Resources
SB 553 workplace violence prevention plan: what California requires, with a free template
Most California employers have needed a written Workplace Violence Prevention Plan since July 1, 2024. Here is what the law asks the plan to cover, the nine fields of the incident log, the training cycle and the record rules, plus a fill-in template you can download.
Printable template
The answer in brief
Since July 1, 2024, almost every employer in California has needed a written Workplace Violence Prevention Plan. The duty comes from SB 553, signed on September 30, 2023, which added Labor Code section 6401.9 and made the plan part of the Injury and Illness Prevention Program (IIPP) every employer already keeps. The plan covers employees, every place of employment and employer-provided housing.
Four things sit at its center: a written plan specific to each work area, a log of every violent incident, training for employees when the plan starts and every year after, and records kept for set periods. The plan can be a stand-alone section of your IIPP or its own document. A single company-wide plan is not enough on its own; each site’s hazards and fixes have to be in it.
This page summarizes the law as written, last checked November 2026. It is general information, not legal advice: for your own situation, ask an employment attorney or Cal/OSHA. Our free fill-in template follows the same order as the statute.
Who the law leaves out
The statute lists six exemptions. If none fits, the plan applies to you, union and non-union sites alike.
- Health care facilities and operations covered by Cal/OSHA’s health care violence standard (Title 8, section 3342), which follow that rule instead.
- Employers that comply with section 3342.
- Department of Corrections and Rehabilitation facilities that comply with Title 8, section 3203.
- Certain law enforcement agencies that meet state POST requirements and keep their facilities in line with section 3203.
- Employees teleworking from a place of their choosing that the employer does not control.
- Workplaces with fewer than 10 employees present at any time, that the public cannot enter, and that comply with section 3203. All three conditions have to be true together.
Cal/OSHA can also issue a special order that brings an exempt employer, workplace or group of employees back under the plan requirement.
The 13 parts of a written plan
Labor Code 6401.9(c) lists what the plan has to contain. The plan must be in effect at all times in every work area and easy for employees, their representatives and Cal/OSHA to reach, for example in a shared binder, a common area or on a company website.
| Plan part | What to write down |
|---|---|
| 1. Who runs the plan | Names or job titles of the people in charge of it, and what each one does when there is more than one |
| 2. Employee involvement | How staff and their representatives help spot and fix hazards, shape the training and look into incidents |
| 3. Other employers on site | How you work with staffing agencies, client or host sites and contractors so everyone working there gets the plan’s training and their incidents reach your log |
| 4. Taking reports | How reports of violence are received and answered, and a clear ban on retaliating against anyone who reports |
| 5. Making it stick | How supervisors and staff are held to the plan, in line with the compliance part of your IIPP |
| 6. Speaking up | How someone reports an incident, threat or concern to you or to police without fear of reprisal, and how you look into it and share what you found |
| 7. Emergencies | How people learn where an emergency is and what it is, when to evacuate or shelter, and how to reach assigned staff, security officers and police |
| 8. Training | How the required training is built and delivered |
| 9. Finding hazards | Scheduled inspections and staff reports, plus an inspection when the plan starts, after every incident and whenever a new hazard comes to light |
| 10. Fixing hazards | How hazards are corrected in good time, in line with the hazard-correction part of your IIPP |
| 11. After an incident | What happens next and how the incident is investigated |
| 12. Reviewing the plan | A review with staff at least once a year, after any workplace violence incident and whenever a weakness shows up |
| 13. Anything else required | Further items Cal/OSHA or the Standards Board add by standard |
The plan also needs the statute’s definitions. Workplace violence is any act or threat of violence at a place of employment, whether or not anyone is hurt, including threats or use of a firearm or another dangerous weapon, common objects included. Lawful self-defense or defense of others is not counted. The law sorts it into four types:
- Type 1: someone with no legitimate business at the site, including a person who comes in to commit a crime
- Type 2: customers, clients, patients, students, inmates or visitors acting against employees
- Type 3: a present or former employee, supervisor or manager
- Type 4: someone outside the company who has, or had, a personal relationship with an employee
The violent incident log and its nine fields
Every incident of workplace violence goes in the log, including threats where no one was injured. Entries draw on what affected staff and witnesses say and what your investigation finds. You can design your own log form as long as it captures these fields:
| Field | What it records |
|---|---|
| Date, time and place | When and where it happened |
| Violence type | Type 1, 2, 3 or 4 (more than one can apply) |
| Description | A detailed account of what took place |
| Who did it | For example a customer, a client’s relative, a stranger with criminal intent, a coworker, a supervisor, a partner or a relative |
| Circumstances | For example usual duties, a poorly lit area, working alone, low staffing or an unfamiliar location |
| Location type | Inside the workplace, in the parking lot or outside area, or somewhere else |
| Kind of incident | Attack with or without a weapon, a threat, sexual assault or threat, an animal used as a weapon, or other |
| Consequences | Whether security or police were called and how they responded, and what was done to protect staff from a continuing threat |
| Completed by | Name and job title of the person filling in the entry, and the date |
Leave out anything that identifies a person: names, addresses, email addresses, phone numbers, Social Security numbers and details that would point to someone when combined with public information. At a site shared by several employers, the employer whose staff were involved keeps the entry and sends a copy to the employer in control of the site.
