The standard tier: what you actually need to do
The standard tier is deliberately light. This is the whole of it, in order, with the things you can safely ignore marked as such.
The standard tier was written for exactly the kind of place you run: a building held together by volunteers, with no security budget and no security expertise. Parliament knew that. The duties reflect it. This is everything the standard tier asks of you, and — just as important — everything it does not.
First: are you actually in the standard tier?
The rule, in three lines
- Fewer than 200 people reasonably expected at once — you are out of scope. This is true for every kind of premises, including churches and schools. A chapel that seats sixty is out.
- 200 to 799 — standard tier.
- 800 or more — enhanced tier, except places of worship and childcare or education settings, which stay standard tier however large they get.
Count everybody who could be there at once: the public, your volunteers, the performers, the person on the door, the ones washing up. Not tickets sold, and not the figure on your fire certificate.
If you are under 200, stop reading and go and do something more useful. You are out of scope, and nothing on this page applies to you. Minute that at your next meeting and revisit it if your events get bigger.
The duties, in full
Work out, and write down, your number
Your honest busiest-day headcount, counting staff and volunteers. Everything else follows from it. Ten minutes at a committee meeting; minute the figure and how you arrived at it. That minute is the cheapest piece of evidence you will ever create.
Decide who the responsible person is
The individual or body in control of the premises — usually the management committee, the PCC, the trustees or the governing body, with a named contact. Name a role and use a role email. Your treasurer will hand over next April; the role will not.
Notify the regulator
The Security Industry Authority regulates Martyn’s Law. Qualifying premises need to tell them the premises exists and who is responsible for it. It is a registration, not an application — nobody grants permission and nobody inspects you for doing it. Keep the acknowledgement when it arrives: it is the single most useful sheet of paper you will hold on this subject.
Have the four public protection procedures
What your people would actually do:
- Evacuation — getting everybody out, and to where. Not the same as your fire drill: in a fire the building is the danger; here the danger may be outside one particular door.
- Invacuation — bringing everybody in, away from the windows, and shutting the building, because going outside would be worse.
- Lockdown — securing the building against someone dangerous. Lock, block, get low, be quiet.
- Communication — how the alarm is raised, who rings 999, and who talks to whom afterwards.
They must be “appropriate and reasonably practicable” for your premises. For a volunteer-run building that means sensible, free, and doable by ordinary people — not a security operation.
Make sure your people know them
A procedure nobody has heard of is not a procedure. Ten minutes before a big event, name three jobs out loud: who makes the announcement, who rings 999 and does nothing else, and who checks the toilets, the kitchen and the store. Write the three names on the whiteboard. That one habit is worth more than every document on this website.
Keep it alive
Look at it once a year, and after anything that actually happens. Note what you learned, however briefly. A half-page note after a false alarm is worth more than a beautiful document nobody has opened since it was written.
What the standard tier does NOT require
This is the section most people are never told, and it is why so many venues overspend.
- No physical security measures. No barriers, no bag searches, no CCTV requirement, no bollards.
- No paid staff, no security personnel, no consultant.
- No formal risk assessment. That is an enhanced-tier duty, and you are not enhanced tier.
- No requirement to document your procedures. Read that again, because somebody will try to sell you a document on the basis that the law demands it. It does not.
A sensible order to do it in
- This month: agree the number. Walk the building. Ask where people go if the assembly point is itself the problem.
- Next meeting: agree the responsible person and the role email. Minute both.
- Before your next big event: name the three jobs. Brief the volunteers for ten minutes.
- When the notification process opens: notify the SIA, and file the acknowledgement.
- Whenever suits: write the four procedures down, adopt them at a meeting, and put them where a new volunteer would find them.
Not sure which side of the line you are on?
The checker walks you through the same rules in about two minutes. It is free, there is no account, and your answers never leave your browser.
Common questions
Do standard tier premises have to write their procedures down?
No. The standard tier does not require documentation. Many venues choose to document anyway — because volunteers turn over, because a written procedure can be handed to someone new, and because it makes any future conversation with a regulator or insurer much shorter — but that is a practical choice, not a legal requirement.
Do we need a risk assessment?
Not at the standard tier. A documented assessment is part of the enhanced-tier regime, which applies to premises expecting 800 or more people — and never to places of worship or education settings, which stay standard tier at any size.
Do we have to buy security equipment?
No. The standard tier does not require physical measures of any kind. It asks for procedures — what people would do — which cost nothing but thought and a conversation.
When do the duties actually start?
They are not in force yet. The Act received Royal Assent on 3 April 2025 and the government has said the implementation period will be at least 24 months, so the earliest commencement is around April 2027. There is no deadline you have already missed.
Where this comes from
Everything above is our plain-English reading of the following. Where we quote a paragraph number, it is from the Home Office statutory guidance. If you want the law itself rather than our summary of it, start with the first link.
- Terrorism (Protection of Premises) Act 2025 (c. 10) legislation.gov.uk The Act itself. Royal Assent 3 April 2025.
- Terrorism (Protection of Premises) Act 2025: statutory guidance GOV.UK (Home Office) Published April 2026, last updated 18 May 2026. The paragraph numbers quoted in these guides are from this document.
- Terrorism (Protection of Premises) Act 2025: overarching factsheet GOV.UK (Home Office) The short version, in the government’s own words.
- Security Industry Authority GOV.UK The regulator for Martyn’s Law. Watch here for the notification process opening.
- ProtectUK Counter Terrorism Policing Free guidance and free e-learning (ACT Awareness). The training is genuinely good and costs nothing.
Last reviewed . Martyn’s Law is not yet in force and the guidance is still developing — if you are reading this long after that date, check the sources above for anything newer.
This is guidance, not a legal determination. Standfast helps you think clearly and get ready. It does not decide your legal position, and nothing on this page is legal advice. If your circumstances are unusual, or a great deal turns on the answer, take advice.