Martyn’s Law: Compliance Is Not the Same as Preparedness

On 11 September, the Security Industry Authority (SIA) published its latest update on preparations for Martyn’s Law, providing further detail on how organisations can determine whether their premises or events are in scope, the development of supporting templates, and the notification portal through which organisations will interact with the regulator.

It is another important step towards implementation of the Terrorism (Protection of Premises) Act 2025 and provides welcome clarity for businesses and venues preparing for the legislation.

But as the regulatory framework becomes clearer, there is a danger that preparedness becomes defined by compliance.

Having a plan is not the same as knowing it will work. Having trained staff does not necessarily mean they will respond effectively under pressure. And being able to demonstrate that procedures exist does not tell you what will happen when a real incident begins to unfold.

For organisations already preparing for Martyn’s Law, the next question should therefore be: How do we know we are actually prepared?

From compliance to preparedness

The SIA’s latest update shows that implementation is moving forward. Tools and templates are being developed, work is progressing on the notification portal, and the SIA has already undertaken pilot assessments and inspections to help test and refine its regulatory approach.

For organisations, this provides increasing clarity around the process.

But once procedures have been documented and responsibilities assigned, how confident are you that those arrangements would work during a real incident?

That is where compliance and preparedness can begin to diverge.

The gap between a plan and reality

Emergency and security plans are generally created in controlled circumstances. Responsibilities are assigned, escalation routes documented and communication processes agreed.

A real incident is unlikely to be so orderly.

Information may be incomplete or contradictory. Communications can fail. Key individuals may be unavailable. Staff, visitors and members of the public may behave unpredictably.

Imagine a suspicious incident is reported immediately outside your premises. Police have not yet arrived and information is limited.

Do you evacuate or keep people inside? Who makes that decision? Who communicates with employees and visitors? What happens if the person identified in the plan to take control is not there?

These are not questions that should be answered for the first time during an emergency.

This is where the difference between having a plan and having a capability becomes apparent.

Test the assumptions

Every security plan contains assumptions.

We assume communications will work. We assume people understand their responsibilities. We assume information will reach decision-makers quickly and that somebody will take control.

Exercising allows organisations to challenge those assumptions before an incident does it for them.

A well-designed scenario can expose unclear responsibilities, communication gaps, conflicting procedures and decisions that have never previously been considered.

Discovering those weaknesses during an exercise is valuable.

Discovering them during a real attack is not.

Preparedness is also a leadership issue

Protective security is often viewed as the responsibility of security teams, facilities managers or venue operators.

During a serious incident, however, it quickly becomes an organisational leadership issue.

Senior leaders may need to consider the immediate safety of employees and the public alongside communications, business continuity, reputational risk and engagement with emergency services. Some decisions may need to be made in minutes.

Dr. Brian Moore, Managing Director at GSA Global and former Chief Constable of Wiltshire Police and Director General of the UK Border Force, says:

“A plan can tell people what should happen, but preparedness is about knowing whether those arrangements will stand up when circumstances are uncertain and decisions have to be made under pressure. That requires organisations to test not only their procedures, but their people, their communications and their leadership. The time to discover where the gaps are is during an exercise, not during a real incident.”

Realistic scenario-based exercises give leadership teams an opportunity to experience some of those pressures before they encounter them for real and understand how effectively different parts of an organisation work together when normal operating conditions disappear.

What would an inspection reveal?

The SIA has confirmed that its regulatory approach will include desk-based assessments and on-site inspections, using a risk-based approach.

That provides another reason for organisations to look critically at the difference between what is documented and what happens in practice.

If someone independent walked through your security arrangements today, would what they saw reflect what was written in your procedures?

Would staff understand their responsibilities? Would escalation routes work? Would managers know what decisions they were authorised to make?

These are useful questions regardless of the regulatory requirement.

Because ultimately, the purpose of preparedness is not to pass an inspection. It is to protect people.

Compliance can be demonstrated. Preparedness has to be tested.

How GSA Global can help

GSA Global helps organisations understand and test the gap between security plans and operational reality.

Drawing on extensive senior-level experience in policing, counter-terrorism, protective security, crisis management and risk management, our specialists support organisations through independent security reviews, preparedness assessments, training and realistic scenario-based exercises.

Our focus is not simply on whether the right procedures exist, but whether people understand them, leaders can make the necessary decisions and the organisation can respond effectively when circumstances do not follow the plan.

For organisations still working through the requirements of Martyn’s Law, our Practical Guide to Navigating Martyn’s Law provides further guidance on preparing for the legislation.

For those further along that journey, the next step may be different: Testing how prepared you really are.