Section 6401.9 applies to all employers, employees, places of employment, and employer-provided housing, subject to a short list of exemptions in subdivision (b)(2). The exemptions are narrow, and an employer that does not clearly fall inside one of them is covered.

Private security agencies are not exempt. A licensed private patrol operator is an ordinary California employer for purposes of this statute, and its officers work at locations that are, by definition, accessible to the public.

Cal/OSHA sets out the required elements of the written plan. Each must be addressed in writing, and each must be effective in practice rather than merely present on the page.

Every covered employer must maintain a violent incident log recording each incident of workplace violence, including incidents that caused no injury. Each entry is built from employee statements, witness statements, and the findings of the employer’s investigation, and must record the date, time, and location; which of the four types of workplace violence applies; a detailed description of the incident; a classification of who committed the violence; the circumstances at the time; the specific characteristics of the incident, including physical attacks, weapon involvement, threats, sexual assault, animal incidents, or other events; the consequences, including any law enforcement involvement; the steps taken to protect employees from further threat; and the name, job title, and date of the person who completed the entry. Personal identifying information that would identify any person involved in an incident must be excluded from the log. Separately, under section 342 of title 8, an employer must immediately report to Cal/OSHA any serious injury, illness, or death occurring at a place of employment or in connection with employment, including those resulting from workplace violence.

Training is where most enforcement attention lands, because it is the element with a recurring deadline and a documentary trail. Employers must provide initial training when the plan is first established, and training at least annually thereafter. Additional training is required whenever a new or previously unrecognized workplace violence hazard is identified, or when changes are made to the plan, and that additional training must address the specific hazard or the specific change. New employees must be trained when they begin employment.

Training must be effective, and the materials must match the education level, literacy, and language of the employees receiving it. A generic off-the-shelf course does not by itself satisfy the statute, because the training must address the employer’s own written plan, the employer’s own hazards, and the employer’s own reporting procedures, and must give employees access to someone who can answer questions about that plan.

The written plan must be accessible to employees, to authorized employee representatives, and to Cal/OSHA representatives. Records are subject to different minimum retention periods.

Because three of the four categories run for five years, many employers retain all workplace violence records on a single five-year cycle rather than tracking training records separately on a shorter clock. Training records should identify the date, the contents or a summary of the training, the names and qualifications of the persons conducting it, and the names and job titles of the employees who attended.

Enforcement sits with the Division of Occupational Safety and Health, known as Cal/OSHA, within the California Department of Industrial Relations. Cal/OSHA cites section 6401.9 directly, and the workplace violence prevention plan now appears on the document request list in routine inspections as well as in investigations opened after a complaint or an incident. Cal/OSHA also operates a Consultation Services Branch, which is separate from enforcement and can be engaged for assistance without triggering a citation. An employer’s plan, log, and training records are the first things requested, and an employer that cannot produce them is in the same position as an employer that never created them.

Cal/OSHA assesses penalties according to how a violation is classified. The amounts are adjusted annually for inflation under a 2017 California law that aligns state penalties with federal OSHA amounts.

Amounts shown are those published by the Department of Industrial Relations for citations issued on or after January 1, 2025. Because these figures are adjusted each year, confirm the current amounts at dir.ca.gov before relying on them. Beyond the citation itself, a documented failure to train or to maintain a plan is evidence in a civil action arising from an incident, and carriers underwriting employment practices and general liability coverage increasingly ask about workplace violence compliance at renewal.

Section 6401.9 directed Cal/OSHA to convert the statute into a formal Title 8 regulation. That rulemaking is active. The draft is proposed section 3343, workplace violence prevention in general industry, and Cal/OSHA released a further revised discussion draft on April 23, 2026 with a public comment period that closed on June 1, 2026. The Occupational Safety and Health Standards Board is required to adopt the standard no later than December 31, 2026. Until it is adopted, section 6401.9 remains the enforceable law and Cal/OSHA is citing under it. Employers should expect the final regulation to be more prescriptive than the statute, particularly on hazard assessment, post-incident response, anonymous reporting, and recordkeeping, and should plan to review plans written in 2024 against the final text once it is published.

A private patrol operator carries this obligation twice over. First, as an employer, the agency must have its own written plan covering its own officers, wherever those officers are posted. The requirement that a plan be specific to the hazards of each work area is demanding for an employer whose employees are distributed across dozens of client sites with different risk profiles, and the statutory requirement to coordinate implementation with other employers applies directly to a security agency working alongside a client’s own workforce. Second, clients rely on security officers as the operational expression of their own plans. When a client’s plan specifies emergency response, alerting employees, or obtaining help, the officer on post is frequently the person expected to execute it. Clients increasingly write those expectations into post orders and service agreements, and ask the agency to document that its officers are trained to perform them. An agency that can produce current training records for every officer assigned to a site answers both the client’s question and its own Cal/OSHA obligation from the same record.

CPSO provides WVPP Annual Training, a 1.5-hour workplace violence prevention course covering, the definitions and requirements of Labor Code section 6401.9; the four types of workplace violence; recognizing and reporting hazards; the purpose of the violent incident log; emergency response and de-escalation and non-retaliation. The course is online, and on completion each officer’s record is updated with the completion date, so the next annual cycle is tracked automatically.

Because the law requires training on the employer’s own written plan and its own hazards, a course alone does not complete an agency’s compliance. CPSO’s course is designed to be paired with the agency’s plan-specific briefing, and the platform records both, so that an agency producing records for Cal/OSHA or for a client can show the general training and the plan-specific training together. Completion dates, expiration, and the next due date are visible per officer and across the roster, and an audit report covering the entire workforce can be generated at any time rather than assembled after a request arrives.

Determine whether you are covered. The exemptions are narrow. If your officers work at locations accessible to the public, you are covered, and the analysis ends there.

Put the plan in writing. Either as a separate document or as a stand-alone section of your Injury and Illness Prevention Program. Address every required element, and make it specific to the hazards of the work your officers actually perform.

Name the people responsible. The plan must identify who implements it. A plan with no owner is the first thing an inspector notices.

Train on hire and every year after. Calendar the annual date now. If your original rollout was in the spring or summer of 2024, your annual cycle falls in that window every year, and it is easy to let it slip.

Train on the plan, not only on the topic. General awareness training does not satisfy the statute by itself. Employees must be trained on your plan, your hazards, your reporting procedures, and must have access to someone who can answer questions about it.

Keep the log, including incidents without injury. Threats count. Weapons incidents count whether or not anyone was hurt. Exclude personal identifying information from the entries.

Retain the records. Five years for the log, hazard records, and investigation records; one year minimum for training records, though a single five-year cycle is simpler to administer.

Review the plan annually, and after every incident. Document the review itself, because the statute requires the procedure and an inspector will ask when it was last performed.

Coordinate with your clients. Where your officers work alongside another employer’s workforce, the coordination requirement applies. Confirm in writing how your plan and the client’s plan interact, and what your officers are expected to do under theirs.

Since July 1, 2024, Labor Code section 6401.9 has required nearly every California employer, private security agencies included, to maintain a written Workplace Violence Prevention Plan, to train employees on it initially and annually, to log every incident including those causing no injury, and to retain the records for up to five years. Cal/OSHA enforces the statute directly and requests the plan, the log, and the training records in the ordinary course of an inspection. Maximum penalties reach $25,000 for a serious violation and $162,851 for one classified as willful or repeat. A formal Title 8 standard is due to be adopted by the end of 2026 and is expected to be more prescriptive still. CPSO helps agencies carry the training and documentation half of that obligation, so that the records exist before anyone asks for them.