General Order




Active Assailant Response


July 10, 2019




May 19, 2023



Sheriff of Monroe County


    The purpose of this Policy is to establish guidelines for sworn and non-sworn personnel responding to an Active Assailant Event (AAE).


    Before Special Weapons and Tactics (SWAT) concepts were developed, patrol law enforcement officers responding to AAE and other high-risk events acted with the equipment they carried and handled the matters themselves. Once SWAT teams were established, agencies trained initial responding officers to set perimeters and contain AAEs until a SWAT team arrived. This led to unacceptable delays in stopping active assailants and mitigating casualties. Law enforcement philosophy evolved and it is now recognized that containment is not the best practice; the first law enforcement officers on the scene must take immediate action to stop the threat, acting alone when necessary.

    A single officer response to an AAE may be required in response to an armed individual who is actively injuring or killing people. Officers responding to these events should remain cognizant that time is of the essence because most innocent lives are lost during the first few minutes of the AAE event. It is imperative that Officers rapidly assess the situation and act quickly.

    These tactics are specifically designed for then–occurring AAEs and situations where people are reasonably believed to have suffered life-threatening injuries because of the AAE. These tactics are not necessarily appropriate for barricaded persons or hostage situations when active harm toward others is not occurring or there are no people present who need to be immediately rescued because of their life- threatening injuries. Although an active assailant exhibits some of the same basic characteristics as hostage and barricaded suspects, active assailant suspects are generally quite different. Active assailant situations usually develop quickly into a deadly situation and are often concluded in a relatively short period of time. Any delay in response and action may result in the further loss of life.


    1. Active Assailant – One or more people who participate in a life-threatening assault and demonstrate their intent to continuously or systematically kill or wound others.

    2. Active Assailant Event (AAE) – An incident where one or more Active Assailants act to harm or kill others. Such events include, but are not limited to: school shootings, workplace violence, terrorist activities, and snipers.

      Commented [TW1]: Added Stimulus back in

    3. . Stimulus: anything that drives or directs a Deputy to the active threat(s) known location. This should be treated as evidence that the active threat(s) are in a specific place. Example: gun fire, screaming, people pointing the direction of the suspect, etc.        

    4. Ambulance Exchange Point (AEP) – An area that is located near the Triage Post where, after triage is completed, victims are moved to for awaiting transport. The area should have easy ingress and egress and allow for staging of multiple ambulances.

    5. Barricaded Subject – A person who takes a position of confinement to avoid apprehension (the use or threatened use of force to resist apprehension shall have been displayed through actions or words and the officer shall have reason to believe the suspect will use force to avoid apprehension). A barricaded subject situation is not one where active deadly force is occurring or where there are victims of deadly force with life threatening injuries who need to be immediately rescued, as that is an AAE.

    6. Casualty Collection Point (CCP) – A temporary location(s) in the Warm Zone where injured victims can be quickly and safely assembled until it is feasible to move the patients to the Triage Post or another formal treatment area.

    7. Critical Incident Stress Management Team (CISM) – A multi-faceted team comprised of agency and outside personnel that includes trained mental health professionals and religious volunteers.

    8. Command Post – A post established by the Incident Commander to direct emergency operations. This may include where the Unified Command is located.

      Commented [TW2]: Eliminated “the first”

    9. Contact Team – A team formed by two to five law enforcement officers on scene who are capable of immediate response to an AAE. Contact Team formations are generally a “T” or diamond formation that provide 360-degree security while advancing through unsecured areas to engage an active assailant. Contact Team formations and tactics are similar to Rescue Task Force formations. Based upon the circumstances an officer shall take immediate action if they are the only person on scene. The officer shall not wait for another officer/deputy to arrive to take immediate action to stop the threat.

    10. Deceased Victim Staging Area—An area within the outer perimeter to where deceased victims are transported for identification, processing by the Medical Examiner and subsequent transportation to the Medical Examiner’s Office.

    11. Hostage Situation – Incidents involving an act or potential act of violence where an innocent person(s) is being held against their will, and may include a situation where the person is used as a bargaining tool or a “shield.”

    12. Incident Commander –The Incident Commander is solely responsible for managing the entire incident, to include: approval of the tactical plan, deployment of personnel, development of staff functions to control the incident, coordination of contributing agencies, ordering and releasing of resources, and the release of information pertaining to the incident. The Incident Commander shall be based at the Command Post.

