America’s deadliest mass shooter came prepared.

Before Stephen Paddock killed 58 people and wounded more than 500 others at the Route 91 Harvest outdoor music festival on the Las Vegas Strip last fall, police and federal records show that the 64-year-old researched—and even visited—other locations and events as potential targets. He Googled SWAT team tactics, ballistics data, building heights, and terms such as “do police use explosives.” Paddock spent years legally accruing an arsenal of firearms that included more than a dozen semi-automatic AR-15 rifles, a type of firearm often used in mass shootings, and devices called bump stocks that allow those guns to fire like fully automatic rifles.

On September 25 and 26, Paddock and unsuspecting hotel staff ferried over 20 duffel bags stuffed with weapons and ammunition up to a pair of rooms he had reserved on the 32nd floor of the Mandalay Bay Resort and Casino. On the night of October 1, Paddock unleashed a storm of bullets from the window of one of those rooms into the crowd of some 20,000 people below who were attending an outdoor country music festival.

“It was just total chaos,” one concertgoer, who was drinking and laughing with a friend when shots rang out, told the New York Times. At first they thought it was fireworks. Then they saw a man fall to the ground with blood spurting from his neck. “People [were] falling down and laying everywhere,” she said. “We were trying to take cover and we had no idea where to go.”

Concertgoers weren’t the only ones confused. When Craig Cooper, chief of special operations for Las Vegas Fire Rescue, arrived on scene, it had been determined that the bullets were coming from an aerial position, but responders weren’t sure how many shooters were involved. To make matters worse, the open-aired venue meant the scene kept spreading as the shooting continued. “Victims were either carried or moved themselves blocks away from where the event occurred,” Cooper told me in an interview in March. This resulted in inaccurate reports of other shootings in the area. “Our concept of what an event like that would look like was completely shaken up,” he said.

Despite the bloodshed and graphic reportage, it didn’t take long for the country to collectively move on from Las Vegas and shift its mourning elsewhere. Just over a month after the Las Vegas shooting, a gunman killed 26 people at a church in Sutherland Springs, Texas. Three months after that, a gunman killed 17 people, mostly teenage students, at Marjory Stoneman Douglas High School in Parkland, Florida.

Ten of the 15 deadliest mass shootings in modern United States history have occurred in the last 12 years, claiming the lives of over 250 people, according to multiple sources. The other five occurred over a 40-year span, from 1966 to 2006, claiming 85 lives. In a sea of divergent viewpoints over what constitutes a mass shooting and what trends are actually occurring, the definitive answer is that mass shootings are becoming more frequent, and they’re becoming deadlier.

Against this backdrop, conversations began taking place among NFPA stakeholders on whether the organization had a role to play in addressing the problem, and what that guidance might look like. Both of those questions have been answered. In March, a committee of more than 40 public safety experts, with backgrounds ranging from law enforcement to medicine to government to the fire service, including Cooper, met at NFPA headquarters in Massachusetts to review public input and finalize the language for a groundbreaking new standard. NFPA 3000™ (PS), Active Shooter/Hostile Event Response (ASHER) Program, provides a roadmap for first responders, medical professionals, community leaders, emergency management officials, facility managers, and the public as they prepare for, respond to, and recover from active shooter and other hostile events. (The PS stands for “provisional standard,” which means it was released faster than a regular NFPA standard.) And as we’ve learned from incidents like the Las Vegas shooting, when attackers are meticulously prepared to kill, communities nationwide must be equally well-prepared. The standard became available for purchase May 1.

NFPA 3000 is based on four main principles: unified command, integrated response, planned recovery, and whole community. In interviews with NFPA Journal, NFPA 3000 technical committee members shared their personal experiences with active shooter and hostile events and often tied them back to these four principles to show both what went well in past events and what didn’t—lessons that were woven into the new standard.

“NFPA can’t prevent these tragedies, but we do think there is more to be done in how they are responded to,” NFPA President and CEO Jim Pauley wrote in a blog after the Parkland shooting. “NFPA has sped up its typical standards development process to develop the world’s first standard to help communities prepare, respond, and rebound from hostile events. … While no standard or code in the world can prevent horrific attacks from occurring in the future, NFPA 3000 is intended to make communities better-equipped to deal with such tragedies.”

