A school can have cameras on every corner and still be unprepared: a recorder that stopped recording, doors that cannot be locked in time, a lockdown plan nobody has rehearsed. We design, install and maintain security around one question: when something goes wrong, will your site and your people cope?
The Department for Education's guidance for schools is called Protective security and preparedness for education settings. Martyn's Law is a preparedness duty too: it asks for procedures that work, not for equipment. The official direction of travel is clear, and it is the right one.
Most security is still sold one product at a time. A camera system here, a door system there, an alarm from someone else. Each may be fine on its own. None of them answers whether the site is prepared.
Our model breaks preparedness into five stages, from stopping an incident at the boundary to recovering afterwards, with a sixth that keeps them all true. Every service we offer, every free tool and every guide on this site sits somewhere on it. Use the model to see where you are strong, where you are thin, and what to fix first.
Who can get in, and how far can they get?
Most incidents are stopped, or never attempted, at the boundary. Prevent covers deterring people from trying and delaying anyone who does: the perimeter, the doors, who holds credentials and what you give away about your site.
Would you know something was wrong, and how soon?
Detection is only useful if it is fast and reaches someone who can act. It comes from systems and from people: cameras, alarms and analytics, and staff who know what suspicious activity looks like.
Can you confirm what is happening before you act?
A false alarm that triggers a lockdown, or a real one that gets dismissed, both cost you. Verify is the step between an alert and a decision: seeing what is happening, and knowing who has been where.
When it happens, does everyone know what to do, and does the building let them?
This is where Martyn's Law and the DfE preparedness guidance focus: evacuation, invacuation, lockdown and communication. The plan has to be known by staff and the building has to support it.
Afterwards, can you prove what happened and get back to normal?
Recovery is the stage most organisations forget until they need it. It means usable evidence, an accurate record, systems back up quickly, and a review that changes something.
How do you know it will all work next time?
Assure runs around every other stage. Systems degrade, staff change and procedures go stale. Maintenance, testing, documentation and governance are what keep the other five true.
Your Martyn's Law tier, your duties and the gaps in your procedures, with a report you can take to governors.
Run the assessment →A site visit and board-ready report on your whole security position against Martyn's Law, DfE guidance, KCSiE and UK GDPR.
About the audit →Every device found, tested and logged, access recovered and a signed baseline. Credited against your first year of maintenance.
About the estate audit →Read the model for your sector: schools independent schools multi-academy trusts NHS and public sector commercial
Every free tool, guide and checklist on this site, organised by what you need to do: the Fyrfly Resource Hub
Security preparedness is being ready to prevent, detect and respond to an incident, and to recover from it, rather than simply having security equipment installed. It combines physical systems, procedures that staff know, and the maintenance and testing that keep both working. The Department for Education's guidance for schools is titled Protective security and preparedness for education settings.
CCTV is one tool within one or two stages. The model asks whether a site can prevent, detect, verify, respond and recover, and whether that is assured over time. A school can have excellent cameras and still be unprepared if the recorder is not recording, the doors cannot be locked quickly or nobody knows the lockdown procedure.
No. Much of preparedness is procedures, awareness and governance, and the official training from ProtectUK and the National Protective Security Authority is free. Fyrfly's role is the systems, maintenance and evidence that make those procedures work, plus free tools to help you write and check them.
Martyn's Law requires in-scope premises to have procedures for evacuation, invacuation, lockdown and communication, which sit in the Respond stage. Enhanced tier premises also need measures for monitoring, movement, physical security and security of information, which sit across Prevent, Detect and Verify. Assure is how you keep both in place.
Sources: Department for Education, Protective security and preparedness for education settings (updated April 2025); ProtectUK, Martyn's Law resources; National Protective Security Authority, See, Check and Notify.
Tell us about your site and we will tell you, honestly, which stages are covered and which are not. If the answer is that you need nothing new, you will hear that too.