What Security Measures May Businesses Need for Martyn’s Law?

Martyn's Law Security Measures

Businesses may need clear emergency procedures, staff awareness training, sensible security planning and, for higher capacity premises, written public protection measures that reduce the risk of harm during a terrorist incident. If Martyn's Law feels like another compliance task landing on your desk, the main point is to prepare in a practical way rather than overreact or spend money in the wrong places.

Martyn's Law is the Terrorism (Protection of Premises) Act 2025. As of 2026, it has received Royal Assent but is expected to come into force in spring 2027, with the exact start date still to be confirmed by the Government.

For many venues, the challenge is knowing what is sensible for the site, the people and the budget. iSecurity Solutions is a trusted UK provider of commercial and domestic security systems, helping homes and businesses stay protected around the clock with CCTV, intruder alarms, fire safety, access control and construction site monitoring.

What Is Martyn's Law UK?

Martyn's Law UK is a new law designed to improve public safety at certain premises and events that the public can access. It asks organisations to think ahead, train staff and prepare for serious security incidents in a way that fits their size, use and risk.

The law is named in memory of Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017. Its purpose is not to turn every shop, hall or venue into a fortress, because nobody wants buying a sandwich to feel like entering airport security. Instead, it asks businesses to take proportionate steps based on capacity, layout and how the premises are used.

The official Government guidance explains the two tier system, the responsible person and the role of the Security Industry Authority, known as the SIA. You can check the latest position on GOV.UK Martyn's Law guidance, which should always be treated as the main source for legal updates.

Which Businesses And Venues Are Covered?

Martyn's Law applies to qualifying premises where 200 or more people may reasonably be expected to be present at the same time. This number can include staff, customers, visitors, contractors and anyone else on site, so it is not only about seats, tickets or the usual number of customers.

Typical premises that may fall within scope include entertainment venues, shopping centres, large restaurants, hotels, places of worship, sports facilities, education sites, community buildings and healthcare settings. The key question is whether the public can access the premises and whether the expected number of people reaches the legal threshold. Do you know your busiest realistic occupancy, including staff and contractors?

Standard Tier Premises

Standard tier premises are those where 200 to 799 people may reasonably be expected to be present at the same time. These businesses will need suitable public protection procedures for evacuation, invacuation, lockdown and communication.

Standard tier duties are meant to be practical and proportionate. A local theatre, busy community hall or popular restaurant will not be expected to have the same level of security infrastructure as a major arena, but staff should know what to do if something serious happens.

Enhanced Tier Premises And Events

Enhanced tier premises are those where 800 or more people may reasonably be expected to be present at the same time. Some qualifying events with 800 or more people may also be covered, especially where the public can enter and there is entry control such as ticket checking, payment or registration.

Enhanced tier organisations will need more than basic procedures. They are expected to assess risks, put reasonable public protection measures in place, document what they have done and provide required information to the SIA once the relevant duties begin.

Who Is The Responsible Person?

The responsible person is the person or organisation that has control of the premises for the relevant use. In simple terms, it is the party with the authority to make decisions about how the premises are run, managed and secured.

In some cases, this will be a company, charity, local authority, school, venue operator or event organiser rather than one named individual. Senior managers and directors should still pay close attention, because clear ownership, good records and proper resources will matter when duties come into force.

Legal responsibility cannot simply be handed to a contractor. You can ask a security company, facilities team or consultant to carry out tasks, but the responsible person remains accountable for compliance. It is a bit like asking someone to service your car; helpful, sensible and often wise, but you still need to make sure the car is safe before you drive it.

Leased and shared premises need extra care. Landlords, tenants, managing agents and event organisers should review leases, licences and operating agreements so everyone knows who controls which areas, who trains staff and who updates procedures.

Standard Tier Security Measures

Standard tier businesses should focus on four core public protection procedures. These are evacuation, invacuation, lockdown and communication, and each procedure should be written in plain language that staff can follow under pressure.

Evacuation Procedures

Evacuation means moving people away from danger to a safer place. A good procedure should cover exits, alternative routes, assembly points, disabled access, staff roles and what to do if a normal exit cannot be used.

