What the guidance and good practice says

From Simulation to Reality

Rob Walley opened the discussion by reflecting on the importance of moving beyond plans and into operational readiness.

The central message was clear. Compliance cannot become a paperwork exercise. Organisations must ensure that plans, procedures and decision making frameworks are translated into practical capability and confidence for staff on the ground.

Readiness training, exercising and simulation are therefore becoming increasingly important components of good practice.

Being prepared means more than understanding a policy. It means teams knowing how to respond under pressure when information is incomplete and conditions are changing rapidly.

A Legal Mandate, Not a Suggestion

The webinar reflected both relief and urgency following Royal Assent.

The legislation now provides a formal framework intended to strengthen public safety and ensure that lessons from previous tragedies are embedded into future planning and operational delivery.

The session also recognised the significant contribution of campaigners and organisations who worked over many years to bring the legislation into law.

The Expanding Role of the SIA

One of the most significant operational shifts discussed was the changing role of the Security Industry Authority.

Under Martyn’s Law, the SIA is no longer solely focused on licensing and standards. It is also becoming the central body responsible for notification, oversight and compliance activity.

Organisations will now be required to provide details regarding venues, events and designated senior leads as part of the formal notification process.

This introduces new administrative and governance responsibilities that many organisations have not previously encountered.

Proportionality Must Drive Decision Making

Gary Jones highlighted that effective planning cannot rely on simple checklists or one size fits all approaches.

Instead, organisations should focus on proportionate assessment and mitigation based on their own operational realities.

Three core considerations were discussed:

• Target Attractiveness: Understanding how appealing a venue or event may be based on profile, crowd density and location.
• Consequences: Assessing the operational, reputational and safety impact of an incident.
• Risk Appetite and Tolerance: Identifying where resources and mitigations should be focused.

The discussion reinforced an important principle:

Mitigation should always remain proportionate to the assessed risk.

Organisations should avoid unnecessarily excessive measures while ensuring that controls remain credible, practical and defensible.

Readiness Through Exercising and Integration

The session repeatedly returned to the importance of exercising and integration.

Plans are only effective if the people responsible for implementing them understand their roles and can operate confidently under pressure.

Simulation exercises, tabletop discussions and live drills remain essential for testing communication, decision making and coordination.

The webinar also highlighted the importance of integrating Protect Duty planning with existing health and safety, fire safety and operational risk management frameworks rather than treating terrorism protection in isolation.

Real Questions Organisations Are Asking

The audience discussion highlighted the level of uncertainty many organisations are currently navigating.

Questions focused heavily on:

• SIA notification requirements
• The practical meaning of proportionality
• How to prioritise planning activity
• The role of exercising and readiness
• Balancing operational practicality with legal obligations

The discussion reinforced that many organisations are still at the early stages of understanding what good practice should look like ahead of formal guidance publication.

Planning Ahead of Formal Guidance

As of February 2026, the SIA continues to finalise section 12 guidance for public consultation.

This means organisations should remain cautious about suppliers or consultants making definitive claims regarding “Protect Duty compliance”.

At this stage, the focus should remain on sensible preparation, operational understanding, proportionate planning and capability building.

Budget planning, readiness training, exercising and practical implementation support will all play important roles as organisations move toward compliance and operational maturity.

What good looks like

• Senior leadership engagement and ownership
• Readiness training that goes beyond awareness
• Proportionate risk based mitigation
• Clear governance and accountability structures
• Integrated planning across safety, security and resilience
• Regular exercising and scenario testing
• Practical operational procedures supported by trained staff
• Evidence based planning and documentation
• Clear understanding of consequences and vulnerabilities
• Balanced decision making aligned to operational realities

Common mistakes we see

Treating compliance as paperwork only

Written plans without exercising or staff capability create false confidence.

Applying disproportionate measures

Overengineering security responses can create operational, financial and reputational challenges without improving resilience.

Focusing only on terrorism

Protect Duty planning should integrate with wider safety and operational risk management.

Leaving leadership disconnected

Senior leaders must remain actively engaged in governance, accountability and decision making.

Failing to test plans

Without simulation and exercising, organisations cannot fully understand how procedures will function under pressure.

Assuming external guidance will provide all the answers

Every organisation must still assess its own risks, operational realities and vulnerabilities.

Practical checklist

• Identify designated senior leads and governance responsibilities
• Review existing safety, security and resilience arrangements
• Assess target attractiveness and operational vulnerabilities
• Understand potential consequences and recovery challenges
• Review incident response and communication procedures
• Integrate Protect Duty planning with wider risk management
• Develop readiness training and exercising programmes
• Document decisions and rationale clearly
• Review proportionate mitigation options
• Prepare for future SIA notification requirements
• Engage stakeholders and operational partners early
• Build long term capability rather than short term compliance fixes

FAQs

What changed after Royal Assent?

Martyn’s Law moved from proposed legislation into formal statutory law, creating legal obligations for qualifying venues and events.

What role will the SIA now play?

The SIA is expected to oversee aspects of notification, compliance and regulatory guidance under the legislation.

What does “proportionate mitigation” mean?

Controls and measures should reflect the actual risk profile, operational realities and vulnerabilities of the organisation rather than adopting excessive or generic solutions.

Why is readiness training important?

Readiness training helps staff translate procedures into practical capability and confidence under pressure.

Should Protect Duty planning sit separately from existing safety planning?

No. Good practice integrates terrorism protection with wider safety, resilience and operational risk management frameworks.

Is there formal SIA guidance available yet?

As of February 2026, section 12 guidance is still being finalised for consultation.