Premises expecting 200–799 people (standard tier) must notify the SIA and have procedures for evacuation, invacuation, lockdown and communication. Premises expecting 800 or more (enhanced tier) must also consider protective measures, appoint a designated senior individual and keep a compliance document. The official guidance is on GOV.UK and ProtectUK.
Staff alerting for premises preparing for Martyn's Law
Martyn's Law is expected to come into force in spring 2027. Premises where 800 or more people may be present will need procedures for evacuation, invacuation, lockdown and communication. Carrying out the communication procedure starts with reaching staff quickly and knowing who has been reached.
SIM alerts staff by SMS and email, shares live situational information and keeps a clear record of what was sent, to whom, and when.
The platform was developed with the Metropolitan Police and London local authorities to support communications during serious incidents involving multiple stakeholders and organisations.
What is happening, and when
- Autumn 2026 — the SIA, as regulator, is due to publish its final guidance for responsible persons.
- Spring 2027 (expected) — commencement. Responsible persons will have three months from that date to notify the SIA.
- 800 or more people — procedures for evacuation, invacuation, lockdown and communication, plus public protection measures, a designated senior individual and a compliance document for the SIA.
Where SIM fits
Martyn's Law does not require any product, and ProtectUK is clear that premises can meet the requirements without buying one. What it does require is a communication procedure that works under pressure. SIM is one way to run that procedure:
- Any approved member of staff can launch an alert from a phone
- Alert groups are set up in advance for each incident type
- Every alert is logged — useful for reviewing procedures and, for enhanced-tier premises, for the documentation the SIA may ask for
Incidents
- Suspicious activity or security threat
- Lockdown
- Evacuation or invacuation
- Incident at a large event, open day or graduation
- Incident across several buildings or a halls of residence
- Incident at a neighbouring premises
- Utility failure
If you are working out how your premises will handle the communication procedure, email Andrew directly.
No lengthy procurement process. No obligation. Just a conversation.
Who it's for
Premises in scope that already run a security or estates function: hospitals, universities, local authority venues, arenas and conference centres. Most single-site hospitality and retail premises will be able to meet the standard tier with existing procedures.
Any approved employee can launch an alert.
Alerted groups can be selected for incident types.
Developed with the Metropolitan Police and London local authorities to support communications during serious incidents involving multiple agencies.
Security staff, healthcare teams and emergency services were all part of that work — SIM was built for multi-organisation incident response from the ground up.
"With SIM, we know the right people — internally and externally — receive the incident information they need to act quickly and confidently."
Head of Security, private healthcare group.
FAQs
What does Martyn's Law actually require?
Are hospitals and universities in scope?
Yes. Hospitals are a listed use and most acute sites will be enhanced tier. Universities are treated like other premises — enhanced tier at 800 or more. Schools and FE colleges are always standard tier.
Commencement is expected in spring 2027. From that date, responsible persons will have three months to notify the SIA, and the procedures and measures for their tier must be in place. The SIA is due to publish its final guidance in autumn 2026.
Does using SIM make us compliant?
No product does. Compliance is about having reasonable procedures and being able to show them. SIM is a tool for running the communication procedure and evidencing it.
How long will it take to set up SIM at our site?
SIM is designed to be simple to use from day one. Most sites are set up and ready to go within 48 hours.
We offer a short briefing session for your team — usually held on Microsoft Teams — so everyone knows how to launch an alert when they need to. Beyond that, there's a dedicated help website, videos and a live chat service if anyone needs assistance.
We're also happy to work with you on any specific requirements.
How many people can use the system?
SIM works as well with small teams as very large ones.
An average team size of approximately 20, with stakeholders between 50 and 200, would be normal.
What are the technical requirements?
SIM products are browser-based web apps and so will operate on any device - laptop, tablet or phone.
All SIM products are GDPR compliant.
CSA STAR certification: Level 4: CSA C-STAR Assessment
Security governance standards: CSA CCM version 3.0
Configuration and change management standard: Conforms to a recognised standard, for example, CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or SSAE-16 / ISAE 3402
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)
