Martyn’s Law in FM and Security Tenders: Evidence Guide 2026

Martyn’s Law is not in force yet, but it is already turning up in tender thinking.

That matters for facilities management and security suppliers. Buyers are starting to ask practical questions: can this provider help us prepare, without panic, overspend or vague compliance promises?

The Terrorism (Protection of Premises) Act 2025 received Royal Assent in April 2025. It creates duties for certain publicly accessible premises and events, with a preparation period before commencement. The direction is clear enough for bid teams to act now.

Facilities management and security bid team reviewing Martyn’s Law preparedness

This guide is for FM providers, security companies, estates teams and bid managers who need to answer Martyn’s Law questions in tenders during 2026.

The short version: do not write a compliance promise. Write an evidence-backed preparedness plan.

Why Martyn’s Law Has Become a Tender Issue

Martyn’s Law was created to improve protective security and organisational preparedness at qualifying premises and events. It is named in tribute to Martyn Hett, one of the 22 people killed in the Manchester Arena attack.

The Act requires responsible persons to take reasonably practicable steps to reduce harm in the event of a terrorist attack. Larger premises and qualifying events also have enhanced duties focused on reducing vulnerability.

That sounds like a legal change. In procurement, it becomes an operational question.

Public bodies, colleges, venues, councils, healthcare estates, transport-adjacent sites and cultural venues need to work out what they own, what they operate and what support they expect from suppliers.

That is why the topic is already appearing in pre-market engagement. One 2026 Find a Tender notice from City of Portsmouth College sought market input on integrated security and safety systems to support anticipated Martyn’s Law requirements, including visitor management, car park access, emergency alerting and invacuation systems.

The signal is obvious. Buyers are not waiting for day one of enforcement before planning.

For FM and security bidders, this creates an opportunity and a risk.

The opportunity is to show calm, proportionate expertise. The risk is to overclaim, suggest unnecessary products, or write a generic paragraph that sounds like it was copied from a legal update.

What Buyers Actually Need From Suppliers

Most buyers are not looking for a supplier to recite the Act back at them.

They need help with practical readiness.

A strong tender response should show how you will help the buyer answer four questions:

1. Are our premises or events likely to be in scope?
2. What procedures do staff need to know and practise?
3. What measures are proportionate for the site, the contract and the risk?
4. How will the service stay current as guidance, SIA processes and site operations change?

That last point matters. Martyn’s Law readiness is not a one-off document. It affects training, mobilisation, visitor journeys, incident response, subcontractor control, helpdesk scripts, asset maintenance, CCTV procedures, access control, car park management and contract governance.

In other words, it sits exactly where FM and security contracts live.

The Two Tiers Bid Teams Need To Understand

The Act uses a tiered approach.

For qualifying premises, standard tier generally covers sites where it is reasonable to expect 200 to 799 people, including staff, to be present at the same time from time to time. Enhanced tier generally covers qualifying premises where 800 or more people may be present.

Qualifying events use the higher 800-person threshold and have their own criteria.

Martyn’s Law standard and enhanced tier tender evidence map

Standard tier duties focus on public protection procedures. These are practical procedures for people working at the premises to follow when they suspect an attack is occurring or is about to occur.

Enhanced tier duties go further. They include public protection procedures, plus appropriate public protection measures. These measures are aimed at reducing vulnerability or reducing the risk of physical harm.

For tender writing, the tier language matters because it stops your response becoming either too thin or too heavy.

A standard tier site does not usually need a dramatic capital works pitch. The government’s factsheet says the standard tier is focused on simple and low-cost preparedness activities, and does not require physical alterations or buying equipment just to have procedures in place.

An enhanced tier site may need deeper assessment, documented measures, technology integration, exercises and senior ownership.

Your tender response should show that you understand the difference.

Do Not Sell Fear

This is the first rule.

Martyn’s Law is sensitive. It sits alongside real human loss, public safety and the day-to-day confidence people need when visiting a venue, college, hospital, office or public building.

A tender response that sounds alarmist will not help.

Avoid language like:

• we will make you Martyn’s Law compliant from day one
• we will eliminate the risk
• every site needs upgraded CCTV and searches
• our package covers all legal requirements
• failure to buy this solution exposes you to enforcement

None of that is the right tone.

