Active Shooter Preparedness in Southern California: What Every Workplace, School and Church Needs to Know

I am not going to sugar coat this. If you run a business, a school, or a house of worship in Southern California and you do not have a written preparedness plan, you are behind. Not behind on paperwork. Behind on the thing that actually matters when someone walks through the door with bad intentions.

I have been training officers, ministry teams, and corporate safety committees in San Diego County for two decades. The conversations I have today are not the same ones I had ten years ago. Back then I had to convince people that preparedness mattered. Now they call me because something happened down the block, or because their insurance carrier asked for proof of training, or because a parent at a board meeting stood up and asked, point blank, what the plan is.

This guide is everything I wish more Southern California leaders knew before they pick up the phone. We will cover what the law actually requires, how to build a plan that holds up under stress, what training looks like when it is done right, and what to do this week if you are starting from zero.

Why This Matters More Now in Southern California

San Diego, Los Angeles, Orange County, the Inland Empire. Different cities, same trend. Targeted violence has shifted from rare events that made national headlines into a steady drumbeat of smaller incidents that rarely make the front page. The FBI tracks active shooter incidents every year, and the numbers have climbed roughly four hundred percent since the early 2000s. California is consistently in the top five states for incidents because of our population size and the density of soft targets we have, places like retail centers, schools, places of worship, and entertainment venues.

Most of the people I train are surprised to learn how short these events actually are. The average active shooter incident is resolved in under five minutes. Many are over in two or three. If the closest patrol car is six minutes away, the math is not on your side. That is not a knock on law enforcement. It is the reality of geography. The people who are in the building when it starts are the only ones who can affect the outcome in the first few minutes, and the first few minutes are the only minutes that matter.

This is why preparedness has stopped being a checkbox exercise. The goal is not a binder on a shelf. The goal is a team that knows what to do without thinking.

What California Law Now Requires: SB 553 in Plain English

If you employ anyone in California, you are almost certainly covered by Senate Bill 553. The law took effect July 1, 2024 and applies to nearly every employer with very limited exceptions. The headlines focused on the training requirement, but the law actually has four moving parts you need to know.

One. A written Workplace Violence Prevention Plan (WVPP). This is not a generic template you print off the internet. Cal/OSHA expects a plan that is specific to your facility, your employees, your shift patterns, and your known hazards. The plan must name the responsible person, describe how employees report threats, and lay out the steps your team will take during an incident.

Two. An incident and threat log. Every workplace violence incident must be logged, and every credible threat, including ones from coworkers, customers, ex-partners, or strangers, gets recorded. You keep this log for five years. Cal/OSHA can ask to see it.

Three. Annual training for every employee. The training is not a video and a sign-in sheet. It needs to be interactive, it needs to be tied to your specific plan, and the person delivering it needs to be qualified. Employees have to walk away knowing how to recognize warning signs, how to report a threat, and what to do during an event.

Four. Records retention. Training records, incident logs, and the plan itself all need to be kept and made available to Cal/OSHA inspectors if requested. Five years is the rule of thumb.

Penalties for noncompliance are serious. Cal/OSHA citations have already been issued, and we have seen civil suits where plaintiffs argued that the absence of a current WVPP was evidence of negligence on the part of the employer. If your insurance carrier asks for proof of compliance and you cannot produce it, expect your premiums to move.

The full breakdown of the law lives in our SB 553 Compliance Guide for San Diego Businesses. If you have not read that yet, start there.

Run, Hide, Fight: The Model That Actually Works

Run, Hide, Fight was developed by the Department of Homeland Security and is the framework used by the FBI and the vast majority of U.S. law enforcement training programs. It is not a slogan. It is a decision tree built around how people actually behave under extreme stress.

Run

If there is a clear path out, take it. Leave belongings behind. Help others if you can do so without slowing yourself down. Keep your hands visible when law enforcement arrives because responding officers do not know who is who in the first few minutes. Do not stop running until you are a long way from the scene.

Hide

If you cannot get out, find a room you can lock or barricade. Turn off the lights. Silence your phone. Stay out of sight lines from the door, especially the door window if there is one. Stay quiet. Do not unlock the door for anyone you cannot positively identify as law enforcement, including someone who claims to be a coworker.