    13. Mobile Command Center (MCC) – A special purpose vehicle primarily designed to house the Command Post and provide communications services at the scene of emergency operations.

    14. Operational Zones:

      1. Zone designations are dynamic and will change as the incident develops.

        1. Cold Zone – An area where there is no threat level and law enforcement has designated it as secure. The Command Post (including Unified Command), patient triage, treatment, and transport are organized and located in this zone.

        2. Warm Zone – An area where there is a moderate threat level and the area has not been completely cleared. Law enforcement protection for Fire Rescue units is required to enter this area.

        3. Hot Zone – An area where there is a high threat level. Active combat is occurring or is likely to occur in this area. EMS/ Fire Rescue personnel, with the exception of SWAT Medics, shall not operate in a Hot Zone.

      2. Inner Perimeter – The immediate area of containment, including the Hot Zone and Warm Zone. This area is initially staffed by patrol personnel until relieved by SWAT Team officers.

      3. Outer Perimeter – A control area set up outside the Inner Perimeter to restrict crowd and traffic from accessing the Inner Perimeter. It is staffed by law enforcement officers. The perimeter teams focused externally to prevent unauthorized people from breaching security.

        Critical Incident Traffic Checkpoints: are deployed as a means to be a containment

      4. Commented [TW3]: I think this is important given our geography.

        procedure in response to a critical incident such as an active assailant incident. The checkpoints may be part of the outer perimeter, or they may be established on roadways which provide an exit indispensable for vehicular traffic. Officers should immediately secure the area of the critical incident. Checkpoints may be established to ensure only authorized individuals enter the area. Critical incident traffic checkpoints cannot be used as a pretext for general crime detection.

    15. Public Information Officer (PIO) – Disseminates information to the public and media at the direction of the Sheriff/Police Chief or designee.

    16. Rescue Task Force (RTF) – A rapid medical response team that operates in the Warm Zone under the protection of law enforcement officers. These teams rapidly assess and stabilize major trauma and they extricate the injured to treatment areas or temporary staging areas, such as CCPs. Teams are minimally composed of one Paramedic, one EMT, and two law enforcement officers.

    17. Reunification Post – A post established where victims are transported to be reunited with family and friends and for victims’ family and friends to await the rescue and debriefing of victims involved in the incident.

    18. Single Officer Response – An officer who arrives at an AAE and determines that it is necessary to respond alone to engage the active assailant and neutralize the threat. This officer will use the best information available and advance towards the threat using agency trained tactics to engage the active assailant.

    19. Tactical Operations Commander (TOC)—An on-scene commander designated by the Incident Commander who is located in the Warm Zone and who is responsible for coordinating the single officer response and contact teams, Rescue Taskforces, and all on- scene efforts to neutralize all threats and rescue all victims. The TOC is responsible for coordinating with the SWAT commander to maintain all perimeters and building/premises clearing. The TOC is responsible for ensuring evidence is preserved to the greatest extent possible.

    20. Threat – A situation where anyone is engaged in an active or on-going act of violence towards others and there is risk of serious bodily injury or death.

    21. Threat Suppression – The act to stop a threat to a person by locating, isolating, capturing or applying the lawful use of appropriate force against any person posing such threat.

    22. Triage Post – A post established by emergency medical personnel to evaluate and classify injuries for the purposes of treatment and evacuation. Personnel at the Triage Post conduct the immediate sorting of patients according to type and seriousness of injury, likelihood of survival and to establish treatment and evacuation priority. The Triage Post is separate from the Causality Collection Point and the Triage Post is established in the Cold Zone.

    23. Unified Command (UC) – The integration of command personnel from responding agencies at a multi- jurisdictional or multi-agency operational event to enhance communication, planning, and logistics. Unified Commands are designed to integrate law enforcement, fire, EMS and other appropriate disciplines. Once a Unified Command is established the Agency command post and Incident Commander will be located within the Unified Command.

    24. Victim Advocate – Responsible for providing victim / witness support services. Victim Advocates will serve as the Victim Services Coordinator at an AAE and will facilitate bringing additional victim advocates and support for the victims’ families.


