Bomb Threat Training Procedures for the Workplace

Bomb threat training procedures for the workplace start with a written plan and end with people who have practiced their part before a threat ever arrives. OSHA’s emergency action plan standard requires employers to document evacuation routes, employee accountability, and emergency contacts, and bomb threats fall inside that framework.¹ The training itself covers four groups: whoever answers the phones, the people who will search, the people who will lead an evacuation, and the one person authorized to make the call. Get those four groups drilled and the rest of the response falls into place.

The Written Plan That Training Rests On

Nobody trains well against a plan that doesn’t exist. The written plan needs to name a Site Decision Maker with clear authority to order a search, an evacuation, or a shelter-in-place, and at least one alternate so coverage holds when that person is out. The Site Decision Maker is the single point of contact for responding law enforcement.

The plan also identifies search teams drawn from employees who work in each area, primary and secondary evacuation routes, external assembly points, and a communication protocol that allows leadership to move people without broadcasting the word “bomb” over a PA system. Joint walkthroughs or tabletop exercises with local police and fire departments, done before any threat, are where these pieces get tested.

OSHA requires that the plan be reviewed with each covered employee when it is first developed, when an employee’s responsibilities under it change, and whenever the plan itself is revised.¹ An annual refresher paired with a drill is the simplest way to keep both the compliance record and the skills current. Update triggers include building layout changes, new tenants, and turnover in local emergency contacts.

Training for Employees Who Need Evacuation Assistance

Standard evacuation drills assume everyone can take the stairs. Employees who use wheelchairs, have limited vision, or have other mobility challenges need an individualized plan. A voluntary, confidential registry lets designated assistants know who to reach and where to find them before the emergency starts.² The registry stays voluntary and its contents protected. Pair each registered employee with trained evacuation assistants and identify areas of refuge, typically fire-rated stairwell landings, where someone can wait for responders if they cannot descend on their own.

Training the Person Who Answers the Phone

Most bomb threats still arrive by phone, and the person who picks up has roughly thirty seconds to move from confusion to controlled information gathering. That does not happen without practice. Every employee who answers an external line should have a bomb threat checklist within arm’s reach, printed at the desk or bookmarked on screen.

Train them to keep the caller talking. Stay calm, sound cooperative, and don’t argue. Write down the exact words of the threat, then work through the checklist questions recommended by the Department of Homeland Security:³

Where is the bomb? Ask for the building, floor, and room.
When will it go off?
What does it look like?
What kind of bomb is it?
What will cause it to explode?
Did you place the bomb?
Why?
What is your name?

Most callers will not answer all of these. Every piece they do give narrows law enforcement’s job. Train receivers to listen for voice characteristics (gender, estimated age, accent, whether the caller sounds nervous or rehearsed) and background noise like traffic, music, or machinery. If caller ID shows a number, write it down. Practice the silent signal that tells a coworker to dial 911 from a different phone while the receiver keeps the caller engaged.⁴

Drill one rule until it becomes reflex: when the caller hangs up, do not hang up your phone. The line may be traceable and disconnecting can destroy that evidence. Use a separate phone, or have someone else call 911, to relay everything recorded.³

Training for Written, Digital, and Package Threats

Threats also arrive by email, text message, social media, and handwritten note. For an email threat, the training rule is simple: do not delete the message.³ Don’t forward it, don’t reply, don’t close the application. Leave the message open on screen and contact the Site Decision Maker and law enforcement. Digital forensics can extract sender metadata, routing information, and timestamps only if the original stays intact.

For a handwritten or printed note, train staff to handle the paper as little as possible. Fingerprints and DNA are often recoverable from threatening letters. Place the note in a protective cover or bag if one is available, and record the date, time, and exact location where it was found along with the names of anyone who saw or touched it.⁵

Mailroom and front-desk staff need specific training on suspicious packages. Warning signs include no return address, excessive tape or postage, and misspelled or poorly written words on the label.⁶ Unexpected weight, stiffness, oily stains, or protruding wires all warrant immediate caution. If something looks wrong, don’t open it, shake it, or carry it to show someone else. Set it down, clear the area, and notify security and law enforcement.

Training the Internal Notification and Assessment

Once the threat receiver has documented everything, the next step is a fast, quiet internal notification. A pre-established code word or phrase, something innocuous like “Code Orange,” alerts security and the Site Decision Maker without broadcasting the emergency to everyone within earshot. That code word only works if people have heard it in a drill.

