A California workplace violence prevention plan is a written program, required of nearly every California employer under Labor Code section 6401.9, that identifies workplace violence hazards, sets procedures for reporting and responding to incidents, records every threat and act of violence in a violent incident log, and trains employees annually on all of it. The requirement took effect July 1, 2024, and Cal/OSHA enforces it.

Two years in, the pattern we see at MPS Security is consistent: most California employers have a document. Fewer have a program. The gap between the two is where enforcement findings and, more importantly, actual incidents live.

What does SB 553 actually require?

Senate Bill 553 amended Labor Code section 6401.7 and added section 6401.9 (California Legislative Information, 2023). The plan itself must be in writing, available and accessible to employees at all times, and may either stand alone or be built into the employer's existing Injury and Illness Prevention Program.

At minimum, the plan has to name the people responsible for implementing it, set out how employees report violence and threats without fear of reprisal, describe how the employer will respond to an actual emergency, and establish procedures for identifying, evaluating, and correcting workplace violence hazards. It must also cover post-incident response and investigation, and it must be reviewed at least annually and after any incident.

Two records requirements are frequently underestimated. The violent incident log must capture every incident, including threats, regardless of whether anyone was injured, with details about the type of violence, the circumstances, and where it occurred, and with personal identifying information excluded. Training records must be kept as well (California Division of Occupational Safety and Health).

Who is covered, and who is not?

The requirement reaches essentially all California employers, employees, workplaces, and employer-provided housing. The narrow exceptions include employees teleworking from a location of their own choosing not under the employer's control, and workplaces with fewer than ten employees present at a given time that are not accessible to the public and that comply with the existing injury and illness prevention regulation. Healthcare settings follow the separate Cal/OSHA violence prevention standard instead.

Note the direction this is heading. Cal/OSHA was directed to develop a formal workplace violence prevention standard and submit it to the Occupational Safety and Health Standards Board, with adoption required by the end of 2026 (Cal/OSHA workplace violence resources). Employers who treated 2024 as a one-time paperwork exercise should expect the requirements to become more specific, not less.

What does the law require you to train on?

Training is required when the plan is first established, whenever a new or previously unrecognized hazard is identified, whenever the plan changes, and annually thereafter. The content has to cover the plan itself and how employees can get a copy, how to report, the specific hazards in that workplace, and how to recognize and respond to a threat.

Here is where most programs are weakest. A recorded module an employee clicks through in eleven minutes satisfies the box. It does not change what a front-desk employee does when a terminated worker returns to the lobby, or what a supervisor does when an employee mentions that a customer has started following them to their car.

In our experience across three decades of protective work, the organizations that get real value from this requirement treat the annual training as the moment to rehearse decisions rather than recite policy. The plan tells people what the procedure is. Practice tells them what to do when the procedure and the moment do not line up neatly.

Where does professional security actually fit?

The statute does not require you to hire a security provider. It requires you to identify hazards and correct them. Correction is where security work enters.

Hazard identification. A structured walkthrough of entry control, lobby design, parking and approach routes, after-hours access, and lighting produces a hazard list a compliance template cannot. Those findings feed the plan's hazard-correction section.

Threat assessment and case management. A plan that logs threats but has no process for evaluating and managing a specific concerning individual is incomplete. Someone has to decide whether a case is escalating, who is notified, and what protective measures apply. This is the point at which a written plan becomes how protective work lowers organizational risk rather than a binder on a shelf.

High-risk events. Terminations of employees who have made threats, restraining order service, contentious public meetings, and the aftermath of an incident all warrant temporary protective coverage. SB 553 also expanded employers' ability to seek workplace violence restraining orders on behalf of employees, which raises the practical question of who stands post while an order is served and in the weeks after.

Executive and leadership exposure. Threats against an organization are frequently threats against a specific named leader. That is why boards treat leadership safety as a governance question rather than a personal preference of the person in the role.

A practical compliance checklist

•           Written plan, current within the last twelve months, accessible to every employee

•           Named owner with authority and budget, not just a title

•           Reporting channel employees actually know about and trust

•           Violent incident log in use, capturing threats, not only injuries

•           Annual training delivered and documented, with content specific to your sites

•           Hazard assessment completed per location, with corrections tracked to closure

•           Post-incident review process that feeds back into the plan

•           Coordination with local law enforcement, and a defined threshold for calling them

Frequently asked questions

When did California SB 553 take effect? The workplace violence prevention plan requirements under Labor Code section 6401.9 became effective and enforceable on July 1, 2024. Employers were required to have the written plan, the violent incident log, and initial employee training in place by that date.

Does a small business have to comply? Most do. The narrow exemption applies to workplaces with fewer than ten employees present at any given time that are not accessible to the public and that already comply with the injury and illness prevention program regulation. Any location open to the public is covered regardless of headcount.

What has to go in the violent incident log? Every incident of workplace violence, including threats, whether or not an injury occurred. Entries record the date, time, and location, a description of the circumstances, the type of violence, who committed it by classification, and the consequences, with personal identifying information of the people involved excluded.

Does remote work count as a covered workplace? Employees working remotely from a location of their own choosing that the employer does not control are outside the requirement. Employer-provided housing and employer-controlled remote sites are inside it.

Can our existing IIPP satisfy the requirement? The workplace violence prevention plan may be incorporated into the existing Injury and Illness Prevention Program, but the specific required elements still have to be present. Simply pointing to an unmodified IIPP does not satisfy section 6401.9.

How often does training have to happen? When the plan is established, when new hazards are identified, when the plan changes, and at least annually after that. Training records must be maintained.

Talk to us about your plan

MPS Security & Protection helps California employers turn a compliance document into a functioning program: hazard assessments per site, threat case management, protective coverage for high-risk terminations, and training that rehearses decisions. Contact MPS Security & Protection to talk about your locations.

About the author

Michael D. Julian has more than 30 years of experience in security, executive protection, and investigations. He served as President of the California Association of Licensed Investigators from 2005 to 2015 and advises corporate, entertainment, and high-net-worth clients on protective operations and threat management across California. Connect with him on LinkedIn.