California SB 553 Workplace Violence Prevention Plan Requirements

Senate Bill 553 was signed into law on September 30, 2023 and took effect July 1, 2024. It added Section 6401.9 to the California Labor Code, and it requires most California employers to establish, implement, and maintain a written Workplace Violence Prevention Plan, or WVPP. California had already imposed a workplace violence prevention standard on health care employers since 2017; SB 553 extended that basic obligation to general industry. It is not optional guidance — it is an enforceable Cal/OSHA requirement with defined content, training, and recordkeeping obligations attached to it.

The plan can stand alone or live as an identifiable section inside your existing Injury and Illness Prevention Program, but either way it has to be a real operational document: named people responsible for it, procedures your employees actually know about, and a log that gets used. A binder that sits in a drawer does not satisfy the law, and it will not help anyone during an actual incident. This guide walks through what the statute requires, what a Cal/OSHA inspector will actually ask to see, and — honestly — where a security contractor can and cannot help you get there.

This is a plain-language summary for planning purposes, not legal advice, and it is not a substitute for reading Labor Code 6401.9 or getting California employment counsel to review your plan. The statute governs where anything here and the law diverge, and Cal/OSHA's rulemaking on the subject is still open.

The statute applies broadly: to employers, employees, places of employment, and employer-provided housing. If you employ at least one person in California, start from the assumption that you are covered. Labor Code 6401.9 lists six enumerated exemptions, which collapse into about five real-world categories, and the important thing most summaries skip is that three of the six are conditional. They are not status exemptions you simply qualify for and forget — those three are contingent on your also being in compliance with the Injury and Illness Prevention Program standard, Title 8 Section 3203. Lose the IIPP compliance and you lose the carve-out with it.

The small-worksite exemption covers a place of employment with fewer than ten employees working there at any given time, that is not accessible to the public, and that is in compliance with Section 3203. All three conditions, not one of them. The statute says "at any given time," which on its face reads as a headcount at any moment rather than a daily average — so a retail back office that reaches ten people during a busy Saturday, an inventory night or an all-hands meeting should not be assumed exempt for that period. The telework exemption covers employees working from a location of the employee's own choosing that is not under the employer's control; a hybrid employee is fully covered the moment they are on your premises.

The remaining carve-outs are sector-based. Health care appears twice in the list — once for the facilities, service categories, and operations already covered by Title 8 Section 3342, and again for employers that comply with Section 3342 — which is why the health care industry is out of this statute and into its own, discussed further below. Facilities operated by the Department of Corrections and Rehabilitation are exempt if those facilities are in compliance with Section 3203. Law enforcement agencies are exempt where the agency meets the applicable POST standards and all of its facilities are in compliance with Section 3203. Outside those categories, if you have a worksite in California with even one employee on it, you almost certainly need a written plan, and assuming otherwise is a bet most employers lose.

The statute organizes workplace violence into four types, and your plan is required to address all four — not just the one that feels most likely at your property. Type 1 is violence committed by a person who has no legitimate business at the worksite: a robbery, a break-in, an assault by a trespasser. This is the category most private security programs are already built around, which is worth naming honestly, because it means guards address one of four required categories well and the other three not at all by themselves.

Type 2 is violence directed at employees by customers, clients, patients, students, inmates, or visitors. Type 3 is violence against an employee by a present or former employee, supervisor, or manager, which is often the hardest category for an employer to plan for honestly because it requires HR and management procedures, not a post order. Type 4 is violence committed in the workplace by someone who does not work there but has, or is known to have had, a personal relationship with an employee — most often domestic violence spilling into work, where the workplace is the location but the relationship, not the job, is the cause.

Naming all four matters because your hazard assessment has to be specific to each. A hazard assessment that only asks whether someone could break in has covered Type 1 and left Types 2 through 4 unaddressed, which is exactly the kind of gap a Cal/OSHA inspector, or a plaintiff's attorney after an incident, will find quickly. Each type calls for a different mix of physical controls, reporting procedures, and training content, and the plan has to show you thought through all four, not just the one your industry talks about most.

Labor Code 6401.9 lists specific elements the written plan must contain, and it reads like a checklist because inspectors use it as one. You need the names or job titles of the people responsible for implementing the plan — real people at your company, not a vendor. You need procedures for employee and employee-representative involvement in developing and implementing it, meaning your employees actually participated rather than received a template. You need procedures to accept and respond to reports of workplace violence and to prohibit retaliation against anyone who makes one, procedures to ensure supervisors and employees comply with the plan, and procedures to communicate with employees about workplace violence hazards and how to report a concern.

