Saturday, 20:15, at a 1,200-capacity music venue. A door supervisor radios the duty manager: there is a man with what looks like a weapon on the pavement outside the main entrance, and the queue is backing away from him.
Every member of staff in the building knows what the fire alarm means. It means open the doors and move people out, and for most of the room the nearest way out is the main entrance. The one signal everyone has rehearsed would walk 1,200 people towards the threat.
There are 74 people working tonight. Twenty-two are behind the bars, fourteen are agency door supervisors who met the venue’s own stewards for the first time at the 17:30 briefing, and only the security team and the duty manager carry radios.
The duty manager has three questions and very little time. Who has the authority to call it? What are the bar staff supposed to do, and how will anyone know the cloakroom got the message?
A Martyn’s Law lockdown procedure for venue staff is a job for a quiet weekday afternoon, and most venues have never written one. Martyn’s Law will make it a legal expectation, because lockdown and communication are two of the four procedures the Act asks venues to have ready. A lockdown is a different instruction from an evacuation, and it needs its own words, its own channel and its own check that people heard.
A Martyn's Law Lockdown Procedure For Venue Staff Is Decided Before Doors Open
A Martyn’s Law lockdown procedure for venue staff is the set of instructions that people working at a venue follow to secure the premises when an attack is suspected outside or nearby. Writing one means settling three things in advance: who is allowed to give the instruction, what the message says to each group of staff, and which channel reaches the people who do not carry a radio. The instruction has to be different from the evacuation signal, and it has to be followed by a check on who received it.
The terms come from UK law. The Home Office’s statutory guidance on the Terrorism (Protection of Premises) Act 2025, published on 15 April 2026, defines lockdown as securing the premises to prevent individuals entering or leaving. Invacuation is moving people to a place inside where there is less risk of physical harm, which can include bringing them in from outside.
What Is Martyn's Law?
Martyn’s Law is the common name for the Terrorism (Protection of Premises) Act 2025, a UK law that requires those responsible for certain public premises and events to be prepared to keep people safe if a terrorist attack happens. It is named in recognition of Martyn Hett, one of the 22 people killed in the Manchester Arena attack in 2017. The Act applies to England, Wales, Scotland and Northern Ireland.
The Home Office describes the aim as putting protective security on the same footing as health and safety and fire safety. For a venue, the practical effect is that planning what staff will do during an attack becomes a legal duty.
When Will Martyn's Law Be Implemented?
Martyn’s Law has not yet been implemented, and no commencement date has been announced. The Act received Royal Assent on 3 April 2025, and the Home Office’s overarching factsheet, updated in July 2026, says the implementation period is expected to be at least 24 months from that date. There is no legal requirement to comply until the legislation comes into force.
Some parts are already in place. Section 27, which covers guidance, came into force on 10 April 2026, and the Home Office published its statutory guidance five days later. That guidance says further details will be provided on when the main requirements will be commenced, so the Home Office and ProtectUK pages are the places to watch for the date.
How Does Martyn's Law Work?
Martyn’s Law works by placing duties on a responsible person, in two tiers set by how many people may be present at the same time. The responsible person is usually the company or organisation that controls the premises, and the regulator is the Security Industry Authority (SIA). In outline:
- Scope: premises used for purposes such as food and drink, entertainment, sport and retail, where 200 or more people, including staff, may be present, and public events of 800 or more
- Standard tier, 200 to 799 people: public protection procedures for evacuation, invacuation, lockdown and communication, so far as is reasonably practicable
- Enhanced tier, 800 or more people, and qualifying events: the same procedures, plus public protection measures covering monitoring, the movement of people, physical safety and security, and the security of information
- Enhanced tier paperwork: a document setting out the procedures and measures, submitted to the SIA, and a designated senior individual where the responsible person is an organisation
- Notification: the responsible person tells the SIA when they become responsible for qualifying premises or a qualifying event
- Enforcement: the SIA can inspect and issue compliance, restriction and penalty notices, with penalties of up to 10,000 pounds in the standard tier and up to 18 million pounds or 5% of worldwide revenue, whichever is higher, in the enhanced tier
A 1,200-capacity venue would normally expect to fall in the enhanced tier, and a separate article explains how the standard and enhanced tiers differ. The part that depends on staff sits in section 5 of the Act. Martyn’s Law public protection procedures for staff communication are, in the Act’s words, procedures “to be followed by individuals working on the premises”, so they only exist if staff know them.
Two points in the guidance matter to anyone planning the staff message. There is no statutory requirement to purchase specific equipment or to pay for third-party training, and the Martyn’s Law page on ProtectUK says neither the Home Office nor the SIA endorses third-party products. What the guidance does expect is that staff with a part in a procedure know their role, and that procedures are tested and practised.
20:15: Who Decides It Is A Lockdown?
