UK Event Security: Complete Emergency & Incident Response Guide

A comprehensive operational reference for event organisers, security teams, and venue managers operating under UK law

Introduction

Every event from a small community gathering to a major music festival carries inherent risk. In the UK, the legal and moral responsibility for managing that risk falls squarely on the shoulders of the event organiser. Getting it right means protecting lives, safeguarding your reputation, and staying on the right side of a demanding regulatory framework.

This event security emergency response guide has been written for event professionals operating in the UK. It brings together emergency response planning, incident management, risk management, crowd management, and legal compliance into a single, actionable reference. Whether you are planning your first public event or reviewing existing protocols for a large venue, this guide provides the essential building blocks for a robust safety strategy.

Linked throughout this guide are detailed supporting resources on first aid at events, how security teams handle incidents and conflicts, coordinating with police and emergency services, post-event security reporting, and the specific security role in handling medical emergencies. Together, these form a complete knowledge base for UK event security.

The UK Legal Framework for Event Security

Before a single ticket is sold, event security and health and safety compliance must be embedded into the planning process. The UK legal framework governing events is broad and cross-cutting. Failing to comply can result in prosecutions, civil liability, and, most critically, loss of life. A comprehensive ultimate event guide which covers all aspects of event planning, other than complete emergency protocols, is vital for full event compliance.

The primary legislation you must understand includes:

Martyn's Law

Represents the most significant change to event security law in a generation. It applies to both permanent venues such as stadiums, theatres, and shopping centres, and temporary events including Christmas markets, festivals, fairs, and marquee gatherings. It is structured into two tiers and is dependent on the number of expected attendees:

Standard Tier (200–799 Capacity)

Venues and events in the standard tier are required to register with the SIA and have in place appropriate public protection procedures practical plans covering how staff should respond if a terrorist attack occurs on-site or nearby. These procedures must address four key areas:

Four Key Areas of Procedure

The standard tier focus is on planning and training rather than expensive physical upgrades. The law does not require standard-tier premises to install new security equipment. Developing an emergency action plan, training staff, and conducting evacuation procedures drills are the primary compliance measures. This mirrors the approach already familiar to most organisations through fire safety regulations.

What compliance looks like

Emergency Action Plan: A documented plan for staff to follow in the event of an attack.

Staff Training: Training relevant staff on procedures and their individual responsibilities.

Evacuation Drills: Conducting regular practice drills to test and refine procedures.

Enhanced Tier (800+ Capacity)

Enhanced duty premises venues or events where 800 or more people are expected simultaneously face significantly more demanding obligations. In addition to all standard tier requirements, enhanced-tier venues must implement public protection measures: tangible security steps to reduce vulnerability to terrorist attacks and limit harm if one occurs.

Public Protection Measures

Enhanced-tier venues must also produce a written security plan or risk assessment documenting the procedures and measures in place, which must be submitted to the SIA. Additionally, any organisation (other than a sole trader) operating an enhanced duty premises must appoint a senior leadership representative a senior manager as the responsible person for Martyn's Law compliance. This individual ensures the business meets its obligations under the Act.

Additional Compliance Obligations

Written Security Plan: A documented risk assessment of all procedures and measures, submitted to the SIA.

Responsible Person: A named senior manager accountable for Martyn's Law compliance (not required for sole traders).

SIA Registration: All enhanced-tier premises must register with the Security Industry Authority.

Understanding Risk: From Assessment to Action

Sound event risk management begins long before the event opens its gates. A structured approach to identifying, evaluating, and mitigating risk is not just a legal requirement it is the foundation upon which all emergency procedures and security plans are built.

The Integrated Emergency Management (IEM) Framework

The UK uses the Integrated Emergency Management (IEM) framework for structuring emergency planning and response. IEM provides a consistent, six-phase methodology that can be applied to events of any size:

Identifying Key Risks

No two events present exactly the same key risks, but the most common threat categories that UK event organisers must address include:

Risk assessment is not a one-time exercise. Plans must be reviewed and adjusted dynamically as the event approaches, as intelligence changes, and in response to updated threat levels. Identified risks must always be formally documented, graded by likelihood and impact, and accompanied by proportionate control measures.