‘Talking the same language’: unified command and integrated response

In the early hours of June 12, 2016, Omar Mateen opened fire with a rifle inside Pulse, a crowded nightclub in Orlando, Florida. Forty-nine people were killed in the incident, and Mateen became, for a time, the nation’s deadliest mass shooter.

As the event unfolded, first responders converged outside the building. Although they had trained together for such incidents, command and communications at the scene broke down. It was like a game of telephone, Otto Drozd, chief of Orange County Fire Rescue in Florida, told me in an interview last year. Rather than a single unified command post, there was a police officer at the fire command post who communicated over the radio to a dispatcher who communicated to the police command post.

Drozd reiterated this in March. “When we looked at the communications piece after the Pulse incident, what we found was that police had their command post and fire had their command post, where it should’ve been a unified command post with face-to-face communication,” he said. “That’s a portion we’re really focusing on within NFPA 3000.”

Despite their training, many aspects of the incident surprised Drozd’s department and the Orlando police and fire departments. Not only was communication difficult, but the logistics of working with the many outside agencies that came to Orlando in the aftermath, including the FBI, also presented challenges. The experience prompted Drozd, in October, 2016, to officially submit a request for NFPA to develop a standard on preparedness and response to active shooter and hostile events.

The unified command principle that Drozd stressed surfaced in nearly all of my interviews with committee members, who spoke candidly about its importance. “Unified command is incredibly important,” said Joe Alvarez, a lieutenant with the Fresno Police Department in California. “Police have a set of information and so does fire, and when reasonable and feasible, as soon as possible, there’s a huge benefit to coming together to share our knowledge so we can direct our resources to where they need to be rather than where we individually think they should be.”

“Even when we have fires or small-scale incidents, we have to work better with our law enforcement partners,” said Julie Downey, chief of Davie Fire Rescue in Florida, which responded to an airport shooting in Fort Lauderdale in January, 2017, and was on standby during the Parkland shooting. “As the scene gets larger—say we have a fight or a single person shot—we’re trying to get in and treat the person, but it’s also a crime scene, so we see a lot of issues when we’re not sharing information and we’re not respecting each other’s roles. A unified command has to happen, especially on larger-scale incidents.” Downey said she hopes the primary thing that comes out of the development of NFPA 3000 is fire and EMS working better with law enforcement, including sharing information. “It just has to happen,” she said.

Establishing a common terminology is an important product of unified command, Downey said, and it could mean the difference between life and death for victims. She’s seen agencies from multiple jurisdictions respond to the same incidents but refer to the same things differently, such as using the terms “ambulance exchange point” and “loading zone” to refer to the place where transport vehicles are available to take patients to the hospital. “The fire department calls building sides by A, B, C, or D, and law enforcement says 1, 2, 3, or 4,” Downey said. “So even things like that, we just have to do a better job of communicating and sharing information so we’re talking the same language.”

A common language is even more critical in active shooter events, she said. “If we don’t get a rescue task force in that warm area very soon, people are going to die. Four to six, maybe seven minutes, if we can’t get in and they’re bleeding and someone inside hasn’t already initiated care, they’re going to die while we’re outside talking about ‘you’re going to A,’ or ‘you’re going to 1.’”

It wasn’t long ago that moving a rescue task force into a warm area, as Downey describes, would’ve been unheard of. (Hot, warm, and cold are used to describe the danger level in descending order in a given area during these events.) But today, an understanding exists that the quicker firefighters and paramedics can get to victims and the more police officers can be involved in administering medical care, the better chance victims have of surviving. This idea of an integrated response between police, fire, and EMS is featured heavily in the standard.

It’s a shift that began to occur following the Virginia Tech shooting in 2007, during which a gunman killed 32 people on the Virginia Polytechnic Institute campus in Blacksburg, Virginia. “Rather than waiting outside, rather than waiting for patients to be brought to them, we’ve seen [fire and EMS] be more aggressive [in recent years],” said Richard Serino, chair of the NFPA 3000 technical committee. Serino spent over three decades working in Boston EMS before becoming deputy director of the Federal Emergency Management Agency within President Obama’s administration and now works at the Harvard School of Public Health. At the same time, Serino said, law enforcement has become more focused on administering medical care during active shooter and hostile events.

