Guidance

Advice for security managers during a heightened threat level

Updated 15 September 2017

This guidance was withdrawn on 30 May 2022

For the latest, up to date versions of NaCTSO guidance, please visit www.protectuk.police.uk. This NaCTSO page is no longer updated.

1. Introduction

The aim of this advice is to provide advice to security managers of crowded places following a change of the threat level to CRITICAL. There are a number of operational and tactical options you may wish to consider.

Terrorism threat levels are designed to give a broad indication of the likelihood of a terrorist attack. They are based on the assessment of a range of factors including current intelligence, recent events and what is known about terrorist intentions and capabilities.

Information about the national threat level is available on the MI5 – Security Service website.

2. Threat Level Definitions

There are five levels of threat which are defined below:

• CRITICAL - An attack is highly likely in the near future
• SEVERE - An attack is highly likely
• SUBSTANTIAL - An attack is likely
• MODERATE - An attack is possible but not likely
• LOW - An attack is highly unlikely

Should there be a change in the threat level, it is recommended those responsible for security, review their plans and operations. They may also wish to consider the options outlined below.

3. Building Response Levels

Building Response Levels provide a general indication of the protective security measures that could be considered and applied to a site or building. They are informed by the UK threat level, but also take into account specific assessments of vulnerability and risk. In the event of an incident or change to the UK Threat Level, individual sites / buildings should conduct their own dynamic risk assessments and apply appropriate protective security measures.

There are three levels of response EXCEPTIONAL, HEIGHTENED and NORMAL.

Response levels equate to threat levels and tend to relate to sites, whereas threat levels usually relate to broad areas of activity. There are a variety of site specific security measures that can be applied within each response level, although the same measures will not be found at every location. The security measures deployed at different response levels should not be made public, to avoid informing terrorists about what we know and what we are doing about it.

The security measures deployed by a site / building at the different response levels should not be made public. This is to avoid equipping terrorists should they be conducting hostile reconnaissance.

Threat level and definition	Response level	Description
Critical. An attack is highly likely in the near future	Exceptional	Maximum protective security. Critical measures to meet specific threats and to minimise vulnerability and risk
Severe. An attack is highly likely	Heightened	Additional and sustainable Substantial and Severe protective security measures reflecting the broad nature of the threat combined with specific business and geographical vulnerabilities and judgements on acceptable risk
Substantial. An attack is likely	Heightened	Additional and sustainable Substantial and Severe protective security measures reflecting the broad nature of the threat combined with specific business and geographical vulnerabilities and judgements on acceptable risk
Moderate. An attack is possible but not likely	Normal	Routine protective security. Low and Moderate measures appropriate to the business concerned
Low. An attack is unlikely	Normal	Routine protective security. Low and Moderate measures appropriate to the business concerned

4. Additional Information

There are practical actions you can take to improve the security of your venue:

4.1 Risk Assessment

• Carry out a risk assessment that is specific to your venue.

4.2 Building Response Level

• Regularly review the response level for your site or venue at security meetings
• Clearly display signage informing staff of the building response level. This should not be displayed in public areas or be within their view.

5. Security Guard Force: Posture and Activity

• Proactive engagement and staff briefings. One of the most effective measures to deter terrorists and wider criminality is a competent security guard force who appear vigilant and proactively engaged with the public. Terrorists and criminals generally feel uncomfortable and exposed when approached by a security officer, albeit politely, particularly if they are conducting hostile reconnaissance. This intervention casts doubt about the success of their attack planning. Staff briefings will enable your security officers to understand the importance of proactive engagement and they should be encouraged to do this where practical and reasonable to do so. For example, should your guard force use a vehicle, and patrol areas such as car parks, encourage them to park and leave their vehicle for short periods in order to engage with people. This may be as simple as saying “good morning”.

• Unpredictable security measures. Unpredictability results in the uncertainty and erosion of confidence in the mind of the terrorist, who needs to encounter predictable security arrangements in order to feel assured of success. Wherever possible, introduce unpredictability into your security regime; e.g. patrol patterns, timings and search regimes applied.

• ‘Recruit’ staff to be vigilant and immediately report suspicious activity and items

Use existing staff communication channels such as shift briefings and the intranet etc. to inform your staff as to what suspicious activity may look like. Encourage them to trust their instincts and report anything suspicious immediately to the security control room/police. In these communications, reinforce the message that reports will be taken seriously and be investigated. Where possible, highlight examples where previous staff reporting has led to positive outcomes; this helps promote confidence.

