Written by: Paul Foster, Founder, CEO, OnePlan
Key Takeaways
- Martyn's Law (Terrorism (Protection of Premises) Act 2025) requires venue operators to implement four core public protection procedures: evacuation, invacuation, lockdown, and communication.
- Standard tier venues (200-799 capacity) focus on procedural readiness, while Enhanced tier venues (800+ capacity) must also document physical security measures and appoint senior accountability.
- Effective compliance relies on risk assessments, venue-specific procedures, staff training, and regular drills with documented outcomes.
- Procedures must reflect your building layout, stay accessible to staff, and be reviewed annually or after significant venue changes.
- OnePlan provides to-scale venue mapping and planning tools that help operators document evacuation routes, assembly points, and security layouts for Martyn's Law compliance. Book a demo today to see how OnePlan can support your compliance work.
The Four Core Martyn's Law Safety Procedures
The four core public protection procedures are the sets of actions staff can take if they suspect an act of terrorism is occurring or about to occur at the premises, at an event, or in the immediate vicinity. They are evacuation, invacuation, lockdown, and communication. These procedures form a toolkit, so a real incident may call for one, two, or all four simultaneously. Clear procedures explain when each applies and how staff make that decision.
Evacuation Procedures
Evacuation moves people away from danger and out of the premises. Terrorism evacuation differs from fire-safety evacuation because the threat profile involves deliberate harm rather than accidental fire. Procedures therefore need at least one alternative route per area in case the primary route becomes unsafe.
Key steps for evacuation procedures include:
- Identify primary and secondary routes from each part of the premises, with a rationale for route priority. For example, one route may lead through a main entrance onto a public pavement and another through a side door into a different area.
- Designate assembly points at a safe distance in more than one direction. Because a predictable route could be compromised, avoid obvious muster points that could be targeted.
- Assign roles so staff know who leads each route, who sweeps each room, and who accounts for headcount.
- Plan specifically for individuals with mobility needs, including the use of evacuation chairs.
- Define the handover process to emergency services on arrival.
Invacuation Procedures
Invacuation brings people inside to a safer internal area when the threat is outside the building or when external evacuation routes are compromised. Staff are often least familiar with invacuation because it runs counter to the instinct that evacuation is always the answer. That is why it requires specific training to build confidence in the decision.
Key steps for invacuation procedures include:
- Identify safer internal zones, ideally interior rooms with limited external access, solid walls, and securable doors. For a restaurant, this may mean bringing individuals into the main restaurant area and, if needed, into staff areas.
- Plan routes from public areas to those zones and assign staff roles to move people.
- Consider how long people can shelter safely, accounting for ventilation, capacity, accessibility, and water supplies.
- Define how the all-clear is given.
Lockdown Procedures
Lockdown secures the premises to prevent an attacker from entering or moving through the space. Lockdown closes the perimeter, while invacuation moves people inward. The two often run together but remain distinct procedures, and regulators expect to see all four documented separately.
Key steps for lockdown procedures include:
- Specify who triggers lockdown, using a single named role with authority and a clear chain of substitution.
- Use an unambiguous trigger phrase or signal, distinct from other emergency calls and ideally pre-recorded.
- Assign who locks each entry point, with a written sequence covering every access point, not just the main door. Nominated individuals should know when and how to quickly lock doors, close window shutters, and turn off lights.
- Address what happens to people approaching the venue during lockdown.
- Define how the all-clear is given, typically on police instruction.
Communication Procedures
Communication alerts staff and the public with clear instructions on how to respond. Communication acts as the connective tissue of the other three procedures, because evacuation, invacuation, and lockdown all depend on it. Alerts must reach every person in every area of the premises within the time it takes an incident to develop. For most premises, that means under 60 seconds.
Key steps for communication procedures include:
- Nominate a communicator with a clear chain of substitution. Staff should know who will enact procedures, such as the shift manager, and how to communicate with customers if an attack occurs.
- Identify channels for internal (staff-to-staff) and external (staff-to-public) audiences, and define a backup channel if the primary fails.
- Prepare pre-agreed wording for common scenarios to reduce hesitation under pressure.
- Plan external communication after the incident, including family contact, regulatory notification, and public statements.
Ready to map your venue's evacuation routes, assembly points, and security layouts to scale? See OnePlan in action with a free first event or a 15-minute demo.