    1. Law enforcement’s most important obligation is the preservation of human life.

    2. It is therefore the policy of this Agency to immediately and effectively respond to all reports of armed aggressive behavior involving acts of violence and take immediate action to stop the violence, or threat of violence and preserve life.

    3. Incidents involving active assailants are unpredictable and evolve rapidly. The immediate deployment of law enforcement officers to the incident location is essential in locating and eliminating the active assailant(s) and mitigating harm to victims.

    4. Every officer responding to an AAE shall take all action necessary to immediately stop the threat by locating, isolating, capturing, or applying lawful deadly force against any person posing an imminent threat to life.

    5. The decision to use deadly force must be based on the facts and circumstances known to the officer at the time the decision is made. When making the decision to use deadly force, officers shall consider the risk to innocent persons. The use of deadly force is governed by law and policy, including F.S. §§ 776.06, 782.02.

    6. Nothing in this policy prohibits any officer from taking any lawful, reasonable, and prudent action to intervene in any AAE.


    1. Planning

      1. When possible, MCSO shall obtain and maintain floor plans, contact lists and all other pertinent information related to facilities and locations deemed to be high risk targets of violence.

        1. Location maps or similar documents regarding high risk targets shall be made accessible to officers through the agency’s “Black Page.” The Major of Operations, or their designee shall review the floor plans, contact list and all other pertinent information related to facilities and locations on an annual basis.

    2. Communications Center Receipt of 911 call for Active Assailant

      1. All calls received advising of an incident that appears to be, or has the potential to become an AAE, shall be dispatched immediately over the radio as soon as a location is known. Once the call taker has advised the dispatcher, he / she will continue to obtain pertinent information related to the incident.

      2. If additional calls are received, responding officers shall be notified over the radio that multiple calls are being received. This will provide situational awareness for responding personnel.

      3. Only pertinent information related to the suspect(s) description and / or location should be relayed over the radio to responding units in order to minimize radio traffic.

      4. Once determined that the incident is an AAE, Communication shall activate SWAT, and Mutual Aid,

    3. Training

      1. The Training Division shall establish and conduct initial, refresher, and advanced response to AAE training for all applicable sworn and non-sworn personnel.

      2. All sworn law enforcement members should attend AAE response training at least annually.

      3. Active Assailant training should be scenario based and conducted at a school or other high- risk target. When possible, training shall be in collaboration with employees of the high- risk target. (E.g. school employees, teachers, etc.)

    4. Response

      1. Upon notification of an AAE, all Agency law enforcement officers within the district shall immediately respond to the scene to eliminate the threat as a single officer response or as part of a contact team. All members responding to a suspected AAE shall do so in a direct, expedient and prudent manner considering the possibility of explosives, sniper attacks or other counter assault tactics.

    5. First Officer or Officers On-Scene

      It shall be the responsibility of the first officer or officers on scene to:

      1. Stop the Active Threats(s) - All officers are expected to engage and neutralize an active assailant without delay and without regard for the presence of other officers.

      2. Facilitate access and evacuation of victims

      3. Provide medical assistance

      4. Arrest the suspect(s)

        Commented [TW4]: I prefer the simplicity here

      5. Preserve the crime scene                     

    6. Radio Communications

      1. Radio interoperability with surrounding jurisdictions is vital in AAE responses

      2. As part of the agency’s training program, radio interoperability shall be tested on a periodic basis.

    7. Deployment of a Single Officer Response or a Contact Team

      1. The purpose of a Single Officer Response or a Contact Team is to immediately stop the threat.

      2. A Single Officer Response or a Contact Team will not conduct any rescue operations that adversely affect the threat suppression response goal. Rescue Task Forces will tend to injured victims. Neither the Single Officer Response nor the Contact Team will stop until they neutralize the active assailant(s).

      3. A Contact Team can be formed using multiple single officer responders who are already active inside the deployment area.

      4. If not actively engaging the threat and/or once the threat is contained or eliminated, the Single Officer Response or Contact Team will update their location and progress via radio. Effort shall also be made to give locations of injured victims, casualties, suspicious or explosive devices, or any other pertinent information known to the officer or team.

    8. Movement / Clearing

      1. A Single Officer Response or a Contact Team’s movement past danger areas, over considerable distances, and through common areas should be done as quickly and safely as possible.