The plan also needs emergency response procedures, hazard identification and evaluation procedures with an inspection schedule and timelines for correcting what you find, post-incident investigation procedures, and — if you share a worksite with other employers, which is common in multi-tenant buildings and on construction sites — methods for coordinating your plan with theirs. That last piece matters more than it sounds: the property manager, the tenants, and any contracted service providers on a shared site are each still responsible for their own employees' plan, coordinated with the others rather than merged into one shared document that nobody individually owns.

The plan is also not a one-time deliverable. It has to be reviewed at least annually, whenever a deficiency is observed or becomes apparent, and after a workplace violence incident occurs — three separate triggers, and the second and third are the ones employers miss. None of this is a document you can buy off a shelf and file away, either. A generic template gets you the section headings; it does not get you named responsible people, a hazard assessment specific to your address, or employees who were actually involved in building it. The statute entitles Cal/OSHA to the paperwork directly: the plan must be available and easily accessible to the Division at all times, and every required record must be produced to the Division on request. What an inspector then checks is whether the document matches what actually happens on-site — a plan that describes a program nobody follows is arguably worse than an honest, thinner one that is real.

Training has to happen when the plan is first established and annually thereafter, with additional training whenever a new or previously unrecognized workplace violence hazard is identified or the plan is changed — that additional session can be limited to the new hazard or the change rather than repeating the whole curriculum. The statute also requires that training include an opportunity for interactive questions and answers with a person knowledgeable about the employer's plan, which is the requirement a purchased video module cannot satisfy on its own. Somebody who actually knows your site and your plan has to be reachable in the room.

The content is specified too, not left to your discretion. Training has to cover the plan itself and how employees can obtain a copy free of charge, the definitions and requirements of the law, how to report workplace violence incidents or concerns without fear of reprisal, workplace violence hazards specific to employees' jobs and the corrective measures in place, and how employees can access the violent incident log. In practice it should also walk through your emergency response procedures concretely — what to do, where to go, and who to call.

This is the requirement most employers underestimate, because it is not a one-time onboarding video you can set and forget. It has to be refreshed every year, updated whenever your plan changes, and it has to actually land with the people sitting in the room rather than check a box on a compliance spreadsheet. Training also has to be delivered in a way your workforce genuinely understands, which is a real operational problem in Los Angeles, where a single site can run shifts in three or four languages. A training record showing everyone clicked through a slide deck once in 2024 will not hold up if an incident happens and nobody in the building remembers the plan exists, let alone what it told them to do.

Every workplace violence incident has to be recorded in a violent incident log, and the log has specific required fields: the date, time, and location; a detailed description; which of the four violence types it was; who committed it, classified by their relationship to the workplace; the circumstances at the time, including whether the employee was working alone, isolated, in a poorly lit area, or unable to summon help; where the incident occurred; whether it involved a physical attack, a threat, a weapon, a sexual assault, or an animal attack; the consequences, including whether security or law enforcement was contacted and what was done to protect employees; and who completed the log entry and when. One rule catches people out: the log must be written without personal identifying information in the first place — names, addresses, phone numbers, email addresses, and anything else sufficient to identify a person involved stay out of it, rather than getting redacted later.

Retention periods differ by record type, and this is a detail worth writing down because it is easy to get backwards. The violent incident log itself, along with records of hazard identification, evaluation and correction and records of incident investigations, has to be kept for a minimum of five years. Training records — dates, contents or a summary of the session, the names and qualifications of whoever conducted it, and the names and job titles of everyone who attended — only need to be kept for a minimum of one year, a shorter window than most employers assume applies to everything else in the file, and one that is easy to trip over during an audit.

Employees and their representatives have a right to see this material. On request, you have to make hazard identification and correction records, training records, and the violent incident log available for examination and copying within fifteen calendar days, at no cost to the employee. Treat that fifteen-day clock as real — it starts on the date of the request, not on your convenience, and a slow response is itself a compliance gap worth avoiding on its own merits.

The anti-retaliation piece is built directly into the plan requirement rather than bolted on separately: your written procedures have to explain how an employee can report a violent incident, a threat, or a concern — to you or to law enforcement — without fear of reprisal, and how you will respond to that report. Separate California law already protects employees who raise workplace safety concerns from retaliation, so a manager who punishes or sidelines someone for reporting a threat is creating exposure well beyond a paperwork violation. Talk to employment counsel about how those protections interact; that is their question, not a security vendor's.

SB 553 did one more thing that gets left out of most compliance summaries. It amended the workplace violence restraining order statute, Code of Civil Procedure Section 527.8, so that beginning January 1, 2025 a collective bargaining representative can petition for a temporary restraining order and an order after hearing on behalf of an employee who has suffered unlawful violence or a credible threat of violence at the workplace — and, at the court's discretion, on behalf of other employees there as well. The employer or representative bringing the petition has to give the affected employee the opportunity to decline to be named in it. If your workforce is represented, that changes who can walk into court over an incident at your site.

