Martyn's Law Readiness Checklist

Martyn’s Law places a legal duty on venues and event organisers to plan for the threat of terrorism. For many organisations that means digital access control, audit trails and lockdown capability are no longer nice to have. Use this readiness checklist to see exactly where your venue stands today and what to prioritise before enforcement begins. 

Why This Law Exists 

In May 2017, 22 people lost their lives in the Manchester Arena bombing, among them 29 year old Martyn Hett, who was doing what millions of people do every year: attending a live event without expecting harm. The tragedy exposed how many public venues were unprepared for a terrorist attack, with limited access control, inconsistent planning and no legal obligation to have security protocols in place. Martyn’s mother, Figen Murray, campaigned for years to make sure the lessons of that night were acted on, and that campaign led directly to the Terrorism (Protection of Premises) Act 2025, now widely known as Martyn’s Law. 

Martyn’s Law received Royal Assent on 3 April 2025 and carries a 24 month implementation period before it comes into force. It introduces a legal duty for venue operators and event organisers to consider the risk of terrorism and take proportionate steps to protect the public, turning what used to be voluntary good practice into a formal requirement. The law applies to stadiums, arenas, theatres, concert venues, shopping centres, universities, museums and any other premises or events where significant numbers of people gather, and it is expected to affect an estimated 178,000 premises across the UK, spanning both public and private sectors. 

Key figures 

  • 22 lives lost in the Manchester Arena bombing, the tragedy behind the law 
  • 178,000 UK premises estimated to fall within scope 
  • 24 months from Royal Assent to enforcement 

What the Law Requires: Two Tiers of Duty 

Martyn’s Law sets two tiers of obligation, based on how many people a venue or event can hold at any one time. 

Standard Tier: 200 to 799 people 

  • Conduct a terrorism risk assessment 
  • Implement basic protective security measures 
  • Ensure relevant staff are trained in response protocols 

Enhanced Tier: 800 or more people (everything above, plus) 

  • Designate a Senior Individual responsible for compliance 
  • Implement additional security measures where reasonably practicable, including digital access control, surveillance and perimeter checks 
  • Maintain written documentation and review procedures 

Who needs to act 

If your venue welcomes the public regularly, operates in a crowded or high-risk environment, or still relies on legacy or manual security systems, you are likely to fall within scope. That can include stadiums and sports clubs, arenas and entertainment venues, educational campuses, places of worship, leisure and retail centres, and civic buildings and council-owned spaces. In every case, the responsible person or organisation needs to do more than write a plan: they need to be able to demonstrate it, through training, systems and documentation. 

1. Access Control & Physical Security
  • All non-public zones secured with controlled access 

Staff-only, operational and other sensitive areas are protected by digital or physical access control, preventing unauthorised entry and reducing internal risk. 

  • Ability to restrict access by role, time and location 

Permissions are set by job role, approved hours and specific zones, so only the right people can reach the right places at the right times. 

  • Remote lockdown functionality for emergency response 

Designated personnel can lock down doors or zones remotely the moment a threat or incident is identified, isolating risk and protecting the public. 

  • Individual and zone-based access audit trails 

The system keeps clear, timestamped logs of who accessed which area and when, supporting investigations and demonstrating control to regulators. 

2. Surveillance & Monitoring
  • CCTV in place across critical access points 

Entrances, exits and sensitive back-of-house areas are covered, supporting threat detection and incident verification. 

  • Surveillance feeds integrated with access events and logs 

Footage and access data work together, so any breach or suspicious behaviour can be reviewed quickly against exactly who came through which door. 

  • Alerts triggered for suspicious or unauthorised behaviour 

The system flags abnormal activity, such as tailgating or forced entry, automatically, so your team can respond proactively rather than after the fact. 

  • Evidence can be extracted quickly for investigations 

Relevant footage and access logs can be retrieved fast for reporting, enforcement or media response after an incident. 

    3. Staff Training & Operational Response
    • Staff trained in emergency lockdown and evacuation protocols 

    Everyone from operations to front of house knows what to do, where to go and how to help lead others during an incident. 