A stronger response says: we will help you prepare proportionately, using official guidance, site-specific risk understanding and procedures your teams can actually operate.

That sounds less dramatic. It scores better because it is credible.

The Evidence Evaluators Will Look For

A buyer evaluating Martyn’s Law support will not only ask whether you understand the Act.

They will ask whether you can deliver the operational pieces around it.

That means your evidence should cover seven areas.

1. Site Assessment And Scope Mapping

Start with how you will understand the estate.

For FM contracts, this might include schools, depots, libraries, civic offices, leisure centres, healthcare buildings or multi-use campuses. For security contracts, it might include front-of-house posts, event cover, CCTV monitoring, access control and incident response.

Your response should explain how you will map:

• site use and public accessibility
• peak occupancy and reasonably expected attendance
• staff, visitors, contractors and service users
• entrances, exits and public congregation points
• existing access control and visitor management arrangements
• known events, out-of-hours use and seasonal peaks
• dependencies with landlords, tenants, event organisers or other contractors

Do not pretend this is a legal determination if it is not. You can support the buyer with evidence gathering and operational assessment, while the responsible person retains the duty.

That distinction builds trust.

2. Public Protection Procedures

Standard tier readiness lives or dies on procedures.

The key tender question is whether your teams know what to do, and whether the buyer believes those procedures will work under pressure.

Write about procedures in plain operational language. Cover:

• evacuation
• invacuation or lockdown
• communication with staff, visitors and control rooms
• alert escalation routes
• decision ownership during an incident
• handover to emergency services
• post-incident reporting and lessons learned

The best answers do not list procedures as if they are policy documents on a shelf.

They show how procedures are briefed, rehearsed, reviewed and embedded into daily service delivery.

For example, a front-of-house guard needs different instructions from a maintenance engineer, cleaner, mobile patrol officer or helpdesk operator. A college reception needs different arrangements from a town hall, leisure centre or multi-tenanted office.

Good bid writing makes that difference visible.

3. Training And Exercises

Training is where many weak responses become vague.

They say staff will be trained. They do not say what training covers, who receives it, how often it is refreshed, or how the buyer will know it happened.

A stronger answer sets out a role-based training model:

• induction briefing for all contract staff
• site-specific procedure briefings for regular staff
• enhanced briefings for supervisors, duty managers and control room teams
• scenario walk-throughs for high-footfall premises
• joint exercises with the buyer where appropriate
• refresher training after material site changes
• records held in the contract training matrix

Role-based Martyn’s Law training model for FM and security contracts

Do not make training sound like a one-hour tick-box module. Evaluators want confidence that people will remember what to do when it is stressful.

Use scenarios.

A useful tender example might be: during mobilisation, we run a tabletop exercise for the three highest-footfall sites, test the escalation route, capture actions, update the site procedure and add the agreed controls to the monthly governance pack.

That is practical. It feels deliverable.

4. Technology And Systems Integration

Martyn’s Law will often trigger conversations about technology.

Visitor management, access control, CCTV, emergency alerting, radio systems, mass notification, car park barriers and lockdown controls can all be relevant.

The mistake is jumping straight to products.

A better tender response starts with the operational requirement:

• Who needs to receive an alert?
• How quickly?
• Through which channel?
• What happens if a system fails?
• How does the procedure work out of hours?
• Who can trigger lockdown or invacuation?
• How does the site avoid confusing visitors?
• How are false alarms managed?
• What existing infrastructure can be reused?

Only then should you talk about systems.

This protects the buyer from overspecification. It also protects you from promising a shiny system that does not fit the site.

If you are bidding an FM contract, show how your planned preventive maintenance, helpdesk and asset data processes support security readiness. If a public address system, CCTV camera, access control panel or barrier is part of the procedure, the maintenance regime matters.

If you are bidding a security contract, show how officers use systems consistently, how incidents are logged and how control room decisions are documented.

5. Proportionality And Reasonably Practicable Measures

The phrase reasonably practicable is doing a lot of work.

It means buyers will care about proportionality. A small community venue, busy college campus and major event venue should not receive the same answer.

Your response should show how you balance:

• risk
• site size
• public accessibility
• occupancy
• operational disruption
• cost
• existing measures
• user experience
• staff capability
• lifecycle maintenance

This is where good suppliers stand out.

