HZL Specialist Solutions has now delivered two SFJ Awards Level 3 Award in Counter-Terrorism Protective Security and Preparedness courses, one in London and one in Derby.
Both courses were well represented, bringing together delegates from a variety of professional backgrounds and organisations. This diversity proved to be one of the strengths of the programme.
There were significant takeaways not only for the delegates, but also for us as trainers. The discussions reinforced an important point: counter-terrorism protective security cannot operate in isolation. It needs to become part of the wider way in which organisations think about risk, safety, people and their operating environment.
The qualification itself has been developed by SFJ Awards in collaboration with the National Counter Terrorism Security Office (NaCTSO) and is the only qualification of its type endorsed by both NaCTSO and Counter Terrorism Policing. Its purpose is to develop the knowledge and practical capability required to strengthen counter-terrorism protective security, risk assessment and preparedness.
Understanding the tiers and who they affect
Unsurprisingly, one of the main areas of discussion on both courses was the Terrorism (Protection of Premises) Act 2025, commonly known as Martyn’s Law.
Understanding whether a premises falls within scope, and at what level, is an important starting point.
Under the current legislation:
- Below 200 people: premises generally fall outside the scope of the Act on numbers, subject to the other definitions and circumstances within the legislation.
- Standard Tier – 200 to 799 people: qualifying premises that can reasonably expect between 200 and 799 people, including staff, to be present at the same time from time to time.
- Enhanced Tier – 800 people or more: qualifying premises that can reasonably expect 800 or more people to be present at the same time from time to time.
- Qualifying events: certain events expecting 800 or more people are subject to the enhanced requirements.
There are important exceptions, including places of worship and some educational premises, so simply counting people is not enough to determine an organisation’s responsibilities.
One discussion was around the words “from time to time”. A venue does not necessarily have to accommodate the threshold number every day. If, for example, it can reasonably expect to exceed the relevant threshold for particular events or periods during the year, that may still bring it within scope.
With the huge number and variety of ticketed, sporting, cultural, corporate and community events taking place across the UK every year, the potential reach of protective security considerations is considerable.
Moving beyond compliance – understanding risk
One of the biggest takeaways from the courses was the importance of not treating Martyn’s Law as simply another compliance exercise.
A good counter-terrorism risk assessment starts by understanding:
- What are we protecting?
- What could realistically happen?
- Where are we vulnerable?
- What could we reasonably do about it?
The course considers different terrorist attack methodologies, including the 5 + 1 methods of attack, and encourages delegates to consider how those methods might apply to their own venue, site, organisation or event.
This is where the subject becomes practical.
A control measure that is appropriate for a major stadium may be completely disproportionate for a smaller venue. Equally, a control measure that appears effective on paper may achieve very little if those responsible for implementing it do not understand it.
The aim is not to remove every conceivable risk – that is impossible. The aim is to identify credible vulnerabilities, understand their potential consequences and introduce proportionate measures that reduce risk.
Events without a fence line
Some of the most interesting discussions concerned events that do not have a conventional security perimeter.
A stadium or established entertainment venue may have clearly defined entrances, ticket checks, barriers and controlled access points. But what about:
- a town-centre event;
- a Christmas market;
- a road race;
- an outdoor concert;
- a public celebration;
- a community event spread across several streets; or
- an event integrated into an existing shopping or hospitality area?
Where exactly does the venue begin and end? This becomes particularly important when there is no obvious fence line.
Security cannot therefore be considered only at the entrance to an event. Delegates need to understand the wider operating environment: pedestrian routes, transport hubs, car parks, public highways, neighbouring businesses, congregation points and areas where crowds may build up before or after an event.
Identifying the “grey space”
This leads directly to another important area explored during the course: grey space.
The space immediately outside a venue or event can sometimes present some of the greatest challenges.
- Who controls it?
- Who is responsible for it?
- Who has the ability to introduce mitigation measures?
The answer may involve several different organisations.
A venue operator may control the building. A local authority may control the pavement or public space outside. A neighbouring business may control an adjoining car park. The police, transport operators, highways authority, contractors and event organisers may all have an interest.
The Terrorism (Protection of Premises) Act itself recognises the importance of coordination between responsible persons in relevant circumstances. Protective security therefore cannot stop at an organisational boundary.