Standard Tier And Enhanced Tier Requirements
Standard tier applies to premises where 200–799 individuals (including staff) may be present, with requirements centred on simple, low-cost activities to reduce harm and save lives. Enhanced tier applies to premises where 800 or more individuals may be present, and qualifying events with 800 or more attendees and entry controls are subject to the same enhanced requirements. Premises whose principal use is childcare, education, or a place of worship remain in the Standard tier even if 800 or more people may be present.
The key difference lies in the level of control. Standard tier focuses on procedural readiness and low-cost planning. Enhanced tier requires more rigorous vulnerability assessment, physical security measures such as CCTV, bag search policies, or vehicle checks, and senior accountability.
Implementing Martyn's Law Procedures At Your Venue
Conduct A Risk Assessment
Begin by reviewing existing emergency procedures and security arrangements against the statutory guidance. Most organisations already have much of the required framework in place, so the first step involves identifying gaps rather than starting from scratch. To-scale site plans are essential here because they let you identify vulnerabilities, plan evacuation routes, determine safe assembly points, and model crowd flow before committing to any physical changes. “Reasonably practicable” means proportionate, weighing what can be done against cost, time, and difficulty.
Develop Clear, Venue-Specific Procedures
Document all four procedures clearly and tie them directly to your venue by using the building name, room names, and named roles. A template that has not been adapted to the specific building, layout, and staff structure is unlikely to satisfy the SIA at inspection. Make procedures accessible to all staff, and consider a laminated quick-reference card at the manager's station with trigger phrases and named roles. Procedure documents in folders are rarely consulted in an incident, while the card on the wall is. Review procedures annually or after any significant change to the venue's setup.
Train Your Staff Effectively
There is no statutory requirement for a specific form of training. The Home Office recognizes induction sessions, team briefings, annual refreshers, shadowing, supervised practice, and e-learning as valid methods. Training should cover the four procedures, recognizing suspicious behavior, and each staff member's specific role. Free ACT Awareness e-learning is available through ProtectUK and certificates can be included in compliance documentation. Counter-terrorism training can often be built into existing induction and refresher programmes rather than delivered only through standalone sessions.
Run Drills And Review Your Plans
Run at least one tabletop exercise and one live drill per year. Drills often reveal operational gaps that are not obvious on paper, such as whether everyone knows their responsibilities, whether decisions can be made quickly, and whether communication channels hold up under pressure. Record gaps with owners and due dates in an improvement log, and review procedures after exercises, relevant incidents, layout changes, or significant changes in expected attendance. Document all exercise outcomes and update procedures based on lessons learned.
Martyn's Law Compliance Checklist
Use this checklist to confirm your current position.
Standard Tier items:
- Procedures for evacuation, invacuation, lockdown, and communication are documented and specific to the venue.
- Staff have received training on these procedures and their individual roles.
- A record of training is maintained.
- Procedures are reviewed annually or after significant changes.
- The venue is registered with the SIA within the 3-month notification window from commencement.
Enhanced Tier additions:
- A senior accountable person is appointed.
- A detailed security plan is documented and provided to the SIA.
- A terrorism risk assessment has been completed.
- Physical security measures (for example CCTV, bag search policies, or vehicle checks) are implemented where appropriate.
- Drills are conducted regularly, documented, and reviewed.
- Training records, exercise outcomes, procedure versions, and review dates are stored and kept current.
How OnePlan Supports Martyn's Law Compliance
Each of the four procedures depends on an accurate picture of your venue. Evacuation routes, assembly points, invacuation zones, lockdown entry points, and communication coverage areas all need to be planned against the real layout of your space, not a rough sketch or a static screenshot.
OnePlan is a browser-based, to-scale event site planning platform. It lets venue operators create accurate maps of their premises, plan evacuation routes and assembly points, and model security layouts. Teams can also collaborate with stakeholders, including security teams, Safety Advisory Groups, and local authorities, all in one live plan. Every object placed on the map stays accurately to scale as you zoom, so a corridor marked as 3 metres wide is actually 3 metres wide on the plan.
OnePlan's crowd capacity calculator lets you outline any standing area and instantly see its safe capacity, giving you defensible figures for your procedures and documentation. The auto-generated Bill of Quantities turns everything placed on the map into an exportable inventory, which helps you document physical security measures and coordinate with contractors. Plans export to high-resolution maps for permit submissions, Safety Advisory Group meetings, and SIA documentation. Existing floor plans and site plans can be imported as .png files, scaled onto the map, and built on top of so you can reuse work you already have.
