutes)
• Protective actions (evac/shelter/lockdown)
• Notifications (internal + external)
• Site shutdown steps (if needed)
• Medical & reunification steps
• Evidence preservation + documentation
• Recovery and return-to-work

---

1.4 Communications: Your “Golden Thread”

When things go sideways, communication is the operation.

Minimum channels (redundancy):

• Mass notification system (SMS/email/voice)
• Radios for on-scene teams
• Backup: Teams/Slack channel + conference bridge
• Public messaging: pre-approved templates

Build a message library now:

• Evacuation order
• Shelter-in-place
• Lockdown
• All clear
• Family/visitor messaging
• Media holding statement

Deliverable: “Crisis Comms Pack” (templates + approval path).

---

1.5 Training & Exercises (the difference-maker)

Don’t run “the big annual drill” and call it done.

Training ladder:

• All staff: what to do (evac/shelter/lockdown, medical, reporting)
• Floor/area wardens: accountability, routes, sweeps
• Supervisors: decision-making, special populations, documentation
• EMT/CLT: tabletop and functional exercises
• Security team: tactical coordination, access control, liaison with law enforcement

Exercise calendar (recommended):

• Monthly: micro-drills (10–15 min) per department
• Quarterly: scenario tabletop (EMT/CLT)
• Semiannual: functional test (notifications, accountability, EOC activation)
• Annual: full-scale drill where appropriate

Deliverable: Exercise Plan + AAR process.

---

1.6 Metrics That Prove Readiness (and win budget)

Track readiness like any other enterprise program:

• Time to detect → notify → protect (minutes)
• Drill participation rate
• Evacuation/shelter compliance rate
• Radio/notification success rate
• Corrective actions closed (% on time)
• AED response time and coverage
• Security incident trends (by site and shift)

---

2) Industry Annexes: What Changes by Environment

Below are industry-specific risk profiles and planning priorities. Use them as annex starters.

---

2.1 Corporate Offices & Headquarters

Primary risks

• Medical emergencies (most common)
• Workplace violence / threats
• Fire alarms / false alarms
• Severe weather and earthquake (region-dependent)
• Executive protection incidents, protests

Planning priorities

• Floor warden program + accountability
• Visitor management and badging
• Mailroom screening procedures
• Threat management team (Security + HR + Legal)
• Reunification and remote work continuity

Must-have annexes

• Workplace violence & threatening behavior
• Bomb threat / suspicious package
• Medical emergency (AED + EMS interface)
• Evacuation of high-rise floors

---

2.2 Manufacturing & Industrial Facilities

Primary risks

• Machinery incidents, amputations, crush injuries
• Fire/explosion (dust, solvents, gas)
• Hazmat release and exposure
• Confined space, electrical, lockout/tagout failures
• Shift-change surge and contractor exposure

Planning priorities

• Integrated EHS + Security command
• On-site medical response capability and trauma kits
• Muster points that account for contractors and visitors
• Shutdown procedures (equipment, gas, ventilation)
• Mutual aid with fire department and hazmat teams

Must-have annexes

• Fire/explosion response + shutdown checklist
• Chemical release (shelter vs evac decision tree)
• Confined space rescue coordination
• Severe injury response and medevac routing

---

2.3 Healthcare (Hospitals, Clinics, Dialysis, Urgent Care)

Primary risks

• Aggressive patients/visitors, behavioral health events
• Infant/child abduction risks (some settings)
• Infectious exposure events
• Utility failures affecting life support systems
• Mass casualty surge

Planning priorities

• Security posture that preserves care continuity
• De-escalation training (clinical + security)
• Controlled access zones (ED, pharmacy, NICU)
• Surge and triage coordination
• Generator/fuel readiness and downtime procedures

Must-have annexes

• Violence in ED / code gray response
• Utility failure (power/oxygen/IT) care continuity
• Hazardous exposure and isolation workflow
• Mass casualty surge staffing & access control

---

2.4 Retail, Shopping Centers, and Big-Box

Primary risks

• Crowd surge, fights, theft-related violence
• Fire and evacuation complexity (high public density)
• Severe weather sheltering
• Protests or targeted incidents (brand-related)
• Cash handling robberies

Planning priorities

• Crowd management and queue control procedures
• Clear public announcements and signage
• Staff roles for evacuation and assembly
• Liaison with mall security / local police
• Safe rooms / lockdown zones for employees

Must-have annexes

• Robbery in progress (do/don’t checklist)
• Active assailant (run/hide/fight + lock procedures)
• Crowd surge / disorder response
• Child separation & reunification

---

2.5 Warehousing, Logistics & Distribution

Primary risks

• Vehicle/pedestrian incidents (dock yards)
• Theft rings, insider threats, cargo diversion
• Fire (packaging), hazmat (batteries), sprinklers
• Labor disputes or picket lines
• High contractor/seasonal workforce