A poor supplier says: here is the package.

A good supplier says: here is the decision framework we use to recommend the right level of procedure, training, technology and governance for each site.

That gives evaluators confidence you will not waste money or leave gaps.

6. Governance And Continuous Review

Martyn’s Law readiness cannot sit outside contract management.

It needs a home in governance.

For a tender response, explain how readiness will be reviewed through:

• mobilisation risk registers
• site security reviews
• monthly contract meetings
• incident and near-miss reviews
• training compliance reports
• asset performance reports
• change control for site layouts or use changes
• annual procedure refreshes
• subcontractor briefings

Contract governance cycle for Martyn’s Law preparedness in FM and security services

Tie this to named roles.

Who owns the site action log? Who updates the procedure? Who reports training gaps? Who reviews changes to public access? Who talks to the buyer if a site moves from occasional high occupancy to regular high occupancy?

Specific role ownership beats broad assurances.

7. Evidence From Comparable Work

Finally, you need proof.

Because the Act is new, not every supplier will have direct Martyn’s Law delivery case studies. That is fine. Evaluators know the regime is emerging.

Use adjacent evidence:

• high-footfall venue security mobilisation
• public building access control projects
• incident response procedure development
• lockdown or invacuation planning in education settings
• event stewarding and control room operations
• CCTV or visitor management integration
• multi-site FM mobilisation with public access risk
• emergency planning exercises
• health and safety procedure implementation

The key is to explain the relevance.

Do not dump a generic case study into the appendix. Pull out what it proves: role-based training, stakeholder management, system integration, procedure testing, minimal disruption, measurable compliance or successful mobilisation.

A Tender Structure That Works

If the question asks how you will support Martyn’s Law readiness, use a structure that mirrors evaluator logic.

Try this:

1. Understanding of the requirement
2. Scope and tier assessment support
3. Site-specific procedure development
4. Role-based training and exercises
5. Proportionate measures and technology integration
6. Mobilisation and implementation plan
7. Governance, review and reporting
8. Evidence and named team experience

That order works because it starts with judgement before solution. It shows you will diagnose before prescribing.

For a shorter method statement, compress it into four headings:

• Assess
• Prepare
• Embed
• Review

Four-step tender response framework for Martyn’s Law readiness

Under each heading, include one or two proof points.

For example:

Assess: we complete a site readiness review covering public access, peak occupancy, current procedures, access control and communication routes.

Prepare: we draft or update public protection procedures, including evacuation, invacuation, communication and escalation.

Embed: we train contract staff by role, run scenario walk-throughs and capture attendance in the contract training matrix.

Review: we report actions through monthly governance, refresh procedures after site changes and review incidents or near misses.

That is concise, practical and easy to score.

How To Handle Mobilisation

Mobilisation is where Martyn’s Law support becomes real.

A good mobilisation plan should not promise to fix every site before contract start. That may be impossible, especially across a large estate.

Instead, prioritise.

In the first 30 days, focus on:

• confirming the buyer’s responsible person and decision route
• collecting existing procedures, site plans and incident logs
• identifying high-footfall and higher-risk sites
• reviewing visitor management and access arrangements
• checking communication channels and escalation routes
• briefing incoming contract staff on interim procedures
• agreeing the format for the readiness action log

In days 31 to 60, move into procedure updates, training, tabletop exercises and quick-win system changes.

In days 61 to 90, embed reporting into governance, complete priority actions and agree the longer-term improvement plan.

This kind of phased plan is much stronger than saying full compliance will be achieved during mobilisation.

It also aligns with how public buyers think. They know some estates are messy. They want a supplier who can create order without pretending the mess does not exist.

How To Answer The Technology Question Without Overpromising

Some Martyn’s Law tender questions will sit inside a wider security systems procurement.

Others will appear inside FM or manned guarding contracts where technology is only part of the service.

Either way, avoid the trap of treating technology as the whole answer.

A balanced response might say:

We will review existing systems before recommending new equipment. Where visitor management, access control, CCTV, emergency alerting or car park controls form part of the agreed procedure, we will assess whether current assets are functional, maintained, interoperable and understood by site teams. We will recommend upgrades only where they are proportionate to the site, the risk and the buyer’s operational requirement.

