Martyn’s Law: A Comprehensive Guide

What is Martyn’s Law?

Martyn’s Law is the Terrorism (Protection of Premises) Act 2025. It was named after Martyn Hett who was killed at the Manchester Arena in 2017. The new law ensures venues are better prepared for, and protected against, terrorist attacks.

Effectively, responsibility has shifted. Public safety is no longer solely in the hands of the emergency services. It is now the responsibility of venue owners and operators to put proportionate safety measures in place.

Timescale

Martyn’s Law received Royal Assent in April 2025, and there’s a minimum 24-month implementation period. If your venue is affected, you should expect to prove compliance from Spring 2027.

Bear in mind that at the time of writing (October 2026), Martyn’s Law is not yet in place. The government is currently finalising statutory guidance and implementation details ahead of the law coming into force in 2027. For updates, see Martyn’s Law: scope, support and what’s next.

Regulation and accountability

The regulator for Martyn’s Law is the Security Industry Authority (SIA) who are keen to stress that they will provide support and guidance. While the legislation includes fines, restriction notices and criminal proceedings, the SIA will resort to these only when there is serious or persistent non-compliance.

Important: To address a common misconception, if your venue employs a security company, proving compliance lies does not lie with the security provider. Compliance with Martyn’s Law is the responsibility of the venue’s owners and operators.

Does the law apply to your business?

Martyn’s Law affects businesses which make their premises available to the 200+ members of the public. More accurately, it applies to venues where at least 200 people typically gather at the same time. As well as ticket holders and members of the public, this minimum of 200 also includes all staff and workers.

Note: Even if your venue only occasionally holds 200+ people, but is normally quieter, it still falls within the scope of the law.

The 17 categories of qualifying use

For the legislation to apply, your building (or a defined part of it) will mainly used for one or more of the following:

The law also applies to the remaining 5 categories below. However, they’ve been granted “special consideration”. They fall under standard tier requirements so the stricter rules won’t apply.

Standard tier and enhanced tier

Under Martyn’s Law, there are different requirements depending on whether your venue falls into standard tier or enhanced tier.

It comes down to the greatest number of people reasonably expected to be present at the same time. Don’t forget that as well as members of the public, this number must include all staff, volunteers and visitors.

The key differences between standard and enhanced tier

If your venue falls within standard tier requirements, it’s mainly about preparedness and response. In practice, make better use of what you have before spending money.

Enhanced tier has all the requirements of standard tier, but there’s a crucial difference. You have to actively reduce the venue’s vulnerability to a terrorist attack in the first place.

The “core four” procedures

At the heart of Martyn’s Law are 4 core public protection procedures which apply to both standard tier and enhanced tier venues.

The most crucial of these 4 procedures is communication. Without clear communication during a terrorist attack, the other 3 procedures will fail.

Internal staff messaging is essential. Every worker must be fully aware of the protocols — how they’ll communicate with one another during an attack, how they’ll coordinate the response, who is responsible for specific actions and so on. Should anything change, even the smallest detail, do make everyone aware of the change.

So, how do you ensure compliance? We’re starting with standard tier compliance.

Standard tier requirements under Martyn’s Law

For standard tier premises (capacity of 200-799 people), the requirements focus on simple, low-cost activities and procedural preparedness.

There’s no need for you to buy expensive physical security upgrades. Instead, you should focus on procedural execution, staff awareness and simple coordination.

The Plan-Do-Check-Act (PDCA) cycle

For busy venue owners, the following Plan-Do-Check-Act template is a useful, practical tool. It turns what seems like impenetrable government bureaucracy into a simple, step-by-step cyclical checklist.

1. Plan

Assess the risk, identify the gaps and document your findings. The document doesn’t have to be detailed. The SIA regulator is looking for a basic, practical and honest appraisal of your building and procedures.

• Risk assessment: Start by evaluating your venue for potential threats. Identify every single way someone can walk into the building. Pinpoint when your venue is at its busiest and most vulnerable.
• Identify scenarios: The most common terrorist threats listed in the government’s threat guidelines are:
  • Bladed weapons or marauding attacks: How easily can your venue become a target to an attacker with a knife on the street outside?
  • Suspect packages and unattended bags: Where are the unmonitored areas where an item could be hidden?
  • Vehicle-as-a-weapon: Is your front entrance on a busy main road, or is there a natural barrier like a wide pavement?
• Guide, shelter, communicate: You’ll be managing panicking customers who don’t know your building’s layout. Develop “guide, shelter, communicate” procedures tailored to your venue. Protect UK has some useful guidance.

2. Do

Put the security plan into action by registering the venue, training staff on a regular basis, and assigning safety responsibilities to designated personnel.

• Register: You will need to register the venue’s details with the SIA. The registration portal is still being built, although you can find details on the SIA Martyn’s Law Guidance Page.
• Staff training: Free counter-terrorism training is available from accredited sources such as ProtectUK’s ACT Awareness E-Learning.
• Designate specific actions: Looking at the “core four” above (evacuation, invacuation, lockdown and communication), assign clearly defined roles and actions to a responsible individual or individuals. The Home Office Standard Duty Factsheet has more information.

3. Check

Things change, so it’s important to monitor your procedures, evaluate their efficiency and amend them whenever necessary.

• Practical exercises: Regularly run your staff through “what if” scenarios and simple drills to make sure everyone understands their assigned roles.
• Compliance logs: Keep written records of training dates and completed exercises. This is important because the SIA will check these records to verify compliance.

4. Act

Fix the gaps, and adjust the security plan according to changing threat levels or test results. Then repeat the PDCA loop for continuous improvement.

