Paul Goldenberg recently argued in a Police1 article that the mission of campus policing has fundamentally changed. He is right.

The threat environment facing colleges and universities is more complicated, the expectations placed upon campus police departments are greater, and chiefs need better staffing, training, intelligence, technology, and integration with the broader law enforcement and homeland security communities.

But there is a second half to this conversation.

If the campus policing mission has changed, then the institution surrounding the police department must change with it.

Campus safety is not something a police department delivers to a university. It is something a university co-produces.

That distinction matters because even the most capable police department operates within a larger institutional system. Whether that system can recognize risk, connect information, mobilize resources, and learn from experience may determine how effectively a university prepares for the next crisis.

Police anchor the ecosystem, but they cannot be the ecosystem

In my book, The Campus Safety Ecosystem, I describe campus safety as the product of an interconnected system involving nearly every facet of the university community. The Campus Safety Department anchors that ecosystem, but producing safety is far more complex than policing alone.

Think about what happens when a university hosts a controversial speaker.

Police may develop the operational security plan, but who selected the venue? Who knows whether attendance has suddenly increased? Who understands the physical vulnerabilities of surrounding buildings? Who controls access to those buildings? Who monitors emerging threats? Who coordinates emergency medical resources? Who communicates with students and employees? Who decides whether an event should be relocated or modified? Who knows when an event that began as a routine campus program has developed implications requiring municipal, county, state or federal assistance?

The answers may involve student affairs, facilities, emergency management, communications, information technology, legal counsel, risk management, behavioral threat assessment teams, event professionals, executive leadership and outside public-safety agencies.

Each may possess a piece of the risk picture.

The challenge is whether the institution can assemble those pieces before they matter.

A university can have an excellent police department and still possess a weak campus safety ecosystem. Conversely, a properly staffed, trained and equipped department becomes considerably more capable when it operates within an institution designed to recognize risk, share information and mobilize resources across organizational boundaries.

That is the co-production of safety.

The most important partnerships may be inside the university

Police chiefs understand external partnerships.

Mutual aid, fusion centers, task forces and relationships with municipal, county, state and federal agencies are familiar components of professional policing. Goldenberg correctly argues that campus departments must become even more integrated into that architecture.

Campus policing, however, requires another kind of integration.

The university police chief must be just as connected inside the institution.

The chief needs durable relationships with student affairs, facilities, information technology, emergency management, communications, legal affairs, human resources, risk management and other functions possessing pieces of the institutional risk picture.

Those relationships cannot begin when the emergency operations center opens.

They must exist on ordinary Tuesdays.

The time to determine who can provide police immediate access to a building is not during an active threat. The time to decide when outside agencies should be requested for a major event is not two hours before the speaker arrives. The time to develop information-sharing protocols is not after an act of targeted violence.

Relationships themselves are a safety capability.

This is why campus police cannot simply be treated as another administrative function. Chiefs need meaningful access to executive decision-making when institutional decisions carry significant public-safety implications.

That does not mean police should run universities.

It means universities should not make consequential safety decisions without incorporating public-safety expertise.

Physical security is an institutional responsibility

Former FBI and CIA Director William Webster is often credited with an observation that captures one of the persistent challenges of institutional security: “Security is always deemed too much, until the day it is not enough.”

That tension is particularly acute on a college campus. Universities are intentionally open environments. They value accessibility, community, movement and engagement. Security measures can be expensive, inconvenient and, when poorly designed, inconsistent with the character of an academic institution.

Yet openness cannot mean the absence of thoughtful physical security.

The objective is not to turn a university into a fortress. It is to make deliberate, risk-informed decisions about how people, buildings and spaces are protected while preserving the essential nature of the campus.

Here again, the ecosystem matters.

The campus police department may oversee important portions of the physical security program, but it rarely controls all of them. Police may manage security assessments, alarm response, camera monitoring or certain access-control functions, while facilities manage doors, locks and building systems. Information technology may maintain the network infrastructure supporting cameras and electronic access control. Residence life may determine how residence halls are accessed. Parking and transportation may manage gates and vehicle access. Capital planning and architects may make design decisions that affect security for decades.