Venue teams use OnePlan to map evacuation routes, invacuation zones, and assembly points for large-scale events. These live plans help them show how their layouts and procedures align with the four-procedure framework required under Martyn's Law.
Want to see how this works for your site? Book a short demo or start your first event free in OnePlan.
To help you address common concerns, here are answers to frequently asked questions about Martyn's Law.
Frequently Asked Questions
What Is The Deadline For Martyn's Law Compliance?
The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, with an implementation period of at least 24 months. The UK government expects Martyn's Law to come into force in spring 2027, with the exact commencement date to be confirmed ahead of time. Qualifying premises will have a 3-month window from commencement to submit their initial notification to the SIA. Changes to notified information must be reported within 28 days after they occur.
What Counts As A Qualifying Venue Under Martyn's Law?
Qualifying premises are those where it is reasonable to expect 200 or more individuals, including staff, to be present at the same time for a Schedule 1 use. This covers a wide range of publicly accessible premises including shops, restaurants, entertainment venues, hotels, libraries, museums, visitor attractions, and healthcare facilities. Premises used primarily for childcare, primary, secondary, or further education, and places of worship remain in the Standard tier even where 800 or more people may be expected. Higher education institutions can fall within the Enhanced tier.
How Should I Train Staff For Martyn's Law?
There is no statutory requirement for a specific form of training. The Home Office recognizes a range of methods, from induction sessions through to e-learning, as noted in the training section above. Paid third-party training is not mandatory. Training should cover the four procedures, recognizing suspicious behavior, and each staff member's specific role. Free ACT Awareness e-learning is available through ProtectUK and completion certificates can be included in compliance documentation. For Enhanced tier venues, training should be more nuanced and may include scenario-based practice for procedure owners and supervisors.
What Is The Role Of The Security Industry Authority (SIA)?
The SIA is the independent regulator for Martyn's Law. It manages venue registration through a notification portal, conducts inspections, and enforces compliance through compliance notices, restriction notices, and penalty notices. The SIA is currently conducting pilot inspections and developing its notification portal ahead of commencement in spring 2027. The SIA's stated approach is driven by public protection objectives and supports events taking place safely.
What Is The Difference Between Invacuation And Lockdown?
Invacuation moves people to a safer place within the premises when the threat is outside, such as an incident on the street nearby. Lockdown secures the premises to prevent an attacker from entering when the threat is inside or on the threshold, stopping all movement and securing every entry point. The two often run together, for example locking the doors and then moving people to safer zones, but they remain distinct procedures. Regulators expect to see all four procedures documented separately.
What Are The Penalties For Non-Compliance With Martyn's Law?
The SIA can issue compliance notices, restriction notices, and penalty notices. Failure to comply can result in civil penalties of up to £18 million or 5% of global revenue. In certain circumstances, criminal offences may apply, including where false or misleading information is provided or compliance notices are ignored. Senior managers who fail to prevent breaches through gross negligence or wilful neglect may also face personal liability.
Do I Need To Hire A Consultant To Comply With Martyn's Law?
The Home Office has stated that organisations can comply without needing to buy specialist or consultancy services. The statutory guidance is designed to be proportionate and practical. Many requirements are procedural rather than capital-intensive, and free resources including ACT Awareness e-learning and ProtectUK guidance are available. A practical starting point involves reviewing what is already in place, identifying gaps, and adapting existing emergency procedures to meet the four-procedure framework.
Conclusion: Take Action Now
Martyn's Law compliance comes down to the four core procedures outlined above, implemented proportionately for your tier, documented clearly, trained out to staff, and tested through drills. Determine whether your venue falls under the Standard or Enhanced tier, review what you already have in place, fill the gaps, and document everything. The SIA is already conducting pilot inspections, and enforcement is expected in spring 2027.
For further information, the Home Office statutory guidance on GOV.UK and ProtectUK are the authoritative sources for determining scope and requirements. The SIA's notification portal and operational guidance are in development ahead of commencement.
Start preparing now. The venues that will be ready in spring 2027 are the ones building their procedures, site plans, and training records today.
Ready to make your venue safer and Martyn's Law compliant? Book a demo to map your venue and start your compliance journey.