THE CLERY ACT: IMPROVING EMERGENCY NOTIFICATION PROCESSES by Suzanne Blake & Dr. Steven Goldman, by Massachusetts Institute of Technology
About the Authors SUZANNE BLAKE, MS, CEM, is the Manager of MIT s Office of Emergency Management. She has over 15 years of experience in higher education emergency management and emergency notification programs. Prior to working at MIT, Suzanne worked for Witt O Brien s as an Emergency Management Consultant and Manager of the company s Higher Education Practice. In this position, she traveled to higher education institutions across the country to assist them in developing their emergency management plans, programs, teams, and systems. Prior working at Witt O Brien s, Suzanne served as University of North Carolina Wilmington s first emergency manager. Suzanne is a founding member of the International Association of Emergency Managers (IAEM) Universities and Colleges Caucus (UCC), with which she has worked extensively to ensure disaster resistance and resilience is instilled in institutions of higher education worldwide. You can reach Suzanne at smblake@mit.edu. DR. STEVEN B. GOLDMAN is an internationally recognized expert and consultant in Business Continuity, Crisis Management, Disaster Recovery, and Crisis Communications. He has over 35 years experience in the various aspects of these disciplines, including program management, plan development, training, exercises, and response strategies. His background is comprehensive yet unique in that he has been a professional engineer, corporate spokesperson, manager of media relations, business continuity planner, crisis responder, consultant, and a Fortune 500 Company s Global Business Continuity Program Manager. He has been invited to speak at industry conferences globally. Dr. Goldman is a cofounder and Senior Lecturer at MIT s Crisis Management & Business Continuity Professional Education summer course. Currently he provides expert handson consulting services to corporations, non-profits, and government agencies worldwide. You can reach Steve at goldmans@mit.edu.
Introduction In this White Paper The Clery Act: Improving Emergency ification Processes we will cover the following topics: Introduction Caveats The Clery Act Timely Warnings vs. Emergency ifications Emergency notification process requirements and best practices The MIT System Emergency ification Program Assessment Gap Analysis Tool Summary Appendix: Emergency ification Gap Analysis Tool The authors wish to thank Everbridge for their sponsorship and support on this very important issue. Caveats 1. You must obtain The Handbook for Campus Safety and Security Reporting, 2016 Edition. It details the Department of Education s interpretation of the Clery Act and its safety and security requirements. (https://www2.ed.gov/admins/lead/safety/handbook.pdf) 2. This White Paper discusses only emergency notification, and not the additional safety and security requirements covered in the Handbook or the Clery Act itself. 3. Although everyone should comply with the guidelines in the Clery Act regarding emergency notification, each institution should develop an emergency notification program that works best for the unique needs of their institution.
The Clery Act The Clery Act had its origin in 1990 when the Crime Awareness and Campus Security Act of 1990 was established, amending the Higher Education Act of 1965. The Crime Awareness and Campus Security Act was created after a student named Jeanne Clery was raped and murdered in a residence hall at Lehigh University in 1986. The Act required higher education institutions that received federal funding to report crime statistics, notify the campus community of threats, and compile and distribute an annual campus security report to the campus community, prospective students, and employees. In 1998, the Act was further amended and renamed the Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act (the Clery Act ) in her memory. In 2008, following the Virginia Tech shootings in 2007, the Higher Education Opportunity Act (HEOA) of 2008 reauthorized the Higher Education Act of 1965, and included the Clery Act requirements, which were amended based on lessons learned from the Virginia Tech incident. This amended version of the Clery Act includes new regulations related to emergency response, emergency notification, timely warnings, missing student notification, fire safety reporting, and hate crime reporting. In 2016, the U.S. Department of Education released a new Handbook for Campus Safety and Security Reporting. This Handbook details the Department of Education s interpretation of the 2008 version of the Clery Act and its safety and security requirements. Although the Clery Act covers considerable additional topics regarding safety and security reporting, the emergency notification components are some of the most complex and concerning for institutions of higher education nationwide. Therefore, this White Paper discusses only the emergency notification requirements, and not the additional safety and security requirements covered in the Handbook or the Clery Act itself. Timely Warnings vs. Emergency ifications Under the Clery Act, every institution must: Issue a timely warning for any Clery Act crime that represents an ongoing threat to the safety of students or employees, and issue an emergency notification upon the confirmation of a significant emergency or dangerous situation involving an immediate threat to the health or safety of students or employees occurring on the campus.
