How to Prepare

How to prepare

Although the bill has not yet been passed and final wording is not confirmed, organisations likely to be impacted should start to prepare and begin making the likely adjustments needed in order to comply.

Understand the threat

The key initial step should be considering and understanding the risks facing your organisation. When evaluating this, you should bear in mind that terrorist groups targets, motivations and attack methodologies tend to change over time. It is also worth considering factors that may cause your organisation to be targeted indirectly, for example, due to proximity to neighbouring organisations.

The Global Terrorism Database, media reporting of recent attacks and the National Threat Level are useful tools in understanding the threats facing your organisation.

Conduct a risk assessment & incident response plan

Once the major threats facing your organisation have been identified, you should undertake a risk assessment and identify appropriate measures to limit these risks. When undertaking this exercise, it's worth noting that organisations can be held responsible for either failing to identify an existing threat or for failing to contain the situation in the event of an attack.

Additionally, organisations under the Terrorism (Protection of Premises) Bill are required to have an incident response plan in place. This should detail not just how you and your staff would respond to an incident occurring inside your organisation, but also how you would respond to an incident outside or near to you.

Implement protective measures

When conducting your risk assessment and incident response plan there are likely to be gaps identified where new measures are required. This could include physical security measures such as;

Security doors
Blast-resistant glazing
Fences
Bollards
CCTV
Electronic access control
Intruder detection systems

Alternatively, less invasive technology could be implemented. For example, technology solutions that support the identification of potential threats, limit the opportunity for an attack and coordinate the response in the event of an attack.

Ensure staff are trained

Before the Bill comes into place it is essential that staff have a clear understanding of the measures and response plans in place.

Staff should also be trained to carry out pre-event checks. This should include checking all security measures are working as expected, including CCTV, metal detectors and emergency exits.

Specific Counter Terrorism training has been developed by Act Counters Terrorism ACT Awareness e-Learning to provide standardised and consistent counter terrorism action across organisations. It is available to all organisations, their staff and the general public and can be used to provide evidence that protective measures have been taken in the event of an investigation.

When implementing new protective measures, such as technology solutions, it's vital staff are trained on how to properly use them. This training should be re-visited at least annually and available to all new starters when they join the organisation.

Undertake readiness testing exercises

Undertaking readiness testing exercises is an effective way to evaluate the effectiveness of the measures you have in place and improve your response plan. This should include ensuring that you have the appropriate number of staff, that staff are trained to identify an attack and that a working contingency plan is in place for if things do go wrong.

This exercise should put your incident response plan to the test and may identify parts of your plan that do not work in practice, so need to be addressed.

Once testing is complete and any necessary improvements have been made, this should provide assurance that you are able to act against an attack.

Introduce a culture of safety

A culture of safety should be created alongside considering what can be done to make it harder for a terrorist to conduct target research, such as introducing a policy for reporting suspicious behaviour. Staff are the most likely to pick up on odd or unusual behaviour, so encourage them to report anything that seems suspicious, whether this is a person themselves or bags left unattended.

To embed a culture of safety you should also be security-minded in your communications, particularly online. Include messages demonstrating your commitment to ensuring security and safety and avoid providing specific information that could aid in planning an attack, such as floorplans.

To ensure health and safety is properly embedded within your culture, risk awareness must be high at every level of your organisation. This means not only ensuring public-facing employees are aware of the risks, but that all levels of staff are aware and know what they should do in the event of an attack.

After an event

After an event has taken place, it's key to reflect on the lessons learnt. This should include reviewing the measures currently in place to identify what has gone well and what could be improved, as well as determining if any new measures are required.

Your plans should constantly be evolving and improving in line with organisational and wider environmental changes.

It is important that any guidance, training and measures are reviewed and refreshed regularly to reflect changes to risks and threats over time.

Terrorism (Protection of Premises) Bill – LGA response