Building Your Emergency Plans

Well-constructed emergency plans are the operational heart of event security. They transform risk assessment findings into clear, actionable procedures that every member of your team can follow under pressure. Emergency plans must be proportionate to the risk presented by the event and reviewed with all relevant stakeholders well in advance.

What Emergency Plans Must Cover

Most event emergency plans should address the following core requirements:

Sharing Your Plans

Except for the smallest low-risk events, your emergency plans should be shared and discussed with:

• The police
• Fire and rescue service
• Ambulance service
• Emergency planning officials
• Venue management in the case of fixed venues such as stadiums and arenas

For large-scale events, the police may appoint a designated liaison months in advance to assist with intelligence sharing, route security, and contingency planning. Engaging with the local Safety Advisory Group (SAG) early in the planning process ensures that all relevant authorities are aligned and that any regional emergency plans are factored into your own.

The level of detail required in your plans, and the depth of your discussions with these bodies, should be proportionate to the scale and nature of the event. A small outdoor market will have different planning needs from a 10,000-capacity music festival. What matters is that both the event organiser and the emergency services are absolutely clear about who is responsible for what, and when the handover of authority takes place should the emergency services declare a major incident.

Emergency Procedures: Step by Step

Having emergency plans is one thing; ensuring your entire team knows how to execute them is another. Emergency procedures should be embedded into staff inductions, written into briefing packs, and regularly tested through drills and table-top exercises.

Core Emergency Procedures for Event Staff

All relevant staff members, regardless of their normal operational role, must understand and be capable of executing the following emergency procedures:

The UK 'Four C's' for Security Threats

When a security threat is identified such as a suspicious package or a potential terrorist threat UK security services, local authorities, and the NHS use the Four C's framework:

• Confirm: Verify the nature of the threat by assessing from a safe distance. Never touch or move a suspicious item.
• Clear: Evacuate or move people away from the affected area to a safe location without causing unnecessary panic.
• Communicate: Alert event control, security teams, and the police immediately. Use coded language over radio to avoid alarming the public.
• Control: Restrict access to the area and ensure that emergency services can operate effectively once they arrive on scene.

The Show Stop Procedure

In some situations, effective emergency response requires a rapid, controlled halt to a live performance. This show stop procedure, used when an incident occurs during a performance, involves:

• Clearly identifying the key individuals who can initiate the show stop procedure
• Establishing pre-agreed lines of communication with performers or participants
• Pre-agreed public announcement scripts, broadcast via PA systems or other communication channels
• Briefing performer management in advance on the show stop procedure so there is no confusion when it is invoked

Once the risk has been reduced to a tolerable level, the event organiser may consider restarting the performance but only after consultation with all key agencies on site, including emergency services, and once event staff and event security personnel have returned to their positions and all services are confirmed ready.

Evacuation Planning: Keeping Everyone Safe

Emergencies can escalate with alarming speed. The ability to move hundreds or thousands of people to safety quickly and calmly is one of the most critical capabilities an event team can develop. Effective evacuation procedures depend on meticulous planning, clear signage, trained staff, and well-maintained infrastructure.

Escape Routes and Exit Management

For exits, plan escape routes carefully and ensure they are maintained throughout the event. All escape routes must be:

• Clearly marked with appropriate signage, particularly for attendees unfamiliar with the venue layout
• Free from obstructions at all times any item blocking an escape route is an immediate safety risk
• Equipped with adequate lighting. Emergency lighting should comply with BS 5266-1 and use an independent power source in case the mains supply fails
• Opening outwards in the direction of escape. Doors and gates leading to final exits must never be locked when the event is in operation if security is a concern, they should be staffed rather than locked

Where temporary lighting such as floodlights or lighting towers is used, ensure it does not direct glare into evacuating attendees' faces. Festoon lighting along escape routes is a practical alternative that illuminates the path without causing visual impairment.

