Preparedness: What Happens When Something Goes Wrong?

Most schools have spent time and money on security. Cameras, access control, intruder alarms, visitor management, perimeter measures. All of it useful. But security and preparedness are not the same thing, and the gap between them is where schools are most often caught out.

Security is not the same as preparedness

It helps to separate five ideas that often get bundled together. Security is the set of measures intended to reduce vulnerability and deter or prevent incidents. Preparedness is the organisation's readiness to respond effectively when something happens anyway. Response is what people actually do during the incident. Recovery is restoring normal operations and supporting those affected. Resilience is the ability to absorb the event, recover, and come out of it having learned something.

Technology touches every stage of that lifecycle. It does not deliver any of them on its own. A camera can show you what is happening. It cannot decide what to do, tell your staff, or reassure a hall full of parents. Preparedness is what connects the technology to the people and the decisions. It is also the part the security industry tends to skip, because it does not sell a specific product. That does not make it less important. It makes it more.

The first question: who takes charge?

When something goes wrong, the first failure is rarely technical. It is usually a pause. A moment where capable people look at each other and no one is sure who owns the decision.

The Department for Education's guidance for schools recommends appointing a security lead, which may be the headteacher or a designated senior colleague, responsible for developing and maintaining the school's plans. During a live incident that person may become the incident lead, making decisions under pressure to get people to safety. That is sensible, and it is worth stress-testing against a few plain questions:

• Is there one clearly understood security or incident lead?
• Are deputies named, and do they know they are deputies?
• What happens if the usual decision-maker is off site, in a meeting, or unreachable?
• Do staff beyond the leadership team understand their own roles?
• Is there a clear escalation route, including when to involve emergency services?

None of this requires elaborate bureaucracy. A school does not need a thick manual. It needs clarity, because clarity is exactly what stress erodes. The value of naming roles in advance is that nobody has to work out the command structure while an alarm is going off.

What happens first?

There is no single correct response to "an incident", because incidents are not all the same. A suspicious package, a serious medical emergency, an intruder, a fire, and a significant event happening in the surrounding area may each call for a different action. The right response depends on the nature of the event and on official emergency guidance, not on a fixed rule.

This is deliberately not the place for tactical instructions. Preparedness is about the principles that hold true across scenarios:

• recognised triggers, so people know when something has become an incident
• clear decision-making, so a response is actually chosen
• defined responsibilities, so the response happens
• communication, so everyone knows what has been decided
• safeguarding, kept central throughout
• coordination with emergency services
• accessibility and SEND, considered in advance rather than improvised
• review afterwards

The DfE guidance points schools towards recognised models such as RUN HIDE TELL and awareness approaches like See, Check and Notify (SCaN). These are tools, not scripts. The work is in making sure the right tool is reachable in the right moment.

Communication is part of security

During an incident, information becomes one of the most valuable things the school has. And this is where well-secured schools are quietly vulnerable.

Ask the awkward questions. How does an alert actually reach every member of staff, including the ones on the far field or in a mobile classroom? Can staff communicate back to leadership quickly? Can leadership reach the whole site at once? What happens if the normal system, the phones, the network, the power, is unavailable, and is there a backup method that anyone has actually tested? Can arriving emergency services be given relevant, current information? Who talks to parents and carers, and when? And how is misinformation on social media managed while it is happening?

The DfE guidance is clear that initial communication with parents and carers should come from the school, not the police, and that holding statements prepared in advance help enormously in the first chaotic minutes. It also recommends telling parents to stay away from the site and to treat the school's own channel as the reliable source. That is difficult to do well if the first time anyone drafts a holding statement is during the incident. Our companion piece on security-minded communications covers the everyday side of this in more detail.

Technology has a real role here. Public address, two-way radios, mobile alerting, digital notification systems, access control status, camera visibility. But every one of those only helps if it is built into a procedure and tested. A notification system nobody has practised with is not a communication plan. It is an assumption.

Preparedness has to include people

Here is the question that separates a plan from preparedness:

A plan in a folder is a document. Preparedness is what happens when that document lives in people's heads and habits. That means thinking about induction for new staff, so preparedness is not something only the long-serving team understands. It means periodic refreshers, because knowledge decays. It means role clarity across the whole staff, not just the senior leadership team, and it means accounting for temporary and supply staff, contractors and visitors, who may be on site on the worst possible day. It means governors and trustees where appropriate, age-appropriate approaches for pupils so they are informed without being frightened, and SEND and accessibility so no one is left out of the response.

A note on the word "drill". The DfE guidance treats testing your plans as good practice, and suggests exercises should be proportionate and appropriate to the setting, the risk and the circumstances. It does not impose a single, identical, mandatory exercise on every school. Read that as freedom, not as permission to skip it. The point of an exercise is not to frighten anyone. It is to find the weak spot before a real event does.

Test the plan, don't just file it

A plan you have never tested is a hypothesis. The useful question is blunt: could we execute this today? Practical checks that produce real learning include tabletop exercises and scenario walkthroughs with the people who would actually respond, testing the primary communication method and then the backup, checking that contact lists are current rather than eighteen months stale, confirming who can lock or open what, checking emergency equipment and CCTV and access-control coverage, and reviewing lessons from any previous incident or near miss.

