In a lockdown, no one will be reading a policy

Schools, colleges and nurseries in scope sit in the standard tier, whatever their size. Childcare, primary, secondary and further education settings have a special consideration in the Act: they stay in the standard tier even where 800 or more people are expected. Settings that can reasonably expect fewer than 200 people present at the same time, including staff, are not in scope at all.

Standard tier means public protection procedures – evacuation, invacuation, lockdown and communication. It does not require physical security measures such as CCTV, gates or bollards. Those sit in the enhanced tier, which applies to premises expecting 800 or more individuals and does not apply to schools.

Events at education premises cannot be qualifying events. If you hire out your hall or playing fields for a large public event, the premises stay in the standard tier and the responsible person does not change – responsibility does not transfer to the hirer. You can set out what you expect of them in the hire contract, but the duty remains yours.

Higher education is different. Universities do not have the special consideration and are treated like any other premises: standard tier from 200 to 799, enhanced tier at 800 or more.

The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025, but its requirements are not yet in force. The government committed to an implementation period of at least 24 months. Commencement is expected in spring 2027, with the exact date confirmed through Parliament beforehand.

The Home Office published its section 27 statutory guidance on 15 April 2026 – the detailed framework setting out what those responsible for qualifying premises need to do. The Security Industry Authority consulted on its draft section 12 guidance, which explains how it intends to regulate and enforce; that consultation closed on 12 June 2026 and the final guidance is expected in autumn 2026.

So the substantive requirements are clear, the regulator is preparing, and there is time. Schools that start now will be refining procedures rather than building them from scratch when the Act takes effect.

No, and the government's own position is that the implementation period exists to be used.

The requirements are clear now. The section 27 statutory guidance was published on 15 April 2026. It confirms what standard tier premises must do: appropriate public protection procedures for evacuation, invacuation, lockdown and communication, suitable for the specific premises. The SIA's final guidance on how it will regulate is expected in autumn 2026.

Procedures take time to become real. Writing them is the quick part. Making sure staff know their part, testing whether the procedures survive contact with an actual school day, and fixing what doesn't work – that takes a few cycles. Schools that begin in early 2027 will be doing all of it at once.

The threat is not tied to the commencement date. Counter Terrorism Policing have disrupted plots against UK schools. The current national threat level is set by MI5 and reviewed regularly.

You may already be most of the way there. The government's reason for keeping schools in the standard tier is that safeguarding and existing safety duties mean most schools already have access control, lockdown and evacuation arrangements. The work is usually reviewing and sharpening what exists, not starting from nothing.

Section 27 required the government to publish guidance on the Act's requirements. That statutory guidance was published on 15 April 2026 and last updated on 7 August 2026. It sets out what those responsible for qualifying premises – including schools and colleges – need to do.

The guidance confirms that education settings in scope sit in the standard tier whatever their size, and that the requirements centre on four public protection procedures: evacuation, invacuation, lockdown and communication. Each must be appropriate to the specific premises and reasonably practicable – proportionate, weighing what can be done against the cost, time and difficulty of doing it. It defines staff broadly: employees, contractors, volunteers and anyone else working on site, on any working pattern.

It also makes clear that this is not a one-size-fits-all exercise. Procedures have to reflect the premises they cover.

CTprepare is built and updated on the same sources that informed the guidance – ProtectUK, NaCTSO and the DfE's Protective Security and Preparedness for Education Settings.

No, and that's deliberate.

Importing an existing plan would convert a document into a different format. It wouldn't tell you whether the plan fits your site, whether staff know their part in it, or where the gaps are. The questions are the product; the document is what falls out of them.

You don't need to start from nothing. Have your existing plans open as you work through the questionnaire – where they already contain good thinking, use it. What the process does is make sure you have been asked about the things a generic plan tends to skip: which doors actually lock, where people go when the field isn't an option, who decides when the head is off site.

Most schools complete the process in about a day, usually spread across several sittings.

Having procedures and having procedures that work under pressure are different things. The question isn't whether you have a document. It's whether staff would act consistently, whether the plan matches the building you actually occupy, and whether you could show what has changed since it was written.

CTprepare works through those questions systematically – threats, vulnerabilities and responses specific to your site, your staff and your pupils. What comes out is a set of procedures for evacuation, invacuation, lockdown and communication, quick-reference guidance for each role, and a record of drills and reviews as you carry them out.

It draws on Counter Terrorism Policing and NaCTSO material, the DfE's Protective Security and Preparedness for Education Settings, and the statutory guidance published in April 2026.

You can meet the requirements without buying anything, and the government says so directly. When it published the statutory guidance, it advised against using third-party providers claiming they can make premises compliant, and confirmed that no third-party product is endorsed by the Home Office or the SIA. The DfE publishes free guidance for education settings, including a self-assessment template. A school with the time and the internal expertise can do this itself.

What you would be taking on is: - working through your site-specific vulnerabilities - building evacuation, invacuation, lockdown and communication procedures that reflect your actual site - writing quick-reference guidance for teachers, support staff and site teams - setting up a way to log and track drills - keeping to an annual review schedule - keeping a record for governors and trustees Done properly that is weeks of work up front and something to maintain every term. CTprepare compresses the build into about a day of structured thinking, then keeps the cycle running – review prompts, drill logs, a record of what changed and when. The questionnaires aren't forms. They're the questions a security adviser would ask, in an order that makes sense for a school. Whether that's worth £600 depends on what a fortnight of your leadership team's time is worth. That's the honest comparison.

At least annually, and whenever something material changes – building work, a new entrance or lock, a significant change in staffing, or after a drill or incident that showed something didn't work. Procedures have to be appropriate to the premises, and a site that has changed can outgrow its plan quickly.

CTprepare prompts the annual review and lets you log drills, incidents and what you learned from them, so the record builds as you go.

No. The platform is step-by-step and assumes no security background. It also produces quick-reference guidance for each role, so staff know what they are expected to do when something happens.

Yes. Procedures, drill logs and review records sit in one place, so you can show what exists, when it was last reviewed and what has been practised. That covers governor and trustee assurance, and gives you something to hand over if the regulator asks.

Unlimited. Your annual subscription covers as many users as you need - whether that's 5 staff or 500. User types: Admin users can create and edit emergency procedures, log drills and update training records.

Viewers can access procedures and guidance but cannot make changes useful for staff who need to reference plans but shouldn't be editing them.

Contacts can be added to your plans - site manager, local police liaison, governors, etc. - without needing platform access. They appear where they are needed in your procedures as important contacts but don't count as users and don't get login credentials.

This means your entire leadership team can collaborate on procedures, all staff can access the guidance they need and there are no surprise costs as your team grows or changes.

Yes. Data is held in the UK in line with UK GDPR, and access is role-based so staff only see what their role requires. The school remains the data controller – it's your data, and you can export or delete it.

The platform holds procedures, site details and staff roles rather than pupil records, so there is limited personal data in the system to begin with.