A locked gate and a visitor badge provide limited protection without clear decisions about admission, supervision and emergency access. School security in the UK depends on controlled movement, supported by staff who know what to check and when to escalate.
Schools need proportionate arrangements that protect pupils without obstructing disabled visitors, emergency responders or everyday school life. Start with responsibilities and local risks, then connect the boundary, reception and internal access arrangements.
Key takeaways
- Assign a senior leadership security lead, with named deputies and clear responsibilities for reception, estates, child protection and incident response.
- Admit visitors only after establishing their identity, purpose and host, then apply the appropriate safeguarding and escort arrangements.
- Assess fencing, gates, secondary entrances and surrounding conditions together, rather than treating fence height as proof of protection.
- Preserve accessible entry and safe emergency escape when changing locks, barriers, intercoms or vehicle controls.
- Prepare for Martyn’s Law using the correct education thresholds and commencement position, rather than assuming April 2027 is a confirmed deadline.
- Test evacuation, invacuation, lockdown and communication arrangements, then assign and record the changes identified by each exercise.
These measures should form one operating plan. Separate records are useful, but reception staff, site managers and safeguarding leads need compatible instructions.
Separate legal duties from security recommendations
School security sits across child-protection duties, health and safety, fire safety, equality and data protection. A product specification cannot establish compliance across all these duties.
Health, safety and child-protection responsibilities
In Great Britain, the Health and Safety at Work etc. Act 1974 and Management of Health and Safety at Work Regulations 1999 underpin employer responsibilities. They require appropriate assessment and management of risks to employees and others affected by the school’s activities.
The health and safety responsibilities guidance is DfE guidance for schools in England. Northern Ireland has its own health and safety framework.
Keep jurisdiction clear. DfE guidance applies to England, whilst education and child-protection arrangements differ across Scotland, Wales and Northern Ireland. Keeping children safe in education applies in England, so it should not be described as UK-wide guidance.
The employer’s identity also matters. Depending on the school, that may be a local authority, academy trust, governing body or proprietor.
A written policy remains important
A standalone security policy is not on the DfE’s statutory policies list for maintained schools or academy trusts. That does not remove the underlying duties to manage risks and protect people.
The DfE’s school and college security guidance is non-statutory guidance that supports having a security policy and associated plans. The policy should explain responsibilities, admission rules, reporting routes and review arrangements.
Security-related incidents include vandalism, arson, cyber attacks, serious weapon incidents and terrorist attacks. Their likelihood and consequences differ, so the policy should reflect local evidence.
Record which decisions require leadership approval. Staff should not have to invent exceptions when a contractor arrives unexpectedly or a parent disputes an access restriction.
Understand what Martyn’s Law requires of schools
The Terrorism (Protection of Premises) Act 2025 received Royal Assent on 3 April 2025. The Act is named after Martyn Hett, who was killed in the 2017 Manchester Arena bombing.
Its purpose is to improve preparedness for terrorist attacks at qualifying premises and events. It doesn’t make every possible security product compulsory.
Apply the education threshold correctly
The threshold concerns the number of people reasonably expected to be present at the same time, including staff. It isn’t simply the number of pupils enrolled.
Qualifying early-years, primary, secondary and further-education premises with 200 or more people fall within the standard tier. The education rule keeps these premises in the standard tier even when expected attendance reaches 800 or more.
The government’s education-specific guidance explains this distinction. Sixth forms and further-education colleges should assess their arrangements within that framework.
Premises below 200 are outside the numerical threshold. This includes settings with fewer than 100 people, but 100 isn’t a separate legal threshold. Smaller settings can still adopt proportionate Protect and Prepare principles.
Distinguish preparation from commencement
As of October 2026, the Act’s substantive duties aren’t yet in force. The implementation period is at least 24 months, and the government expects commencement in spring 2027.
April 2027 is a planning reference, not a confirmed universal compliance deadline. The exact commencement date determines when the duties become legally operative.
Once those duties commence, the responsible person for qualifying standard-tier premises must notify the Security Industry Authority (SIA). They must also have appropriate public protection procedures, so far as reasonably practicable.
