UK security, in plain English

A specialist police officer or staff member working within local police forces, coordinated by NaCTSO, who provides free protective security advice to businesses and organisations.

CTSAs are the primary source of tailored counter-terrorism advice for sites likely to fall within Martyn's Law's scope. Their input is free and independent of any supplier.

The UK government department responsible for education and children's services in England.

The DfE issues Keeping Children Safe in Education (KCSiE), the statutory safeguarding guidance that every school and college in England must follow, and publishes the school security guidance underpinning most physical security expectations for schools.

The national regulator for workplace health and safety in Great Britain.

Fire safety, lone working and premises safety obligations intersect the HSE's remit. For schools and public sector buildings, this influences how physical security systems are designed to protect staff as well as visitors.

The UK's independent regulator for data protection and information rights, operating under the Data Protection Act 2018.

Any use of CCTV, access control or visitor logging that captures personal data falls under the ICO's remit. Its guidance on video surveillance is the practical reference point for signage, retention and workplace monitoring policies.

A police unit that provides counter-terrorism protective security advice across the UK, hosted by Counter Terrorism Policing.

NaCTSO oversees the Counter Terrorism Security Adviser (CTSA) network and publishes the ACT Awareness training programme that will play a central role in staff preparation for Martyn's Law.

The coordinating body for UK policing, formed in April 2015 as the successor to the Association of Chief Police Officers (ACPO).

NPCC owns the Secured by Design (SBD) initiative and shapes national police-led guidance on crime prevention through environmental design, which planning authorities often reference.

The non-ministerial government department that inspects and regulates schools, further education and skills training in England.

Ofsted's Education Inspection Framework covers safeguarding, which draws in physical security arrangements where they are relevant to keeping pupils safe. Inspectors will expect security measures to align with KCSiE and the school's own risk assessments.

The UK regulator for the private security industry, established under the Private Security Industry Act 2001. A non-departmental public body sponsored by the Home Office.

The SIA licenses individuals working in guarding, door supervision, CCTV operation and close protection. It will also regulate the Terrorism (Protection of Premises) Act 2025 (Martyn's Law) once its requirements commence.

The UK legislation that implements the UK GDPR and covers areas outside its scope, including law enforcement processing and intelligence services.

The DPA and UK GDPR should be read together. For schools and public sector organisations, the DPA governs how personal data captured by security systems must be handled, retained and disclosed.

UK legislation giving the public a right of access to information held by public authorities, including schools, colleges and local authorities.

Security policies, CCTV coverage areas and incident data can be the subject of FOI requests. This is a strong reason for policies to be written to a publishable standard from the outset, rather than as internal notes.

The DfE's statutory safeguarding guidance for schools and colleges in England, issued under sections 175 and 157 of the Education Act 2002. Updated annually with a September in-force date.

KCSiE is the anchor document for school safeguarding. It sets out the expectation that schools have proportionate arrangements to protect children on site, including from external threats. Physical security measures are not prescribed by name, but they must support the wider safeguarding framework.

The primary fire safety legislation for non-domestic premises in England and Wales. Places duties on the person who has control of the premises, referred to as the responsible person.

Fire alarm systems, evacuation procedures and fire risk assessments all sit under the RRFSO. Note that the responsible person under the RRFSO is a separate legal role from the responsible person under Martyn's Law, though in practice they are often the same individual.

A UK police-led initiative owned by the NPCC that provides a preferred specification for crime prevention through design of buildings, systems and products.

SBD is not statutory, but planning conditions and public sector procurement frameworks often reference it. SBD-certified products can be a proportionate specification anchor when a client wants a defensible standard without over-engineering.

UK legislation that will place duties on qualifying publicly accessible premises to have protective procedures in place. Received Royal Assent on 3 April 2025.

The substantive requirements are not yet in force. Commencement is expected from 2027, with the final date to be confirmed. Premises where 200 or more people may reasonably be expected fall within scope; below 200 is out of scope. Schools remain in the Standard Tier whatever their capacity, under the Act's special consideration for education.

The UK's version of the EU GDPR, retained in UK law after Brexit and sitting alongside the Data Protection Act 2018.

Every CCTV system, access control record and visitor log processes personal data under the UK GDPR. Compliance requires signage, documented retention periods, a lawful basis for processing and a Data Protection Impact Assessment for high-risk deployments.

An independent, third-party certification scheme provider for the fire safety industry. BAFE certifies competency for fire product installation, servicing and design.

For fire detection and alarm systems (BAFE scheme SP203-1) and portable fire extinguishers (SP101), BAFE certification is the recognised marker of installer competence and is often specified by insurers and the fire and rescue service.

The UK's national standards body, publisher of British Standards (BS) and the UK member of ISO and CEN.