• Refine and adjust: Adjust your procedures based on lessons learned from “what if” scenarios or following any venue upgrades.
• Review: Carry out an annual review of the standard tier requirements. Refresh the cycle immediately if your regional threat levels shift.

Standard tier compliance in a nutshell

Standard tier compliance is about low-cost readiness, rather than expensive upgrades. To remain compliant and keep everyone safe, keep these 3 points in mind:

Enhanced tier requirements under Martyn’s Law

Once a venue hits a capacity of 800 people, it falls under enhanced tier requirements. Because there are greater consequences of a terrorist attack at larger venues, compliance with Martyn’s Law is more demanding.

You will be expected not just to respond to an attack, but to proactively reduce its likelihood and impact. Compliance will include a comprehensive terrorism risk assessment, additional protective measures, an ongoing security plan, clear documentation and proof of continuous improvement.

The “core four” plus four more

Alongside the “core four” procedures common to both standard and enhanced tier premises — evacuation, invacutation, lockdown and communication — there are four additional protection measures:

The Plan-Do-Check-Act (PDCA) cycle

For the owners of larger venues, complying with the strict demands of Martyn’s Law can be a daunting prospect. To help you with implementation, we’ve put together a structured template tailored to the standard compliance requirements.

The Plan-Do-Check-Act cycle is a continuous, step-by-step checklist.

1. Plan

• Designate a senior individual: Legally assign a named board-level director or senior leader to become accountable for compliance.
• Vulnerability assessment: Carry out a comprehensive, written terrorist risk assessment. It should include an evaluation of the most common terrorist methods listed in the government’s threat guidelines which are:
  • Bladed weapons or marauding attacks: How easily can your venue become a target to an attacker with a knife on the street outside?
  • Suspect packages and unattended bags: Where are the unmonitored areas where an item could be hidden?
  • Vehicle-as-a-weapon: Is your front entrance on a busy main road, or is there a natural barrier like a wide pavement?
• Guide, shelter, communicate: Develop “guide, shelter, communicate” procedures tailored to your venue. Identify primary and alternative evacuation routes and safe assembly zones. Protect UK has some useful guidance.
• Dual-layer protection: Plan out both public protection procedures (evacuation, invacuation, lockdown, communication) and physical public protection measures such as surveillance, access controls and perimeter barriers.

2. Do

• SIA registration: You will need to submit a formal venue compliance document to the Security Industry Authority (SIA), the official regulator.
• Deliver staff training: Your staff must be trained in counter-terrorism and security awareness so that under pressure, they can act instinctively and not panic. There are a number of free courses available, for example ProtectUK ACT Awareness E-learning.
• Physical security measures: Install all necessary security systems such as access control, barriers and CCTV monitoring covering the venue and its perimeter.
• Assign roles: Assign clear roles and operational responsibilities during an incident. Develop a pre-agreed crisis communication plan for use in the event of an attack. ProtectUK has some useful information about how to do this.

3. Check

• Run live drills: Schedule regular, fully documented evacuation, invacuation and lockdown simulations to test response time and efficiency, and to identify problems.
• Security audits: On a regular basis, carry out physical security reviews to test systems such alarms, CCTV, access control and PA systems.
• Documentary evidence: Compliance is evidence-based so maintain detailed logs of all drills, staff training sessions, equipment checks and security audits.

4. Act

• Update and improve: Based on drill feedback or new vulnerabilities, immediately update emergency plans to correct problems and fill the gaps. Fully document your updates.
• Official security guidance: Incorporate updated government threat levels and official security guidance into your security plan.
• Annual reviews: Review and refresh the plan annually. If threat levels change, or the venue layout changes, update the plan immediately.

Enhanced tier compliance in a nutshell

Enhanced tier compliance involves a proactive, documented and continuously managed approach to reducing the risk. Rather than simply having an emergency response plan, you must actively reduce the chances of a terrorist attack happening in the first place.

The financial and practical consequences

While venue owners broadly support the aim of improving safety, there are significant concerns over the financial and practical burdens of implementing Martyn’s Law.

In the end, it’s about proportionality and practicality. Any measures you put in place should reflect the actual level of risk at your venue. You need time to prepare, and practical guidance about which changes are necessary and which are not.

You’ll have noticed from this guide that everything starts with a risk assessment. This is where we can help.

CSG offers free security assessments. There’s no charge for these, and no obligation to continue. It’s an opportunity to find out where your security risks lie, and to receive expert advice on how to fill the gaps.

We’ll be honest with you about what’s necessary for compliance with Martyn’s Law, and equally honest about what’s not needed at your venue.

Get in touch with the CSG team.

Download your compliance materials

• A detailed factsheet about the Terrorism (Protection of Premises) Act 2025
• For updates on the help the SIA will be offering, and preparations on notifications. Martyn’s Law: scope, support and what’s next
• ProtectUK advice portal has advice about venue requirements for standard tier and enhanced tier.
• Supporting materials, including statutory guidance, a one-page overview leaflet and other implementation resources. ProtectUK Martyn’s Law Resources 
• Useful answers to practical questions about scope, tiers, responsible persons and compliance documentation. Martyn’s Law Frequently Asked Questions
• Explains the role of the Security Industry Authority (SIA) as regulator, and what you need to do to prepare. Understanding Martyn’s Law and the SIA’s role as regulator
• Free security and counter-terrorism training courses for staff working at venues affected by Martyn’s Law. ProtectUK ACT Awareness E-learning.
• A crime prevention toolkit which includes the government’s terrorist threat guidelines. CT crime prevention toolkit

Image note: This article includes some AI-generated imagery.