These cover evacuation, invacuation, lockdown and communication. Standard-tier preparation centres on workable procedures; it doesn’t create a general requirement to buy new fencing, CCTV or biometric readers.
Assign ownership and assess local risks
Appoint a security lead from the senior leadership team. Give that role authority to coordinate decisions, obtain resources and follow up faults.
Give each control a responsible owner
The security lead should coordinate the plan, whilst operational duties remain explicit. Reception owns admission checks; estates owns physical defects; the designated safeguarding lead advises on child-protection concerns and pupil access restrictions.
Assign deputies for absence and reduced staffing. A reception alert has little value when its only recipient is teaching, off site or unavailable during lunch cover.
Record who can authorise temporary access, suspend a credential, request police assistance and approve reopening after an incident. Distinguish these operational roles from the legal responsible person under the Act.
Governors or trustees should receive a proportionate account of significant risks, overdue actions and exercise findings. They need evidence of action, without circulating sensitive operational detail unnecessarily.
Assess how the site operates
Walk the boundary and entrance routes during arrival, lessons, collection and evening use. Different activities create different access demands.
Consider previous incidents, nearby roads, shared facilities, public footpaths, adjoining properties and known concerns about pupil protection. Include school trips and regularly used off-site education areas within the wider assessment.
Use Annex D of the DfE’s protective security and preparedness guidance to identify strengths and gaps. Existing plans can be reviewed against it rather than duplicated.
Record the risk, existing control, required action, owner and completion date. Keep detailed layouts, response arrangements and identified weaknesses within restricted operational records.
Make visitor sign-in support an admission decision
Visitor management begins before a badge is printed. Staff need enough information to decide whether a person should enter, where they may go and who will supervise them.
Establish identity, purpose and authority
Pre-register planned visits where practical. Record the host, purpose, expected time and any arrangements for access or supervision.
At arrival, confirm identity against the expected visit and contact the host through the school’s established channel. A contractor’s uniform or organisation badge does not establish permission to enter.
If the host is unavailable, keep the visitor in the designated waiting area or rearrange the visit. Reception staff should not grant wider access because somebody appears confident or familiar.
Issue a clearly distinguishable, day-valid visitor badge. Explain escort requirements, how to report safeguarding concerns or incidents, photography restrictions and the immediate emergency instructions relevant to the visit.
Consistent reception security procedures help connect these checks with escalation. The process should also cover governors, agency personnel and regular contractors, rather than relying on recognition.
Record attendance without exposing personal information
A visitor record should capture the information needed for admission and accountability. This normally includes name, host, arrival, departure and the issued badge or credential.
Avoid collecting unnecessary identity-document copies. Protect paper records from other visitors, restrict digital permissions and set a retention period linked to the purpose.
A visitor register records admission and departure. Hosts and escorts remain responsible for knowing where their visitors are during an incident.
Paper systems can work when staff use them consistently and store them securely. Digital systems can improve searching and alerts, but they still need a decision-maker.
Test the fallback for a failed kiosk, printer, network or power supply. Reception should retain a usable admission process and emergency attendance information without exposing personal data.
Connect visitor access with safeguarding decisions
Permission to enter a school and permission to work unsupervised with children are separate decisions. The visitor process should support safeguarding judgement, not replace it.
Apply appropriate checks and supervision
The designated lead should define checks according to the person’s role, activity and supervision. A brief escorted delivery and regular work with children require different consideration.
A DBS certificate doesn’t establish unlimited authority to move around the school. Staff still need to check identity, purpose, relevant checks and agreed supervision.
For agency and contracted personnel, retain the appropriate assurances and establish who has completed the required checks. Give hosts clear instructions about collecting visitors and maintaining supervision.
Reception should receive only the information needed to apply access decisions. Details of child-protection concerns belong in controlled records, not general visitor notes.
Handle parents and challenging behaviour consistently
Parents and carers need clear arrangements for appointments, late arrivals, collections and access to teaching areas. Familiarity shouldn’t create unrestricted movement.
Where collection restrictions or other child-protection directions apply, translate them into usable instructions. Name the person reception must contact before releasing a pupil when an issue arises.
