The Challenge: Preparedness and Compliance Together

Enhanced Tier organisations face a practical reality: preparedness must work in the moment, and compliance must meet regulatory requirements.

These are not competing priorities, but they are demanding ones. The Designated Senior Individual (DSI) must demonstrate sustained oversight. Security and HSEQ managers must translate risk assessments into executable procedures, while operational teams must coordinate effectively under pressure — all within a framework that withstands regulatory scrutiny.

The answer cannot be a policy folder that sits on a shelf. Nor can it be a periodic reporting exercise disconnected from daily operations. What's required is a solution where preparedness and accountability work together — where the tools used to manage real incidents also generate the evidence required for compliance.

What the SIA Will Assess

The Security Industry Authority (SIA) will evaluate whether organisations have:

• Documented and accessible Public Protection Procedures
• Evidence of a "mature testing programme"
• Functional communication systems under stress
• Defensible decision-making with traceable audit trails
• Continuous review and improvement mechanisms

The challenge is rarely understanding what is required. It is embedding these requirements into daily operations in a way that sustains operational control.

What to Look For

To meet Martyn's Law requirements effectively, organisations need a critical event management solution that addresses both operational readiness and regulatory compliance.  

1. Centralised Documentation That's Operationally Accessible

Public Protection Procedures cannot sit in a shared drive that no one accesses during an emergency. They must be:

• Instantly accessible via mobile and desktop during incidents
• Version-controlled with clear audit trails
• Structured to support predefined escalation pathways and task assignments

The DSI needs visibility over where procedures are stored, when they were last reviewed, and who is responsible for executing them.

2. Structured Testing with Automatic Evidence Generation

The SIA expects a "mature testing programme." This means:

• Regular drills that test procedures under realistic conditions
• Timestamped records of who participated and what actions were taken
• Post-exercise reports that identify gaps and drive improvements

Testing should build real capability while automatically generating the audit trail required for compliance — without creating parallel administrative work.

3. Live Coordination with Automatic Record-Keeping

During an incident, operational teams need:

• Real-time communication across the response team
• Clear task assignments with immediate visibility of who is doing what
• Automatic logging of all actions and decisions as they happen

Coordination and record-keeping should not be separate activities. The system used to manage the response should automatically create the documented record of actions and reasoning required by Martyn's Law.

4. Continuous Improvement as Standard Practice

Martyn's Law requires ongoing review and refinement. The solution should:

• Generate post-incident reports automatically after drills and real events
• Enable lessons learned to be documented and procedures updated without leaving the platform
• Maintain a "story of compliance" showing how procedures evolve based on testing and experience

Martyn's Law requires demonstrable evidence that the organisation is learning and adapting over time.

Evaluating Solutions: The Dual Lens

When evaluating potential solutions, apply this dual lens: each requirement should strengthen operational capability while supporting regulatory compliance. The table below shows how this works in practice: