Write each venue's document on the SIA's own form, with what whoot. records already filled in, save versions that never change, and download the Word file to keep or to submit.
What the Document Is
The Terrorism (Protection of Premises) Act 2025, known as Martyn's Law, asks the people responsible for premises to have public protection procedures in place: evacuation, invacuation, lockdown and communication. Larger premises and qualifying events must also put measures in place and set both out in a document for the Security Industry Authority (SIA), the regulator. Each venue in whoot. has a Martyn's Law document, written on the SIA's form for the venue's tier. Everything whoot. records about the venue is filled in for you, and every box that calls for your own judgement is left for you to write.
Writing, saving and downloading the document needs security_ops.manage. The document supports the work the Act asks of you; it is not legal advice, and whoot. never writes your reasoning for you. In the SIA's own words: "Completing and submitting this template for documenting compliance purposes does not of itself constitute compliance with the full requirements of the Act."
Which Form Your Venue Follows
The tier comes from what the venue is mainly used for and how many people may reasonably be expected to be there at the same time. Both are asked in the first stage of the public protection wizard, under Security Ops → Public Protection Procedures → Your plan, and each venue's tier is shown under Venues. Until a venue's use is recorded, whoot. reads the number recorded under About this venue, or the answers given when the response pack was added.
Standard tier: 200 to 799 people — The document follows the SIA's planning tool for standard tier premises: a description of the premises, then each of the four procedures with what is in place and your reasoning, then training, working with others and review. There is no duty to send it to the SIA. The SIA can ask for information or inspect, and the planning tool is how you can show your procedures when it does.
Enhanced tier: 800 or more, and qualifying events — The document follows the SIA's template for enhanced tier premises and qualifying events. It adds the public protection measures (monitoring, movement, physical safety and the security of information), an assessment for each procedure and measure, how they work together, and the completion and adviser details. This document has to go to the SIA.
Always standard tier — Schedule 1 to the Act keeps premises whose principal use is a school, further education, childcare or worship in the standard tier however many people are present. Universities are not covered by that rule. A college with both further and higher education is asked which is its principal use, and that decides.
Your choice of tier — A venue can follow a different tier from the Act's reading, with a reason, from its page under Venues. The document then follows the form for the tier chosen, and says that it was chosen and why. Choosing the standard tier for a venue the Act reads as enhanced changes what whoot. asks of you, not what the Act asks.
Not known yet — A venue whose use and numbers are not recorded follows the planning tool, and the document says how to record them.
If a venue changes tier, its document changes form, and nothing you have written is lost. Answers to boxes the new form shares with the old one stay in place. Answers to boxes only the enhanced template has are kept and listed at the end of the editor, and come back if the venue moves up again.
Before You Start
The more whoot. records about a venue, the more of the document is already written. Four things make the most difference:
About this venue — On the venue's page under Security Ops → Public Protection Procedures → Venues: how many people can be there, what the venue is used for, when it is open, how crowds form, how it is staffed, and what you treat as its immediate vicinity. These fill the description of the premises.
Published procedures — Only a published version counts as a written procedure. A procedure written for this venue is used ahead of one written for the whole workspace.
Briefings and drills — Who confirmed they had read each procedure, and how quickly people acknowledged a practice alert, are listed beside the boxes where you may want to cite them.
Places on the venue map — Entrances, exits, CCTV, barriers and safe rooms marked on the venue map are listed where the form asks about layout and measures.
Opening and Writing It
Open Security Ops → Public Protection Procedures → Venues, choose the venue and press Martyn's Law document. The editor lays the form out part by part, with a contents list on the left showing how many boxes in each section are answered; a count in amber means a box the SIA says you must complete is still empty. Each box has the SIA's question and prompts on the left and your answer on the right.
What is in place — These boxes show what whoot. records on a shaded background, headed with the date the facts were read: the procedure's published version, each role's action card, the scenarios that send it and who they reach, briefings, drills and after-action reviews. Below that is a list of what the form asks for that whoot. does not record. Add anything else in the box beside it.
Assessment and reasoning — These boxes are only ever yours: how a procedure or measure reduces the risk of harm, and why it is appropriate and reasonably practicable for your premises, including what you considered and decided against. The records you may want to cite, such as drill timings and acknowledgement rates, are listed beside the box with where to find them in the venue's evidence pack.
