KEY POINTS
- At the standard tier there is no legal duty to document your procedures, but Home Office guidance says you should, and that compliance may be hard to show without records.
- At the enhanced tier, the Act requires a document setting out procedures and measures with an assessment of how they reduce risk. It must be kept up to date and given to the SIA.
- SIA inspectors can view documents, ask for explanations and take copies, and draft SIA guidance says they may question staff about procedures.
- Good records are short and current: procedures, roles, training, exercises and reviews, each with a date and version.
- Store records securely. Floor plans, codewords and procedures could help someone planning an attack.
What the law requires you to record
The answer depends on your tier. If you are not sure which applies, use our free tier checker.
| Standard tier (200 to 799) | Enhanced tier (800 or more) and qualifying events | |
|---|---|---|
| Legal duty to document | No. The guidance says you should prepare a document anyway. | Yes, under section 7 of the Act. |
| What it covers | Your public protection procedures, as good practice. | Statements of procedures and measures, plus assessments of how they reduce risk and vulnerability. |
| Send it to the SIA? | No. | Yes, as soon as reasonably practicable after it is first prepared, and within 30 days of any revision. |
| Keep it up to date? | Strongly recommended. Reviews could be annual. | Required. |
For the standard tier, the Home Office statutory guidance says there is no legal requirement to prepare a document setting out your procedures, but you should, because it provides a basis for staff to understand them. It adds that it may be difficult to demonstrate compliance, for example during an inspection by the Security Industry Authority (SIA), if procedures are not documented in some form. The Home Office has said optional templates will be developed.
Good practice records at the standard tier
Think of your records as the evidence that your procedures exist, that staff know them and that they work. For most standard tier venues, this fits in one folder:
| Record | Why it helps |
|---|---|
| Capacity and tier assessment | Shows how you decided you are in scope and which tier applies |
| SIA notification | Confirms you have notified the regulator, once the notification process opens |
| The four procedures | Evacuation, invacuation, lockdown and communication, with version and date |
| Reasons for any procedure you judged not appropriate | The guidance suggests recording this in case of inspection |
| Roles list | Who decides and who does what, on every shift |
| Training log | Who has been briefed or trained, on what, and when |
| Exercise records | Tabletops, walk-throughs and drills, with actions taken |
| Review log | When procedures were reviewed and what changed |
| Co-ordination notes | Agreements with your landlord, neighbours or other responsible persons |
| Incident and near-miss notes | What happened, decisions made and lessons learned |
| Equipment checks | Radios, PA, locks, shutters and grab bag contents |
Keep it proportionate. A 250-capacity restaurant does not need a lever-arch file, and a few well-kept pages are more convincing than a long generic document nobody has read. See staff training requirements and testing and drills for simple log templates.
Required documentation at the enhanced tier
Section 7 of the Terrorism (Protection of Premises) Act 2025 requires the responsible person for enhanced tier premises or a qualifying event to prepare, and keep up to date, a document containing:
- a statement of the public protection procedures in place
- an assessment of how those procedures may be expected to reduce the risk of physical harm if an attack occurred
- a statement of the public protection measures in place, or proposed to be put in place
- an assessment of how those measures may be expected to reduce the vulnerability of the premises or event and the risk of harm
- any further information required by regulations
The statutory guidance adds detail. Statements should cover each procedure and measure, related policies, how and when they will be used, and who can make decisions in an attack. Where measures cannot be put in place straight away, for example because of a planned refurbishment, the guidance says to set out the plan, the reason for the delay and the interim mitigations. It also says the responsible person should keep a record of staff training, and considers this a necessary element of the compliance document.
Anyone informed and capable can prepare the statements and assessments. A third party can help, but the responsible person remains legally accountable. The statutory guidance says the SIA will publish specific guidance on compliance documents. See enhanced tier duties, public protection measures and our enhanced tier page.
What an SIA inspector may ask for
The statutory guidance explains that an authorised SIA inspector will usually give at least 72 hours' written notice of an inspection, although a warrant can allow entry without notice in some circumstances. During an inspection, an inspector can:
- inspect the premises and observe activities
- view physical or electronic documents on the premises
- inspect equipment
- require anyone on the premises to explain any relevant document or say where it can be found
- take copies, measurements, photographs and recordings
- require people on the premises to assist with the inspection
The SIA's draft operational guidance, consulted on in 2026, adds that inspectors may ask people working at the premises about working practices, including public protection procedures, and will give a document at the end recording what was done during the inspection. Inspectors can also issue notices requiring information or attendance at an interview.
In practice, it is reasonable to expect an inspector to want to see your procedures, understand who makes decisions, and check whether staff on duty know what to do. Being able to produce your folder quickly, and having a duty manager who can explain it, will make an inspection far simpler.
How long to keep records
We have not found any fixed retention period in the Act or the statutory guidance. As good practice:
- Keep the current version of every procedure, and keep superseded versions rather than deleting them, so you can show what was in place on any given date.
- Keep training and exercise records for as long as the person works for you, and for a reasonable period afterwards.
- Keep notes of any real incident, as they may be needed by the police or for your own review.
- Remember that training logs contain personal data, so data protection law still applies. Keep only what you need.
If you are unsure, check the SIA's guidance once it is finalised, and take advice on your wider data retention policy.
Version control that works
Procedures change: new managers, a refurbishment, a lesson from an exercise. Without version control, staff end up following an old copy. A simple system:
- Keep one master copy, electronic or paper, that everyone knows is the official version.
- Give each version a number and date on every page, for example 'Version 1.3, March 2027'.
- Keep a short change log at the front: version, date, what changed, who approved it.
- When a new version is issued, remove old copies from staff areas and brief staff on what changed.
- Set a next review date, and review sooner after significant changes to the premises, operations or capacity.
- At the enhanced tier, remember that a revised compliance document must go to the SIA within 30 days.
Keeping records secure
Your procedures describe exactly how your venue would respond to an attack. The statutory guidance says enhanced tier compliance documents should be held securely, balancing access for those who need it against the risk of information helping someone with malicious intent. That is sensible at any tier:
- Do not publish procedures, floor plans or codewords online or on public notices.
- Give staff what they need for their role, such as a prompt card, rather than the full document.
- Limit access to the master copy and keep electronic copies password protected.
- Keep a copy in your grab bag, stored where the right people can reach it in an emergency.
Next steps
Check your tier with the free checker, then gather what you already have: fire risk assessment, staff lists and floor plans. Write your public protection procedures, start a training log and an exercise record, and set a review date. Our packs include a ready-made records folder structure, version log and templates.
Frequently asked questions
Do I have to write down my procedures at the standard tier?
There is no legal requirement at the standard tier. However, the Home Office guidance says you should prepare a document, and that it may be difficult to demonstrate compliance during an SIA inspection if procedures are not documented in some form.
Do standard tier premises send documents to the SIA?
No. Standard tier premises must notify the SIA that they are responsible for qualifying premises, but the duty to prepare a compliance document and provide it to the SIA applies to enhanced tier premises and qualifying events.
Will the SIA give notice before inspecting?
The statutory guidance says an inspector will usually give at least 72 hours' written notice. In some circumstances an inspector can apply for a warrant to enter without notice, for example if access is urgent or has been refused.
How long should we keep Martyn's Law records?
We have not found a fixed retention period in the Act or statutory guidance. As good practice, keep current and superseded versions of procedures, plus training and exercise records, and follow data protection law for personal information.
Sources
General information based on the Act and published guidance, not legal advice. Check the official statutory guidance on GOV.UK for your situation.