Planning priorities

• Yard control and traffic separation (physical barriers, routes)
• High-volume access control and credentialing
• Incident reporting discipline across shifts
• Inventory integrity + chain-of-custody
• Rapid evacuation/muster with large headcount

Must-have annexes

• Vehicle strike / serious injury response
• Fire and smoke management in large footprints
• Security breach / theft ring escalation
• Labor disruption operations plan

---

2.6 Construction Sites & Capital Projects

Primary risks

• Falls, structural collapse, trench incidents
• Unauthorized access and theft of materials/equipment
• Hot work fires
• Utility strikes (gas/electric/water)
• Multi-employer coordination failures

Planning priorities

• Clear site command (GC + Security + Safety)
• Contractor orientation and muster accountability
• Emergency access routes always kept open
• Permit control (hot work, confined space)
• Weather stop-work triggers

Must-have annexes

• Collapse/trench rescue coordination
• Hot work fire response
• Utility strike immediate actions
• Severe weather stop-work and site lockdown

---

2.7 Education (K-12, Higher Ed)

Primary risks

• Active threats, social media-driven incidents
• Student mental health crises
• Large event crowd control
• Access control challenges in open campuses
• Reunification pressure from parents/media

Planning priorities

• Age-appropriate training and communications
• Lockdown/secure campus procedures with clarity
• Strong reunification plan (site + process + staffing)
• Threat assessment team with student services
• Coordination with local law enforcement

Must-have annexes

• Lockdown and reunification (detailed)
• Missing student / welfare check protocol
• Large event security (games, graduation)
• Shelter for severe weather

---

2.8 Hospitality (Hotels, Resorts, Venues)

Primary risks

• High guest turnover, anonymity, and privacy constraints
• Large events, alcohol-related incidents
• Fire/life safety with sleeping occupants
• Human trafficking indicators (staff training)
• VIP incidents and reputational exposure

Planning priorities

• Guest evacuation procedures with staff roles by department
• Front desk security protocols + key control
• Event security plans (crowds, egress, medical)
• Coordination with EMS for guest privacy and care
• Surveillance and incident documentation standards

Must-have annexes

• Fire evacuation for overnight occupancy
• Disorderly guest / violence response
• Suspicious activity / trafficking indicators escalation
• Large event operational plan

---

2.9 Energy, Utilities & Critical Infrastructure

Primary risks

• Sabotage, intrusion, and targeted attacks
• Severe weather impacts on operations
• Hazmat/industrial incidents
• Insider threat
• Regulatory reporting requirements

Planning priorities

• Layered security (perimeter, access, monitoring, response)
• Redundant communications and power
• Joint drills with government/emergency management
• Clear shutdown and isolation procedures
• Evidence preservation and reporting playbooks

Must-have annexes

• Intrusion/sabotage response (security + operations)
• Extended outage continuity plan
• Hazmat/industrial event response
• Government liaison and reporting

---

2.10 Data Centers & High-Reliability Facilities

Primary risks

• Power/cooling failures
• Fire suppression events
• Access control breaches
• Vendor/contractor risks
• Coordinated cyber + physical incidents

Planning priorities

• Strict access governance and escort policies
• Incident response alignment with IT/cyber teams
• Environmental monitoring escalation thresholds
• Rapid “protect the humans first” protocols in technical emergencies
• Controlled media and customer communications

Must-have annexes

• Power/cooling failure response (roles + thresholds)
• Fire suppression discharge procedures
• Unauthorized access and evidence handling
• Evacuation with critical system considerations

---

3) The “First 30 Days” Implementation Plan (Practical, achievable)

Week 1: Establish control

• Name ICs by site; publish escalation matrix
• Confirm notification tools; create crisis channels/bridges
• Start the risk register (top hazards only)

Week 2: Build the Core

• Draft the Core EOP (lean, readable)
• Write three universal annexes: Fire, Medical, Violence

Week 3: Add industry annexes

• Choose your Top 10 scenarios; create 2–5 page annex each
• Site maps: exits, muster points, AEDs, shutoffs, safe rooms

Week 4: Train and test

• Run one tabletop (leadership)
• Run one micro-drill (staff)
• Do an AAR; assign corrective actions with due dates

---

4) Copy-Paste Templates (Starter Set)

4.1 Annex format (2–5 pages)

• Situation / triggers
• Immediate actions (first 5 minutes)
• Protective action decision tree
• Notifications (who/when/how)
• On-scene roles
• Medical actions
• Accountability & reunification
• Recovery and documentation

4.2 Incident Commander “first minute” checklist

• Confirm nature of incident (what/where/who)
• Decide protective action (evac/shelter/lockdown)
• Activate notifications (internal + 911 as needed)
• Establish command point and communications
• Assign: perimeter control, medical lead, accountability lead
• Document time stamps and actions

4.3 After-Action Review (AAR) prompts

• What was expected to happen?
• What actually happened?
• What went well and why?
• What failed or slowed us down?
• Corrective actions, owners, due dates

The All-Hazards Safety & Emergency Planning Playbook

for reference use only