      2. Officers’ direction will be dictated by the stimulus. Officers should move toward the sound of gunfire, screams, or any other indicators of an active threat.

      3. When officers encounter fleeing victims prior to stopping the active assailant, they should direct victims to evacuate via the path traveled by the Single Officer Response or the Contact Team, unless it has been determined that the path is no longer safe.

      4. The Single Officer Response or the Contact Team should expect to encounter:

        1. Mass confusion

        2. Alarms

        3. Smoke

        4. Fires

        5. Sprinklers

        6. Explosives

        7. Seriously injured persons

        8. Emotional extremes

        9. Self-deploying law enforcement officers in various uniforms or attire.

      5. Officers’ entry and room clearing tactics will depend on the number of officers moving towards the active assailant.

      6. Once inside the room, movement should be directed immediately towards the active assailant. Engaging while moving and closing in on the threat is expected.

      7. If a member is in fresh pursuit of the active assailant and the active assailant enters a room with potential victims, the member shall continue to pursue and eliminate the threat.

    9. Threat Suppression

      1. The Single Officer Response or Contact Team’s main objective is threat suppression.

      2. If the situation changes from an AAE to a barricaded subject or hostage situation, then deploying officers should take up a close perimeter position around the area of the threat to isolate the incident and call for additional resources. However, just because active shooting has paused does not mean the incident is reclassified from an AAE to another type of situation and does not mean that tactics other than an active assailant response are appropriate. Each situation has to be evaluated on its merits and unique circumstances to determine the appropriate response.

    10. Mass Casualty Care / Rescue Task Forces

      1. The objective of the Rescue Task Force (RTF) is to assess the injured victims and extract them to the safest and most readily accessible area for treatment, which may be the Triage Post or a Casualty Collection Point. The Rescue Task Force is not formed to suppress the threat and does not operate in the Hot Zone.

      2. An RTF should be coordinated, compiled and directed via the Unified Command. The Unified Command will maintain control of and accountability for every deployed RTF because these groups are comprised of personnel from different agencies, and different disciplines, and members have various forms of expertise and training.

      3. Law enforcement officers’ primary function on the Rescue Task Force is the protection of the task force itself. EMS / Fire Rescue personnel’s primary function is to treat and extract the injured victims. Rescue Task Force members should stay together while searching the scene.

      4. The first EMS / Fire Rescue personnel on-scene should be deploying with the equipment that allows them to quickly integrate into an RTF with law enforcement officers.

      5. Law enforcement officers deploying into the scene who are not directly engaged with the assailant, may be assigned to RTFs with EMS / Fire Rescue personnel.

      6. The deployment location and direction of movement for an RTF should be determined based on information provided by the Single Officer Response, the Contact Team or at the direction of the Unified Command.

      7. Tactics involving the actual ingress and egress of the RTF from deployment location to its stopping point will be directed by law enforcement personnel. The RTF will not enter the Hot Zone.

      8. Once in the area of greatest and most obvious mass casualty, the RTF should begin extracting victims via appropriate means. The EMS / Fire Rescue personnel of the RTF will direct this portion of the response.

      9. EMS / Fire Rescue personnel are to provide guidance regarding victim priority. Top priority is to be given to those with the most severe injuries and risk of death.

      10. Treatment coordination and transport of the victims should be directed by EMS / Fire Rescue personnel.

    11. Inner Perimeter

      1. The Inner Perimeter is a portion of the Operational Zone.

      2. The Inner Perimeter shall be posted with as many law enforcement officers as needed to prohibit access to the Warm Zone.

      3. Only properly identified law enforcement or emergency medical personnel with an operational purpose shall be allowed to enter the Inner Perimeter.

      4. Fleeing victims and witnesses shall be allowed to leave the Inner Perimeter and directed to move to either a Reunification Post or Triage Post.

      5. Officers assigned to the Inner Perimeter must be aware that suspects may try to escape the scene while blending in with others who are fleeing.

      6. Officers assigned to the Inner Perimeter shall remain vigilant and on post until relieved by the SWAT Team or the Incident Commander.