Every technical standard referenced in a security specification (BS 5839, BS EN 50131, BS EN 62676 and so on) is a BSI publication. Compliance with the current BS is the baseline expectation on any professional installation.

The certification arm of BRE, providing product-level certification against Loss Prevention Standards (LPS).

LPCB is best known for LPS 1175 (physical security-rated doors, gates, cages and barriers) which is often specified where a defined attack resistance is required. Product certification, distinct from company certification like NSI or SSAIB.

A UKAS-accredited certification body that inspects and certifies companies providing security systems, fire detection and manned guarding services against BS and BAFE standards.

NSI certification (Gold and Silver schemes) is one of the two dominant marks of company-level competence in UK security. Insurers, police forces and larger clients often specify NSI or SSAIB certification as a procurement requirement.

A UKAS-accredited certification body that certifies companies providing security systems, monitoring services, guarding and telecare against relevant BS standards.

SSAIB is the other main third-party certification body for security installers, sitting alongside NSI. Insurer and police procurement typically accepts either NSI or SSAIB certification as demonstrating competence.

The UK code of practice for the design, installation, commissioning and maintenance of fire detection and fire alarm systems in non-domestic buildings.

BS 5839-1 defines system categories (P1, P2, L1, L2, L3, L4, L5, M) that specify what a fire alarm system is designed to protect. Getting the right category is the single most important design decision in a fire alarm specification.

The UK code of practice for confirmed alarm systems, which require two or more independent detections before triggering a full police response.

Confirmed alarms exist to reduce false police call-outs and remain a police response condition in most UK forces. BS 8243 is the code of practice that alarm designs must follow to qualify for police response under the current ACPO/NPCC secure key-holder policy.

The UK code of practice for remotely monitored, detector-activated CCTV systems where an alarm signal triggers live operator engagement.

BS 8418 is what makes monitored CCTV eligible for police URN response in many force areas. It defines how detection, verification and remote intervention must be integrated, and is the standard behind most solar CCTV tower deployments.

The European standard series that specifies requirements for the design, installation and performance of intruder and hold-up alarm systems.

BS EN 50131 defines the four security grades (Grade 1 to Grade 4) used to match alarm system performance to the risk of the premises. Insurers typically specify Grade 2 or Grade 3 for commercial and public buildings.

The European standard series specifying performance and testing of the transmission paths that carry alarm signals from a system to an alarm receiving centre.

BS EN 50136 defines the ATS categories (SP1 through DP4) used to grade single-path and dual-path signalling. Insurers typically specify a minimum ATS category based on risk; higher grades give faster fault detection and greater resilience.

The European standard covering the physical construction, staffing and operational requirements of alarm receiving centres.

BS EN 50518 is what makes an ARC an ARC. Any ARC handling monitored intruder or CCTV signals for insurance or police response should be certified against this standard.

The European standard series covering requirements, performance and testing of video surveillance systems.

BS EN 62676 is the modern replacement for older CCTV standards, covering everything from image quality classifications to network security. A specification citing this standard is confirming the system will be designed to current European best practice.

The BSI Published Document that sets out how BS EN 50131 and related European standards should be applied in the UK.

PD 6662 is the practical bridge between the European standard and UK installation practice. A specification citing PD 6662:2017 is confirming that the system will be installed to current UK practice.

NaCTSO's public awareness campaign encouraging the reporting of suspicious activity, together with the free ACT Awareness e-learning package for frontline staff.

ACT Awareness is the recognised free training route for staff counter-terrorism awareness and is the practical baseline for Standard Tier Martyn's Law staff training. Bookable online through the ProtectUK platform.

A camera-based technology that reads vehicle number plates and matches them against watchlists or access lists.

ANPR is commonly used at school and campus vehicle entrances, car parks and delivery yards. Under UK GDPR it is a significant data processing activity that requires a lawful basis, a documented retention period and clear signage.

A secure, 24/7 monitoring facility that receives alarm signals from remote sites and takes agreed action, typically to BS EN 50518.

The ARC is where an alarm actually gets responded to. A monitored intruder alarm, a detector-activated CCTV system or a lone-worker device is only as good as the ARC behind it, so the ARC's grading, response protocols and police URN status all matter.

The umbrella term for video surveillance systems, whether analogue or, more commonly today, IP-based network cameras.

The legacy of the analogue CCTV era is that clients often assume all systems are broadly the same. Modern IP-based CCTV differs significantly in image quality, network security, storage architecture and integration with access control, and specification matters.

Physical security measures designed to prevent or reduce the impact of vehicle-borne threats, including bollards, planters, active road blockers and vehicle security barriers.

For sites likely to fall within Enhanced Tier scope of Martyn's Law, or those hosting public events, HVM is often part of the proportionate security assessment. Specification should reference an impact rating (IWA 14 or PAS 68/BSI PAS 170) rather than appearance alone.

