KEY POINTS
- Public protection measures apply to enhanced tier premises (800 or more people) and qualifying events, on top of the four public protection procedures.
- Section 6 of the Act sets four types: monitoring, movement of people, physical safety and security, and security of information.
- Measures aim to reduce vulnerability to terrorism and the risk of physical harm. They can be delivered through people, policies and processes, or physical mitigations.
- You must assess and keep measures under review, and put appropriate ones in place so far as is reasonably practicable.
- Every choice, including a decision to defer or scale down a measure, should be reasoned and recorded in your compliance document.
The short answer
Public protection measures are the extra layer of security that Martyn's Law asks of larger premises and qualifying events. Under section 6 of the Terrorism (Protection of Premises) Act 2025, the responsible person for enhanced tier premises or a qualifying event must assess and keep under review the measures appropriate to reduce vulnerability to terrorism and reduce the risk of physical harm, and ensure those measures are in place so far as is reasonably practicable.
Procedures are what staff do when an attack is happening: evacuate, invacuate, lock down and communicate. Measures work before and during an attack, making the site harder to target and easier to protect. Standard tier premises do not need them by law. If you are unsure of your tier, use our free tier checker.
The four categories at a glance
| Category (s6(3)) | Purpose, per Home Office guidance | Typical examples |
|---|---|---|
| Monitoring | Detect and identify suspicious activity and items, on the premises and in the immediate vicinity | Briefed staff, patrols, searches, CCTV with live monitoring, security lighting |
| Movement of people | Control, prohibit, restrict or reduce movement into, out of and within the site | Ticket and pass checks, screening, crowd and queue policies, restricted access points, locks and shutters |
| Physical safety and security | Mitigate the impact of attacks and deter or hinder attackers | Stand-off zones, vehicle security barriers, parking controls, protective glazing, vehicle checks |
| Security of information | Keep information about the site's operation, design and workings away from people who might use it to plan an attack | Audits of public information, social media policies, IT access control, supply chain rules |
The guidance stresses that measures overlap. Perimeter patrols are both monitoring and movement. Screening at entry is both. Design them as one system rather than four separate lists.
Monitoring
Monitoring measures help staff spot, observe and report suspicious behaviour, items or vehicles. The guidance says alertness and clear reporting are the key: knowing what to report, who to report it to and how quickly. Monitoring must also cover the immediate vicinity, which has no fixed distance but would typically include queues, drop-off points and approaches.
Examples from the Home Office guidance, by delivery type:
- People: heightened staff awareness through briefings; unpredictable security patrols; perimeter patrols checking gates, doors and windows.
- Policies and processes: searches of people (by consent as a condition of entry, since there is no general legal power to search); searches of bags, pushchairs and other items; access control with passes or accreditation.
- Physical mitigations: search and screening technology; CCTV monitored in real time from a control room; security lighting; voice alerts and intrusion sensors.
For example, a 1,200-capacity music venue might post a radio-linked steward on the external queue at doors-open, brief all front of house staff before each show on what suspicious behaviour looks like and how to report it, and make sure CCTV covering the queue is watched live rather than just recorded.
Movement of people
Movement measures manage how people enter, leave and move around. The guidance notes that controlling access at all or part of a site is likely to be fundamental to most security regimes, and can be as simple as counting people in and out or checking tickets, passes or registrations.
- Screening and searches on entry (random or full), with clear policies on prohibited items.
- Restricting areas to pass or ticket holders, setting visiting times and escorting visitors where needed.
- Crowd policies that limit how many people enter or leave at once, so dense crowds do not form outside.
- Traffic and pedestrian control, and clearly designated accessible and non-accessible areas.
- Locks, shutters, screens and barriers to secure back of house areas, the site out of hours, or parts of the site during lockdown.
The guidance's museum example uses a designated queuing area away from the road plus timed tickets to reduce crowding. Its antiques market example rejects searching everyone, because the resulting queue would itself become a target, and uses a random selection system instead.
Physical safety and security
These measures harden the site itself. Existing structures often do much of the work, so start by asking what you already have, then what could be added.
- Stand-off zones: using the built environment to keep vehicles away, pedestrianising busy arrival routes, or placing street furniture to increase distance from a possible device.
- Parking restrictions with effective enforcement, so abandoned vehicles are dealt with.