Fight

This is the last resort, but it is part of the model for a reason. If a shooter is in the room with you and there is no other option, fighting back gives you better odds than freezing. Improvised weapons, surprise, aggression, and numbers all matter. The DHS training videos show people throwing chairs, fire extinguishers, anything heavy. That is not theater. That is what works.

The hardest part of teaching this model is breaking the freeze response. In the moment, most untrained people do nothing for several seconds, sometimes longer. Training is what shortens that gap. Drills are what compress it further. A team that has walked through the model three times will respond several times faster than a team that has only read about it once.

Building a Plan That Holds Up Under Stress

Every facility is different, but the planning framework is the same. Here is the structure we walk Southern California clients through.

Step 1: Honest Risk Assessment

What kind of facility do you run? Who comes in and out? What entry points exist? Where are the choke points? Are there areas where people congregate that have only one way out? A warehouse in National City has a different risk profile than a church in Carlsbad or a tech office in Sorrento Valley. The plan needs to reflect the building you are actually in, not the building someone else is in.

Step 2: Roles and Responsibilities

Who calls 911? Who unlocks the gate for first responders? Who accounts for staff? Who handles the kids in the back room of the church or the patients in the back of the clinic? A good plan names actual people for actual roles. When the moment comes, no one wants to be looking around the room wondering whose job it is.

Step 3: Communication Tree

Phones, radios, mass notification systems, internal channels. Whatever you use, make sure there is a backup. We have walked into too many buildings where the only communication plan was the cell carrier that goes down first when the network gets overloaded. Test your system. Test it again. Then test it under stress.

Step 4: Lockdown and Evacuation Routes

Every space needs to be classified. Which rooms lock from the inside? Which doors barricade well? Which exits are reliable and which are propped open by the smoking break crew? Walk your building during your busiest hour and look at it the way someone with bad intentions would. You will see things you missed.

Step 5: Training Cadence

Annual is the legal floor under SB 553. Quarterly tabletop briefings keep the plan top of mind. At least one full walk-through drill per year is what most professionals recommend. Drills should change. Same scenario every time builds complacency. Vary the entry point, the time of day, the role assignments.

Step 6: After-Action Review

Every drill ends with an honest debrief. What worked, what did not, what changes the plan. Write it down. Update the plan. That is how a paper document becomes muscle memory over time.

For Schools and Campuses

Southern California schools sit at the top of every threat assessment list, and not because Mike from Spring Valley says so. Federal data has consistently shown that K through 12 campuses are among the most targeted categories of public spaces. The good news is that schools that take preparedness seriously have a track record of preventing incidents and limiting harm when something does happen.

A real school plan covers more than the basics. Visitor management, vestibule design, classroom locks that work under stress, communication between admin and classrooms, integration with local law enforcement, parent reunification protocols. The administrators we work with in San Diego County are also focused on the upstream side, the threat assessment teams that catch warning signs early. Most planned attacks leak in some form before they happen. The training that helps staff recognize and report what they see is the most important training your school will ever do.

Read our companion piece on this topic: School Threats Are Real: How Trained Security Guards Protect Students and Staff.

For Churches and Houses of Worship

I have trained more church safety teams in the last five years than in the previous fifteen combined. After Sutherland Springs in 2017 and Colleyville in 2022, congregations across Southern California started taking a hard look at their own posture. What I tell every senior pastor and elder board is this. You do not need to turn your sanctuary into a fortress. You do need a trained, organized, low profile team that knows what to do.

The pattern most San Diego County churches are following looks like this. A safety ministry of volunteers, trained in awareness and de-escalation, supported by one or two BSIS licensed officers during high attendance services. A medical lead with first aid training. A communications lead with a radio. Clear roles, clear authority, regular drills, and a relationship with local law enforcement so they know who you are before something happens. We walk congregations through this process at a pace that fits their culture. Some teams want a full curriculum. Some want a single afternoon. Both work as long as the plan keeps moving.

See our deeper dive: Church Security Training: Protect Your Congregation.