Cal/OSHA enforces the plan requirement the way it enforces other written-program requirements: during a routine or complaint-driven inspection, an investigator can ask for the plan, the training records, and the violent incident log, and an employer who cannot produce them is in the same position as one who never built any of it. Penalty exposure scales with severity and repetition the way it does for any Cal/OSHA citation, with the most serious consequences reserved for willful or repeat violations rather than a first, good-faith gap. The practical takeaway: the paperwork is not a formality, it is what an inspector checks first.

Cal/OSHA is not finished with this area. SB 553 also directed the Division to propose, and the Occupational Safety and Health Standards Board to adopt, a more detailed general-industry workplace violence prevention regulation to sit alongside the statute, with a statutory deadline of December 31, 2026 for the Board to act. That rulemaking is still in progress. Draft language has circulated and been revised several times, most recently in a revised draft released in late July 2026 with a public comment window that closed in August 2026. The Division has already missed the December 31, 2025 deadline the statute set for proposing a standard, and the Standards Board faces a December 31, 2026 adoption deadline. Practitioners expect a vote and an implementation date to follow, but expectation is all that is — nothing has been finalized, and no discussion draft you find online should be treated as the final requirements.

Do not wait on it. Labor Code 6401.9 is already in effect and already enforceable regardless of what the Standards Board eventually adopts, and successive drafts have moved in both directions — the July 2026 revision narrowed some obligations and added a safe harbour in one place while tightening another. Build your plan to the current statute now, watch the Standards Board's docket as the deadline approaches, and budget for revising the plan again once a final regulation lands rather than treating today's version as something you write once.

Hospitals, skilled nursing facilities and other 24-hour licensed health facilities — along with hospital-based outpatient clinics, home health and hospice, emergency medical services and medical transport, and drug treatment programs — are carved out of SB 553 because California already regulates them under a separate, older rule: Title 8 of the California Code of Regulations, Section 3342, which took effect April 1, 2017, with the plan, plan-review, and training provisions phased in by April 1, 2018. That standard was built specifically around health care violence patterns — combative patients, behavioral health units, emergency departments — and it requires a plan tailored to the hazards of each work unit and service, its own violent incident log, and its own training regime, distinct from the general-industry requirements this guide covers.

If you operate a hospital, a skilled nursing facility, or a similar health care setting, SB 553's general-industry plan is not the standard that applies to you — Section 3342 is, and it predates SB 553 by several years with its own compliance history. Ancillary, non-clinical operations connected to a health care organization, such as a corporate headquarters or a standalone administrative building, may fall under the general-industry rule instead. If your organization spans both, confirm with a workplace-safety attorney which standard applies to which location rather than assume one covers everything.

Be honest with yourself about what this plan actually is: mostly your own administrative and HR work, not a security purchase. Naming responsible people means your own staff. Employee involvement means your employees, not a vendor's. The hazard assessment, the plan document, the training delivered to your general workforce, the log, and the recordkeeping are all things a security contractor cannot do for you and should not be claiming it can. If a vendor tells you a guard contract makes you SB 553 compliant, that is a sales pitch, not a compliance answer, and it will not hold up if Cal/OSHA or a plaintiff's attorney ever looks closely.

Where a contractor like Stratton actually contributes is narrower and more concrete. Officers briefed on your site-specific plan can execute the emergency response procedures your plan describes, rather than leave them as a document nobody has practiced. Timestamped incident reports an officer writes after a real event are useful raw material for your violent incident log, though you still own the log, still have to enter it correctly, and still have to keep personal identifying information out of it. A site walkthrough surfaces physical and access-control hazards — the kind that feed a Type 1 or Type 2 hazard evaluation — that you can fold into your own written hazard assessment. What that walkthrough covers is laid out in What to Expect From a Professional Security Assessment. None of it substitutes for the plan; it feeds it.

What officers cannot do is stand in for your employee training, your employee-involvement procedures, or your named responsible person. Those require your own people, in your own workforce, doing the work the statute specifically assigns to the employer rather than to whoever staffs your lobby or patrols your lot. If your property already has, or is considering, contracted security, treat that program as one input to your Type 1 and Type 2 hazard controls, not as the plan itself.

If you are starting from scratch, sequence it this way: name your responsible person, get real employees into the drafting process, write the hazard assessment for your actual address, and bring in a workplace-safety attorney or compliance consultant for the anti-retaliation procedures and the training curriculum — that legal work is not something Stratton provides, and any security firm that claims otherwise deserves the same skepticism this guide has asked you to apply everywhere else. Once the plan exists, Stratton's role is the physical piece: officers executing it, incident documentation that feeds your log, and a free on-site security assessment surfacing the hazards worth building in. Stratton is licensed under California PPO #122163, and an advisor responds within one business day — call (424) 440-5554 or use the Contact page.