The first ten minutes
The first ten minutes of an attack, and why a plan matters
If an attack happens at or near a venue, the people already there will act long before the emergency services can. This page looks at what those first minutes can look like with no plan and with one, and what Martyn's Law asks you to decide in advance.
Why Martyn's Law focuses on the first minutes
The Terrorism (Protection of Premises) Act 2025 is not about stopping attacks. Its objective is to reduce the risk of physical harm to people if an attack happens on the premises or in the immediate vicinity. In practice, that means the time between something going wrong and the emergency services arriving and taking control.
During those minutes, what happens depends on the people on site: staff, volunteers, stewards and managers. If they have already agreed what to do, they can act at once. If they have not, they have to work it out under pressure, often with incomplete information.
The phrase "the first ten minutes" is not in the law. It is a way of describing that period. The real length will vary, and the procedures you put in place need to work whether it is three minutes or thirty.
What the first ten minutes can look like, with and without a plan
The timeline below is an illustration, not an account of any real incident. It shows a busy venue, such as a pub on a Friday evening or a hall during a function, and how the same moments unfold differently when staff have agreed a plan.
0:00
The first sign that something is wrong
A loud bang outside, shouting at the door, or someone running in.
No plan
People look at each other. Staff look to the manager, and the manager is not sure what to do first.
With a plan
The nearest member of staff gives the instruction they were briefed on. Nobody waits to be asked.
0:30
Choosing evacuation, invacuation or lockdown
No plan
Some people head for the main door, towards the noise. Others stay where they are.
With a plan
Staff say "Leave now by the nearest exit" and guide people away from the danger through exits they already know.
2:00
Moving people to safety
No plan
People bunch at one door. Someone goes back for a coat. A child is separated from a parent in the car park.
With a plan
Exits are held open, people are kept moving past the car park, and a member of staff stays with a guest who uses a wheelchair.
5:00
Calling 999
No plan
Several people call 999 with different accounts. Nobody knows how many people were inside or where they are now.
With a plan
The Incident Lead has called using the script: where, what, how many. A deputy is at the main entrance to meet the police.
10:00
Handing over to the emergency services
No plan
The police spend their first minutes finding out who is in charge and where people are.
With a plan
The police are met, told what happened and shown where people are. Staff have done what the plan says, and the police take over.
What makes the difference
The difference in the timeline does not come from equipment or security staff. It comes from a handful of decisions made calmly, in advance, and shared with the people who will be on site.
- Who takes charge. The most senior person present is the Incident Lead until the emergency services arrive, and everyone knows that.
- Which option to use. Get out if the danger is inside, get in if it is outside, lock down if an attacker is inside and you cannot get people out safely.
- Where people go. Exits, assembly points, safe areas and lockable rooms are named and known.
- What to say. Short, agreed words for each option, so instructions are clear and consistent.
- How to call 999. One person calls with the key facts. If you cannot speak, stay on the line and press 55 when prompted.
- Permission to act. Staff know they are supported if they act in good faith, including ordering an evacuation that turns out not to be needed.
If an attacker does get in, the police advice is Run, Hide, Tell: run if you can, hide if you cannot, and tell the police when it is safe to do so.
What Martyn's Law asks of standard tier venues
At standard tier, the responsible person must notify the Security Industry Authority and have appropriate public protection procedures in place, so far as reasonably practicable. The Act sets out four kinds: evacuation, invacuation, lockdown and communication. Staff should know the procedures and how to carry them out. The law does not require a written document at standard tier, but the statutory guidance says documenting even simple procedures is good practice.
The Act is expected to come into force in spring 2027, with the date to be confirmed. Read Martyn's Law explained for who it covers, or use the free checker to see whether it applies to your venue.
Turning this into procedures for your venue
Each moment in the timeline corresponds to a document in the pack. The decision at thirty seconds is covered by the evacuation, invacuation and lockdown procedures. The words staff use and the 999 call are in the communication procedure. The staff briefing sheet and wall poster make sure people remember them.
Whether you use the pack or write your own, the important step is the same: agree the decisions now, tell your people, and review them each year.
Does Martyn's Law apply to your venue?
Six questions. Free. No account needed.