Everything you type is saved as you type it, and the header says when it last saved. If someone else changes the same box while you are writing in it, the box shows both texts and you choose Keep mine or Use theirs; neither is overwritten without you seeing it. Changes they make to other boxes are kept alongside yours.
The SIA asks that answers be "specific to your premises or qualifying event". Where a procedure's wording is still exactly as it came from the response library, the document says so, as a prompt to check it against your exits, your people and your layout.
Completion, Adviser and Review
Near the end of the form, the enhanced template asks who completed the document and their role, and the name, role and organisation of any security consultant or adviser who helped. Each of the SIA's forms asks for the date of your next scheduled review. The date of completion is the date you save a version, and the version number is given when you save it.
Versions
Save as version freezes the document as it stands: your answers, the details, and the facts whoot. holds at that moment. A saved version never changes afterwards, however your procedures, roles or venue change, so it always shows exactly what you wrote and what it was written beside. Add a note to say what changed, such as annual review or new lockdown procedure. The working copy carries on, and you can save another version whenever you need one. Compare versions, above the list, shows what changed between two versions, or since one was saved: your answers with the words added and removed, the completion and review details, and the facts whoot. records beside each box. It starts from the last version given to the SIA, because a revised copy goes to the SIA within 30 days of a revision.
Downloading
Download (.docx) — The working copy as a Word file, with today's facts and your answers so far. It keeps the lists of what whoot. could not fill in and the records worth citing, to help whoever is writing.
A saved version — From the Versions list. The file is written from the version exactly as it was saved, drops the writing aids, and fills in the completion and review tables. This is the copy to keep, to give the SIA, or to show an inspector.
The file is laid out like the SIA's own form, in plain black on white, and opens in Word, Google Docs and LibreOffice. Shaded passages are what whoot. filled in; everything else is yours.
Submitting to the SIA
whoot. does not submit anything to the SIA. The SIA says it "will tell you how to do this on our GOV.UK pages when the Act comes into effect". When you have submitted an enhanced-tier version, open the Versions list, choose the send icon beside it and record the date, which cannot be before the version was saved or after today. You can correct or clear the record later.
Enhanced tier — The SIA's template says: "You must submit a revised copy to the SIA within 30 days if you make any changes." Save a new version when the document changes, and submit it.
Standard tier — The planning tool says: "If your premises are in the standard tier, there is no legal requirement to: prepare a document to send to us; send us details of your public protection procedures when you notify us that your premises are in scope." It also says you may use it "should we ask you to send information to us or if we decide to inspect your premises". Keeping your procedures under review is, in the SIA's words, "recommended and good practice", including after a security incident.
Keeping It Secure
The SIA's form carries the line "This template will contain sensitive information once completed. You should store it securely and restrict access to authorised users only." The document gathers your layout, staffing and your own view of where the venue is weak, so whoot. treats it accordingly:
Who can open it — Only people with security_ops.manage. Security Operations viewers cannot.
What is recorded — Opening the document, saving a version, recording a submission and every download are written to the audit log. The text of your answers never is.
What reads it — Nothing else. No AI feature, search, report or data export reads the document.
What it never contains — Duress phrases, watchdog patterns, phone numbers, or the names of the people in each role, which appear only as counts.
Downloaded files are outside whoot.'s control. Keep the Word file somewhere only the people who need it can open, and mark printed copies as sensitive.
A Worked Example
Record the venue. The safety officer at Riverside Leisure records Riverside Stadium as 800 or more people, with 18,000 on match days, under About this venue. The document follows the enhanced-tier template.
Read what is filled in. The evacuation section already shows version 2 of the published procedure, the stewards' and the public's cards, the scenario that sends it to the app and by text, the briefing nine of twelve stewards confirmed, and the October drill.
Write the judgement. Beside the assessment box, the drill's acknowledgement rate and timing are listed with their place in the evidence pack. The safety officer writes how clearing each stand away from the danger reduces harm, and why the procedure is reasonably practicable for a ground of this size.
Work together. The head of security writes the monitoring and movement sections at the same time. When they both edit the vicinity note, each sees the other's text and they keep one.
Save and submit. With the completion details filled in, they save version 1, download it and submit it. They record the submission date against version 1.
Keep it current. In March a new lockdown procedure is published. They update the lockdown section, save version 2 with the note new lockdown procedure, and submit it within 30 days.