The network protocol that underlies almost all modern security systems. An IP camera is one that transmits video over a computer network rather than as an analogue signal.

IP-based systems bring the benefits of network technology (remote access, high resolution, integration) and also its risks (cyber security, network dependency). Any specification for IP CCTV should include the cyber security posture, not just the camera count.

The dedicated device or server that records and stores video from IP cameras on a network.

The NVR determines how long footage is retained, how quickly it can be searched and exported, and how resilient the recording is to failure. Retention should be documented in the site's UK GDPR retention schedule.

The most common motion detection technology used in intruder alarms and lighting controls. Detects the change in infrared radiation caused by a warm body moving through a monitored area.

PIR detectors are inexpensive and effective indoors but have known limitations (line-of-sight, false triggers from heat sources). More critical detection points often combine PIR with microwave or dual-technology detectors to reduce false alarms.

An IEEE 802.3 standard that allows Ethernet cabling to carry electrical power alongside data, powering devices like IP cameras, wireless access points and access control readers from the network switch.

PoE dramatically reduces installation cost and disruption because devices need only a single cable rather than separate power supplies. Modern PoE++ (802.3bt) supports higher-power devices including PTZ cameras and heaters.

The Counter Terrorism Policing digital platform providing protective security advice, training and, in due course, Martyn's Law guidance and support tools for the Responsible Person.

ProtectUK is the official source that all Martyn's Law preparation should reference. Any supplier's guidance, including ours, should be a proportionate interpretation of what ProtectUK sets out, not a substitute for it.

The traditional analogue and copper-based telephone network in the UK.

Openreach is phasing out the PSTN in favour of digital voice services. This directly affects intruder alarms, fire alarms, lift lines and door entry systems that rely on analogue signalling, all of which need migration planning to digital signalling paths before the switch-off completes.

The software platform that manages CCTV cameras, recordings, users and integrations.

The VMS is the operational heart of a modern CCTV system. Its cyber security posture, integration capability and user management directly affect how a site actually uses its cameras day to day.

The individual formally designated under UK GDPR Article 37 to advise on and monitor compliance with data protection law. Mandatory for public authorities and for organisations whose core activities involve large-scale monitoring or processing of special category data.

The DPO should be consulted on the design of any CCTV, access control or ANPR system that captures personal data. In schools and local authorities, the DPO's sign-off on a Data Protection Impact Assessment is often the pragmatic gate before a system goes live.

The named senior member of school staff with lead responsibility for safeguarding and child protection, required by KCSiE.

The DSL is the natural internal counterpart for the physical security specifier in a school. Site security arrangements, access control logic and CCTV usage policies should be aligned with, and signed off by, the DSL alongside the school's senior leadership.

The professional membership body for bursars, business directors and finance directors in independent schools in the UK.

ISBA's Bursar's Review, annual conference and framework agreements are the primary professional environment of independent school bursars. Suppliers serious about the independent sector engage through ISBA, not through general education marketing.

The professional body for school business leaders in England, formerly the National Association of School Business Management (NASBM).

ISBL sets the professional standards for the SBP role and provides accredited routes such as ISBL Fellowship. Suppliers respected within ISBL networks tend to have a more accurate understanding of how school procurement actually works.

A group of academy schools operating under a single trust and governance structure.

MATs typically hold contracts centrally, giving them purchasing power to consolidate maintenance, monitoring and installation across sites. A single accountable partner across a trust is often more cost-effective than parallel arrangements at each academy.

The national membership organisation for governors and trustees of state schools and academy trusts in England.

Where a proposal will go before a governing body or board of trustees, framing that reflects NGA good practice, particularly around due diligence, value for money and safeguarding assurance, tends to land more effectively.

The person who has control of non-domestic premises for fire safety purposes, whether as employer, occupier or owner.

This is a separate legal role from the Martyn's Law Responsible Person, though the same individual often carries both. The fire responsible person is the one accountable for the fire risk assessment and for arrangements under the RRFSO.

The person or body who has control of the qualifying premises or event under Section 3 of the Act. Where the responsible person is an organisation, a senior individual must be designated to be accountable for compliance.

This is a named role in law once the Act commences. There is no requirement in the Act for that person to hold any specific security qualification, contrary to some suppliers' claims. Naming the Responsible Person and documenting the appointment is one of the practical steps organisations can take now, before commencement.

The senior operations and finance role in a school, responsible for premises, contracts, procurement and non-teaching operations. SBP is the modernised term used by ISBL.

The SBM or SBP is usually the person who signs off security contracts and holds the operational relationship with the installer. Their priorities of value for money, minimal disruption and compliance visibility should shape any proposal put in front of them.