      7. The perimeter should start larger and be reduced in size based upon the circumstances.

    12. Outer Perimeter

      1. The Outer Perimeter is a portion of the Operational Zone and includes the Command Post, Unified Command, Triage Post, Ambulance Exchange Post, Reunification Post (if onsite), Outside Agency Resources Staging Area, and Deceased Victim Staging Area.

      2. The Command Post/Incident Commander is responsible for the Outer Perimeter.

      3. The Outer Perimeter shall be staffed by as many officers or law enforcement personnel from other agencies as needed to prohibit ingress or egress of any pedestrian or vehicular traffic to any of the interior area.

      4. The Outer Perimeter shall remain vigilant and on post until relieved by direction of the Incident Commander.

      5. The perimeter should start larger and be reduced in size based upon the circumstances.

    13. Incident Commander

      1. The Incident Commander shall follow procedures established under General Order Chapter 39 (All Hazard Plan) to include:

        1. The first on-scene supervisor that is assuming the Incident Commander responsibility shall announce this over the radio so everyone is aware. Anytime the Incident Commander changes it shall be announced over the radio so that everyone is made aware. The Incident Commander should assign an officer to serve as the scribe. The scribe will be responsible for recording pertinent information to include but not limited to: event times, personnel assignments, personnel requests, equipment requests, and the sharing of information between posts.

        2. Assess incident priorities

        3. Establish the location for the Command Post

        4. Develop and implement an incident action plan

        5. Coordinate overall on-scene emergency activities

        6. Confirm the notification of required resources, including but not limited to:

          1. SWAT Team

          2. Mutual Aid Resources

          3. Outside Agency Resources (SAO, DCF, Fire Marshal, Bomb Squad, etc.)

          4. Investigative Detective

          5. Mobile Command Center

          6. Victim Advocate

          7. Public Information Officer

          8. Critical Incident Stress Management Team

          9. Enacting the Reunification Plan

        7. Immediately liaison with the EMS / Fire Rescue Incident Commander and form a Unified Command. The Unified Command may be located at the already established Command Post or another mutually agreed upon location. The Incident Commander’s responsibility is not affected by establishing a Unified Command and

          no command responsibilities are relinquished by the establishment of a Unified Command.

        8. Determine strategic goals and tactical objectives not related to SWAT, but coordinate with SWAT

        9. Establish a location for outside agency resources to stage

        10. Coordinate information that may be released to the media after receiving authorization from the Sheriff/Chief or designee.

        11. It is paramount that the Incident Commander consider and plan for immediate needs, as well as needs during the succeeding 24-72 hours.

        12. Identify if the situation will require a Reunification Post.

    14. Tactical Operations Commander (TOC)

      1. The Incident Commander shall designate a Tactical Operations Commander.

      2. The Tactical Operations Commander will be located in close proximity to the incident location and inside the inner perimeter line.

      3. The TOC is responsible for supervising the single officer responses/Contact Teams, Rescue Taskforces, and all on-scene efforts to neutralize active threats and rescue all victims. The TOC shall coordinate all on-scene tactical operations.

      4. The TOC is responsible for coordinating with the SWAT commander to maintain the inner perimeter and ensure the systematic clearing of all buildings/premises at the AAE site.

      5. The TOC will routinely and as often as practical update the Incident Commander or Unified Command regarding the progress of tactical clearing teams and other relevant information.

      6. The TOC will ensure that evidence is preserved to the greatest extent possible under the circumstances.

    15. Casualty Collection Point

      1. The Casualty Collection Point (CCP) is not the Triage Post. A CCP or multiple CCPs may be established within the Inner Perimeter, including inside the Warm Zone, so that officers and RTFs can move the injured to the CPP for transfer to the Triage Post. All CCPs are temporary staging areas used to provide immediate life-saving treatment when feasible and facilitate patient transfer as efficiently and safely as possible.

      2. Officers and RTFs operating in the Warm Zone shall establish CCPs as necessary and in the safest place(s) possible within the Warm Zone. Any officer establishing a CCP shall notify the TOC or Incident Commander of its location. The CCP’s location should not interfere with any tactical operations.

    16. Triage Post

      1. The Triage Post shall be located inside the Outer Perimeter but as close as possible to the Inner Perimeter to facilitate patient transfer from the CCP or other areas.

