School emergency planning made straightforward

Almost all schools and further education colleges fall under the Standard Tier, even if more than 800 people are on site. The government has confirmed that education settings below higher education level are covered by proportionate, procedural requirements only. The focus is on having clear plans and procedures - such as lockdown, evacuation and communication arrangements - rather than introducing new physical security measures. The Enhanced Tier applies where 800 or more members of the public could reasonably be expected at one time, such as large public events or higher education institutions that meet that threshold. If a school or college hosts a large public event organised by a third party, responsibility would generally be shared: the event organiser must meet Enhanced Tier requirements for the event, while the school or trust must cooperate and ensure the site’s security arrangements are appropriate. In short, everyday school and further education operations remain Standard Tier, while higher education settings and large public events may fall under the Enhanced Tier.

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, but its requirements are not yet in force. The government has confirmed an implementation period of at least 24 months, meaning organisations will not be expected to meet their obligations under the Act until 3 April 2027 at the earliest.

Before the Act commences, the Home Office needs to publish its Section 27 statutory guidance - the detailed framework that will help organisations understand exactly what is expected of them. That guidance is expected during 2026. Once published, the Security Industry Authority (SIA) will consult on its own regulatory guidance setting out how it will monitor and enforce the requirements.

Whilst organisations are not required to comply until the Act formally commences, the threat is real now. Security experts, DfE and Counter Terrorism Policing encourage schools and colleges to have preparedness plans in place - not because of a deadline, but because effective procedures protect people today. Those that start now will be refining and strengthening their plans rather than building from scratch when the legislation takes effect.

No. Here's why starting now makes sense:

The threat exists today. Counter Terrorism Policing have stopped real plots against UK schools. Waiting for a legal deadline to prepare your school doesn't protect the pupils and staff in your care right now.

Early adopters refine, late movers rush. Schools that start now have time to build procedures, run drills, identify what works and what doesn't, and embed preparedness into school culture. Schools that wait until 2026 or early 2027 will be creating procedures under pressure, with no time to test them properly.

Guidance will evolve. When Section 27 statutory guidance is published during 2026, you'll want to review and adjust your procedures - not start from scratch. CTprepare users will already have robust plans in place and a year's worth of drill evidence, making adaptation straightforward rather than overwhelming.

It takes about a day to set up, then runs itself. This isn't a massive project. You can have comprehensive procedures in place within a week, then CTprepare maintains them year-round with drill logging and automatic updates.

Parents and governors expect it now. Try explaining to a parent or governor: "We know the threat exists and we know what we should do, but we're waiting until the law forces us to act." That's not a defensible position for any school leader. The SIA will enforce compliance from 2027, but your duty of care exists right now.

Section 27 of the Terrorism (Protection of Premises) Act 2025 gives the Secretary of State the power to issue statutory guidance on the duties the legislation imposes. This guidance will set out in practical terms what those responsible for qualifying premises — including schools and colleges — need to do to meet their obligations. It carries real weight: if an organisation's approach is ever questioned, being able to demonstrate that it acted in accordance with the Section 27 guidance is a key way of evidencing it has met the requirements.

That guidance has not been published yet. However, a great deal of good practice is already established. Counter Terrorism Policing and the DfE have published preparedness frameworks and resources, including the DfE's Protective Security and Preparedness for Education Settings. The core expectations — evacuation, invacuation, lockdown and communication procedures — are clear from the Act itself. Organisations that build their planning around this existing best practice will be well placed when the formal guidance arrives.

CTprepare has been designed around this established best practice. As soon as the Section 27 guidance is published, we will update the platform and share practical insights with our schools and colleges to help them understand what it means for them.

CTprepare doesn't have an import function - and that's deliberate. Here's why:

The real value of CTprepare isn't about converting existing documents into a different format. It's the guided questioning process that makes you think about your site-specific vulnerabilities, staff capabilities and realistic response scenarios.

