Enhanced terrorism risk assessment – Terrorism Protection of Premises Bill

Revised September 2024

Enhanced terrorism risk assessment is required by draft legislation ‘Terrorism (Protection of Premises) Bill‘, otherwise known as Martyn’s Law. Places Martyn’s Law applies to include public premises with a public capacity of 200 or more-

• shops;
• hotels;
• hospitals;
• and universities to name but a few.

It also applies to ‘qualifying events’; spaces that aren’t public premises but are used to access events. For example, a queue between a railway station and public premises.

Below we look at the risk assessment required by Martyn’s Law however, you may also find our guides on how to write a security plan and how to write a security risk assessment helpful.

Enhanced terrorism risk assessments application

The public capacity of the premises determines whether an enhanced terrorism risk assessment is necessary-

1. Standard terrorism evaluation is required if capacity is 200 to 799
2. Enhanced terrorism risk assessment is required if capacity is 800 or more

(There are exceptions: public transport is exempt, only the standard terrorism evaluation is required for places of worship and education establishments.)

Both the standard terrorism evaluation and enhanced terrorism risk assessment should address threats such as (in order of likelihood):

1. Marauding attacker (carrying a firearm, blade or other weapon)
2. Vehicle as a weapon (primarily road vehicles but could be rail, shipping, aircraft such as drones)
3. Improvised Explosive Devices (which can be carried, placed, posted, vehicle borne)
4. Fire as a weapon
5. Chemical, biological or radiological attacks (poisoning or other harm by chemical, biological or radiological means)
6. Cyber-attack (when used to harm people, through controlling or disabling equipment or other devices and endangering safety).

1. Standard terrorism evaluation (200 – 799 capacity)

If the premises has a public capacity of 200 to 799 then the Protection of Premises requirement is-

• standard terrorism evaluation;
• terrorism protection training.

It’s estimated 154,600 premises fall within this scope.

a) Standard terrorism evaluation

This is to address the types of terrorism most likely to occur at or in the immediate vicinity of premises-

• measures to reduce risk of acts of terrorism occurring at or near premises;
• measures to reduce risk of physical harm to individuals at or in immediate vicinity;
• procedures to follow if act did occur at or in immediate vicinity;
• ways people working at premises will be made aware of the evaluation (relevant to their individual responsibility in those premises).

b) Terrorism protection training

Training to be given to all “relevant workers”. This means people who work at, or in connection with, the premises or event, with responsibilities that make it appropriate for them to receive terrorism protection training.

It does not matter whether the relevant worker is an employee, works full-time or is paid for their work at, or in connection with, the premises or event.

Training must be given-

• before, or as soon as is reasonably practicable after, the relevant worker first assumes the responsibilities;
• for premises, before the end of the period of 12 months, beginning with the day on which the relevant worker last completed training;
• for events, before the event begins.

Content of terrorism protection training

Terrorism protection training to include-

• the types of acts of terrorism most likely to occur at, or in the immediate vicinity of, the premises or event;
• the indications that an act of terrorism may be occurring at, or in the immediate vicinity of, the premises or event;
• the procedures to be followed if acts of terrorism were to occur at, or in the immediate vicinity of, the premises or event;

The training must be appropriate to-

• the size and other characteristics of the qualifying public premises or the premises at which the qualifying public event is to be held;
• the user of the premises or (if event) the type of event;
• the responsibilities of the relevant worker in relation to the premises or event.

2. Enhanced terrorism risk assessment (800+ capacity)

If the premises or event has a public capacity of 800 or more then the Protection of Premises requirement is-

• enhanced terrorism risk assessment;
• terrorism protection training;
• security measures.

It’s estimated 24,300 premises fall within this scope. 

a) Enhanced terrorism risk assessment

The Protection of Premises Bill requires the enhanced terrorism risk assessment to include-

• types of acts of terrorism most likely at or in immediate vicinity of event or premises;
• reasonably practical measures to reduce risk of terrorism at or in immediate vicinity of premises or event;
• assessment must consider size and other characteristics of premises or event;
• existing measures in place;
• current use of premises and any further uses for the premises;
• if event, kind of event.

Risk assessment frequency

The terrorism risk assessment must be kept up-to-date. A review of the risk assessment is to be made each time a material change to the risk assessment is likely and at least 12 month from last assessment.

If there’s a qualifying event then the assessment must be 3 months before event or as soon as reasonably practicable after details are first made available to public and before the event begins.

b) Terrorism protection training

The same standard terrorism training as above applies but in addition-

• training to be given as soon as is reasonably practicable after the completion or any material revision of a terrorism risk assessment of the premises. A revision is “material” if it is reasonable to assume that it would materially effect the training.

c) Security measures

Reasonably practicable measures are in place to-

  i) reduce the risk of acts of terrorism occurring at, or in the immediate vicinity of, the premises or event, and;

  ii) reduce the risk of physical harm to individuals if acts of terrorism were to occur at, or in the immediate vicinity of, the premises or event.

In particular, i) & ii)  must include-

• measures in relation to monitoring the premises or event and the immediate vicinity of the premises or event;*
• measures in relation to the movement of individuals into, out of and within the premises or event;**
• procedures to be followed if acts of terrorism were to occur at, or in the immediate vicinity of, the premises or event;***
• measures in relation to the security of sensitive information; “sensitive information” means information which it is reasonable to consider might assist in the planning, preparation or execution of acts of terrorism at, or in the immediate vicinity of, the premises or event.

Note the following SIRV features will help with this:

* Threat and Service Monitor

** Major Incident Management

*** Procedures

iii) Procedures must, in particular, include-

• procedures for alerting the emergency services;
• procedures for alerting persons at, or in the immediate vicinity of, the premises or event;
• procedures for the evacuation of persons from the premises or event, where it is safe and appropriate to do so;
• procedures for bringing persons in the immediate vicinity of the premises or event into the premises or event, where it is safe and appropriate to do so;
• procedures for securing the premises or event, where it is safe and appropriate to do so.

Martyn’s Law under review

Because Martyn’s Law is draft legislation, its final form and date for implementation have yet to be decided.

Find out what premises and events Martyn’s Law applies to here.