An animal attack belongs in the log only when a person used the animal as a weapon. Injuries that meet the usual rules still go on Cal/OSHA Form 300 as well, and a serious injury or death has to be reported to Cal/OSHA straight away under Title 8, section 342.
Training: when it happens and what it covers
Employees receive training when the plan is first set up and then once a year. The annual cycle runs from your first session; the statute names no calendar date. Extra training is due when a new or previously unknown hazard is found or the plan changes, and it can be limited to that change. Materials have to suit the education level, reading level and language of the people in the room.
- The plan itself, how to get a free copy and how to take part in it
- The definitions and requirements of Labor Code 6401.9
- How to report incidents or concerns to you or to police without fear of reprisal
- Hazards tied to each job, the measures in place, how to get help and ways to avoid physical harm
- The violent incident log and how to get copies of records
- Time for questions, answered live by someone who knows the plan
How long to keep the records
| Record | Keep it for at least |
|---|---|
| Hazard identification, evaluation and correction records | Five years |
| Training records: dates, content or a summary, trainer names and qualifications, attendee names and job titles | One year |
| Violent incident logs | Five years |
| Incident investigation records, with no medical information in them | Five years |
Cal/OSHA can ask to see any of them. When an employee or their representative asks for the hazard, training or log records, you have 15 calendar days to hand them over, free of charge. Cal/OSHA enforces the law through citations and civil penalties.
How the plan sits inside your IIPP
The IIPP rule, Title 8, section 3203, already asks every California employer for a written program with eight parts: who is responsible, how employees comply, how you communicate about hazards, hazard inspections, injury investigation, hazard correction, training, and employee access to the written program. The workplace violence plan follows the same pattern for one kind of hazard, which is why many employers file it as a section of the IIPP. An employee who asks for the written IIPP gets it within 5 business days, and the first printed copy is free.
Cal/OSHA has also proposed a separate workplace violence standard for general industry; as of November 6, 2026 it had not been adopted, so this page covers the statute in force.
Our template and Cal/OSHA’s model plan
Download the template below to start your own plan. We wrote it from scratch: a block for each of the 13 plan parts, a sheet for hazard inspections, a training record and a single-incident log page with the nine fields. Fill in one copy for each work site, because the plan has to match the hazards of each area.
Cal/OSHA publishes its own model written plan for general industry as a Word file, with a Spanish version, and answers common questions on its workplace violence FAQ. Its general industry page collects both. Using any model, ours or the state’s, is optional and does not by itself make a plan compliant; the plan works when it describes what really happens at your site.
Get help
Several plan parts lean on security: emergency procedures name how staff reach security officers, contractors on site count as other employers, and the incident log asks how security responded. HALO’s on-site officers work from written post orders and file incident reports with photos, which give your log and investigation a dated record to draw on. If you are weighing guard coverage as part of the plan, our security review is free with a guard quote, and you can ask for one here.
Resources
Related guides
A few useful answers
Common questions
Does a small office need a workplace violence prevention plan?
Usually yes. The small-site exemption covers only a workplace with fewer than 10 employees present at any time, that the public cannot enter, and that meets the IIPP rule. If the public walks in, or 10 or more people are there at once, the plan applies.
Can the plan be part of our existing IIPP?
Yes. Labor Code 6401.9 lets you write it as a stand-alone section of the IIPP or as a separate document. Either way it has to be specific to each work area and easy for employees to reach.
Do threats with no injury go in the violent incident log?
Yes. Every workplace violence incident is logged, including threats, whether or not anyone was hurt. Keep names and other identifying details out of each entry.
How often do employees need workplace violence training?
When the plan is first set up, then every year, counted from that first session. Add a session whenever a new hazard is found or the plan changes.
Do contract security officers belong in our plan?
The plan has to describe how you coordinate with other employers at your site so their employees get the training and their incidents are reported and logged. Contract officers are one of those employers, so the plan should say how their reports reach you.
Is filling in a template enough to comply?
A template is a starting point. Cal/OSHA says its own model does not by itself ensure compliance, and the same is true of ours. The plan has to describe the real hazards, people and steps at each of your sites.