The protective security measures implemented at each building response level are a matter for each individual premises or organisation and will differ according to a range their own, bespoke circumstances. It’s advised a menu of options be identified in advance of any change in national threat level / building response level and should be clearly notified to those staff who are responsible for ensuring compliance. It is important to train staff and to conduct rehearsal exercises for each building response level.

The checklists below provide a number of protective security options you may wish to consider.

5.1 For further information visit:

• NaCTSO
• CPNI
• Cabinet Office
• Emergencies: preparation, response and recovery
• Emergency Planning

6. Security Checklist

6.1 INITIAL ACTIONS

1. Review your security plans
2. Identify your risks based on the current UK threat level
3. Review your Business Continuity Plans
4. Decide what you need to protect, identifying critical operations and functions
5. Increase staff vigilance – through appropriate briefing mechanisms
6. Review Evacuation, Invacuation and Lockdown procedures. Ensure you have plans for vulnerable staff and visitors. Have you designated marshals to support this activity?
7. Identify ‘protected spaces’
8. Review your Emergency Assembly Point

6.2 PREPAREDNESS

1. Ensure First Aid Kits are fully stocked and staff know where they are kept
2. Ensure Crisis Incident Kits (grab bags) are available and up to date

6.3 COMMUNICATION

1. Brief staff – ensure they understand their roles and responsibilities
2. Engage with neighbours, partners and suppliers
3. Ensure you are able to alert staff and visitors of any imminent or immediate threat or incident
4. Provide prior notification to staff and visitors of enhanced security measures, encouraging them to arrive in plenty of time and encourage them to bring minimal possessions
5. Monitor news and media channels
6. Develop pre-scripted messaging and alerts and determine how these will be communicated to staff and visitors

6.4 PERSONNEL

1. Maintain an up to date list of personnel (Do HR update leavers and joiners?)
2. Consider your staffing requirements. In some instances, this may for example include the requirement to alter or extend staff shifts, or the cancelling of leave
3. Consider cancelling non-urgent business or visitors where appropriate to your venue
4. Identify whether you have sufficient staff for critical roles such as your control room
5. Review requirements for Personal Protective Equipment (PPE) for security staff

6.5 TRAINING

1. Ensure all staff understand how to respond to a terrorist incident. see ETHANE
2. Are staff first aid trained?
3. Review and deliver training to your staff and conduct rehearsal exercises

6.6 STAFF VIGILANCE

1. Do ALL staff understand how to respond effectively to reports of suspicious activity and items when reported by the public? Are they clear who they should report to internally and when to report to police using 999? Do staff understand the HOT principles?
2. Disrupting hostile reconnaissance: Ensure staff understand how to identify suspicious behaviour (Do you have a challenge culture? – see CPNI website)
3. Ensure all staff and visitors wear passes
4. Where entry is restricted, check the visitor’s identification prior to permitting access to the site

6.7 PHYSICAL SECURITY

1. Enhance your security presence where appropriate. Consider staff patrolling in high visibility clothing
2. Ensure CCTV is working effectively and that it is suitably monitored
3. Review your site’s access control measures. Where appropriate close any unnecessary entrances to prevent unauthorised access
4. Ensure infrastructure, such as signage, lighting, floor level signs, stairs etc. are clearly marked and labelled.
5. Prepare floor plans
6. Establish if your control room is capable of being operationally effective against different attack types and can be secured and protected
7. Check critical systems and equipment such as PA systems
8. Ensure control rooms have alternative means of communication such as mobile phones with spare batteries, chargers etc.
9. Consider the protection requirements for any queues of people created by additional search measures (CCTV, position of the queue etc.)