Vulnerable Attendees and Additional Assistance

Evacuation planning must always account for attendees who may require additional assistance:

• People with physical disabilities, including wheelchair users who require evacuation chairs
• Attendees with sensory impairments who may not receive standard audio or visual alerts
• People with learning difficulties who may become distressed or disorientated in an emergency
• Children, particularly those in designated play areas. Parents must receive clear instructions about how to reunite with their children during an evacuation, so they do not attempt to move against the direction of crowd flow to reach them

Managing Crowd Psychology During Evacuation

Panic is frequently more dangerous than the emergency that triggers it. When crowds panic, they tend to move toward familiar entrances rather than the nearest safe exit, creating dangerous bottlenecks. Trained security personnel and stewards play a pivotal role in managing crowd psychology during evacuations:

• Security personnel should direct attendees calmly and authoritatively to alternative exits
• The physical presence of trained staff provides a visual anchor of authority that can help de-escalate collective fear
• Clear, repeated public announcements via PA systems should provide simple, step-by-step instructions
• Communication systems including radios must be tested before the event and kept operational throughout

Medical Emergencies: Planning and Response

Handling medical emergencies at events requires advance planning, well-trained staff, coordinated first aid provision, and an established working relationship with the local NHS ambulance service. A failure in any one of these areas can turn a manageable incident into a tragedy.

Planning for Adequate Medical Assistance

HSE guidance strongly recommends that event organisers include members of the visiting public not just workers in their first aid and medical needs assessment. To ensure you have enough medical assistance on site, consider:

• The expected crowd size, demographic profile, and nature of the event activity
• The proximity of the venue to a hospital emergency department
• Whether the local capacity of the NHS ambulance service can support your event needs without creating risk to the wider community
• For events where ambulances are required on site, plans must be developed in conjunction with the local NHS ambulance service, clearly setting out how patients will be transported to hospital

Common Medical Emergencies at Events

Your medical team and security personnel should be prepared for the following medical incidents that commonly occur at public events:

First aid stations must be clearly marked and prominently signposted across the event site. The Events Industry Forum's Purple Guide provides detailed example medical assessments that can be used as a planning baseline.

The Role of Security Personnel in Emergency Response

Professional security personnel are not a peripheral element of event safety they are central to it. When an incident occurs, security guards are almost always the first people on scene, the first to assess the situation, and the first to begin the emergency response. They serve as the critical bridge between your emergency plans and their execution in the real world.

Situational Awareness and Early Detection

The most effective emergency response is one that prevents the emergency from occurring in the first place. Trained security personnel maintain a high level of situational awareness throughout an event, monitoring crowd density, identifying suspicious behaviour or unattended items, and spotting hazards such as blocked fire exits before the event begins. This proactive approach can often resolve potential threats before they require a full-scale emergency response.

Communication and Chain of Command

Event security operates within a strict hierarchy built around clear communication protocols. When an incident occurs, the security guard on the ground reports to their supervisor, who relays verified information to the command and control centre. This structured escalation process prevents misinformation from spreading, ensures that decision-makers have accurate data, and prevents multiple individuals from attempting to manage the same incident simultaneously.

Security teams use coded communications over radio to communicate specific threats without causing public alarm. Strict radio discipline keeps channels clear for critical information and prevents operational channels from being flooded with non-essential traffic.

Liaising with Emergency Services

Once the emergency services arrive on scene, control of the incident typically passes to them. However, they will depend heavily on the on-site security team for contextual intelligence the exact location of the incident, safe access routes for paramedics, the current state of the crowd, and the layout of the venue. Security personnel must be prepared to brief incoming responders quickly and accurately.

If the emergency services declare a major incident on site, all event personnel and resources will come under police command. In some scenarios, the police may take authority over one section of the event while leaving other areas under the event organiser's control this distinction must be understood and planned for in advance.

Counter-Terrorism at Events

The threat of terrorism at crowded places is a current and credible risk in the UK. Events represent attractive targets for those wishing to cause mass casualties or widespread disruption. Under Martyn's Law, counter-terrorism planning is now a legal requirement not an optional extra.

