Major threats to national security include terrorism, espionage, cyber threats and weapons of mass destruction, many of which impact on the UK’s national infrastructure. Understanding threats facing the UK is key to ensuring the right protective security measures and mitigations are taken, and that they are also proportionate, effective and responsive.
The New Protect Duty Legislation
Protect Duty is a new proposed piece of legislation, currently under consultation, that will for the first time, require many businesses to formally assess the risk of terror attack.
This will be mainly aimed at organisations providing publicly accessible spaces, such as venues and events. Protect Duty will require these businesses to conduct risk assessment reviews so that they understand what the risks are – and to take reasonable measures to mitigate against them.
Who Will be Affected by Protect Duty?
An estimated 650,000 UK businesses could be affected by the new legislation according to The Home Office.
The three main areas (with examples) it will potentially apply to are:
- Public venues: entertainment and sports venues, tourist attractions, or shopping centres with a capacity of 100 persons or more.
- Large organisations: retail or entertainment chains employing 250 staff or more operating at publicly accessible locations.
- Public spaces: public parks, beaches, thoroughfares, bridges, town/city squares and pedestrianised areas. This includes event organisers using these spaces.
How Will It Affect Businesses/Organisations?
The Government considers that the owners and operators of such public venues and large organisations should be required to:
- Use available information and guidance provided by the Government and the police to consider terrorist threats to the public and staff at locations they own or operate within.
- Assess the potential impact of these risks across their operations and location, and through their systems and processes.
- Consider and implement ‘reasonably practicable’ protective security and safety plans such as:
- Developing a strategy that ensures the site and its use have been assessed.
- Suitable mitigation measures are put in place to protect staff.
- Staff training for what to do in the event of an attack.
- Develop a robust organisational plan on how to deal with, or act in response to a terrorist attack.
Mitigating the Risks
Central to the Protect Duty legislation will be the need for a competent person to undertake detailed, subjective risk assessments to identify vulnerabilities and what appropriate measures need to be in place.
Mitigation measures may include:
- Multi agency planning and exercising.
- Training staff to identify and report suspicious behaviour and how to respond in a crisis.
- Live CCTV monitoring - acts as both a deterrent and active security measure, especially when combined with a police response.
- Vehicle stop points.
- Access control - enabling management of who goes where and when, within your site. May include search and screening with or without the use of technology, such as full body scanners.
- Monitoring and patrols.
- Ability to lock down.
- In-depth crisis response and communication plans.
Any risk assessments will need to be kept under review, ensuring measures keep pace with the inevitable changes terrorists make to the way they carry out attacks.
What if a Business isn’t Affected by Protect Duty?
Even if a business doesn’t directly fall into the affected categories, it remains important to consider how such attacks could impact customers and suppliers, and the resulting effect that would have.
For smaller organisations and venues, this would involve simple low-cost (or no-cost) preparedness measures, such as ensuring that staff are trained to:
- Be aware of threats, likely attack methods and how to respond to them.
- Identify the signs of hostile reconnaissance and to take appropriate action.
And that the organisation’s response to different attack types is regularly updated and exercised.
The Protect Duty Consultation
The consultation considers how legislation might be used to enhance the protection of publicly accessible locations across the UK from terrorist attacks and ensure organisational preparedness.
With some exceptions (e.g. on transport security and for certain sports grounds), there is currently no legislative requirement to consider or implement security measures at publicly accessible locations. However, there are many reasonable and appropriate measures which can be – and often already are – undertaken by organisations who operate at such locations. These include:
- Having security plans and procedures to react and respond to different threats which are understood by all staff and regularly exercised.
- Having simple and freely available training and awareness courses in place as part of new staff and refresher training programmes.
- Employing simple security measures (such as door locks, roller shutters) for crime prevention and anti-social behaviour, which may also be used in response to other security threats.
For an explanation of what the Protect Duty covers, and how to be part of the consultation process it can be found on the Government website here.
How Should Businesses Prepare?
It is expected that a draft bill will be introduced to parliament within the next 12-18 months with detailed guidance to follow.
Whether directly affected by the legislation or not, now might be an excellent time for businesses to take stock of what provision they have in place to protect their operation from such outside threats, and what choices need to be made regarding both their existing set-up and future projects.
For further resources, please speak to your Arch contact about our Arch Risk Management solutions.