If a visitor reports a bullying concern at reception, staff should pass it through the school’s established reporting route rather than investigate it at the desk.
Staff also need a response when somebody demands an exception, refuses to wait or becomes threatening. Provide an escalation route that doesn’t depend on physical confrontation.
The principles for responding to threatening visitors include keeping staff safe and seeking assistance early. Where there is immediate danger, call 999 and follow the school’s emergency arrangements.
Assess the whole school perimeter
A boundary should direct legitimate movement and discourage unauthorised access. Its effectiveness depends on the gates, surroundings and maintenance, not height alone.
Select measures for the assessed risk
Review fencing, walls, gates and connections to neighbouring structures together. Ground levels, slopes and changes in boundary type can affect how well the perimeter functions.
Assess ground clearance, gate alignment and nearby objects that provide climbing opportunities. Bins, stored equipment, temporary works and overgrown vegetation can change the original design assumptions.
Anti-climb features require suitable design, lawful installation and ongoing maintenance. Avoid improvised additions that create injury risks for pupils, maintenance staff or the public.
There is no single fence height that establishes adequate security for every UK school. Planning constraints, pupil-protection needs, accessibility and the surrounding environment all influence the appropriate arrangement.
Maintain a welcoming frontage through clear wayfinding, good supervision and orderly landscaping. Security does not require every boundary to appear hostile.
Inspect, record and repair
The site manager should set inspection frequency according to risk and use. Routine opening checks should include gates and obvious damage, with fuller inspections at a recorded interval.
Inspect after severe weather, impact, vandalism or works near the boundary. Temporary arrangements need the same clear ownership as permanent ones.
Record loose or damaged components, failed lighting, vegetation growth and changes around gates. Assign a repair date and interim control where necessary.
Keep lighting appropriate to entrances and movement routes. Avoid glare, nuisance to neighbours and designs that leave staff unable to see beyond a brightly lit entrance.
For schools using mobile patrol checks, define which conditions must be reported and who acts on them. A visit record alone does not establish that a fault received attention.
Boundary inspection reports should support repairs without becoming a publicly available description of the school’s vulnerabilities. Limit detailed photographs and defect locations to those who need them.
Control vehicles without obstructing emergency access
Vehicle arrangements must account for pupils, pedestrians, deliveries, accessible parking and emergency responders. A barrier that controls routine parking may provide no protection against a deliberate vehicle attack.
Separate traffic control from protective barriers
Set delivery arrangements that reduce conflict with pupil movement. Provide a clear waiting point and a named person who can authorise entry.
Assess pedestrian crossings, reversing movements, congestion and visibility around access points. Keep queues away from roads and routes needed by wheelchair users.
Where a credible vehicle threat is identified, obtain competent advice on hostile-vehicle mitigation. Ordinary parking barriers should not be described as hostile-vehicle protection.
Improvised blocks and poorly positioned bollards can introduce collision hazards or force pedestrians into traffic. Barrier choice and placement require assessment of the whole approach.
Preserve access and escape
The site manager should maintain a clear emergency-access arrangement, including authority to open controlled entrances. Cover loss of power, unavailable staff and access outside reception hours.
Emergency escape must remain available without occupants searching for a keyholder. Integrate access changes with the fire strategy rather than treating escape as a later adjustment.
Government guidance on escape arrangements for disabled people supports planning for people who need assistance. Include temporary injuries and visitors unfamiliar with the site.
Keep sensitive access instructions available to authorised staff and responders through controlled arrangements. Public information should explain where visitors report, without publishing operational security details.
Include contractors, secondary entrances and shared facilities
The main reception is only one access point. Service entrances, deliveries, maintenance work and evening lettings need compatible controls.
Give contractors defined access
Confirm the work order, school contact, permitted area and expected duration before admitting a contractor. Complete checks appropriate to the work and the contractor’s contact with pupils. Set supervision to match the work and level of pupil contact.
Keep keys and temporary credentials under recorded control. Remove permissions when the task ends, rather than allowing access to continue until somebody notices.
Assess secondary doors, roof access and externally accessible service areas within the site review. Protect plant, communications equipment and other supporting assets where interference could interrupt school operations.
