NTAC threat assessment model: The NTAC 8-Step Threat Assessment Model, Explained

Each step of the U.S. Secret Service NTAC model for preventing targeted school violence, what it asks schools to do, and how to put it into practice.

By VeriThreat Editorial TeamUpdated November 4, 2026 5 min read

In 2018, the U.S. Secret Service National Threat Assessment Center (NTAC) published Enhancing School Safety Using a Threat Assessment Model, an operational guide for preventing targeted school violence. It lays out eight steps that together make up what NTAC calls a comprehensive targeted violence prevention plan.

This article walks through each step: what NTAC recommends, and what it looks like in practice. For the bigger picture, see School Behavioral Threat Assessment: The Complete Guide.

Step 1: Establish a multidisciplinary threat assessment team

What NTAC recommends. A team of people from different disciplines, such as teachers, guidance counselors, coaches, school resource officers, mental health professionals, and school administrators, so that "varying points of view will be represented and that access to information and resources will be broad." The team "needs to have a specifically designated leader," usually a senior administrator. It should have clear procedures and meet regularly, not just when a case comes in.

In practice. Write down who's on the team, who leads, and who backs up the leader. Schedule regular meetings for case review and practice scenarios. See How to Set Up a School Threat Assessment Team.

Step 2: Define prohibited and concerning behaviors

What NTAC recommends. Policies that define prohibited behaviors that warrant immediate intervention: threatening or engaging in violence, bringing a weapon to school, bullying or harassing others, and other concerning or criminal behaviors. Policies should also name behaviors that may not indicate violence but still warrant intervention: a marked decline in performance; increased absenteeism; withdrawal or isolation; sudden or dramatic changes in behavior or appearance; drug or alcohol use; and erratic, depressive, and other emotional or mental health symptoms.

NTAC emphasizes that "the threshold for intervention should be relatively low," because it's "much easier to intervene" while a student is working through a personal setback than once there are concerns about threats to others.

In practice. Put the list in your policy and in staff training. Make clear that reporting a concerning behavior is a way to get a student support, not a referral for punishment.

Step 3: Create a central reporting mechanism

What NTAC recommends. One or more reporting channels, such as an online form, a dedicated email address or phone number, or a smartphone app, with:

  • training for students, staff, SROs, and parents on what to report and how
  • a team member who "proactively monitors all incoming reports and can respond immediately when someone's safety is concerned"
  • an option to report anonymously, because students are more likely to come forward without fear of retribution
  • confidence that "reports will be acted upon, kept confidential, and handled appropriately"

In practice. Pick channels people already use, publish them everywhere, and make sure reports land in one place, not scattered across inboxes. A standard Concern Reporting Form helps reporters include what the team needs.

Step 4: Determine the threshold for law enforcement intervention

What NTAC recommends. Most reports can be handled with school and community resources. But reports involving "weapons, threats of violence, physical violence, or concerns about an individual's safety should immediately be reported to local law enforcement." If no SRO serves on the team, set a clear threshold for when law enforcement will be asked to support or take over an assessment.

In practice. Write the threshold into your procedures, with names and phone numbers, and train the team on it so nobody hesitates in the moment.

Step 5: Establish assessment procedures

What NTAC recommends. Clearly defined procedures that let the team "form an accurate picture of the student's thinking, behavior, and circumstances." Any safety concerns are addressed first. Then the team:

  • reviews social media, conducts interviews, reviews class assignments, and considers searching the student's locker or desk
  • reviews academic, disciplinary, law enforcement, and other records, including prior reports and what interventions were tried
  • maintains documentation, with forms and templates "to ensure standardization across cases"
  • uses a community systems approach, gathering information from family, classmates, teachers, neighbors, online platforms, and others
  • builds rapport with the student and family
  • evaluates behavior in the context of the student's age and development

The team organizes what it learns around 13 investigative themes, and doesn't wait to finish every interview before acting on a need it has found.

In practice. Use a consistent worksheet for every case so nothing is skipped and cases can be compared. Our Threat Assessment Worksheet follows the 13 themes.

Step 6: Develop risk management options

What NTAC recommends. After the assessment, the team evaluates whether the student is at risk of harming themselves or someone else, remembering that the team "is not attempting to predict with certainty if violence will happen." Then:

  • every student gets an individualized management plan
  • often the student isn't at risk of violence but needs monitoring or support to cope with losses, build resilience, or manage emotions
  • plans stay in place "until the Team is no longer concerned"

NTAC lists basic elements of management: notify law enforcement immediately if a student is thinking about or planning violence; address the safety of potential targets; create a situation less prone to violence (for example, asking family or law enforcement to block access to weapons); remove or redirect the motive; and reduce the effect of stressors.

If suspension or expulsion is necessary, NTAC cautions that "removing a student from school does not eliminate the risk," and teams should find ways to stay connected with the student.

In practice. Give every action an owner and a date, and review open plans on a schedule. See the Management Plan template.

Step 7: Create and promote safe school climates

What NTAC recommends. Positive climates "built on a culture of safety, respect, trust, and social and emotional support." That means breaking down "codes of silence," helping students feel connected to adults and classmates, and considering programs such as Positive Behavioral Interventions and Supports (PBIS).

In practice. NTAC describes one school that gave faculty a roster and asked them to mark students they had a warm relationship with. Students without a mark were paired with staff who reached out. Simple, cheap, and effective.

Step 8: Conduct training for all stakeholders

What NTAC recommends. Training for faculty, staff, and administrators (including maintenance, custodial, and food service staff); students; parents; and SROs or local law enforcement. "School safety is everyone's responsibility." Training should cover the goals and steps of an assessment, what to bring forward, and how to report.

For students, NTAC stresses the difference between "snitching" and seeking help, and reminds them to keep speaking up until a friend gets the help they need.

In practice. Plan training by audience and repeat it each year. New staff and new students need it most.

Sources

U.S. Secret Service National Threat Assessment Center, Enhancing School Safety Using a Threat Assessment Model: An Operational Guide for Preventing Targeted School Violence (2018), free at secretservice.gov/protection/ntac.

Frequently asked questions

What is the NTAC threat assessment model?

It's the framework in the U.S. Secret Service National Threat Assessment Center's 2018 operational guide, Enhancing School Safety Using a Threat Assessment Model. It describes eight steps for a comprehensive targeted violence prevention plan in K-12 schools.

Do we have to complete the steps in order?

No. The steps describe the parts of a complete program, not a strict sequence. Most schools start with the team (step 1), then write procedures (steps 2 to 6), and build climate and training (steps 7 and 8) continuously.

Is the NTAC model required by law?

The NTAC guide is guidance, not a federal mandate. Many states have their own laws requiring school threat assessment teams or specific procedures, so check your state's requirements with counsel.

Can the model be used for adults, not just students?

NTAC notes the plan can also help schools mitigate threats from a variety of individuals, including employees and parents. The guide itself focuses on students.

Every attacker in the Secret Service's study showed concerning behavior first.

Make sure the people who notice it have somewhere to go, and your team has what it needs to act.