When the Manchester Arena Inquiry examined the response to the 2017 attack, one theme returned again and again. The difference between confusion and competence in those first critical minutes came down to people: whether they recognised what was happening, whether they knew what to do, and whether they felt able to act. Equipment matters. Procedures matter. But it is trained people who turn a plan into a response.
That principle sits at the heart of Martyn’s Law, the Terrorism (Protection of Premises) Act 2025. As organisations across the UK work out what the Act means for them ahead of its expected commencement in spring 2027, a great deal of attention is landing on a single word: training. Search for “Martyn’s Law training” and you will find a crowded field of e-learning modules and awareness courses, many promising compliance for the price of an afternoon and a certificate.
Some of that provision is genuinely useful. Some of it risks giving organisations a false sense of security, which is a dangerous thing to buy. At Redline Assured Security, we have spent more than twenty years training people to deliver counter-terrorism security to the highest regulated standards, and we want to be clear about what good training under Martyn’s Law actually looks like, what your staff genuinely need, and what is simply noise.
What the Law Actually Says About Training
It is worth starting with a clarification, because there is some confusion in the market. Martyn’s Law does not, in its standard tier, mandate a specific training course or qualification that every member of staff must complete. What the Act requires is that those responsible for qualifying premises put in place public protection procedures, and that staff are made aware of those procedures and how to carry them out.
In practice, awareness without competence is meaningless. A procedure that exists only on paper, or in the head of a manager who happens to be off shift when an incident occurs, is not a procedure at all. The duty to have effective procedures carries with it an unavoidable need for the people on site to understand them and be able to act. That is training, whether or not the Act uses the word in every clause.
At the enhanced tier, where premises must implement and document public protection measures and appoint a responsible senior individual, the expectation of demonstrable competence rises further. Documentation that describes a sophisticated response means little if the workforce cannot deliver it under pressure.
The Difference Between Awareness and Competence
The most common mistake we see is treating a short awareness module as the finish line. Free counter-terrorism awareness training, such as the ACT (Action Counters Terrorism) materials available through ProtectUK, is valuable and we encourage every organisation to use it. It builds a baseline understanding of the threat and the principles of protective security. But baseline awareness is the beginning of preparedness, not the whole of it.
There is a meaningful distinction between knowing that an evacuation procedure exists and being able to lead one calmly while frightened members of the public look to you for direction. Between having heard the word “lockdown” and knowing which doors to secure, in what order, and how to account for people once you have. Awareness tells someone what the words mean. Competence is what they can actually do when it counts.
Effective Martyn’s Law training closes that gap. It is specific to the premises, grounded in the procedures that premises has chosen, and rehearsed often enough that the right actions become close to instinctive. A generic certificate that could have been issued to a stadium, a school or a corner shop without changing a single slide is, almost by definition, not specific to any of them.
What Your Staff Genuinely Need
The right training programme depends on the premises, the tier and the roles people hold, but a few elements are close to universal.
First, staff need to understand the threat in a way that is realistic rather than alarming. People respond well to honest, proportionate information and badly to either complacency or fear. Good training builds quiet confidence.
Second, they need to know the specific procedures for their premises: evacuation, invacuation, lockdown and communication, and crucially how to decide between them, because the wrong choice can cost lives. Moving people outside towards a threat is worse than keeping them in. Staff need the judgement to read a situation, not just a checklist to follow.
Third, frontline and customer-facing staff benefit enormously from the ability to spot something out of place. Behavioural detection and the recognition of hostile reconnaissance are skills that have prevented attacks. They are also skills that take proper instruction to build, which is why they have long been central to professional aviation and event security.
Fourth, those with leadership responsibilities, and the senior individual designated at the enhanced tier, need a deeper grounding still: how to assess risk, how to oversee procedures and measures, and how to evidence that the organisation is meeting its duties. This is where recognised, structured qualifications earn their place.
What Your Staff Don’t Need
Just as important is what to avoid. Your staff do not need a thick binder of generic policy that nobody reads. They do not need a one-off tick-box session eighteen months before the law takes effect, then never revisited. And they do not need training pitched at a level of complexity or threat that bears no relationship to their actual premises and role.
Over-engineering is its own failure. A village hall does not need the training programme of an international stadium, and pretending otherwise wastes goodwill and money while teaching people very little. Proportionality is written into the spirit of Martyn’s Law for good reason. The best training reflects it: enough to be genuinely capable, not so much that it becomes theatre.
Why the Provider Matters
The market for Martyn’s Law training has filled quickly, and not all of it is built on counter-terrorism experience. A polished e-learning platform is not the same as deep operational knowledge of how attacks unfold and how people really behave under threat. When you are preparing your people for the worst day they may ever face, the credibility behind the training is not a detail. It is the whole point.
Redline Assured Security brings something the resellers cannot. As TrustFlight’s security capability, we have delivered counter-terrorism and aviation security training for more than two decades, to standards regulated by the Civil Aviation Authority, which recognised our delivery as “Outstanding.” We are an ICAO-appointed UK Aviation Security Training Centre, and we have recently been approved by SFJ Awards to deliver the UK’s counter-terrorism Level 3 security qualification. That heritage means our training is built by people who have spent their careers in protective security, and it is grounded in how threats actually behave rather than how a template imagines they might.
It also means we can match the training to the organisation. From short, sharp awareness sessions for standard-tier premises, through behavioural detection and procedure rehearsal, to structured qualifications and ongoing assurance for enhanced-tier operators, the programme fits the duty rather than the other way around.
This is exactly what Redline’s Level 3 Award in Counter-Terrorism, Protective Security and Preparedness is built to deliver, turning awareness into genuine, assessed competence.
Building Readiness That Lasts
The organisations that will handle Martyn’s Law best are not the ones that buy a certificate and file it away. They are the ones that build a culture in which security is understood as everybody’s business, where procedures are known, rehearsed and refreshed, and where new starters are brought up to the same standard as everyone else. Training is not an event you complete. It is a capability you maintain.
With commencement expected in spring 2027, there is time to do this properly, but only if that time is used. Embedding genuine competence across a workforce takes longer than installing a piece of equipment, and it is far more valuable.
Trust in your security is built by the people who deliver it, not by the paperwork that describes it. If you would like to talk through what Martyn’s Law training should look like for your organisation, and how to build readiness that holds up when it matters, please get in touch with our team.
Frequently Asked Questions
Does Martyn’s Law require specific training? The Act requires effective public protection procedures and that staff are able to carry them out. While it does not prescribe a single mandatory course for every worker, meeting the duty in practice requires staff to be trained to understand and deliver those procedures competently.
Is free counter-terrorism awareness training enough? Free awareness training such as the ACT materials on ProtectUK is a valuable baseline and well worth using, but it is a starting point. Premises-specific procedures, decision-making and, for many roles, behavioural detection skills require more than a generic awareness module.
What training do enhanced-tier premises need? Enhanced-tier premises should ensure broad staff competence in their procedures and measures, plus deeper training for those with leadership and oversight roles, including the designated senior individual, who needs to understand risk assessment, measures and how to evidence compliance.
How often should Martyn’s Law training be refreshed? Training should be treated as an ongoing capability rather than a one-off. Regular refreshers, rehearsal of procedures, and induction for new staff keep competence current and meaningful, which is what the law is ultimately concerned with.
Why choose a specialist security provider? Preparing people for a terrorist attack demands genuine operational expertise. A provider with frontline counter-terrorism and regulated security experience can deliver training that reflects how threats actually behave, tailored to your premises and tier, rather than a generic certificate.