A controlled reception offers limited protection if another entrance is routinely left unsecured during works. Agree how materials enter and how the opening is supervised.
Construction segregation should protect pupils without obstructing required escape routes. Changes to temporary fencing or access need approval before the work starts.
Set boundaries for community use
Evening clubs, sports bookings and events may bring people onto the site after the usual reception team has left. Define which areas are available and which remain restricted.
A letting agreement should assign admission, supervision, emergency communication, lock-up and incident reporting. Record how the organiser obtains assistance if a problem develops.
Review attendance and access arrangements for larger events. Avoid assuming that the school-day staffing model or normal visitor register will cover a different activity.
Keep school records, teaching spaces and staff areas separately controlled where they are outside the letting. Complete a documented handover when responsibility returns to the school.
Use internal access control proportionately
Internal controls should reflect the consequences of unauthorised entry. A reception meeting room, classroom, staff room and records store do not require identical permissions.
Limit permissions and preserve accessibility
Assign access by role, area and time. Remove permissions promptly when employment, placement or contracted work ends.
Test door closing, latching, intercoms, accessible controls and emergency release arrangements. Physical faults should be repaired before adding more equipment.
The principles of physical access control apply, but school permissions must also protect pupils and support everyday supervision.
Provide a practical alternative where a person cannot use an intercom, touchscreen or standard reader. Consider hearing, vision, dexterity, language and cognitive needs.
Security arrangements should not force a disabled visitor to use an unsuitable route or wait without assistance. Assign responsibility for responding to accessible-entry requests.
Treat biometrics as a separate decision
Biometric readers can restrict access to classrooms, staff rooms or sensitive interior spaces. Their availability does not establish that they are necessary or proportionate.
Biometric information used to identify someone uniquely is special category personal data under UK GDPR. Its use requires additional legal justification and safeguards.
In England and Wales, additional statutory rules apply to children’s biometric information in schools and colleges. These include parental notification and consent requirements, respect for a child’s objection and reasonable alternative arrangements.
The data protection officer should assess necessity, proportionality, lawful processing and the need for a data protection impact assessment before procurement. Compare the proposed benefit with less intrusive options.
Biometrics also need a fallback for refusal, failed recognition and system outage. A reader cannot replace supervision or repair a door that fails to latch.
Make CCTV support a defined response
CCTV can assist deterrence, incident review and live assessment. Recording an incident does not establish that somebody will provide immediate help.
Define the purpose before selecting cameras. Entrance oversight, out-of-hours intrusion and investigation of damage may require different arrangements.
Assign monitoring and escalation
Record who receives alerts, when they are available and what action they should take. Cover school hours, evening use, holidays and system faults.
Test the connection between an alert and the person authorised to respond. Repeated nuisance alerts should prompt investigation, rather than routine dismissal.
The distinction between recording and response is central to effective CCTV monitoring. A camera should not be presented as a substitute for staffed supervision.
Protect footage and privacy
Restrict access to footage, record disclosures and set retention according to purpose. Camera positioning should avoid unnecessary intrusion into neighbouring properties and sensitive school areas.
Apply appropriate data protection assessment, transparency and signage. Pupils, staff and visitors should understand why surveillance is used.
Keep footage available for authorised investigation without giving general access to staff or contractors. Maintenance access also needs control, particularly where systems can be reached remotely.
Include cyber security in the site security plan
Visitor databases, access systems and network cameras depend on digital services. A cyber incident can disrupt admission, communications and emergency accountability.
Understand the reported attack figures
The government’s Cyber Security Breaches Survey 2025 reported that 44% of primary schools and 60% of secondary schools identified a breach or attack during the preceding 12 months.
These are separate estimates for school types, not one percentage for every UK school. The measure includes identified breaches or attacks; it should not be rewritten as confirmed successful data theft.
The figures also relate to that survey year. Keep the date attached when using them in governor reports or procurement documents.
Protect systems and maintain a fallback
The IT lead should maintain supported software, strong authentication, restricted administrator access and tested backups. Supplier remote access should be authorised, limited and removed when no longer needed.
Separate access-control and surveillance systems appropriately within the network design. Document how doors and admission procedures behave during a network or power failure.