“What we’re learning now is we cannot be siloed in our individual areas of concern,” said Dr. Ricky Kue, an EMS physician in the Boston area. “While law enforcement is worried about perimeter security, neutralizing the threat, and keeping any more deaths or injuries from happening, they’re also recognizing now that they have to be players in addressing bleeding and getting victims out to definitive care. … At the same time, EMS and fire personnel who have traditionally not worked in what we consider a law enforcement environment now recognize that we have to have some degree or ability to respond [in those areas] in these events.” Kue in part credits a well-executed unified command and integrated response with the fact that, in the Boston Marathon bombing in 2013, every injured person who was transported to a hospital survived.

In the Las Vegas shooting, these principles were also executed well, Cooper said. “Unified command was established rather quickly,” he told me, “and it helped with the sharing of information and the coordination of all aspects of the response. Can we do better? We can always improve, but all things considered, it went really well.”

‘It can happen anywhere’: preparing for the worst

Las Vegas officials knew the city, a global tourism hub, was a target for an incident like the October 1 shooting. But what they and NFPA 3000 committee members will also tell you is that these events can happen anywhere—even an idyllic New England town of 27,000 residents like Newtown, Connecticut. In 2012, a gunman killed 26 people inside the town’s Sandy Hook Elementary School. Most of the victims were six- and seven-year-old children.

“Newtown was the kind of place that you would never expect something like that to happen,” said Dr. Richard Kamin, a trauma physician at the University of Connecticut, who responded to the incident in an advisory role with law enforcement. “But as has been shown over and over again, the unpredictability of these active shooter events and a lot of the hostile events around the world [mean] we can no longer assume that, just because where we live seems to be one of these places where you wouldn’t expect it to happen, we can sit back and rest on the fact that it won’t happen.”

“It can happen anywhere,” John Montes, the NFPA staff liaison to NFPA 3000, said about active shooter and hostile events in April, during an NFPA 3000 presentation to NFPA staff members. He displayed a heat map of recent active shooter events in the United States that illustrated the point; while there were higher concentrations of incidents in a couple of larger metropolitan areas, essentially no corner of the country was left unscathed. Kamin said he hopes NFPA 3000 will provide communities everywhere with that awareness and a sense of the need to be prepared.

For all communities, a critical part of preparation is conducting a risk assessment, as outlined in NFPA 3000, to identify the locations that are most at-risk for an active shooter or hostile event, and then making sure the people who are in charge of those locations, such as facility managers, are prepared.

“Facility managers need to be mindful that when events occur in their facility, they’re going to be the first responders,” said Jeff Sarnacki, an NFPA 3000 committee member who has worked as a facility manager overseeing more than 40 high-rise buildings. “People who are already there have to be prepared to respond quickly to save lives. Police, fire, EMS will get called and they will show up, but a lot will occur prior to their arrival. That’s the critical piece, that gap between an event and when first responders can make it to the scene.”

Facility managers can prepare by readying their buildings in various ways, such as ensuring accessibility for first responders and readying occupants by conducting drills and trainings, Sarnacki said. His buildings, for example, were equipped with elevators for first responders and bleeding control kits that selected staff members were trained to use. “We tried to make sure we had a group of people we knew were going to be at the building trained [in first aid, CPR, and bleeding control],” he said. “The more we can train the better off we are.”

‘It goes on and on and on’: planned recovery and the whole-community approach

All this preparation, however, must occur with the knowledge that these events ultimately can’t be eradicated. Therefore, preparation must also account for the recovery process, which begins the moment an incident occurs. For many communities that have experienced an event like an active shooter, returning to a sense of normalcy can take years.

In March, when I asked Cooper how Las Vegas was doing almost six months after the Mandalay Bay shooting, the first thing he said was “Vegas Strong”—a slogan that has come to embody the city’s sense of resiliency after the shooting in the same way “Boston Strong” did after the marathon bombing. Then he provided a more detailed answer laced with a heavier dose of reality. “It’s not something that’s going to be forgotten overnight,” Cooper said. “I could have never imagined it to be as far-reaching as it was. … There are people who weren’t even at the event who had friends there, and as they start telling the story of their friends, they start crying. It affects the entire community.”