- Vehicle security barriers, scalable from bollards, planters, bunds and berms to certified hostile vehicle mitigation. NPSA publishes guidance on these.
- Protective glazing, from anti-shatter film to blast-resistant facades, to reduce injuries from flying glass.
- Vehicle checks or screening, or simply prohibiting or tightly controlling vehicle access.
Context decides what is appropriate. The guidance contrasts a pub inside a shopping centre with no vehicle access, where vehicle measures are not appropriate, with a shop on the centre's exterior where they are, but bollards are phased in over several years because immediate installation is not reasonably practicable. Physical changes may need consent from a landlord or freeholder, who must co-operate so far as is reasonably practicable. Listed buildings may limit what you can install.
Security of information
Hostile reconnaissance often starts online. These measures stop useful details about your site, such as layouts, camera positions, staff names or security routines, being widely available.
- Audit your website, social media, apps, maps, planning and licensing documents for security-relevant detail, and remove, redact or restrict it.
- Check internal documents that have leaked into public use, such as facilities management floor plans showing CCTV.
- Adopt a security-minded communications approach: say security is in place without describing it.
- Set social media rules for staff, including not posting about working at an event.
- Control IT access, remove leavers promptly and use strong passwords or multi-factor authentication.
- Require suppliers and contractors to protect security-sensitive information, and only give tradespeople the plans they need.
The guidance also suggests considering insider threat in recruitment and vetting. And remember that your compliance document is itself sensitive and should be held securely.
Judging what is reasonably practicable
The Home Office describes reasonably practicable as proportionate. You weigh the objectives of a measure against the cost, time and difficulty of putting it in place, considering the nature of your premises or event and your resources. It is not about doing something or nothing; it is about the right scale of intervention.
- Understand your site: location, layout, heritage status, operating and financial model, numbers and staff.
- Identify vulnerabilities against the attack methods the guidance lists: marauding attacks, vehicle as a weapon, explosive devices, fire as a weapon and hazardous substances.
- For each category, list measures that would be appropriate.
- For each appropriate measure, decide how far it is reasonably practicable now. Consider cheaper alternatives, phasing and interim mitigations.
- Check the measures work together and do not clash with your procedures or fire strategy.
- Plan contingencies, such as manual searches if screening equipment fails.
- Record the decision and rationale in your compliance document, and set a review date.
The guidance's examples show how this works. A listed country house that cannot install CCTV relies on higher staffing and pre-shift briefings instead. A cinema rejects anti-shatter film on cost and effectiveness grounds but uses street furniture to create a stand-off zone. A rugby club that cannot fund bollards moves match day entry to a gate it can protect cheaply.
Making measures real: training, review and records
Training is not a standalone legal requirement, but the guidance is clear that if no one knows how to carry out a measure, it is not properly in place. Staff who search bags, watch CCTV or operate barriers need instruction, supervision and a plan for when equipment fails. Note other licensing duties too: door supervisors and CCTV operators need SIA licences under existing law.
You must keep measures under review. The guidance suggests periodic reviews and reviews after significant changes to the site, its use, its numbers or its surroundings, and recommends testing measures so staff can operate them effectively.
Common mistakes include buying kit without policies, screening one entrance while others stay open, forgetting the queue outside, and publishing the security details you are trying to protect. See enhanced tier duties for how measures feed into the compliance document, and testing and drills for practising them. For enhanced tier sites, we can introduce you to a specialist.
Frequently asked questions
What are the four public protection measures in Martyn's Law?
Measures relating to monitoring of the premises or event and its immediate vicinity, the movement of people into, out of and within it, its physical safety and security, and the security of information about it.
Do standard tier premises need public protection measures?
No. The section 6 measures duty applies only to enhanced tier premises and qualifying events. Standard tier premises need public protection procedures, though many sensible steps overlap.
Does Martyn's Law require bollards or CCTV?
Not automatically. You must put appropriate measures in place so far as is reasonably practicable. The Home Office gives examples where cheaper alternatives, phased installation or extra staffing were judged proportionate instead.
Can we search customers' bags under Martyn's Law?
The Act gives no power to search. The Home Office guidance notes that premises can make consent to searches a condition of entry, and that search policies should take account of the Equality Act 2010.
Sources
General information based on the Act and published guidance, not legal advice. Check the official statutory guidance on GOV.UK for your situation.