CISA Releases De-Escalation Series for Critical Infrastructure Owners and Operators


The De-Escalation Series for Critical Infrastructure Owners and Operators contains four products to assist Critical Infrastructure Owners and Operators to recognize the warning signs of someone on a path to violence; assess if the situation or person of concern is escalating, or if an emergency response is needed immediately; de-escalate the situation currently taking place through purposeful actions, verbal communication, and body language; and report the situation through organizational reporting to enable assessment and management of an evolving threat, and 9-1-1 for immediate threats.


The De-Escalation Series for Critical Infrastructure Owners and Operators follows the Employee Vigilance Through the Power of Hello to help critical infrastructure owners, operators, and staff identify and navigate suspicious activity or potentially escalating situations to safely dis-engage and report to local law enforcement or their organization’s multi-disciplinary threat management team. The products contain a small list of examples of potential stressors, changes in baseline behaviors, observable behavioral indicators, observable physical behaviors, and potential warning signs of an escalating person; these are not intended to be taken as single indicators but should be observed to support a holistic assessment of the person of concern’s circumstances and stressors.


This series describes activities and behaviors that may be concerning or indicative of impending violence. Some of these activities while concerning, may be constitutionally protected and should be reported only when there are sufficient facts to support a rational conclusion that the behavior represents a potential threat of violence. Do not report based solely on protected activities, or on the basis of race, religion, gender, sexual orientation, age, disability, or a combination of only such factors. In addition, be aware that critical infrastructure owners and their operations may also be targeted based on these factors.



ASSESS - How to Navigate the Risk When Someone is Escalating

DE-ESCALATION - How You Can Help Defuse Potentially Violent Situations

RECOGNIZE - How You Can Notice the Warning Signs of Violence

REPORT - How to Engage Your Organization and Community


Steve Lyddon
Protective Security Advisor, Region 5, Illinois
Cybersecurity and Infrastructure Security Agency