School Threat Assessment Checklist: Steps, FERPA, and IDEA

A school threat assessment checklist walks a trained team through six working steps — intake of the report, triage into transient or substantive, a full behavioral investigation, risk classification, a written safety plan, and ongoing monitoring — all carried out within the legal boundaries set by FERPA and, for students with disabilities, IDEA. The process is designed to identify students on a path toward violence and redirect that path, not to assign blame for what was said. Federal guidance from the U.S. Secret Service National Threat Assessment Center provides the backbone most schools follow.¹

Who Conducts the Assessment

No one person runs a threat assessment. A standing multidisciplinary team does the work, and the Secret Service guide is explicit that these decisions should never rest with a single administrator.¹ The core team includes a school administrator with authority over discipline and scheduling, a mental health professional such as a school counselor or psychologist, and a school resource officer or law enforcement liaison. The Department of Homeland Security recommends adding social service providers, medical personnel, or technology specialists when local resources allow.² SchoolSafety.gov treats certified mental health professionals as essential rather than optional.³ Every member needs formal training before taking a case.

Step 1: Receive and Document the Report

The process begins when someone reports a concern. Schools need a central reporting channel that is easy to find and use — a phone number, an online form, or a smartphone app the Secret Service suggests as workable formats.¹ Schools that offer an anonymous reporting system see 13.5% fewer violent incidents than schools without one, according to a National Institute of Justice–funded study.⁴

The threshold for a report should be low. A reportable concern includes any communication or behavior suggesting a student may intend to harm someone, whether spoken, written, posted online, or expressed through gestures. It does not have to be an explicit threat. Changes in behavior, expressions of hopelessness, fascination with weapons or past attacks, and social withdrawal all count.¹ Reports involving weapons, physical violence, or immediate danger go to law enforcement right away.

Step 2: Triage — Transient or Substantive?

The team’s first analytical move is the triage decision developed at the University of Virginia: is the threat transient or substantive? That one call shapes everything that follows.⁵

A transient threat has no sustained intent to harm. These are impulsive statements made in anger, jokes taken out of context, or figures of speech that sound worse than they are. A student who says “I’m going to kill you” during a basketball argument and immediately calms down is usually making a transient threat. The team resolves it with a conversation, a counseling check-in, and a brief follow-up with anyone who felt threatened.⁶

A substantive threat is one where intent to harm is present or cannot be ruled out. Anything the team cannot quickly and clearly rule transient becomes substantive by default. Substantive threats split into “serious” (threats to fight or beat someone up) and “very serious” (threats to kill, use a weapon, or cause severe injury). Threats are more likely to be substantive when they involve a history of violence, mention a weapon, or combine harm to others with self-harm.⁵

Step 3: Investigate the Substantive Threat

Once a threat is classified as substantive, the team takes protective action first and then investigates. Protective measures include separating the student from any identified target, increasing supervision, notifying law enforcement, and contacting the parents or guardians of both the student of concern and the target.⁶ Those measures stay in place throughout the investigation.

The investigation is behavioral, not demographic. Secret Service research is explicit that no profile of a student attacker exists; attackers come from every background, family type, and academic record. What they share is a pattern of warning behavior. In a study of 67 averted school attack plots, 94% of plotters communicated their intentions to someone beforehand, two-thirds had a demonstrated interest in violence, and nearly all had experienced significant stressors in the five years before their planned attack.⁷

The Secret Service guide organizes the investigation around specific themes. These are the questions the team is actually answering:¹

Motive and grievance — what is driving the behavior?
Communications — has the student told anyone about plans, warned people away from school, or posted threatening content online?
Interest in violence — does the student show unusual fascination with school shootings, mass attacks, or weapons?
Weapons access — can the student get to firearms or other weapons, especially at home?
Stressors — recent losses, failures, or family disruption?
Emotional state — evidence of hopelessness, desperation, or suicidal thinking?
Planning and preparation — research into tactics, surveillance of the school, target lists, rehearsal?
Protective factors — positive relationships, activities, or support systems that reduce risk?

Information comes from interviews with the student, the target, witnesses, family, and teachers; from academic, disciplinary, and law enforcement records; and from social media posts, class assignments, and other communications. The team may also search the student’s locker or desk. Everything gets documented.

Step 4: Classify the Risk Level

After the information is in, the team classifies the student’s risk using a three-tier framework:

Low — the behavior and circumstances do not suggest movement toward violence.
Medium — the threat could potentially be carried out; concerning indicators exist, but the threat may not appear fully realistic or imminent.
High — the threat appears imminent and serious; the student has the means, motive, and opportunity, and there is evidence of planning or preparation.