The far-reaching and long-lasting nature of these events, which one NFPA 3000 committee member likened to “tentacles,” was a common thread in my conversations with those who came from communities that had experienced recent or large-scale incidents. Downey said the same thing about Parkland that Cooper said about Las Vegas that Drozd said about Orlando. “The shooting is over and then it’s the next day and the next day and all of these things have to happen for recovery—recovery for the responders with PTSD and all of the things occurring with them, and then all of the victims and their families,” Downey said. “It goes on and on and on.”

To address this challenge, NFPA 3000 instructs communities to be prepared for recovery before an incident occurs. Plans need to be in place, for example, to provide mental health treatment to first responders and to set up a recovery center for victims and victim families, rather than scrambling to plan and implement these resources after the fact. These were lessons learned in Orlando. “That scene didn’t end in three or four hours—that scene continues today,” Drozd told me in an interview one year after the Pulse shooting.

When the NFPA 3000 technical committee met for its second meeting in Orlando last September, members visited the shuttered Pulse building. Coincidentally, the owner was there, and committee members shared with her their efforts to write NFPA 3000. She was optimistic about the new standard, and was mostly drawn to how it emphasized the need to take a whole-community approach to recovering from these incidents—that is, recognize that businesses, organizations, and individuals who weren’t directly connected to the event can be negatively affected. “She really highlighted the importance of the whole-community concept,” Drozd told me in March. “It’s not just the firefighters or the police or the hospitals, it’s the entire community. With incidents like Orlando, Las Vegas, Sutherland Springs, wherever these things happen, it has community-wide impacts. … Her focus was on how we take care of families, how we take care of the victims in the aftermath, how you bring a community to normalcy, if that’s even possible, because a lot of these things leave an indelible mark on communities.”

On a more granular level, each individual touched by an active shooter or hostile event has their own road to recovery, separate from the community’s, and many of the NFPA 3000 technical committee members have waged these personal battles with recovery—and seemingly won. They drew on those experiences as they wrote the standard.

Kamin, the doctor who responded to Sandy Hook, is a good example. As a first responder or doctor, exposure to death is often a part of the job. But as Kamin will tell you, nothing can prepare you for walking into a scene like the one he encountered at Sandy Hook.

When he talked with me about that experience, Kamin paused frequently as he tried to come up with the right words to describe a situation that lends itself to speechlessness. “I walked out of that school and I was really afraid that I was broken, and that my ability to be a dad and a husband and a doctor and a friend had been completely turned upside down,” he eventually told me. “And I was very, very grateful and very happy when someone said, nope, you shouldn’t expect that as long as you … take care of yourself, get help when you need it, don’t do things that are destructive, and just let this process take shape.” The key words in that sentence are “as long as you,” and NFPA 3000 provides a framework for creating a list of things to be done to aid in recovery for both responders and the community as a whole.

“It’s critical that we advocate for resources to be available,” Kamin said. “With the right resources, you can go through an event and not automatically be broken.”

‘Nothing worthwhile is easy’: Meeting the need

In October, 2016, when Drozd submitted the request for NFPA to develop a standard like NFPA 3000, he cited the need for such a document with statistics. “Between 2000 and 2013, over 160 active shooter events have occurred within the United States, killing 468 and injuring over 550,” he wrote on the new project initiation form. That was before Las Vegas, Sutherland Springs, Parkland, and others. The Las Vegas shooting alone injured nearly as many as had been hurt in the numbers cited by Drozd.

The need for NFPA 3000 couldn’t be clearer. While committee members were at NFPA in March, news broke of an active shooter at a high school in Maryland. I watched as members scrubbed the news for updates on the incident via their cell phones. Not long after they left, another shooting occurred at YouTube’s headquarters in California.

Ultimately, that need and a shared goal of saving lives are what powered committee members through a grueling four days of finalizing the new standard. Members frequently clashed over how specific the document should be and how it should be worded to address competencies for each group involved. Law enforcement, for example, doesn’t have the codes and standards the fire service has had for decades, and a lot of consideration was given to the apprehension law enforcement agencies might experience when faced with a document that outlines what they should do to prepare for responding to these incidents.

In the end, committee members knew nothing like NFPA 3000 had been done before, and it was too important to let a perceived cultural divide between police and firefighters stall the process. “When we started this thing, we knew it would be difficult,” Drozd told members on the final day of their meeting. “But nothing worthwhile is going to be easy.”