The difference between timely warnings and emergency notifications are described in the table below. Criterion Timely Warning Emergency ification What Where Crimes that continue to pose a threat On-campus or non-campus (including public property that falls in your Clery Act Geography) Any significant emergency or dangerous situation that poses an immediate threat to the health or safety of students or employees On-campus only (including on-campus public property that falls in your Clery Act Geography) Who The entire campus community Can be tailored to the segment of the community that is threatened When Sent when enough information is available to adequately describe the threat Sent immediately upon confirmation of the threat We recommend that you develop procedures, training, and exercises for both timely warnings and emergency notifications. Don t forget to document everything while doing this! Emergency ification Process Requirements and Best Practices Along with the language of the Clery law, several emergency management standards outline essential elements of emergency notification programs. One of these standards is the Emergency Management Accreditation Program (EMAP) standards, Communications and Warning section. Additionally, over the past 10 years, higher education institutions have evolved and perfected their emergency notification programs, which has elicited best practices in emergency notification. First let s look at the language of the (Clery) Law. Then we will discuss the EMAP criteria for Communications and Warning. Finally, we will present some exemplary practices. A gap analysis tool is included as an appendix to this White Paper that you
can use to assess your emergency notification program using the laws, standards, and best practices described in this paper. The language of the (Clery) Law is best approached by tabulating the relevant language: Program Element The institution must have A statement of current campus policies regarding immediate emergency response and evacuation procedures, including the use of electronic and cellular communication (if appropriate) policies shall include procedures to immediately notify the campus community upon the confirmation of a significant emergency or dangerous situation involving an immediate threat to the health or safety of students or staff occurring on the campus unless issuing a notification will compromise efforts to contain the emergency The institution must publicize emergency response and evacuation procedures on an annual basis in a manner designed to reach students and staff The institution must test emergency response and evacuation procedures on an annual basis. EMAP suggests that your plan outlines: How to initiate, receive, and/or relay warnings to alert key decision makers and personnel How to disseminate emergency alerts to the public Delineation of the decision-making process and triggering incidents You must also verify that the plan is: Designed for specific hazards and the institution's environment Reviewed and updated on a regular basis (and this process must be documented)
Your Emergency ification System is your means to communicate reliably, but you must have redundancy in the system and tools you use and alternate means of notification. These systems must be able to notify vulnerable populations. EMAP also indicates that notification systems should be regularly tested and that you should develop clear procedures and system tools for operation of the emergency notification system. Exemplary practices have emerged over the past 10 years as institutions of higher education have built and improved their emergency notification programs. We have compiled some common exemplary practices for emergency notification programs below, but are sure others exist. Feel free to forward your experiences to us; our e-mails are listed at the beginning of this White Paper. Plan Development and Process ü Various stakeholders across campus have worked together to develop the program ü Ability to disseminate emergency notification messages expediently ü Determined ahead of time situations in which the emergency notification system will be activated ü Process to distinguish between situations that need immediate notifications and those that can take more time ü Change management procedure Authority and Decision-Making ü Determined in advance who has the authority to initiate, approve, and broadcast notifications ü Clear and streamlined decision-making process for issuing notifications ü Authority and decision-making pushed to operations level ü Originate from a trusted campus authority for safety Tools and Technologies ü Suite of tools and technologies that have redundancy ü SMS text alert database ü System that allows for choosing appropriate modes depending on the emergency Scope of ifications ü System allows for dissemination to as much of the community as possible
ü Program is opt out or enrollment is mandatory ü Ability to send notifications to smaller groups, such as first responders and decision makers ü Methods to notify temporary community members (contractors, visitors, etc.) ü Methods to communicate with the external community (including parents) Messaging ü Clear and concise audible and written messages that contain appropriate and useful information ü Pre-scripted messages to speed process ü Process to quickly send follow-up messages Access and Implementation ü Security measures in place to protect the system and access to it ü Users and operators work in an environment that allows for effective and expedient operation of the system ü Individuals involved in the process have received appropriate and regular training Testing, Training, and Education ü Frequent but reasonable schedule for testing and exercising tools, technologies, and processes ü Education and outreach to the university community about the program, what to expect, and how to respond Integration into Emergency Management and Safety Program ü Ability to integrate emergency notification process into first responder operations ü Crisis communications plan in place that integrates with emergency notification plan The MIT System If you would like specific information about MIT s emergency notification program, please contact Suzanne Blake, Manager of MIT Emergency Management, at smblake@mit.edu.
