• United States




How to address civil unrest

Apr 06, 20175 mins
Business ContinuityDisaster RecoverySecurity

A checklist that enterprises can peruse in preparation, response, and mitigation of an incident.

As the state of public discourse around political ideology remains a flashpoint for demonstrations and dissent, differentiating between peaceful protest and a violent public disturbance is vital. Operational and security management within organizations should view current events as a catalyst for evaluating enterprise best practices and policies around preparing office locations and employees for potential civil unrest.

In order to frame considerations and timelines around emergency preparedness response plans, law enforcement has identified the escalation of civil unrest in three evolutionary phases. The first phase constitutes the incident initiating a disturbance among a small group. The second phase commences as other individuals, alerted by social media and news reporting, join the smaller group, often for the purpose of looting, spectating and otherwise causing damage. Often, these individuals are not concerned or associated with the incident that gave rise to the disturbance. The third phase begins when organized groups join in the unrest with planned disruptive activities directed against targets of opportunity or “soft targets.”

Best practices for how companies or organizations should prepare for or respond to such incidents depend on many factors, including the nature of the precipitating event, proximity of location and type of business. Curated below is a list of recommendations for businesses and individuals to help mitigate the risks from civil unrest situations, taking into account these variables and associated pathways for escalation, communication and response.

Best practices: Protecting businesses against civil unrest

Recent outbreaks of civil unrest are a reminder to businesses of the necessity to develop and maintain comprehensive emergency preparedness response plans. Emergency plans define the scope of preparedness and incident management activities that are necessary for an organization to respond during a civil unrest incident.


Companies must have comprehensive plans in place to account for employees and their family members in the event of civil unrest or other emergencies; plans must include clear lines of communication and detailed guidelines for actions that all levels of staff should take during and after such an incident. As part of these efforts, enterprises should:

  • Maintain ongoing close communications with local, state and federal law enforcement;
  • Coordinate response plans across functional disciplines (police, fire, medical, and private sector);
  • Continuously review, update and drill procedures and best practices; 
  • Conduct threat analyses, vulnerability assessments, consequence analyses, and security audits on a regular and ongoing basis;
  • Insurance coverage should be reviewed to ensure that proper limits and terms are included in a policy to ensure reliance after an incident;
  • Ensure all emergency communications equipment is operational and post clear instructions for their use;
  • Establish and implement an emergency communications system for personnel (i.e., phone trees or text messages);
  • Establish safe areas within the facility for people to assemble and seek refuge during a crisis;
  • Maintain resource listings to support an emergency action plan;
  • Develop means for employees to receive updates about local and state law enforcement or government advisories;
  • Develop an evacuation plan and designated destination if relocation from the business is necessary; and
  • Estimate need for scalable auxiliary security forces, as necessary.

Response and mitigation

Response and mitigation best practices protect against, or at least minimize, the chances that the business will be targeted during a civil unrest situation and require universal effort. All businesses need to be alert at all times to any suspicious indicators and designate clear pathways for escalation and response, which anticipate and avert the potential for wide-scale attacks on critical infrastructure and transportation for significantly disrupting day-to-day economic and commercial activity. Tactics include:

  • Promoting awareness of developing threats and vulnerabilities that will affect the business or employees;
  • Reporting suspicious activity to proper authorities, and training security personnel to watch for;
  • Abandoned parcels, suitcases, backpacks and packages;
  • Gatherings of unknown individuals around the business;
  • Acts of violence or destruction of property;
  • Alerting employees to exercise caution if a large or suspicious-looking group is gathering outside the business. Employees should be instructed to leave the area, or shelter in place before the situation escalates;
  • Alerting employees to remain inside the building and away from the windows if avoiding the disturbance is unfeasible;
  • Alerting employees to evacuate calmly and avoid confrontations with demonstrators, if evacuation is necessary;
  • Securing the business by locking all doors and protecting all sensitive areas;
  • Designating a pre-determined location away from a threatening environment (rally point) to meet employees, bearing in mind that during a civil unrest situation, traditional means of communication (mobile phones, email, text, etc.) may be disabled.

Additional considerations

  • Institute security access controls;
  • Provide appropriate signage to restrict access to non-public areas;
  • Remove vehicles parked for an unusual length of time, including at adjacent buildings;
  • Install secure locks and protection on all internal/external doors and windows, with quick-release capability;
  • Ensure that the business facilities have at least two clear means for egress in the event of an emergency;
  • Ensure area supervisors are trained in directing all personnel (employees, customers, visitors, vendors, etc.) in their area to safely evacuate the facility; and
  • Identify alternate gathering points where employees can meet for coordinated evacuation.

Preparing for any type of crisis or emergency is a shared responsibility within an organization. An organization’s success or failure in response to incidents of civil unrest is predicated upon how an organization prepares in advance for such dynamic incidents.

Tell us what you think. Head to our Facebook page.


Jonathan Wackrow is a security professional with 18+ years of high level management and operational planning experience with exceptional knowledge in risk assessments and security operations. He has spent the majority of his career in the United States Secret Service, serving as criminal investigator in New York City and on the Presidential Protection Division. He is currently a Managing Director at Teneo Risk, a strategic threat advisory firm that offers CEOs a holistic approach to identify, manage and mitigate operational risks to their businesses.

Jonathan is formerly an Executive Director at RANE, an information and advisory services company that connects business leaders to critical risk insights and expertise to drive better risk management outcomes.

As President of i4 Strategies, Jonathan advised leading corporations on critical infrastructure protection, physical security, executive protection and crisis management procedures. His philosophy towards corporate security is simple; security should be a workforce multiplier to enhance other divisions, helping to achieve the fiscal goals of the company.

Jonathan is a CNN Law Enforcement Analyst and is a regular commentator on security and risk management on other major news outlets.

The opinions expressed in this blog are those of Jonathan Wackrow and do not necessarily represent those of IDG Communications, Inc., its parent, subsidiary or affiliated companies.