No single department controls the entire system.

Access control illustrates the challenge. A card reader is only one component. The larger questions are who receives access, who authorizes it, how quickly privileges are removed, how exceptions are documented, how doors are monitored and who periodically audits the system. An electronic access-control program can be undermined by something as simple as an uncontrolled mechanical master key or a door that does not reliably latch.

The same principle applies to cameras. The number installed matters less than whether the institution has determined what those cameras are intended to accomplish and whether placement, image quality, retention, monitoring, maintenance, privacy and rapid retrieval support that purpose.

Lighting, landscaping and the design of campus spaces deserve similar attention. Crime Prevention Through Environmental Design provides a framework for considering natural surveillance, access control, territorial reinforcement, maintenance and activity support. Those principles are most effective when police and security professionals are involved during planning and design rather than being asked to solve security problems after construction.

The strongest physical security programs emerge when these disciplines work together.

Campus police should therefore have a defined role in capital projects, renovations, residence-hall planning, and other decisions with significant security implications. Physical security standards should be institution-wide rather than department-specific, and responsibility for cameras, access control, keys, alarms, lighting, and other systems should be clearly assigned.

Just as importantly, physical security should be periodically reassessed. Campuses change. Buildings change uses. Technology ages. Student behavior evolves. Threats change.

The question for a university president or police chief should therefore not simply be, “Do we have cameras and access control?”

It should be: “Do we have a physical security program — and does the institution know who is responsible for making all of its parts work together?”

The police department may anchor the security conversation, but it cannot control every door, camera, light, key, residence hall, and construction project across a modern university.

It should not have to.

What it must do is help ensure that the people who control those systems understand that they are part of the campus safety ecosystem.

Every major incident should become a case study

Every major campus tragedy presents two risks.

The first is failing to learn from it.

The second is concluding that the circumstances were so unique that its lessons do not apply elsewhere.

Utah Valley University should be approached in that spirit — as a case study, not an anomaly.

Goldenberg’s article uses the 2025 assassination of Charlie Kirk at Utah Valley University to raise questions about staffing, event-security planning, threat assessment and coordination with outside law enforcement. Some of the specific assertions surrounding the event are allegations associated with pending legal claims and should not be confused with established findings.

UVU itself announced a comprehensive independent review following the assassination, saying that the review should provide insights for improving preparedness not only at UVU but across Utah higher education.

That is exactly the right approach, and its application should extend beyond Utah.

When relevant findings become available, other institutions should not study them to determine whether they would have performed better than Utah Valley. They should study them to discover where their own systems could fail.

One way to do that is to take a major event held on campus during the past year and reconstruct it.

What information existed 30 days before the event? Seven days before? Twenty-four hours before? One hour before?

Who possessed that information?

Did it reach the people capable of acting on it?

Examine staffing. Examine threat assessment. Examine physical vulnerabilities and elevated positions. Examine mutual-aid thresholds and command relationships. Examine communications interoperability and emergency medical resources. Examine the relationship between event organizers and public safety. Examine who possessed the authority to modify, relocate or cancel an event as circumstances changed.

Most importantly, examine the assumptions behind those decisions.

The objective is not to demonstrate that your university would have performed better than another institution.

The objective is to discover where your system could fail.

“It could happen here” is a discipline, not a slogan

My second book, It Could Happen Here: True Incidents from College Campuses, grew out of studying major campus incidents and asking what universities can learn from them.

The premise is deliberately simple: Institutions should not have to experience their own catastrophe before learning from someone else’s.

The incidents examined in the book span targeted violence, mass shootings, sexual assaults, hazing deaths, laboratory accidents, riots and infrastructure failures. Different incidents, different institutions, different causes — but the same opportunity to identify lessons before another campus has to learn them firsthand.

This matters because low-frequency, high-consequence events create a dangerous institutional paradox.

When nothing happens, the absence of catastrophe can begin to look like evidence that existing systems are adequate.

Staffing requests are deferred.

Exercises become less frequent.

Equipment ages.

Mutual-aid relationships become dependent upon individual personalities.

Experienced people retire.