The Site Decision Maker, in contact with responding law enforcement, then classifies the threat as credible, non-credible, or indeterminate. Factors that push toward credibility include specific details about the device’s location or detonation time, apparent knowledge of the building’s layout, and internal consistency. Vague language, implausible claims, and identical threats sent to many targets tend to suggest a hoax, but no one without explosive ordnance training should be making that final call alone. Based on the assessment, the Site Decision Maker chooses among an internal search, a full or partial evacuation, and, in rarer cases, sheltering in place. The decision is communicated in measured language, such as “we have a security concern and are asking everyone to move to assembly points,” rather than an intercom announcement of a bomb threat.

Training the Search Teams

The people best equipped to search are the employees who work in those spaces every day. A maintenance worker knows what belongs in a mechanical room. A receptionist knows whether that backpack has been sitting by the lobby couch all week or appeared twenty minutes ago. Outside searchers do not have that baseline.

Divide the facility into zones and assign teams to each. Train them in a systematic method: floor to waist height, waist to ceiling, then the ceiling itself. The rule is look but don’t touch. A suspicious item is anything unexpected or out of place. When a team finds something, they stop, mark the area, and report the exact location to the Site Decision Maker and law enforcement.

One precaution deserves its own training block. Do not use cell phones or two-way radios near a suspected device. DHS bomb threat procedures explicitly warn that radio signals have the potential to trigger a detonation.³ Keep transmitting devices off in the immediate vicinity of a suspicious object and communicate from a safe distance using a runner or a phone on the perimeter.

Training Evacuation, Assembly, and Standoff Distances

When the Site Decision Maker orders an evacuation, speed matters and orderly movement matters more. Employees follow pre-designated exit routes, never elevators, and proceed to the external assembly point. CISA recommends that evacuees take personal belongings like purses and backpacks with them, because items left behind become additional suspicious objects that search teams and bomb squads have to investigate.⁵ At the assembly point, floor wardens or team leaders run headcounts against pre-established rosters. Every person is accounted for. If someone is missing, that information goes to the incident commander and no one re-enters to look.

How Far the Assembly Point Needs to Be

Assembly points only work if they are far enough away. CISA publishes a standoff distance card that scales with the potential threat:⁵

Pipe bomb (5 lbs): mandatory evacuation at 70 feet, preferred distance 1,200+ feet
Briefcase or suitcase (50 lbs): mandatory evacuation at 150 feet, preferred distance 1,850+ feet
Car (500 lbs): mandatory evacuation at 320 feet, preferred distance 1,900+ feet
SUV or van (1,000 lbs): mandatory evacuation at 400 feet, preferred distance 2,400+ feet
Small delivery truck (4,000 lbs): mandatory evacuation at 640 feet, preferred distance 3,800+ feet
Semi-trailer (60,000 lbs): mandatory evacuation at 1,570 feet, preferred distance 9,300+ feet

If the parking lot assembly point sits 100 feet from the building and the threat involves a vehicle, that point is dangerously close. Training on evacuation means measuring actual distances on a map, not eyeballing them from the front door. Organizations near highways or loading docks should factor vehicle-borne threats into their distance calculations from the start.

Shelter-in-Place as a Trained Alternative

Evacuation is the default, but there are situations where moving people outside creates more danger, such as when the threat involves an exterior area, a vehicle in the parking structure, or when evacuation routes pass directly by a suspicious object. In those cases the Site Decision Maker may order a shelter-in-place, directing everyone to interior rooms away from windows and exterior walls.⁵ Shelter-in-place is not the response to a confirmed interior device. It is a calculated alternative when evacuation routes are compromised, and employees should have heard that distinction before they encounter it live.

The After-Action Review Is the Training Loop

Every real threat and every drill should end with a formal review. Within a few days, bring together the Site Decision Maker, search teams, floor wardens, and the person who took the call. Walk through what happened, what worked, what didn’t, and what needs to change in the plan. A drill that exposed a gap in an evacuation route or revealed that nobody remembered the code word is a free stress test. Update the written plan on the basis of what you learned, then brief all employees on the changes, which also satisfies OSHA’s requirement to review the plan whenever it is revised.¹

1
Occupational Safety and Health Administration. 29 CFR 1910.38 – Emergency Action Plans
2
ADA.gov. ADA Best Practices Tool Kit for State and Local Governments – Chapter 7 Emergency Management
3
U.S. Department of Homeland Security. Bomb Threat Procedures
4
Office of Research Services. Bomb Threat
5
Cybersecurity and Infrastructure Security Agency. Bomb Threat Guide
6
United States Postal Inspection Service. Suspicious Mail