6.8 SEARCH AND SCREENING

1. Business as usual search and screening (looking for prohibited items) should, when done well, provide a good capability to detect larger threat items concealed about the person
2. You will have a finite amount of security and screening resources; focus on addressing your highest priority threats
3. Be clear about what the search process is aiming to detect and where you will conduct the process
4. Define a list of prohibited items. Communicate this both to customers and personnel conducting the search
5. Ensure you provide advanced notification (at point of sale or media) of your site’s extra security measures and encourage people to arrive early. This will smooth peaks and allow safe and effective searching
6. Provide effective public address messaging to people as they approach, asking people to prepare for additional search and screening. This will help to reduce delays
7. Consider initial search and screening on the approach to, or outside the venue; e.g. a visual check inside jackets and bags
8. Conduct search and screening measures efficiently, effectively and politely. Aim to maximise screening throughput (to minimise queues that may be targeted), without compromise to your required level of security.
9. Bags and other items should be searched to the extent required to provide confidence that no items of concern are present. Manual bag searches should be proportionate, systematic, consistent and safe for the person conducting the search.
10. Manual person searches should be considered to the extent required to provide confidence that no larger threat items are present. Consider the privacy needs of the individual
11. Ensure your site or venue is searched on a regular basis, but not at predictable times or in a predictable way
12. Ensure you maintain your search regime for the lifecycle of the event including prior to its commencement, during and post event
13. Determine whether you allow vehicles into your venue and if you intend to search them
14. Train search staff to search safely and effectively
15. Ensure all staff are aware of the response when they locate threat items
16. There are a number of other tactical options available for search and screening. Specialist advice should be sought from the CPNI website, or your local Counter Terrorism Security Advisor.

6.9 SECURITY PERSONNEL

Depending upon their responsibilities, an effective guard force must be able to demonstrate they can respond competently to a number of scenarios including:

1. Responding effectively to reports of suspicious activity and items when reported by the public. Knowing who they should report to internally and when to report to police using 999, 101 or the Anti-Terrorist Hotline 0800 789 321
2. As an initial responder to a terrorist incident. See the ETHANE checklist
3. The maintaining of an effective search and patrol regime for the lifecycle of an event, including prior, to during and post event. Consider a patrol sweep of the public areas before, during and after an event for suspicious items and behaviours. Patrol areas may include areas close to the site, pick up zones and transport hubs. Ensure they are able to communicate effectively with their control room.
4. Responding to the different activities required should there be an increase to the UK threat level / Building Response Level.
5. Patrolling effectively to disrupt hostile reconnaissance activity, identifying and responding to suspicious behaviour
6. Responding effectively to suspect items, including knowledge of the ‘four Cs’ protocols and the HOT principles
7. Chemical, biological and radiological incidents, how to recognise and respond using Remove, Remove, Remove
8. Responding to firearms and weapons attacks and the importance of Run, Hide, Tell principles
9. Understanding evacuation, invacuation and lockdown procedures
10. Searching a site effectively
11. Applying the basic principles of good housekeeping and how it reduces the opportunities for an attack
12. Responding appropriately to a bomb threat
13. Using emergency first aid equipment such as defibrillators etc.
14. Using of incident logs and checklists, thus facilitating an effective response to incidents such as terrorist incidents and bomb threats etc.

6.10 GOOD HOUSEKEEPING

1. Where your risk assessment determines it is necessary, examine opportunities to reduce reasons for crowds to develop, such as reducing, removing or relocating activities that are attractive, such as street entertainers, mobile food outlets etc. Consider increasing patrols in these areas. Consider carefully where these activities take place and your security posture around it.
2. Have you reviewed the use and location of all waste receptacles in and around your venue or event, taking into consideration their size, proximity to glazing and building support structures? Consider repositioning and securing within areas which are not crowded
3. Are the bins emptied regularly?
4. Are external areas, entrances, exits, stairs, reception areas and toilets kept clean, tidy and well lit? Where possible reduce areas where items can be concealed
5. Do you keep furniture to a minimum to provide little opportunity to hide devices, including under chairs and sofas?
6. Do you use seals/locks to secure maintenance hatches, compactors and industrial waste bins when not required for immediate use?
7. Consider arranging vehicle deliveries for times where the fewest number of people are on site. Consider adopting time windows where no deliveries will be accepted.
8. Do you screen all your mail and can you isolate your mail processing area?
9. Have you tested and exercised for a terrorist incident within the last 12 months? Do staff understand their roles and responsibilities?
10. Are relevant staff and deputies trained and competent in managing bomb threats?
11. Do you regularly check the content of first aid kits, crisis management packs and firefighting equipment?
12. Have you checked your CCTV to ensure it is working effectively and has sufficient coverage both internally and externally?
13. Have you taken into account the location of street vendors (e.g. flower sellers, news-stands and refreshment stalls) so as not to impact upon evacuation routes, assembly points, exits or entrances?
14. Are cycle racks and lockers positioned away from crowded areas? Is CCTV monitoring necessary?