      2. Patients are evaluated and treated by EMS / Fire Rescue personnel at the Triage Post and prioritized for transport to the hospital.

      3. The Incident Commander shall assign law enforcement officers to the Triage Post. These officers must be cognizant that suspects and / or accomplices may attempt to escape a scene by blending in as fleeing victims.

        1. It is essential that Officers keep open an ingress and egress route between the Triage Post and the Ambulance Exchange Point.

        2. Victims that have complete the triage process should then be moved to the Ambulance Exchange Point.

        3. Victims in the Triage Post who succumb to their injuries should immediately be moved to the Deceased Victim Staging Area.

    17. Deceased Victim Staging Area

      1. The Incident Commander shall establish a Deceased Victim Staging Area when necessary.

      2. The Deceased Victim Staging Area shall be inside of the Outer Perimeter.

      3. Strict security of this post is necessary to protect the identity of deceased victims, respect the family of deceased victims and to ensure evidence is not lost or mishandled. All reasonable steps should be taken to prevent this area from being viewed or photographed by the public.

      4. A personnel entry log shall be maintained by an officer at the Deceased Victim Staging Area.

      5. The Deceased Victim Staging Area shall be staffed by an adequate number of law enforcement officers and forensic science personnel to aid the Medical Examiner’s Office in identifying and recording any recovered evidence.

    18. Reunification Post

      1. The Reunification Post may be on or off the premises where the incident occurred depending on the nature of the incident and other operational needs.

      2. If the Reunification Post is on the premises where the incident occurred it shall, if possible, be inside the Outer Perimeter. However, regardless of where the Reunification Post is located it shall be cordoned off and secured by officers or other law enforcement personnel.

      3. At no time will members of the media be allowed in the Reunification Post without express approval from the Incident Commander.

      4. The Reunification Post shall be staffed by law enforcement officers and other appropriate personnel. If the event is at a school, the County schools’ personnel will provide staff for the Reunification Post and be responsible for the management of the Post, including checking-in and releasing people from the Post. If the event is not at a county school, this responsibility will fall to Agency personnel. Officers at the Reunification Post shall record

        the identity of all persons at this location and will ensure that no minors are permitted to leave this post unless accompanied by a parent / guardian.

      5. The Reunification Post Commander shall release people from this post as appropriate under the circumstances. Whether a person needs to be interviewed by investigators is a factor in determining if they should be immediately released or asked to remain. This decision should be made in consultation with a supervisor in the Investigations Section. An adult who has been reunited, or a minor accompanied by a parent or guardian, will not be required to remain if they ask to leave regardless of their status as a witness. Arrangements will be made to conduct an interview at a later time.

      6. It is preferable to locate the Reunification Post a sufficient distance from the AAE so as not to interfere with the incident and/or the post-incident investigation and crime scene processing.

    19. Staging Area

      1. The Staging Area shall be inside the Outer Perimeter.

      2. This location will be announced over the radio and provided to all outside responding agencies.

      3. An officer initially assigned to this post shall remain there until relieved by the Incident Commander or designee, and shall record all outside agency members’ names, agency, and any specialized equipment or specialized abilities (armored vehicle, SWAT team, CISM, language, etc.) they have.

      4. The Staging Area shall communicate all information to the Incident Commander and assignments for outside agency resources will be designated by the Incident Commander.


    1. All on-scene law enforcement and EMS / Fire Rescue personnel shall wear a uniform or have attire with markings easily identifiable as a law enforcement or EMS / Fire Rescue personnel.

    2. Contact Teams, law enforcement personnel on Rescue Task Forces and Inner Perimeter personnel should wear approved body armor. Failure to wear body armor does not affect any law enforcement officer’s duty to act and shall not delay any immediate response.

    3. Specialty tools, to include rams, Halligan tools, ballistic shield and other adequate resources are accessible at each station and/or with the duty sergeant.

    4. Agency issued rifles and / or shotguns shall be deployed when there is a tactical benefit.

    5. All deploying officers shall have with them a law enforcement radio, for communication.


    1. The Incident Commander shall have the responsibility to determine when to transition the operation from a tactical command to an investigative command.

    2. After relieving the tactical Incident Commander, the Investigative Commander shall make all decisions related to scene security needs and assign personnel to complete the investigative process.