One of the practical lessons is the importance of building relationships before they are needed. Talking to neighbouring businesses, landlords, local authorities, emergency services, transport providers and other stakeholders can identify vulnerabilities that would not necessarily be apparent when looking at a site in isolation.
The challenge of stewards and temporary staff
Another recurring discussion concerned the people expected to implement security and emergency procedures.
Large events can employ significant numbers of stewards, contractors, temporary employees and volunteers. Their knowledge and experience can vary considerably.
- Some will be highly experienced professionals.
- Others may work only occasionally.
- Some may enthusiastically complete training.
- Others may see training as something they simply need to get through before starting work.
Yet in an incident, these may be exactly the people members of the public turn to for direction.
A written procedure has limited value if the people expected to implement it have never seen it, do not understand it or cannot remember what they are expected to do.
Current statutory guidance specifically recognises the importance of ensuring staff receive the instruction or training necessary to implement public protection procedures effectively.
This presents organisations with a practical challenge: how do we provide meaningful training to a workforce that may be large, temporary, dispersed or frequently changing?
The answer does not necessarily have to be lengthy classroom training for everybody. Briefings, exercises, scenario-based learning, toolbox talks and clear instructions can all form part of the solution.
The important point is that people understand what they need to do and why they need to do it.
Counter-terrorism risk does not sit in its own box
Perhaps one of the strongest themes to emerge from both courses was the synergy between counter-terrorism protective security and other established areas of organisational risk management.
Many organisations already have arrangements covering:
- Health and Safety
- Fire Safety
- Event Safety
- Emergency Planning
- Business Continuity
- Security
- Safeguarding
- Crowd Management
- Evacuation
- First Aid and Medical Response.
The question therefore should not necessarily be:
“Where do we create a completely separate counter-terrorism system?”
A better question may be:
“Where does counter-terrorism risk fit within the systems we already have?”
Consider evacuation. Fire planning may require people to leave a building quickly. A terrorist incident outside that building might mean that immediately evacuating people into the threat area is exactly the wrong response.
Similarly, existing procedures for lockdown, invacuation, communications, incident management and emergency decision making may already provide much of the framework required, but they may need to be reconsidered through a counter-terrorism lens.
The objective should be integration rather than duplication.
Looking at the whole environment
The course reinforces the importance of looking beyond individual security measures.
CCTV, hostile vehicle mitigation, searching, access control and physical barriers can all be valuable, but protective security is not simply a list of equipment to purchase.
Effective preparedness is built around:
People + Procedures + Physical Measures + Information + Training + Exercising
… and, importantly, regularly reviewing whether those measures remain appropriate.
The environment changes. Businesses change. Events change. Threats change. Staff change.
Risk assessments therefore need to remain live documents rather than something completed, filed and forgotten.
One of the biggest lessons: conversation matters
For us at HZL, one of the greatest benefits of delivering the first London and Derby courses has been the discussion between delegates.
The trainer may provide the framework, knowledge and experience, but delegates bring their own environments, problems and professional experience into the classroom.
Questions such as:
- “Who actually owns that risk?”
- “What happens outside our boundary?”
- “Would our stewards know what to do?”
- “Are we duplicating something already covered by our fire or event safety plan?”
- “Have we ever actually tested this procedure?”
… are exactly the conversations organisations should be having.
The SFJ Level 3 qualification is not, by itself, a guarantee of compliance with Martyn’s Law, something SFJ Awards itself makes very clear. What it does provide is the knowledge, understanding and practical skills that can help organisations develop their approach to counter-terrorism risk assessment and preparedness.
From awareness to preparedness
Our main takeaway from the first two courses is simple.
Protective security is not just about preventing an attack. It is about creating organisations that understand their risks, recognise their vulnerabilities and are prepared to respond effectively if the worst happens.
- That requires competent people.
- It requires proportionate risk assessment.
- It requires cooperation between stakeholders.
- And it requires counter-terrorism considerations to become part of everyday organisational risk management rather than something considered only when a major event takes place.
Following the positive response to our first courses in London and Derby, HZL Specialist Solutions will continue to deliver the SFJ Awards Level 3 Award in Counter-Terrorism Protective Security and Preparedness, helping individuals and organisations develop the practical knowledge and confidence to better protect their people, premises and events.
Preparedness should not begin when an incident happens. It starts with understanding the risk before it does.
For further information about forthcoming HZL Specialist Solutions courses in Derby and London, please contact us.
