Two terms sit at the heart of Martyn’s Law, and they are not interchangeable. Public protection procedures apply to every premises in scope. Public protection measures apply only to Enhanced Tier premises. Confusing them leads organisations to plan for the wrong set of obligations, which costs time and leaves gaps.

Public protection procedures apply to all in-scope premises under the Terrorism (Protection of Premises) Act 2025. There are four:

• Evacuation. The procedure for getting people out of the premises by the nearest safe exit, away from the threat, not (as in a fire) any available exit.
• Invacuation. The procedure for getting people inside the premises and securing it when the threat is outside.
• Lockdown. The procedure for stopping movement on the premises, barricading rooms, and preventing access.
• Communications. The system and procedure for alerting everyone on the premises to an incident, reaching every room and every building, quickly.

These procedures focus on response: how your premises and your staff behave in the minutes of an incident to reduce physical harm.

Each procedure is specific to the premises. A fire evacuation plan is not a Martyn’s Law evacuation procedure. A generic lockdown plan pulled from a template is not a purpose-built procedure. The regulator will expect to see procedures tailored to the building, tested against likely scenarios, and evidenced with training records and exercise outcomes.

Public protection measures apply only to Enhanced Tier premises (those with 800 or more individuals reasonably expected on site from time to time). They focus on reducing vulnerability rather than responding to an incident.

Measures fall under four categories, commonly described as:

• Deter. Visible steps that discourage an incident occurring at this premises.
• Detect. Steps that increase the likelihood of spotting a threat before it escalates.
• Delay. Steps that slow the progression of an incident once it begins.
• Defend. Steps that protect people on the premises during an incident.

Specific measures are not prescribed by the Act. Instead, Enhanced Tier premises choose measures based on a documented risk assessment of their specific premises. The regulator will expect to see the rationale, not a particular kit list.

Confusion between procedures and measures creates two specific risks:

1. Over-preparing. A Standard Tier premises believing it needs measures (and therefore designing bollards, barrier systems, or surveillance kit) is wasting time on obligations that don’t apply.
2. Under-preparing. An Enhanced Tier premises believing procedures alone are sufficient is missing half the Act’s requirements.

The language used in documents, training, and correspondence matters. Get it consistent.

For Enhanced Tier premises, procedures and measures complement each other. Measures reduce the likelihood and impact of an incident occurring. Procedures govern how the premises responds if one occurs anyway. Both are required, and both need evidencing.

The fastest way to know is our free Am I in Scope? tool. A handful of questions, a clear answer, no account needed.

If you already know you’re in scope, Get Started with Prova Risk to prepare your public protection procedures, train your staff, and keep the evidence you’ll need if inspected. £399 per year per site.

• Why Health and Safety and Fire Legislation Don’t Cover Martyn’s Law
• What Are Public Protection Procedures?
• Standard Tier vs Enhanced Tier
• Do I Need to Hire a Security Guard?