Many schools tell us their existing plans are generic templates that haven't been properly adapted to their context. Or they're comprehensive but buried in Word documents that nobody can find under pressure, with no system for logging drills or tracking updates.

CTprepare's structured questions help you build genuine understanding - not just documentation. You might already have some good thinking in your existing plans and you can absolutely reference those as you work through the platform. But the guided process ensures you've covered everything properly.

The result is tailored procedures that reflect your actual site, staff and pupils - not just repurposed generic templates - plus the year-round drill logging and evidence management that existing Word documents can't provide.

Most schools complete this process in about a day spread over several days, working in their own time.

Having emergency procedures and having procedures that actually work under pressure are very different things. CTprepare guides you through a structured process that builds a security mindset across your school — helping you think through threats, vulnerabilities and responses specific to your site, staff and pupils. The result is detailed, tested plans covering lockdown, invacuation, evacuation and communication, with role-specific staff guidance, documented drills and evidence ready for governors and regulators. All aligned with current best practice from Counter Terrorism Policing, the DfE's School Estate Management Standards and Martyn's Law obligations as these become clearer.

The government is clear: you can meet Martyn's Law obligations without buying a product. Schools that have the time, security expertise and internal capacity can absolutely build their own emergency procedures using DfE guidance and Counter Terrorism Policing resources. The challenge isn't just creating initial procedures - it's doing it properly, then maintaining them. That means: - Working through site-specific vulnerabilities and threat scenarios - Building lockdown, invacuation, evacuation and communication plans that reflect your actual site, not generic templates - Creating role-specific guidance for teachers, support staff and site teams - Developing training materials and drill protocols - Setting up systems to log and track drills - Maintaining annual review schedules - Keeping procedures updated as Section 27 and DfE guidance evolves - Having audit-ready evidence available for governors and SIA inspection Done properly, this is weeks of work initially, plus ongoing administrative overhead every term. Most school leaders don't have that time - or the security expertise to know they're asking themselves the right questions. CTprepare compresses this into about a day of guided, structured thinking for initial setup, then maintains everything year-round - drill logs, training records, review prompts, guidance updates - in one secure platform. The guided questionnaires aren't just forms - they're the questions a security expert would ask you, helping you build a genuine understanding of your vulnerabilities and appropriate responses. You're not paying for a day's work. You're paying for security expertise embedded into a year-round preparedness management system, with ongoing support as requirements become clearer. The real question isn't "Should we pay for this?" It's "What's our time worth - and what's the cost of getting this wrong?"

DfE guidance recommends an annual review, and CTprepare sends reminders so you never miss it. You can also log drills and lessons learned directly into the system.

No. The platform is simple and step-by-step. It also generates crib sheets that help staff know exactly what to do in a real incident.

Yes. CTprepare stores drill logs, training records and procedures in one place, making it easy to share evidence during audits, inspections or governor meetings.

Unlimited. Your annual subscription covers as many users as you need - whether that's 5 staff or 50. User types: Admin users can create and edit emergency procedures, log drills and update training records.

Viewers can access procedures and guidance but cannot make changes useful for staff who need to reference plans but shouldn't be editing them.

Contacts can be added to your plans (site manager, local police liaison, governors, etc.) without needing platform access. They appear in your procedures as important contacts but don't count as users and don't get login credentials.

This means your entire leadership team can collaborate on procedures, all staff can access the guidance they need and there are no surprise costs as your team grows or changes.

Yes. CTprepare is designed to support Multi-Academy Trusts in building consistent, robust emergency preparedness across all schools.

Each school creates its own tailored procedures using the same structured process, ensuring consistency of standards while reflecting site-specific reality. Trust leaders can access procedures, drill logs and training evidence across all schools from a central dashboard.

This means you can confidently report on preparedness trust-wide, while individual schools have procedures their staff can actually follow under pressure.

Yes. CTprepare is built with security and data protection at its core. All information is stored securely in line with UK GDPR requirements, and schools remain in control of their own data. Access is role-based so only authorised staff can view or update records.