    • Clear, documented procedures for different threat levels 

    Plans exist for scenarios such as a suspicious package, an armed threat or a mass evacuation, each with defined roles, responsibilities and communication flows. 

    • Regular drills conducted across departments 

    Testing procedures in real time builds muscle memory, exposes gaps and gives your team confidence to act under pressure. 

    • Incident logs and response plans reviewed periodically 

    Security documentation is checked at least annually, or after any incident, so it reflects your current systems, threats and staffing. 

    4. Policy & Compliance Preparedness es Here
    • Terrorism risk assessment completed in the past 12 months 

    A Protect Duty aligned assessment identifies vulnerabilities in infrastructure, access control and crowd movement, and recommends how to mitigate them. 

    • Access control policy covers third party and vendor procedures 

    Contractors, temporary staff and other partners are built into your security protocols rather than treated as exceptions to them. 

    • Compliance lead or team identified internally 

    One person or team holds formal responsibility for Martyn’s Law compliance, with the authority to review systems, coordinate training and prepare documentation. 

    • Plans in place for Protect Duty alignment ahead of enforcement 

    Work toward compliance, an action plan, sourcing solutions, closing known gaps, is already under way rather than waiting for the law to take effect. 

     

    “As we wait for Martyn’s Law to come fully into force, organisations responsible for public safety face one question: are we truly prepared? For stadiums, arenas and other high footfall venues, this is a shift from guidance to obligation, and that shift calls for action, not just awareness.” 

    – Bruce Donald, UK Sales Manager, SimonsVoss Technologies 

    SimonsVoss already supports venues including Northampton Saints and Trinity College, Cambridge, as they strengthen their security, prepare for audits and take firmer control over who can access their sites. These examples show that readiness is achievable, and that it makes a real difference. 

    Case Studies

    How Northampton Saints Boosts Security with SimonsVoss Digital Locks

    Northampton Saints Rugby Football Club, with roots dating back to 1880, has clinched seven major trophies, including the prestigious English Premiership (2014 and 2024), European Champions Cup (2000) and European Challenge Cup (2009 and 2014) titles. Operating from cinch Stadium at Franklin’s Gardens, they needed a modern and reliable solution to streamline their access control and enhance security across their sprawling facilities. 

    Read More

    How Trinity Hall Boosts Security

    Trinity Hall, one of the Colleges of Cambridge University, sought a robust solution to enhance security and streamline its access management processes. Their quest led them to partner with SimonsVoss, resulting in modernised, efficient locking solutions that have transformed the College’s day-to-day operations. 

    Read More

    Cheadle Parish Church – Unlocking Community Access with SimonsVoss

    Nestled in the heart of Cheadle, Cheadle Parish Church serves as a multi-use community building that is primarily used by the church but also accommodates various groups throughout the week. From local clubs and social gatherings to one-off meetings, the building is a hub of activity, requiring flexible yet secure access control. 

    Read More

    About SimonsVoss 

    SimonsVoss is a digital, wireless access control provider trusted by stadiums, campuses and critical infrastructure sites across the UK and Europe. Our systems help venues strengthen physical security, simplify day to day operations and respond quickly in an emergency, while supporting compliance with legislation such as Martyn’s Law. Remote lockdown, user level access control and zone based configuration are all built in, designed for environments where high footfall comes with high responsibility. 

    Through our SmartIntego products, we integrate with trusted third party providers to deliver a fully rounded compliant solution: 

    1. CCTV integration 
    2. Audit trail functionality 
    3. Instant lockdown capability 
    4. Building Management Systems (BMS) integration 
    5. Video Management Systems (VMS) integration 
    6. Physical security operations support 

      Why venues choose SimonsVoss 

      1. Proven partner of venues including Northampton Saints and Trinity College, Cambridge 
      2. Scalable from single buildings to complex, multi-site estates 
      3. Real-time access data that supports faster incident response
      4. Built-in flexibility for emergency lockdowns 

            This checklist is intended as a guide only and does not constitute legal advice. SimonsVoss Technologies, part of the ALLEGION group.