For Workplaces and Property Managers

Workplaces in Southern California span everything from quiet professional offices to round the clock industrial sites. The plan you need is the plan that fits the work you actually do. SB 553 raised the floor for everyone, but the ceiling depends on your honest risk picture.

Three areas separate the workplaces that handle a crisis well from the ones that do not.

Front desk and access control. The reception area is your first filter. Most violent incidents involve someone the company knows already, often a current or former employee or someone with a personal dispute. The people at the front need clear protocols and a panic option that does not require them to make a phone call in front of the person they are afraid of.

HR and threat reporting. Employees see things before HR does. If reporting feels uncomfortable or pointless, threats go unreported until it is too late. SB 553 requires a confidential reporting process. Make it real. Make it easy. Tell people what happens after they report.

Coordination with security and law enforcement. If you contract a guard company, the guards need to know your plan, not their plan. If you do not contract guards, you still need a relationship with the local San Diego, Chula Vista, Escondido, or whichever PD covers you. A five minute introduction now is worth hours during an incident.

If you manage property, see our piece on Property Management Security Training in San Diego.

Recognizing Warning Signs Before the Event

Almost every targeted attack leaks signs in advance. Threats made to coworkers or family. Online posts. Increased fixation on prior incidents. A clear stressor like a job loss, eviction, breakup, or court date. Acquisition of weapons. Sudden farewell behavior. The Secret Service National Threat Assessment Center has published this list in different forms for years.

The point is not to turn your team into amateur profilers. The point is to make sure people who notice something know exactly where to take it. A reporting culture saves lives. A culture where employees keep concerns to themselves because nothing happens when they speak up is the culture that produces preventable tragedies.

The First Five Minutes: What Untrained People Get Wrong

I keep coming back to the first five minutes because they are the only minutes that matter. Here is what I see untrained people do that I want you and your team to never do.

They freeze. They look around for cues from other people. They stand in hallways and try to figure out what is happening. They stop to gather belongings. They call family before they call 911. They open doors when someone knocks claiming to be law enforcement. They group together near the exit they were closest to and never look for the second exit they did not notice on a normal day. They follow the crowd toward a single point rather than spreading out and reducing the target.

Training fixes all of this. Not in theory. In repetitions. The first time you walk through a drill, you find ten things wrong. The third time, you find one or two. The tenth time, you find yourself reacting before you finish thinking. That is the point.

What to Do This Week If You Are Starting From Zero

You do not need to overhaul your entire safety posture overnight. Here is what to do this week.

Day one. Walk your facility with fresh eyes. Note exits, choke points, lockable rooms, blind spots, and any door that should never be propped open. Write it down.

Day two. Identify the person responsible for your WVPP if you are an employer. If that person is you, accept it. If it is someone else, talk to them today.

Day three. Pull your existing plan, if there is one, and read it as if you have never seen it before. Highlight anything that is out of date, unclear, or assumes a person or system that no longer exists.

Day four. Schedule the training. The legal minimum under SB 553 is annual. If you do not have a session on the calendar in the next ninety days, get one scheduled.

Day five. Brief your team. Not a full training session, just a five minute heads up that preparedness is being upgraded and they will hear more soon. The silence around this topic is what makes people anxious. Talking about it lowers the temperature.

How SOTC Helps Southern California Teams Get Ready

The Security Officer Training Center has been training officers, business teams, schools, and houses of worship in Southern California for over a decade. We are BSIS approved, and the same instructors who train licensed security officers run our workplace, school, and church programs.

For workplaces, we deliver SB 553 compliant training in your space, build out your written WVPP if you need one, and integrate with your existing safety committee. We can run a full all hands session or train your safety committee as trainers so the program scales internally.

For schools, we offer staff training tailored to K through 12 and higher education, including run, hide, fight refreshers, threat assessment basics, and integration with local law enforcement.

For houses of worship, we build safety ministry teams from the ground up, train volunteers, and provide BSIS licensed officer support during high attendance services or special events.

None of this requires a long term contract. Most clients start with a single training day, see the difference, and then decide what they want next.

Frequently Asked Questions

Related Guides