Protective Security Measures

Security measures for counter-terrorism at events should include:

• Hostile vehicle mitigation (HVM) measures such as physical barriers, bollards, or vehicle exclusion zones around pedestrian areas
• Structured access control points with screening capabilities
• CCTV and real-time monitoring for large venues
• Thorough pre-event venue checks and sweep procedures
• Staff trained to identify suspicious behaviour and unattended items

Run, Hide, Tell

The National Counter Terrorism Security Office (NaCTSO) advises the public to follow the Run, Hide, Tell protocol in the event of a terrorist attack in a crowded place:

1. Run Escape to a place of safety. This is far preferable to surrendering or remaining in place.
2. Hide If there is nowhere to run, hide. Turn phones to silent, disable vibrate, and barricade if possible.
3. Tell Contact the police by calling 999 when it is safe to do so.

All event staff should be trained in this response through ACT (Action Counters Terrorism) awareness training. They must also understand how to integrate with police during a live terrorist attack, including an awareness of police tactics and the limitations on available resources.

Incident Management Systems and Reporting

Incident management is the process of responding to, documenting, and learning from unplanned events or disruptions. At a large event, even seemingly minor incidents a slip, a dispute, a medical episode must be recorded accurately and in real time. The data generated through incident management is one of your most valuable operational and legal assets.

Why Documentation Matters

One of the most persistent misconceptions in the events industry is that documenting safety incidents increases an organisation's legal exposure. In reality, the opposite is true. In the event of litigation, well-documented incident records and response procedures provide a demonstrable record of reasonable, practicable safety management. Attorneys defending against liability claims will specifically seek this evidence. Inadequate or absent documentation leaves an organisation far more exposed.

Venues and event organisers relying on spreadsheets or paper radio logs alone risk gaps in their record. These systems cannot aggregate data across multiple events or venues, identify trends in incident occurrence, or provide the kind of structured audit trail that may be required in legal proceedings or regulatory inspections.

What a Modern Incident Management System Should Deliver

An effective incident management system for events should provide:

When reviewing whether your current system is fit for purpose, ask: Can we aggregate incident data across multiple events? Do we have a defensible record for legal purposes? Can our leadership team easily interrogate the data? If the answer to any of these is no, it is time to consider upgrading your incident management capabilities.

Training, Drills, and Continuous Improvement

An emergency plan stored in a binder is of little practical value. The test of any plan is how well it performs under pressure. This is why regular training, realistic drills, and a commitment to continuous improvement are the defining characteristics of truly resilient event security operations.

Pre-Event Briefings and Staff Preparation

Before every event, a comprehensive briefing must take place with all security personnel and event staff. This should cover:

• The specific emergency plans and procedures for this event and venue
• Individual roles and assigned zones every member of staff must know exactly where they are positioned and what their responsibilities are if an alarm is raised
• Communication protocols and radio codes
• The location of emergency equipment, first aid stations, and emergency exits
• Testing of all communication systems before the event opens to the public

Testing Your Emergency Scenarios

For events of significant scale or risk, validation through table-top exercises and live drills is essential. These activities should simulate realistic emergency scenarios, including:

• A blocked main exit requiring the use of alternative escape routes
• Failure of PA systems or radio communication
• A simultaneous medical and security incident
• A severe weather event requiring rapid evacuation of outdoor areas

The insights gained from these exercises should be used to update emergency plans, revise communication protocols, and improve staff training. This continuous improvement loop gathering feedback from deployed teams, reviewing incidents from past events, and incorporating the latest guidance from the HSE and Purple Guide, is what separates well-prepared events from those that are unprepared when the unexpected occurs.

After the Incident: Recovery and Learning

When an incident occurs and is resolved, the work does not stop. How an organisation responds in the aftermath of a safety incident is just as important as how it handled the incident itself. Returning to normal operations in a structured way, capturing accurate documentation, and building lessons learned into future events is what transforms each incident into an improvement opportunity.

Attendee safety does not end when the last person leaves the site. Data gathered through your incident management system across multiple events, and patterns revealed through that data, represent one of the most powerful tools available for improving event operations over time.