Martyn's Law: a readiness guide for security & FM teams

If you guard, manage or maintain venues that the public can walk into — shopping centres, stadia, event spaces, places of worship, visitor attractions, hospitality — Martyn's Law changes what "doing your job well" is going to mean. It moves counter-terrorism preparedness from a nice-to-have into a legal duty, and it hands a lot of the practical work to the security and facilities teams already on the ground.

This guide is written for operators, not lawyers: what the law is, who has to do what, and how to get an operation ready without drowning in paperwork. It is general guidance to help you plan — not legal advice.

What Martyn's Law actually is

Martyn's Law is the common name for the Terrorism (Protection of Premises) Act 2025. It is named after Martyn Hett, one of the 22 people killed in the 2017 Manchester Arena attack; the campaign led by his mother, Figen Murray, is what drove it onto the statute book.

The core idea is straightforward. Premises and events where the public gather should have thought about what they would do in the event of a terrorist attack, and taken proportionate steps to be ready — before anything happens, not after. Rather than prescribing a single checklist for every venue, the Act sets duties that scale with the size of the crowd a premises can hold.

Who it applies to — the two tiers

The Act works on a tiered model based on how many people a premises or event can accommodate. At the time of writing, the thresholds are broadly as follows:

• Standard tier — smaller venues. Broadly, premises where 200 to 799 people may be present. The focus here is low-cost, common-sense preparedness: having simple procedures in place and making sure staff know them.
• Enhanced tier — larger venues and events. Broadly, premises and events where 800 or more people may be present. These carry heavier duties, including documented risk assessments and more developed security measures.

Capacity is about how many people could be there — public and staff — not the average on a quiet Tuesday. A venue that usually sees a hundred people but fills to several hundred for events needs to plan around the busy number. If you run multiple sites, expect them to fall into different tiers, and some to sit outside scope entirely.

The duties, in plain English

Whatever the tier, the responsibilities land on the person or organisation responsible for the premises or event. In practice that duty gets discharged through the security and FM teams. The main obligations to plan around are:

1. Understand your risk

You need to think through how a terrorist attack could affect the premises and the people in it — the vulnerable points, the crowd flows, the ways in and out. For enhanced-tier sites this becomes a documented risk assessment that you keep current, not a one-off exercise filed and forgotten.

2. Have public protection procedures

These are the practical things staff would do to reduce harm if an attack happened at, or near, the premises — for example evacuation, invacuation (moving people to safety inside), locking down, and communicating with the people on site. They should be written down, realistic for your building, and something your team can actually carry out.

3. Appoint a designated responsible person

Someone has to own this. There should be a clearly designated person accountable for the premises' compliance — making sure the assessment exists, the procedures are in place, and staff are trained. For a security or FM provider, that is often a named contract or operations manager.

4. Train and inform your people

Procedures only work if the people on shift know them. Staff should be made aware of the procedures relevant to their role and how to act on them. For frontline officers that means real familiarity with lockdown, evacuation and escalation — not a poster in the mess room.

5. Keep records and cooperate with the regulator

A dedicated regulator will oversee the regime, with the ability to inspect and, where duties are ignored, to enforce. Enhanced-tier premises in particular will be expected to be able to show their working: the assessment, the procedures, who is responsible, and evidence that training has happened. Being able to produce that quickly is the difference between a smooth interaction and a difficult one.

A practical readiness checklist

You don't need to wait for every last detail to be finalised to make progress. Most of the groundwork is good operational practice regardless. Work through this:

1. List every site and its realistic maximum capacity. Include event peaks, not just typical footfall.
2. Classify each site by tier — out of scope, standard or enhanced — and record why, so the reasoning is defensible later.
3. Name a designated responsible person for each in-scope premises, and make sure they know they hold it.
4. Carry out and document a risk assessment for enhanced-tier sites: vulnerable points, crowd flows, entrances and exits, neighbouring risk.
5. Write public protection procedures for each site — evacuation, invacuation, lockdown and communication — tailored to that building, not a generic template.
6. Train frontline staff on the procedures for their role, and capture who was trained and when.
7. Brief subcontractors and partners who work on the premises, so the whole team on site responds the same way.
8. Rehearse. Run a tabletop or drill at least once so procedures survive contact with reality — and note what you changed afterwards.
9. Store the evidence in one place so the assessment, procedures, responsible person and training records can be produced on demand.
10. Set a review cycle. Diarise a periodic re-check so assessments and procedures stay current as sites, layouts and threats change.

How a platform like Pulse helps

None of the above is impossible on spreadsheets and a shared drive. It just tends to rot — the assessment goes stale, the training log lives on one person's laptop, and when the regulator or the client asks, the scramble begins. A platform built for security and FM operations keeps the moving parts in one place:

• Per-site tier classification held against each site record, so the whole portfolio's status is visible at a glance rather than reconstructed from memory.
• Procedures attached to the site — evacuation, lockdown, invacuation — so the version on the officer's phone is the current one, wherever they are.
• A designated responsible person named on the record, with accountability that doesn't evaporate when someone leaves.
• Training records that show who was briefed on which procedure and when, without hunting through inboxes.
• Evidence on demand — assessments, procedures and training logs pulled together into something you can hand to a regulator or a client in minutes, not days.

Pulse is built around exactly this kind of record-keeping for UK security and facilities teams, so the compliance story is a by-product of running the operation properly — not a separate project bolted on the side.

Start now, refine as the detail lands

The sensible move is to get the structure in place — sites classified, responsible people named, procedures drafted, training under way — and tighten the specifics as the final thresholds, dates and regulator guidance are confirmed. Operations that treat Martyn's Law as an extension of good practice, rather than a last-minute compliance panic, will find the transition far easier.

This guide is general information to help you plan and is not legal advice. Martyn's Law is being brought into force in stages, and specific thresholds, dates and requirements may change. Always confirm the current position against official government and regulator sources, and seek professional advice for your particular premises and obligations.