If you haven't yet confirmed you're in scope, read Martyn's Law explained first.
Step 1: Confirm scope and tier
Work out whether 200 or more people could reasonably be present, and whether you are Standard or Enhanced Duty. Schools and colleges are always Standard Duty (details here).
Step 2: Assign clear ownership
Someone must be accountable. Enhanced Duty premises must appoint a designated senior individual; Standard Duty premises should still name an owner so reviews and training keep happening. Responsibility can be shared but must be clearly assigned.
Step 3: Carry out a risk assessment
You don't need to be a counter-terrorism expert. Ask three questions:
- What could happen?
- How vulnerable are your premises?
- How would your organisation realistically respond?
Consider the six attack categories set out by NaCTSO:
Record what you found, what options you considered and why you chose your measures. Review the assessment periodically and whenever your premises, capacity or use changes significantly.
Risk assessment template. A simple structure is: premises and capacity; entrances, exits and vehicle approaches; attack methods considered; existing controls; gaps; proportionate actions; owner and target date; review date. The HSE's risk assessment guidance is a useful model for format. If you would like a ready-made version, offer your readers a downloadable template here (CTA).
Step 4: Put procedures in place
Write practical procedures for evacuation, invacuation, lockdown and communication that reflect your size, layout and use. Give each a clear owner and review date. Enhanced Duty premises also need documented additional public protection measures.
Step 5: Prepare your people
Procedures only work if people know them. Cover employees, agency workers and volunteers, and practise rather than just read. See Martyn's Law training.
Step 6: Create evidence as you go
Keep simple records of risk assessments, procedures, training, exercises and decisions. For Enhanced Duty premises these form the basis of the formal compliance document available to the SIA. Records created through everyday operations are more reliable than a file assembled in a panic.
Step 7: Review and improve
Test procedures with tabletop exercises, debrief, and update. Check guidance regularly, because the SIA will continue publishing detail ahead of commencement. See when enforcement is expected.
Martyn's Law compliance checklist
Governance
- A named person or team is accountable.
- Senior leaders understand the obligations.
- Enhanced Duty: a designated senior individual is appointed.
- Responsibilities are clear on rented or shared premises.
Risk assessment
- Completed for each qualifying premises or event.
- Considers the relevant attack methods.
- Reviewed periodically and after significant change.
Procedures
- Written evacuation, invacuation, lockdown and communication procedures exist.
- They reflect the premises and have owners and review points.
- Enhanced Duty: additional measures are in place and documented.
Training and exercises
- Staff understand their role in each procedure.
- New, casual, agency and seasonal staff are trained at induction.
- Refreshers are scheduled and tracked.
- Drills or tabletop exercises take place regularly and lessons are recorded.
Evidence
- Records are kept for assessments, training, exercises, reviews and decisions.
- Evidence is created in everyday operations, stored securely and easy to retrieve.
- Enhanced Duty: the compliance document is in place and current.
For a fuller version, download the Preparing for Martyn's Law guide. Venue operators can pair this with our venues, stadiums and events guide.