That gives you room to propose improvements without looking like you are using Martyn’s Law as a sales hook.

If you are bidding for an integrated security system, go deeper. Explain:

• discovery workshops with estates, safeguarding, security and IT
• integration with existing infrastructure
• user permissions and audit trails
• business continuity if systems are unavailable
• testing before handover
• staff training and quick-reference guidance
• maintenance, support and reporting
• data protection considerations where systems process personal data

The buyer wants confidence that the system will work in real life, not just look good on a diagram.

What To Avoid In Your Bid

Here are the mistakes that will cost marks.

Mistake 1: Treating Martyn’s Law As A Legal Essay

The buyer does not need four paragraphs on the history of the Act.

Give enough context to show understanding, then move quickly into what you will do.

Mistake 2: Saying Compliance Too Often

Unless the question specifically asks for legal compliance, use preparedness, readiness, procedures, measures and support.

Compliance can sound like you are taking over the buyer’s duty. That may not be true.

Mistake 3: Giving Every Site The Same Answer

Site-specificity matters.

A leisure centre, college campus, civic office and public event space have different public access patterns, staffing models and incident challenges.

Your tender should show how your approach flexes.

Mistake 4: Forgetting Subcontractors

FM contracts often rely on cleaning, maintenance, landscaping, security, fire systems, access control and specialist contractors.

If those people work on site, they need the right briefings and escalation routes.

Do not leave them out.

Mistake 5: Writing A Policy Without An Operating Model

A procedure is only useful if people can follow it.

Show who owns it, who trains it, who updates it and how it is tested.

The Bid Library You Should Build Now

If you bid for FM or security work, build a Martyn’s Law evidence folder before the next tender lands.

Include:

• a short internal briefing on the Act and tiers
• a standard site readiness checklist
• sample evacuation and invacuation procedure headings
• training matrix template
• mobilisation action log template
• sample governance dashboard
• anonymised examples from comparable sites
• security systems integration questions
• role profiles for contract manager, site supervisor and security lead
• approved wording on the responsible person and your support role

Keep it practical. The aim is not to create a monster policy pack. The aim is to give bid writers fast access to accurate, reusable evidence.

If your team uses a bid library, tag the content clearly. Martyn’s Law evidence will overlap with security, FM mobilisation, health and safety, business continuity, safeguarding, estates, risk management and technology integration.

That is exactly where content gets lost.

A clean library saves hours when the tender deadline is tight.

Where mytender.io Fits

This is the kind of topic where messy bid libraries cause real pain.

A Martyn’s Law question can pull from legal updates, site procedures, FM mobilisation plans, security case studies, training records, systems documentation and governance templates. If that evidence is scattered across SharePoint folders, old tenders and someone’s desktop, the bid team wastes time stitching together a half-answer.

A platform like mytender.io helps bid teams organise reusable evidence, draft from approved content and keep responses aligned to the actual tender question.

The point is not to automate judgement. You still need an expert to decide what is proportionate for the site.

The point is to stop starting from scratch every time a buyer asks for your preparedness model.

A Practical Scoring Checklist

Before you submit a Martyn’s Law response, test it against this checklist.

Can the evaluator see:

• which sites or service areas your approach applies to?
• how you will support tier and scope assessment?
• what public protection procedures you will help develop or operate?
• how training differs by role?
• how invacuation, evacuation and communication routes are handled?
• where technology helps, and where it is not needed?
• how you avoid overprescribing measures?
• how evidence is captured during mobilisation?
• how readiness is reviewed during the contract?
• what comparable experience proves your approach?
• who is accountable for each part of delivery?

If the answer is yes, the response is probably in good shape.

If the answer is no, it is likely still too generic.

Final Thought

Martyn’s Law will not reward suppliers who shout loudest about compliance.

It will reward suppliers who understand public premises, operational pressure and proportionate preparedness.

For FM and security bidders, that means writing with calm authority. Show the buyer that you can assess the site, brief the people, maintain the systems, record the evidence and review the plan as the contract changes.

That is what will make the response feel real.

If you want to see the kinds of FM and security opportunities where this evidence may matter, the Tender Finder is free to use and can help you spot relevant contracts earlier.