Invacuation Procedures

Invacuation means moving people into safer areas inside the premises when going outside may be more dangerous. This could involve moving customers away from glass frontages, vehicle routes, entrances or exposed public areas.

Lockdown Procedures

Lockdown means securing parts of the premises to reduce access and movement during a threat. Businesses should decide who can start a lockdown, which doors can be secured, how staff will be alerted and how emergency services can still gain access where needed.

If a lockdown had to happen today, your team should know who makes the call, where people should move and how to keep instructions calm and clear. A simple plan that staff understand is far better than a long document that nobody has read.

Communication Procedures

Communication is the link that holds every other procedure together. Staff need to know how alerts are raised, how customers are instructed, how contractors are included and what backup methods are available if phones, radios or public address systems fail.

Staff Training And Awareness

Staff training should help people spot concerns, report them quickly and understand their role during evacuation, invacuation, lockdown or emergency communication. It does not need to be frightening or overly technical, but it does need to be clear and repeated often enough to be remembered.

Training should include how to recognise suspicious behaviour without stereotyping, how to report unattended items, when to escalate concerns and how to speak calmly to members of the public. Front of house staff, reception teams, facilities teams, security personnel and managers may all need slightly different briefings.

Induction training is a good starting point, but refreshers matter too. Staff turnover is real, memory fades and procedures that live only in a dusty folder tend to perform about as well as a chocolate teapot in a crisis.

Event staff, casual workers and contractors should not be forgotten. Even a short briefing before opening can make a big difference if it explains exits, radio channels, reporting routes and who is in charge.

Enhanced Tier Security Measures

Enhanced tier premises and qualifying events need a more structured security approach. This means reviewing credible threats, vulnerable areas, crowd movement, queues, vehicle approaches, sensitive information and the practical measures that could reduce harm.

A security plan should map entrances, exits, queues, public spaces, staff areas, delivery points and critical systems. It should also record who owns each action, when measures are reviewed and how changes to layout, events or occupancy affect the plan.

Monitoring may include CCTV, staff observation, control room activity and checks around the immediate site. If CCTV is used, it should be properly positioned, maintained, privacy compliant and linked to a response plan, because cameras are not magic if nobody knows what to do with the footage.

For businesses reviewing camera coverage, CCTV systems can support monitoring of entrances, exits, queues and vulnerable areas when they are designed around real site risks rather than guesswork.

Movement control may involve visitor management, staff identification, ticket checks, controlled access to restricted areas and better queue layouts. The aim is to manage how people enter, leave and move around the premises without creating new risks or blocking emergency routes.

Physical security may include stronger doors, gates, barriers, lighting, signage, protected service yards and proportionate hostile vehicle mitigation. Vehicle measures should be based on the layout and risk, not installed simply because the phrase sounds serious in a meeting.

Security of information is also important. Floor plans, staff rosters, access codes, camera locations, security routines and technical details should only be shared with people who genuinely need them.

Physical And Technical Security Businesses May Consider

Physical and technical security may include CCTV, access control, alarms, lighting, barriers and safer door arrangements, but Martyn's Law does not say every business must install every system. The right measures depend on the premises, capacity, threat picture, existing controls and what is reasonably practicable.

Access control can help separate public areas from staff only spaces, plant rooms, offices, cash rooms or sensitive storage areas. If you are reviewing credentials, doors or visitor movement, access control can make daily operations safer while supporting wider security procedures.

Intruder alarms, perimeter detection and monitored CCTV can be useful for wider security, especially at larger or higher risk sites. Where intruder alarm systems are installed, they should be designed to EN 50131 Grade 2 or Grade 3 as appropriate. Where police response is needed, Insurance Approved SSAIB certification is usually the prerequisite for a Police Response URN. Detector activated CCTV and alarm confirmation may also need to be considered against relevant standards such as BS 8418, BS 5979 and BS 8243 where they apply.

Technology should be tested, maintained and understood by staff. A brilliant alarm that nobody can reset, a camera pointed at the ceiling or a door access system with old staff cards still active will not do much for anyone, apart from proving why maintenance matters.