Emergency ification Program Gap Analysis Tool This white paper includes an Emergency ification Program Gap Analysis Tool for you to use to assess your emergency notification program (see Appendix A). This tool was developed by Suzanne Blake for use at higher education institutions to assess their emergency notification programs. It includes language from the Clery Act regarding emergency notification requirements, communication and warning elements from the Emergency Management Accreditation Program (EMAP) standards, and tried and true best practices developed by higher education institutions over the past 10 years as we have been developing and implementing our programs. Use this tool to assess your program and determine if you have addressed each respective element, have partially addressed the element, or have not yet addressed the element. The tool also includes a space to write up findings on each element (next steps, which plan outlines the elements, who will be assigned to improve the element, etc.). Completing the assessment will provide you with a work plan of what to address next to improve your program and how to ensure your program is compliant with laws, standards, and best practices. Summary In the past 10 years, higher education institutions have done considerable work on developing their emergency notification programs. Remember: Exemplary practices do exist! Don t reinvent the wheel. You should have reliable, tested, and user-friendly tools and technologies in place to aid in the process. And always remember that what works for one institution may not work for another. Use exemplary practices, but tailor your program to the unique needs of your institution.
About Everbridge Everbridge, Inc. (NASDAQ: EVBG) is a global software company that provides critical event management and enterprise safety applications that enable customers to automate and accelerate the process of keeping people safe and businesses running during critical events. During public safety threats such as active shooter situations, terrorist attacks or severe weather conditions, as well as critical business events such as IT outages or cyber incidents, over 3,000 global customers rely on the company s SaaS-based platform to quickly and reliably construct and deliver contextual notifications to millions of people at one time. The company s platform sent over 1.5 billion messages in 2016, and offers the ability to reach more than 200 countries and territories with secure delivery to over 100 different communication devices. The company s critical communications and enterprise safety applications, which include Mass ification, Incident Management, IT Alerting, Safety Connection, Community Engagement, Secure Messaging and Internet of Things, are easy-to-use and deploy, secure, highly scalable and reliable. Everbridge serves 8 of the 10 largest U.S. cities, 8 of the 10 largest U.S.-based investment banks, all four of the largest global accounting firms, 24 of the 25 busiest North American airports and 6 of the 10 largest global automakers. Everbridge is based in Boston and Los Angeles with additional offices in San Francisco, Lansing, Beijing, London and Stockholm. Visit www.everbridge.com to learn more.
Appendix A: Emergency ification Gap Analysis Tool Higher Education Opportunity Act of 2008 Requirements (Clery requirements) # HEOA Standard Element Findings 1 2 The university must have A statement of current campus policies regarding immediate emergency response and evacuation procedures, including the use of electronic and cellular communication (if appropriate) policies shall include procedures to immediately notify the campus community upon the confirmation of a significant emergency or dangerous situation involving an immediate threat to the health or safety of students or staff occurring on the campus unless issuing a notification will compromise efforts to contain the emergency 3 The university must publicize emergency response and evacuation procedures on an annual basis in a manner designed to reach students and staff
# HEOA Standard Element Findings 4 The university must test emergency response and evacuation procedures on an annual basis.