The decision to lock down belongs to a named role, agreed in advance, with a named deputy for the nights that person is not in the building. The statutory guidance asks the responsible person to consider who will decide what actions to take, who has the authority to start a procedure, and who will alert the emergency services.
At 20:15 the duty manager and the agency’s head door supervisor are both on the radio, and each assumes the other will make the call. The venue’s plan names “the senior manager on duty”. Tonight that could mean either of them, and ninety seconds go on finding out.
The decision is also more specific than lock down or carry on. The duty manager wants the main entrance secured, the queue brought in through the east side door if that can be done safely, and the audience kept in the hall. That’s an invacuation followed by a partial lockdown, and somebody has to turn it into instructions.
20:16: The Fire Alarm Would Send 1,200 People Towards The Threat
A fire evacuation procedure does not cover a threat outside the building, because the fire alarm gives one instruction and that instruction is to leave. Many venue operators assume that years of fire drills mean staff are prepared for any emergency. For a threat at the main entrance, the drilled response is the wrong one.
The statutory guidance is direct about it. It says procedures for a suspected terrorist attack “may differ from fire evacuation plans”, and that such plans should, where possible, avoid using the normal fire alarm, because people may respond inappropriately to the threat. For larger premises it adds that the instructions communicated for an evacuation should be different to those communicated for a lockdown.
None of this makes the fire procedure a waste. Staff who have drilled an evacuation know the exits and the stairwells, and all of that carries over. What doesn’t carry over is the signal, so staff need a second instruction that reaches them some other way than the alarm.
20:17: Communicating An Invacuation To Venue Staff, Group By Group
Telling staff about an invacuation means sending each group the action that belongs to its position, in words that can be read at a glance. The statutory guidance notes that the information given to staff and to the public might differ, and that instructions should be simple, clear and specific to the action required. One message to all 74 people saying “security incident, follow procedure” meets none of those tests.
For example:
- Door supervisors: “LOCKDOWN. Threat outside main entrance. Secure the main doors now. Bring the queue in through the east side door. Acknowledge.”
- Bar staff: “LOCKDOWN, NOT FIRE. Stop serving. Keep customers in the hall and away from the foyer. Wait for the next instruction. Acknowledge.”
- Box office and cloakroom: “LOCKDOWN. Leave the foyer now and move into the hall. Acknowledge.”
- Sound desk: “LOCKDOWN. Be ready to cut the music for an announcement from the duty manager. Acknowledge.”
The wording will differ at every venue, and it should come from the venue’s own procedures and layout. What the four messages share is their shape: the word that names the instruction, where the threat is, one action, and a request to confirm.
Staff here means more than employees. The guidance defines staff as everyone working at the premises, including contractors and volunteers, which at this venue covers the agency door team, the caterers and the touring sound engineer who controls the public address system. A contact list built from the payroll misses most of them, so groups have to be rebuilt for each event.
20:19: Who Has Not Answered?
A lockdown instruction is not complete until the person who sent it knows who has confirmed it. Sending tells the duty manager that the message left. It doesn’t say whether the kitchen porter with the extractor fans running knows the building is locked down.
At 20:19 every radio user has answered. Of the 22 bar staff, nine have confirmed on their phones, and the others are serving three-deep and have not looked. The realistic options are a second channel that is harder to miss, such as a voice call, or a steward sent to each bar. Either works, as long as someone can see who is still silent.
20:25: The Instruction Changes
The first instruction in a lockdown is rarely the last, and staff need the follow-up as reliably as they needed the first message. The statutory guidance describes procedures used in sequence. Its own example has a theatre lock its front doors, then move the audience out through the rear doors and tell them to disperse.
At 20:25 police are at the front of the venue and ask for the hall to be cleared through the rear loading doors. The bar staff who were told to keep people in now have to be told to move them out, by a named route, and away from the fire assembly point in the front car park. A member of staff who missed the first message has no idea why the route is unusual.
Then comes the stand-down. Somebody decides the lockdown is over and says so to every group. Without that message some doors stay locked, and some staff keep people in a room long after they need to.
Five Messages To Write Before The Next Event
Five pre-written messages answer most of the question of how to tell staff to lock down a public venue. Write them for the building as it is, with real door names, and keep each one short enough to read on a phone lock screen.
- Full lockdown: the threat is outside, every entrance is secured and everyone stays in
- Invacuation: bring people in from a named outside area, or move them from one named zone to another
- Partial lockdown: named doors secured, named routes left open
- Evacuate by a named route and disperse: explicitly not to the fire assembly point
- Stand down: the lockdown is over, and who staff report to next
Then check each message against the same list:
- The first word names the instruction, so it cannot be mistaken for a fire evacuation
- There is a version for each staff group, and each asks for an acknowledgement
- The role that can send it, and the deputy, are named on the event sheet
- The groups include agency staff, contractors and volunteers
- One message has been sent as a drill on a busy night, and the silences counted
The last check shows whether the rest works. A message sent at 20:00 on a Saturday, clearly marked as a drill, shows within a few minutes which bars never look at a phone and which corners of the building have no signal.