Entry, Bag Checks And Queue Management

Entry, bag checks and queue management should be planned in a lawful and proportionate way, based on the type of premises or event. Businesses do not automatically need bag checks under Martyn's Law, although searches may be suitable for some venues when they are clearly explained and supported by a refusal of entry policy.

Door supervisors and security staff may need SIA licences depending on the work they carry out and the setting. For example, door supervision at licensed premises is commonly licensable, while ordinary stewards, ushers or customer service staff may not need the same licence if they are not carrying out licensable security duties.

Queue management is often overlooked, yet queues can create crowded and exposed areas. Good planning may include moving queues away from vehicle routes, using clear signage, keeping emergency access clear, preventing crowd pressure and briefing staff on what to do if entry has to pause.

Penalties, Deadlines And Preparation

The SIA will act as regulator for Martyn's Law, and enforcement tools are expected to include compliance notices, restriction notices, financial penalties and, in certain circumstances, criminal offences. Businesses should therefore prepare early and keep clear records of what they have reviewed, decided and improved.

As of 2026, the Act is not yet fully in force, and spring 2027 is the expected commencement period. Businesses should use the implementation period wisely rather than waiting until the final few weeks, because rushed compliance has a special talent for becoming expensive compliance.

Preparation should start with scope, capacity and responsibility. Record how many people could reasonably be present at peak times, decide whether standard or enhanced tier is likely to apply, identify the responsible person and review existing emergency plans.

If you want a smaller step by step version for early planning, the Martyn's Law compliance checklist covers practical actions that smaller UK businesses can start with before the implementation period ends.

Martyn's Law Compliance Checklist

A Martyn's Law compliance checklist should help businesses confirm whether the law is likely to apply, identify the responsible person and prepare clear procedures before the duties begin. The points below are a practical starting place for UK premises and events.

• Confirm whether your premises or event is likely to be in scope.
• Calculate the maximum number of people reasonably expected at one time, including staff.
• Decide whether the standard tier or enhanced tier is likely to apply.
• Identify the responsible person and record decision making authority.
• Review landlord, tenant, event organiser and contractor responsibilities.
• Write evacuation, invacuation, lockdown and communication procedures.
• Train staff, contractors and temporary workers in their specific roles.
• Review entrances, exits, queues, public areas and vehicle approaches.
• Assess CCTV, alarms, access control and physical security proportionately.
• Protect sensitive security information and access credentials.
• Check whether any security roles require SIA licensed staff.
• Test procedures through exercises and record improvements.
• Monitor GOV.UK and SIA updates for the confirmed commencement date.

Final Thoughts

Martyn's Law is about preparation, proportion and people. The businesses that handle it best will be the ones that understand their premises, train their teams, document sensible procedures and avoid treating security as a last minute box ticking exercise.

Not every venue will need expensive new equipment, but many will benefit from reviewing CCTV, access control, alarms, staff training and emergency communication before the law comes into force. A calm and practical review now can save stress later and, more importantly, help protect the people who use your premises every day.

If you are unsure where to start, review your current CCTV, access control, alarms and staff procedures now, then prioritise the gaps that matter most before the implementation period ends.

Frequently Asked Questions

Does Martyn's Law Apply To Small Businesses?

Yes, it can apply if the premises can reasonably expect 200 or more people at the same time. Size of business is less important than public access, use and occupancy.

Do Businesses Automatically Need CCTV For Martyn's Law?

No, CCTV is not automatically required for every business. It may support monitoring and evidence gathering, but measures should be based on a proportionate risk assessment.

Who Is Responsible In A Leased Building?

Responsibility usually depends on who controls the premises for the relevant use. Landlords, tenants and managing agents should review agreements and record who is responsible for procedures, training and shared areas.

Do Security Systems Need To Be Insurance Approved SSAIB Certified?

For alarms, monitored CCTV and perimeter detection that need police response, insurers often expect an Insurance Approved SSAIB certified installation, as Insurance Approved SSAIB certification is normally needed before applying for a Police Response URN.

How Much Will Martyn's Law Compliance Cost?

There is no single cost because it depends on capacity, layout, current procedures, staffing and existing security systems. Many businesses can start with planning, training and documentation before deciding whether technical upgrades are needed.