School emergency planning made straightforward

Almost all schools and further education colleges fall under the Standard Tier, even if more than 800 people are on site. The government has confirmed that education settings below higher education level are covered by proportionate, procedural requirements only. The focus is on having clear plans and procedures - such as lockdown, evacuation and communication arrangements - rather than introducing new physical security measures. The Enhanced Tier applies where 800 or more members of the public could reasonably be expected at one time, such as large public events or higher education institutions that meet that threshold. If a school or college hosts a large public event organised by a third party, responsibility would generally be shared: the event organiser must meet Enhanced Tier requirements for the event, while the school or trust must cooperate and ensure the site’s security arrangements are appropriate. In short, everyday school and further education operations remain Standard Tier, while higher education settings and large public events may fall under the Enhanced Tier.

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, but its requirements are not yet in force. The government has confirmed an implementation period of at least 24 months, meaning organisations will not be expected to meet their obligations under the Act until 3 April 2027 at the earliest.

The Home Office published its Section 27 statutory guidance on 15 April 2026 – the detailed framework that sets out what those responsible for qualifying premises need to do. Alongside it, the Security Industry Authority (SIA) has opened a public consultation on its draft section 12 guidance, which explains how it intends to regulate and enforce. That consultation closes on 12 June 2026.

The requirements are not yet in force, but the guidance is published, the regulator is preparing, and the direction is clear. Schools that start now will be refining and strengthening their procedures rather than building from scratch when the legislation takes effect.

No. Here's why starting now makes sense:

The threat exists today. Counter Terrorism Policing have stopped real plots against UK schools. Waiting for a legal deadline doesn't protect the pupils and staff in your care right now. Early adopters refine, late movers rush. Schools that start now have time to build procedures, run drills, identify what works and what doesn't, and embed preparedness into school culture. Schools that wait until early 2027 will be creating procedures under pressure, with no time to test them properly. The guidance is published. The Section 27 statutory guidance landed on 15 April 2026. It confirms the requirements: site-specific procedures for evacuation, invacuation, lockdown and communications. Schools no longer need to guess what will be expected. The standard is set. It takes about a day to set up, then runs itself. This isn't a massive project. You can have comprehensive procedures in place within a week, then CTprepare maintains them year-round with drill logging and automatic reminders. Parents and governors expect it now. Try explaining to a parent or governor: "We know the threat exists and we know what we should do, but we're waiting until the law forces us to act." That's not a defensible position for any school leader. The SIA will enforce compliance from 2027, but your duty of care exists right now.

The Section 27 statutory guidance was published on 15 April 2026. It sets out what those responsible for qualifying premises – including schools and colleges – need to do to meet their obligations under the Terrorism (Protection of Premises) Act 2025. It carries real weight: if an organisation's approach is ever questioned, demonstrating that it acted in accordance with this guidance is a key way of evidencing compliance.

The guidance confirms that schools are standard tier only, regardless of size. The requirements centre on four public protection procedures: evacuation, invacuation, lockdown and communications. Each must be appropriate to the specific premises and reasonably practicable – meaning proportionate to the site, its staff and its resources. The guidance defines "staff" broadly: employees, contractors, volunteers and anyone else working on site.

CTprepare is built around the same best practice that informed this guidance – including ProtectUK, NaCTSO resources and the DfE's Protective Security and Preparedness for Education Settings. The published guidance confirms the approach we've taken.

CTprepare doesn't have an import function - and that's deliberate. Here's why:

The real value of CTprepare isn't about converting existing documents into a different format. It's the guided questioning process that makes you think about your site-specific vulnerabilities, staff capabilities and realistic response scenarios.

Many schools tell us their existing plans are generic templates that haven't been properly adapted to their context. Or they're comprehensive but buried in Word documents that nobody can find under pressure, with no system for logging drills or tracking updates.

CTprepare's structured questions help you build genuine understanding - not just documentation. You might already have some good thinking in your existing plans and you can absolutely reference those as you work through the platform. But the guided process ensures you've covered everything properly.

The result is tailored procedures that reflect your actual site, staff and pupils - not just repurposed generic templates - plus the year-round drill logging and evidence management that existing Word documents can't provide.

Most schools complete this process in about a day spread over several days, working in their own time.

Having emergency procedures and having procedures that actually work under pressure are very different things. CTprepare guides you through a structured process that builds a security mindset across your school — helping you think through threats, vulnerabilities and responses specific to your site, staff and pupils. The result is detailed, tested plans covering lockdown, invacuation, evacuation and communication, with role-specific staff guidance, documented drills and evidence ready for governors and regulators. All aligned with current best practice from Counter Terrorism Policing, the DfE's School Estate Management Standards and Martyn's Law obligations as these become clearer.

The government is clear: you can meet Martyn's Law obligations without buying a product. Schools that have the time, security expertise and internal capacity can absolutely build their own emergency procedures using DfE guidance and Counter Terrorism Policing resources. The challenge isn't just creating initial procedures - it's doing it properly, then maintaining them. That means: - Working through site-specific vulnerabilities and threat scenarios - Building lockdown, invacuation, evacuation and communication plans that reflect your actual site, not generic templates - Creating role-specific guidance for teachers, support staff and site teams - Developing training materials and drill protocols - Setting up systems to log and track drills - Maintaining annual review schedules - Keeping procedures updated as Section 27 and DfE guidance evolves - Having audit-ready evidence available for governors and SIA inspection Done properly, this is weeks of work initially, plus ongoing administrative overhead every term. Most school leaders don't have that time - or the security expertise to know they're asking themselves the right questions. CTprepare compresses this into about a day of guided, structured thinking for initial setup, then maintains everything year-round - drill logs, training records, review prompts, guidance updates - in one secure platform. The guided questionnaires aren't just forms - they're the questions a security expert would ask you, helping you build a genuine understanding of your vulnerabilities and appropriate responses. You're not paying for a day's work. You're paying for security expertise embedded into a year-round preparedness management system, with ongoing support as requirements become clearer. The real question isn't "Should we pay for this?" It's "What's our time worth - and what's the cost of getting this wrong?"

DfE guidance recommends an annual review, and CTprepare sends reminders so you never miss it. You can also log drills and lessons learned directly into the system.

No. The platform is simple and step-by-step. It also generates crib sheets that help staff know exactly what to do in a real incident.

Yes. CTprepare stores drill logs, training records and procedures in one place, making it easy to share evidence during audits, inspections or governor meetings.

Unlimited. Your annual subscription covers as many users as you need - whether that's 5 staff or 50. User types: Admin users can create and edit emergency procedures, log drills and update training records.

Viewers can access procedures and guidance but cannot make changes useful for staff who need to reference plans but shouldn't be editing them.

Contacts can be added to your plans (site manager, local police liaison, governors, etc.) without needing platform access. They appear in your procedures as important contacts but don't count as users and don't get login credentials.

This means your entire leadership team can collaborate on procedures, all staff can access the guidance they need and there are no surprise costs as your team grows or changes.

Yes. CTprepare is designed to support Multi-Academy Trusts in building consistent, robust emergency preparedness across all schools.

Each school creates its own tailored procedures using the same structured process, ensuring consistency of standards while reflecting site-specific reality. Trust leaders can access procedures, drill logs and training evidence across all schools from a central dashboard.

This means you can confidently report on preparedness trust-wide, while individual schools have procedures their staff can actually follow under pressure.

Yes. CTprepare is built with security and data protection at its core. All information is stored securely in line with UK GDPR requirements, and schools remain in control of their own data. Access is role-based so only authorised staff can view or update records.