The classification is a snapshot, not a permanent label. It drives the intensity of the response and is reassessed as new information arrives and interventions take effect.

Step 5: Build the Safety Plan

The classification feeds a tailored safety plan. The Secret Service framework is firm that risk management should both lower the chance of violence and raise the chance of positive outcomes for the student; punishment alone does neither.¹ A workable plan usually addresses several areas at once:

Mental health support, including referral to a school counselor, psychologist, or community provider, and mobile crisis teams for students in acute crisis.
Environmental changes to schedule, class assignments, or supervision level that reduce contact with the target and limit access to areas of concern.
Written behavioral expectations, often including no-contact conditions and conditions for continued enrollment.
Family engagement, particularly around unsecured weapons at home.
Law enforcement coordination where criminal conduct or imminent danger is involved.

The team notifies the parents of the student of concern and, in substantive cases, notifies the target and the target’s family about the protective measures in place.⁶

Step 6: Monitor and Manage Re-Entry

A plan without follow-through is paperwork. The team conducts regular check-ins to confirm the student is adhering to the plan, the interventions are working, and the risk level has or has not changed. There is no fixed end date; monitoring continues until the team determines the risk has been sufficiently reduced and the student has stabilized.

For a student who was removed from the regular setting, re-entry requires a structured transition. The team reviews progress, confirms the triggering conditions have been addressed, and sets a monitoring plan for the return. Sending a student back without that plan is where problems tend to recur.

FERPA and the Safety-Emergency Exception

Threat assessments pull in sensitive student information, which triggers the Family Educational Rights and Privacy Act. FERPA normally bars schools from disclosing personally identifiable information from education records without parental consent, but it carves out a health-or-safety emergency exception that applies directly to this work.

Under 34 CFR § 99.36, a school may disclose record information to appropriate parties when disclosure is necessary to protect the health or safety of the student or others. The school must determine, based on the totality of the circumstances, that there is an articulable and significant threat. If the school had a rational basis for that determination at the time, the Department of Education will not second-guess it.⁸

The exception has limits. It applies only during the emergency period and does not authorize a blanket release of the student’s file. Disclosures must relate to an actual or imminent emergency, and only information necessary to address the threat may be shared.⁹ Document every disclosure: who received the information, what was shared, and the emergency justification.

IDEA and Students With Disabilities

When the student is a student with a disability, the Individuals with Disabilities Education Act adds requirements. If the threat assessment results in a change of placement lasting more than 10 school days, the school must conduct a manifestation determination review within 10 school days of the decision. The review asks whether the conduct was caused by or had a direct and substantial relationship to the child’s disability, or was the direct result of the school’s failure to implement the IEP. The review is done by the school, the parents, and relevant members of the IEP team.¹⁰

If the behavior is a manifestation of the disability, the school must conduct a functional behavioral assessment (if one has not already been done), develop or revise a behavioral intervention plan, and return the student to the original placement unless the parents and school agree otherwise.¹⁰

One exception matters. A school may remove the student to an interim alternative educational setting for up to 45 school days regardless of whether the behavior is a manifestation of the disability if the student carried a weapon to school, possessed or sold illegal drugs at school, or inflicted serious bodily injury on another person at school.¹⁰ Getting this analysis wrong exposes the school to liability and strips the student of protections they are entitled to.

Why Reporting Culture Decides the Outcome

The checklist only runs if someone tells the team there is a problem. In nearly every averted plot the Secret Service studied, someone other than the plotter knew about the plan in advance; friends and classmates were the recipients of that information in 69% of cases.⁷ Whether those students speak up depends on whether they trust the adults in the building to respond with help rather than punishment. Tip line training, trusted-adult relationships, and a climate where reporting is normal are the infrastructure the rest of this process rests on.

1
U.S. Secret Service. Enhancing School Safety Using a Threat Assessment Model
2
U.S. Department of Homeland Security. Threat Assessment and Management Teams
3
SchoolSafety.gov. Threat Assessment and Reporting
4
National Institute of Justice. Tip Lines Can Lower Violence Exposure in Schools
5
Office of Justice Programs. The Distinction Between Transient and Substantive Student Threats
6
UVA School of Education and Human Development. The Comprehensive School Threat Assessment Guidelines
7
U.S. Secret Service. Averting Targeted School Violence
8
eCFR. 34 CFR 99.36 – Conditions for Disclosure of Information in Health and Safety Emergencies
9
Protecting Student Privacy. When Is It Permissible to Utilize FERPAs Health or Safety Emergency Exception for Disclosures
10
eCFR. 34 CFR 300.530 – Authority of School Personnel