Lloyd Major, Founder and CEO of Halo Solutions, and a former police and counter-terrorism officer with the National Counter Terrorism Policing Operations Centre, gives us his insights into the implications of Martyn’s Law and what good practice looks like

The Security Industry Authority (SIA) has published its first practical tools for Martyn’s Law: a planning tool for standard tier premises and events, and a template for the enhanced tier.

They arrive with the Terrorism (Protection of Premises) Act 2025 expected to come into force in spring 2027. The implementation window organisations have talked about for the past year is now measured in months, not years.

Martyn’s Law is an operational shift toward live operational capability. It formalises a standard that good operators already recognise: safety and security embedded into how the organisation runs every day.

What the SIA tools get right, and what they can’t do

The standard-tier tool takes premises and events through four procedures: evacuation, lockdown, communications and invacuation.

That is the right place to start. They are the same four procedures everyone should put at the centre of any operation’s readiness. The enhanced tier template covers procedures, vulnerability assessment and protective measures.

Templates help. They give organisations a common structure. But a completed template is a record of a plan. It is not proof that the plan works on a busy night, with a new steward on the gate and a radio channel that is already full.

The test for every section is whether the people on the ground could carry it out, in real conditions, where information may be unclear and time is limited.

The SIA is asking for feedback on the tools until 23 December. Its Martyn’s Law Executive Director, Laura Gibb, put it plainly: “We cannot build an effective, workable system without the people and organisations who will be using it.”

Operators should test the tools against a real shift, a real event day or a real exercise, and tell the SIA where they fit and where they don’t.

What the law is really asking for

For larger premises and events, organisations must assess their vulnerabilities and implement measures that reduce both the likelihood of an attack succeeding and its potential impact.

Alongside this, there is a clear expectation around documentation and auditability.

Organisations must be able to explain what they have in place, why those decisions were made, and how they contribute to reducing harm.

For enhanced tier premises and events, clear senior accountability will also be essential.

So, we really need to start asking ourselves, “What data supports these plans?” and “What training has been conducted with our people?”, and how is all of that documented in a trustworthy, transparent and disclosable manner?

What readiness looks like in practice

In effective operations, procedures are clear and focused for the teams on the ground and can be applied quickly without interpreting complex scenarios.

Teams are trained in a way that builds confidence and resilience. Staff need to know the intent behind a procedure, not just the steps, so exercises must be practical and reflect real conditions.

Information flows effectively. Incidents and updates are reported from the ground as they happen, so control rooms hold a live, accurate picture, and actions, communications and decisions are logged in real time, creating a reliable audit trail.

If information is scattered across radios, paper logs, spreadsheets, private messages and separate contractor systems, leaders may not see the full picture until much later. That creates risk during the incident and weakness during review.

Finally, a strong leadership team enforces these practices quickly and calmly, championing standards and reviewing performance. In these environments, compliance is not a separate exercise but a by-product of how the operation functions.

Experience alone is not enough. How many people do we know with “twenty years’ security experience” and an impressive CV who, in reality, stopped learning after the first two years and haven’t picked up any new skills or contributed any new knowledge or ways of thinking to the industry?

Plenty of people will chase the job title and the pay that might come with it; very few will truly own the responsibility or deliver meaningful and insightful enhancements.

Why paperwork and technology can’t do it alone

Faced with new regulation, organisations naturally reach for more documentation or more technology. Both can play a role. Neither will do it all.

Martyn’s Law requires them to demonstrate that their operation can respond effectively. That outcome cannot be purchased or documented into existence.

A well-implemented incident management system can provide a single source of truth and stronger, time-stamped records, but only when the surrounding operation supports it.

If reporting is inconsistent, data will be incomplete. If teams are not engaged, systems will be bypassed. And procedures too complex to interpret quickly introduce hesitation at the exact moment clarity is needed.

Culture will determine whether compliance works

The statutory guidance is explicit that protective security is based on a good security culture, and that it takes effort and leadership to build.

Culture determines whether staff report suspicious behaviour quickly or assume someone else will; whether contractors are included in briefings; whether exercises are taken seriously or treated as box-ticking; whether control rooms receive useful information early, or fragmented updates too late.

That is the lesson to carry into every template and planning tool: regulation can set expectations, but it cannot create operational maturity by itself.

The real measure of preparedness

Between now and commencement, Martyn’s Law and the SIA’s tools will push organisations to review policies, procedures and governance. But the real test will be whether organisations can act effectively when it matters, not just whether they have filled in the right documents.

That means building a culture where safety and security are part of daily operations and training really matters. Where training is taken seriously, easily remembered and enacted when it counts, lives are saved.

Where the opposite is true, lives are lost. The primary aim of this legislation, and of all the amazing people who have championed it to date, is simply that: to save lives.

That is maximised further where contractors are included, information moves quickly and leadership is visible, and where tools and procedures are simple enough to use and strong enough to stand up to scrutiny.

Public safety is not strengthened by paperwork alone. It is strengthened by people, culture, processes, and the discipline to keep improving before an incident forces the issue.