Appendix B — Threat triage and immediate response card

Appendix B — Threat triage and immediate response card Scope This card supports initial routing; it is not a professional threat assessment. When uncertain about imminent danger, choose safety and contact qualified local authorities. Local law and emergency guidance control. LEVEL EXAMPLES DO NOW DO NOT 4 — Emergency Attack, weapon, fire, forced entry, immediate specific threat. Move to safety; call emergency services; follow trained authorities; help dependents if safe.

Do not film, post, confront, or delay for evidence. 3 — Urgent Specific target/time/place, stalking, doxxing with violent language, escalating fixation, apparent access/capability. Contact authorities/security; protect target; preserve evidence; restrict details; activate leadership. Do not investigate alone or announce vulnerabilities. 2 — Serious incident Discrimination, repeated targeted harassment, vandalism without active danger, organized exclusion. Support person; document; report; preserve due process; assign follow-up.

Do not minimize, retaliate, or broadcast private evidence. 1 — Offensive / concerning Slur, stereotype, ambiguous meme, isolated hostile comment; no target/action signal. Choose education, boundary, moderation, documentation, or monitoring. Do not create unnecessary virality or label a whole group dangerous. Behavior-based questions

What exactly was said or done? Preserve verbatim language; do not paraphrase first.

Is a person, institution, event, time, or location identified?

Is there a method, weapon, capability, access, surveillance, or operational detail?

Is conduct escalating in frequency, specificity, proximity, or fixation?

Is personal information exposed? Are children or vulnerable people involved?

Has the person/network acted before? What is verified versus rumor?

What immediate protective capacity exists—authorities, security, venue, family, allies? Local contact card — complete before distribution ROLE NAME / NUMBER / LINK WHEN TO USE Emergency services [LOCALIZE] Immediate danger, attack, fire, medical emergency. Police non-emergency / hate crime [LOCALIZE] Serious non-immediate incident and followup. Institution decision lead / alternate [LOCALIZE] Activate internal response and authority. Security / venue / school / workplace [LOCALIZE] Protect people and coordinate operations. Safeguarding lead [LOCALIZE] Children, abuse, vulnerable adults, mandated reporting. Cyber / platform escalation [LOCALIZE] Doxxing, account compromise, coordinated harassment. Legal / civil-rights referral [LOCALIZE] Rights, discrimination, evidence preservation, legal options. ROLE NAME / NUMBER / LINK WHEN TO USE Mental-health / pastoral support [LOCALIZE] Distress, recovery, family and spiritual support. ReJEWenate coordinator [LOCALIZE] Education, accompaniment, referrals, evidence pack—not emergencies. What to say when calling for help 1. State your name, callback number, and exact location. 2. Describe concrete behavior: exact words, weapon/method if seen, target, time, direction, injuries, fire, or access. 3. State what is happening now, not only why you think it is antisemitic. 4. Mention access or medical needs and whether children or vulnerable people are present. 5. Follow instructions; record the report/reference number when safe. Source trail: U.S. DOJ reporting portal

CISA houses of worship

USFA six steps