EMAP Standards for Communications and Warning # EMAP Standard Element Findings 1 2 3 4.10.3 The Emergency Management Program has developed and maintains a plan to initiate, receive, and/or relay warnings to alert key decision makers and emergency personnel... This capacity has been designed for the specific hazards and requirements of the [institution s] potential operating environments and includes redundancy to provide alternative means of notification in case of failure in primary systems. 4 4.10.4 ification systems are regularly tested on an established schedule under operational conditions and results documented and addressed.
# EMAP Standard Element Findings 5 6 4.10.5 The Emergency Management Program has developed and maintains a plan to disseminate emergency alerts and warnings to the public potentially impacted by an actual or impending emergency and to communicate reliably with the population within [the institution] 7 8 9 The plan addresses dissemination of alerts and warnings to vulnerable populations as defined by the Emergency Management Program. 4.10.7 The Emergency Management Program has developed and maintains formal written procedures to ensure personnel familiarity with and the effective operation of the systems and capabilities of the ification and Warning systems These procedures clearly delineate any decision making processes or triggering events, and are reviewed and updated regularly on an established schedule
# EMAP Standard Element Findings 10 " The review/update process for notification procedures is recorded and documented.
Exemplary Practices # Exemplary Practice Findings 1 2 3 4 Various departments across the university have worked together to formulate and establish the emergency notification program (police and public safety, emergency management, IT, public affairs, various campuses, etc.). The university has the ability to disseminate emergency notification messages expediently, i.e., as quickly as information about an emergency can be verified. The university has determined ahead of time the situations in which the emergency notification system will be activated (i.e. when to send emergency notifications). The university has a process in place for distinguishing between situations that need immediate emergency notifications disseminated and those that can take more time and discussion to disseminate.
# Exemplary Practice Findings 5 6 7 8 9 10 The university has adopted a change management procedure so that everything is documented and everyone knows about system changes/improvements. The university has determined in advance who has the authority to initiate, approve, and broadcast emergency notifications. The university has a clear and streamlined decision making process for issuing emergency notifications. The university has implemented emergency notification procedures that clearly push time-sensitive authority and decision-making to the field or operations level in order to achieve immediacy in broadcasting emergency notifications. Emergency notification messages originate from a trusted campus authority for safety and security. The emergency notification program includes a suite of tools and technologies that have redundancy.
# Exemplary Practice Findings 11 12 13 14 15 The university has an automated SMS text alert database. The university has a system that allows for choosing appropriate delivery modes of emergency notification messages depending on the specifics of the emergency. The university s emergency notification program allows for dissemination of emergency notifications to as much of the university community as possible. The university has made enrollment in the emergency notification system an opt-out program, or makes enrollment in the program mandatory. The university has the ability to send emergency notification messages to smaller groups, such as first responders and decision makers, using the tools and technologies associated with the emergency notification system.
# Exemplary Practice Findings 16 17 18 19 The university includes methods to notify temporary community members (i.e. contractors, vendors, and temporary employees), visitors, and the transient public in the emergency notification system. The university has determined how it will communicate with the external community (including parents) during and after an emergency. The university has created clear and concise audible and written messages to include in the emergency notification system that contain appropriate and useful information. The university has created prescripted messages to increase the speed of emergency notification dissemination, both for initial notifications and follow-up messages.
# Exemplary Practice Findings 20 21 22 23 24 The university has a process in place for quickly sending follow-up messages and information when initial emergency notification messages contain general information only. The university has incorporated security measures to protect the emergency notification system, with access granted only to authorized and trained users. Users and operators of the emergency notification system work in an environment that allows for effective and expedient use and operation of the system. The university has delineated clear roles and responsibilities and has supplied appropriate training to individuals who play a role in the emergency notification process. The university has a frequent but reasonable schedule for testing and exercising the various tools and technologies in the emergency notification system.
# Exemplary Practice Findings 25 26 27 The university provides appropriate and sufficient education and outreach to the entire university community about how the emergency notification system is used, what to expect when an emergency notification is disseminated, and what to do to respond to an emergency after receiving an emergency notification. The university has worked to ensure that all emergency management and response entities will work together to create a unified message in emergencies, including in initial emergency notifications. The university has a comprehensive crisis communications plan in place that coordinates seamlessly with the emergency notification system.