And a mindset shift worth stating plainly. A good exercise is not one where everything goes perfectly. A good exercise is one that surfaces something you did not know. "We discovered that nobody was sure who contacts the local authority" is not a failure of the exercise. It is the exercise working exactly as intended. That single sentence, found on a quiet Wednesday afternoon, is worth more than a plan that looks immaculate and has never been touched.

Technology should support the response

This is where a security company is expected to start listing products. We will resist that, because it misses the point. Technology earns its place in preparedness by putting the right information in front of the right people at the right time. Held against that test:

• CCTV gives situational awareness, lets you verify what is actually happening rather than reacting to a rumour, and provides an evidential record afterwards.
• Access control helps you understand and manage who is where, and can support controlled access or lockdown where that is the appropriate response.
• Intruder alarms alert, escalate, and where monitored, bring an external response.
• Communication systems move information quickly between people and places.
• Remote monitoring adds oversight outside normal operating hours, when the site is least populated and most exposed.
• Integrated systems reduce fragmentation, so information can move between systems and people instead of stopping at the boundary of each separate box.

But the objective is not more technology. Adding cameras to a school with no clear incident lead and no tested communication plan does not make it more prepared. It makes it better recorded. This is the whole argument for treating security as a system rather than a shopping list.

What happens after the incident?

Recovery is the stage schools think about least and need just as much. It is not simply getting the doors open again.

After the immediate danger has passed, a prepared school is thinking about the welfare of pupils and staff, ongoing safeguarding, honest and timely communication, and continuity of education. It is thinking about the site itself, preserving evidence where relevant, recording what happened accurately, and debriefing properly rather than moving on because everyone is exhausted.

The debrief is where resilience is actually built. What worked? What did not? What did we assume that turned out to be untrue? Which procedure needs rewriting, and who owns that change? A school that captures those answers and feeds them back into its security planning becomes measurably harder to catch out next time. A school that files the incident and moves on has learned nothing it can use.

A forthcoming change worth understanding: Martyn's Law

Many education leaders are now hearing about Martyn's Law, the Terrorism (Protection of Premises) Act 2025. It is worth being precise about where this actually stands, because there is a good deal of noise around it.

The Act received Royal Assent in April 2025. It is not yet in force. Government has signalled commencement no earlier than spring 2027, with an implementation period of at least 24 months to give organisations time to prepare. Statutory guidance was published in 2026 to help those responsible get ready, but the requirements themselves are not yet enforceable. The Security Industry Authority will act as the regulator.

Most schools, as premises where 200 or more people may be present, are expected to fall within the standard tier when the law commences. The emphasis of that tier is on proportionate, practical procedures rather than expensive equipment.

A practical preparedness checklist for schools

Leadership

• A named security or incident lead is in place and understood by staff.
• Deputies are identified and know they are deputies.
• Escalation routes are clear, including when to involve emergency services.

Plans

• The scenarios relevant to our setting have been considered.
• Procedures are documented.
• Plans are accessible in the moment, not locked inside one system or one person's memory.
• Plans are reviewed on a sensible cycle.

People

• Staff understand their roles, not just the leadership team.
• New, temporary and supply staff are accounted for.
• SEND and accessibility are built into the response.
• Contractors and visitors are considered where appropriate.

Communication

• The primary alerting method reaches everyone, everywhere on site.
• A backup communication method exists and has been tried.
• Emergency and parent contact lists are current.
• Responsibility for internal and external communication is assigned.
• Holding statements for parents are drafted in advance.

Technology

• CCTV is operational and its coverage is understood.
• Access control is operational.
• Alarms are tested.
• Communication systems are tested.
• Critical systems have appropriate resilience if power or network fails.

Exercises

• Procedures have been tested proportionately to our setting.
• Lessons from exercises are recorded.
• Identified weaknesses are actually addressed.

Recovery

• Business continuity has been considered.
• Welfare and support arrangements are understood.
• A post-incident review process exists.
• Lessons feed back into security planning.

The preparedness question every school should ask

Everything above reduces to one question:

A prepared school is not one where nothing ever goes wrong. That school does not exist. A prepared school is one where people understand their roles, systems support them rather than replace them, communication holds up under pressure, leadership is clear, and the organisation is honest enough to learn when an event exposes a weakness.

That is the philosophy behind everything Fyrfly does. Secure. Prepare. Respond. Recover. Learn. Good security is not a collection of products bought separately and hoped to work together. It is understanding the environment, finding the real vulnerabilities, preparing the people, choosing appropriate technology, integrating it, maintaining it, and improving the whole thing over time.

If your school or trust is reviewing its security arrangements, Fyrfly can help you look beyond individual technologies and think about how the complete security and preparedness system works together.

Sources and further reading

• DfE: Protective security and preparedness for education settings. Non-statutory guidance that applies to all schools, and the framework this article draws on. Our plain-English summary is here.
• ProtectUK: Martyn's Law. Current position on the Terrorism (Protection of Premises) Act 2025, including implementation timing and the role of the SIA as regulator.
• DfE: Keeping children safe in education 2026, the statutory safeguarding guidance in force from 1 September 2026, which sets the wider safeguarding context.
• See, Check and Notify (SCaN) and the Action Counters Terrorism (ACT) for Education e-learning, free staff training signposted from ProtectUK and your local Counter Terrorism Security Adviser.