Prepare bomb-threat decisions before the call or message arrives

Source facts: assess before selecting the response

CISA’s Office for Bombing Prevention Bomb Threat Guide organizes preparedness into planning, receiving a threat, assessment, response, and suspicious-item actions. It is written for site decision makers and stresses an orderly, controlled process coordinated with law enforcement and first responders.

The guide describes risk levels based on the threat’s specificity, realism, feasibility, and immediacy, then presents response options such as assess and monitor, assess and search, search with partial or full lockdown, and evacuation. CISA cautions against automatic evacuation because a threat can be used to move people toward a device or other attack. When evacuation is selected, routes and assembly areas should be evaluated and kept away from a suspicious item.

If a suspicious item is found, CISA says not to touch, tamper with, or move it; report it to decision makers and local law enforcement or first responders; secure and clear the area; and brief responders. The guide does not make an employee a bomb technician or guarantee that a checklist establishes credibility. Emergency responder direction and site-specific public-safety authority control the incident.

DSE recommendation: prepare the decision structure and preserve the facts

Write a bomb-threat management plan with law-enforcement, fire, emergency-management, facilities, security, communications, accessibility, and operational input. Identify a primary decision maker and alternates who can order protective actions. Give them building plans, occupancy information, critical operations, mobility needs, route options, assembly areas, and current responder contacts.

1. Train likely receivers. Reception, call centers, assistants, supervisors, and anyone monitoring public messages should know how to stay calm, preserve the exact wording, note time and source, capture available caller or message details, listen for background information without provoking the sender, and notify the established emergency path. Use CISA’s bomb-threat checklist at the point of work.
2. Protect original evidence. Preserve voicemail, email, envelope, social-media post, caller display, notes, and system timestamps. Limit forwarding or rewriting that loses headers or context. Do not ask staff to trace, confront, or investigate the sender.
3. Notify responders promptly. Follow local emergency-reporting instructions and provide the threat’s exact content, delivery method, time, named location or target, stated timing or device details, actions already taken, and a safe contact. Keep the designated liaison available as facts change.
4. Use authorized search teams. Preidentify people who know their ordinary work areas and can report something unusual under responder-approved procedures. Define search boundaries, communications, marking, accountability, and the immediate action for a suspicious item. Searching is not touching, opening, or moving property.
5. Select protective action deliberately. Consider the credible information, suspicious findings, threatened location, occupancy, routes, assembly areas, operational constraints, and responder advice. Prepare partial and full evacuation, lockdown, shelter, or continued monitoring options rather than forcing every incident into one alarm sequence.
6. Control evacuation and re-entry. Use routes and assembly points evaluated for the incident, account for occupants and visitors, maintain responder access, support people who need assistance, and prevent casual return. Name the authority that can approve re-entry and how that decision will be communicated.

Exercise telephone, written, electronic, and suspicious-item scenarios separately. Observe whether the receiver captures facts, notification reaches the decision maker, responders receive accurate information, teams avoid the simulated item, alternate routes work, visitors are accounted for, and operations know when to stop or continue. Never place an object or conduct a surprise exercise that could trigger a real emergency response without authorization and coordination.

After a threat, preserve the decision log, responder instructions, communications, accountability results, operational impacts, and corrective actions. Support affected employees and avoid public speculation. The objective is disciplined uncertainty management: reliable facts reach the right authority, people do not handle suspicious items, and protective movement occurs only through a route judged safer than remaining in place.

Official references

• Cybersecurity and Infrastructure Security Agency, Office for Bombing Prevention, Bomb Threat Guide, Version 1, August 2023.
• CISA and the Federal Bureau of Investigation, DHS-DOJ Bomb Threat Guidance Quad-Fold.