Other priorities consume institutional attention.

And the lessons from the last crisis slowly fade.

Then something happens.

A commission is formed. Consultants arrive. After-action reports are written. Recommendations are made. Policies change. Resources are committed.

For a while.

And eventually, the institution begins forgetting why those changes were made.

That cycle points to a problem much larger than any individual recommendation.

We do not have a recommendations problem.

American law enforcement and higher education have studied catastrophic campus incidents for decades. We have after-action reports, federal guidance, professional standards, accreditation programs, independent reviews, commissions, litigation and an enormous body of accumulated experience involving active assailant response, behavioral threat assessment, emergency communications, incident command, mutual aid, event security, intelligence sharing and crisis management.

We are not suffering from a shortage of recommendations.

The central challenge facing campus safety is not the absence of reform recommendations.

It is the inability of institutions to sustain organizational learning across generations.

Chiefs retire.

Presidents leave.

Vice presidents move to other universities.

Emergency managers accept new positions.

Sergeants promote.

Trustees complete their terms.

Institutional priorities change.

The recommendation survives somewhere in a report.

The institutional memory does not.

That distinction is critical.

A reform that depends upon a particular police chief remembering why it exists has not been institutionalized.

A mutual-aid relationship dependent upon two commanders who happen to know one another has not been institutionalized.

A threat-assessment process understood only by the current members of the team has not been institutionalized.

And an after-action recommendation that never becomes policy, training, budgeting, exercise design and executive oversight has not been institutionalized.

It has merely been remembered temporarily.

Make organizational memory part of the safety system

The next evolution of campus safety should therefore focus not simply on identifying best practices, but on making those practices durable.

Major incidents and exercises should produce documented lessons with assigned owners, deadlines and executive accountability.

Incoming police chiefs should inherit more than policies and organizational charts. They should receive the institutional history behind major safety decisions, significant risks, previous incidents, after-action findings and unresolved recommendations.

Incoming presidents and senior executives should receive public-safety briefings as part of their transitions.

Governing boards should periodically examine the condition of the campus safety ecosystem rather than waiting for a critical incident to put public safety on the agenda.

Exercises should not simply test whether the university can respond to an emergency today. They should test whether reforms adopted five or ten years earlier remain operational.

And universities should deliberately study incidents at other institutions.

We should not require our own casualties before we become willing to learn.

Turn lessons into institutional capability

Utah Valley University’s independent review was initiated with the stated goal of improving preparedness at UVU and informing safety efforts across Utah higher education.

The higher education community should embrace the broader principle behind that effort.

When relevant findings from major campus incidents become available, police chiefs should study them. Presidents should study them. Trustees should study them. Emergency managers, student-affairs leaders, facilities executives, communications professionals and event managers should study them.

Not to determine who to blame from hundreds of miles away.

To determine what to change at home.

The lasting value of an after-action review is not the number of recommendations it contains. It is whether institutions convert those recommendations into durable capability.

Goldenberg is right that the campus policing mission has changed.

The next question is whether the institution around the police department is prepared to change with it.

Campus police departments must be appropriately staffed, trained, equipped and connected to the broader law enforcement and intelligence community. But even the finest police department cannot independently secure a modern university.

Safety must be co-produced.

Police must anchor the ecosystem. Campus partners must participate in it. University leadership must sustain it. Outside agencies must reinforce it.

And the entire institution must learn how to remember.

Because the ultimate test of organizational learning is not what a university changes in the year after a tragedy.

It is what remains changed a generation later.

About the Author

A nationally recognized expert on campus safety, Michael J. Rein, CPM, CPP, CHPA, is a Vice President with COSECURE, a professional services firm specializing in providing tailored security solutions to a diverse range of industries, including Corporate, Education, Healthcare, Hospitality, Manufacturing, Non-Profit & Social Services, Office Buildings, Retail, and Religious Centers. Before joining COSECURE, Michael served as a police officer at Rutgers University, retiring in 2022 as the Deputy Chief of University Police. Mike is the author of two books on campus safety: The Campus Safety Ecosystem and It Could Happen Here: True Incidents from College Campuses.