What Kind Of Tool Helps With Martyn's Law Public Protection Procedures?
A tool helps with Martyn’s Law public protection procedures when it does three jobs: it gets a specific instruction to every person working at the premises, it shows who has acknowledged that instruction, and it keeps a record of drills and real activations. Those jobs map to the communication procedure in section 5 of the Act and to the guidance’s expectation that procedures are tested and practised. No tool makes a venue compliant, and the Act does not require one.
Venues already own some of these tools. The statutory guidance lists public address systems, loud hailers, closed radio systems and alarms as ways to share information quickly, and says smaller premises can rely on loud, clear verbal commands. Each has a limit worth knowing:
- A public address system reaches the public and staff with the same words, when the guidance notes the two may need different information
- Radios reach the security team, and rarely the bar, kitchen or cloakroom
- A group chat reaches phones, with no view of who has read the message and no record afterwards
- Mass notification software reaches staff phones by group and shows who has acknowledged, provided the phones have a signal
What Ping Covers, And What It Leaves To The Venue
Everything above can be done with radios, a public address system and a printed call sheet, and for a small venue that may be enough. The gap appears with scale, and with staff who do not carry radios. Many communication tools send a notification and stop there, without coordinating the updates and acknowledgements that follow.
Crises Control is an operational incident coordination platform, and Ping is its mass notification software. For venues preparing for Martyn’s Law, Ping supports the communication procedure: it delivers one message across SMS, voice calls, email, push notifications, Microsoft Teams and web alerts, and can target specific groups such as a single site or a department. The bar team and the door team can each be sent their own lockdown instruction.
Recipients acknowledge with one tap, and Ping can be configured to cascade across channels until they do. Every delivery, acknowledgement and response is recorded, so the duty manager can see who has confirmed, and the venue has a communication history from each drill to review. The hospitality crisis management software page describes how alerting sits alongside incident coordination for hospitality organisations.
Messages to the public are a separate job. Public safety communication software such as Public Alerting covers large-scale SMS alerts to people outside the organisation, and an earlier article looks at Martyn’s Law training for the staff who carry the procedures out.
Ping does not decide whether the right call is a lockdown, an invacuation or an evacuation. That remains a human decision, made by the person the venue has named. Ping also depends on staff phones having a signal or a data connection, and it does not make a venue compliant with Martyn’s Law. Compliance rests on the procedures the responsible person puts in place, and the SIA is the regulator that will assess them.
The Alarm Staff Know Is Not The Only Instruction They Need
At 20:15 on a Saturday the duty manager has the fire alarm, a radio channel that reaches a third of the team, and whatever was agreed beforehand. A venue that has written the lockdown message, named who sends it and counted who answers a drill has a second instruction ready, and has done the part of Martyn’s Law that depends on staff. Alerting staff is the first step, and keeping them updated and knowing who has confirmed is the next.
Frequently Asked Questions
What should a venue's lockdown procedure for staff include?
A Martyn’s Law lockdown procedure for venue staff should include who can give the instruction, a pre-written message for each staff group that is different from the fire alarm, and a way to see who has acknowledged it. The message names the instruction first, says where the threat is and gives one action.
What is Martyn's Law?
Martyn’s Law is the Terrorism (Protection of Premises) Act 2025, a UK law requiring those responsible for certain public premises and events to prepare for a terrorist attack. Premises where 200 or more people may be present must have procedures for evacuation, invacuation, lockdown and communication, and those of 800 or more must also put protective measures in place. The Security Industry Authority is the regulator.
When does Martyn's Law come into force?
Martyn’s Law is not yet in force and no commencement date has been announced. The Act received Royal Assent on 3 April 2025 and the Home Office expects the implementation period to be at least 24 months from that date. There is no legal requirement to comply until the legislation is commenced.
Should a venue use the fire alarm for a security threat outside the building?
The Home Office statutory guidance says plans for a terrorist attack should, where possible, avoid using the normal fire alarm, because people may respond inappropriately to the threat. Writing a Martyn’s Law lockdown procedure for venue staff therefore includes choosing a signal that is not the fire alarm.
What software helps venues prepare for Martyn's Law?
Mass notification software helps venues prepare for the communication and lockdown procedures in Martyn’s Law by sending role-specific instructions to staff phones and showing who has acknowledged them. Crises Control’s Ping module does this across SMS, voice calls, email, push notifications and Microsoft Teams, and records every delivery and acknowledgement. No software makes a venue compliant, and the statutory guidance says there is no requirement to purchase specific equipment.
This article was drafted with AI assistance and reviewed by the Crises Control team. Featured image: AI-generated.