Keep essential emergency information available through a controlled offline fallback. Avoid making the school’s only roll-call information dependent on one cloud service.
Use the NCSC’s cyber security resources for schools to support staff awareness and incident planning. Reception and estates staff need training where their systems connect with visitor data or physical access.
Write four distinct public protection procedures
Plans for moving people out, invacuation and lockdown respond to different conditions. Communication supports each response and should reach everyone affected, including visitors and people outside the main building.
Use clear definitions when writing the emergency response plan.
| Procedure | Function | Planning requirement |
|---|---|---|
| Evacuation | Move people out of premises to relative safety. | Assess the threat, route, destination and accountability arrangements. |
| Invacuation | Move people inside to a place of relative safety. | Identify suitable spaces and support people moving indoors. |
| Lockdown | Secure premises or areas against an attacker. | Define authority, communication, securing arrangements and release instructions. |
| Communication | Alert and instruct people during danger. | Use clear messages, accessible methods and reliable alternatives. |
The appropriate response to a terror attack depends on the threat and its location, so follow the procedure selected through assessment. A familiar assembly point may be unsuitable for a security incident, so plans shouldn’t copy the fire procedure without assessment.
Define authority and accountability
Name who can initiate each procedure and who acts when that person is unavailable. Staff facing immediate danger need clear principles for protective action without waiting for a committee decision.
Include visitors, contractors, pupils outside classrooms and people using separate buildings. Hosts should account for their visitors through the agreed process.
Plans for people who need assistance to leave and other individual support arrangements should connect with the wider response. Assign assistance that remains available during absence or reduced staffing.
Plan messages and safe release
Use plain instructions that identify the required action without spreading unconfirmed claims. Provide alternatives for people who can’t hear, see or understand the primary alert.
Prepare for telephone, network or public-address failure. Staff should know the alternative communication method relevant to their location and role.
Define how restrictions end and who authorises reopening or reunification. Parents need instructions that reduce the risk of arriving at an unsafe entrance.
Keep detailed routes, protected locations and operational instructions within controlled plans. Public-facing summaries can explain the approach without exposing site-specific arrangements.
Train staff and review every drill
An emergency plan needs evidence that staff understand their roles. Attendance at a briefing establishes participation, not the ability to apply the procedure.
Connect awareness with reporting
The free ACT for Education Awareness eLearning available through ProtectUK’s education training resources supports staff awareness. Follow it with school-specific instruction on reporting and immediate responsibilities.
SCaN means See, Check and Notify. It supports recognising and reporting suspicious behaviour within a safe, role-appropriate process.
HOT considers whether an item is Hidden, Obviously suspicious or Typical of its surroundings. Staff should not handle or investigate an item to establish whether it is dangerous.
Awareness should focus on behaviour and circumstances, not assumptions about appearance or background. Reception, estates, teaching and contracted staff need reporting routes they can use.
Practise calmly and record changes
Plan proportionate evacuation, invacuation and lockdown drills and exercises according to assessed needs. Use briefings and tabletop exercises before more involved practice where appropriate.
Avoid surprise attack simulations or realistic threat props. Consider age, SEND, sensory needs and previous trauma when preparing pupils and staff.
Review every drill. Record missed messages, unavailable assistance, accountability problems and unclear decisions, then assign corrective actions and completion dates.
Share age-appropriate personal safety teaching and RUN HIDE TELL guidance with parents. Explain how teaching relates to school arrangements.
Pupils should know that 999 is for emergencies and 101 is the police non-emergency number. Staff should reinforce those distinctions without encouraging children to investigate danger.
Procure security against a written scope
Security spending should address an assessed problem. Additional equipment is difficult to justify when existing doors, staffing arrangements or reporting processes remain defective.
Define the requirement before comparing prices
State the areas covered, operating hours, admission responsibilities, response expectations and required records. Include accessibility, pupil-protection requirements and emergency arrangements in the specification.
For guarding, identify the duties and competence required, including applicable SIA licensing. A licence does not show that an officer has the school-specific training needed to follow its procedures.
Our manned guarding services can support access control and patrols where the assessment identifies a staffing requirement. The scope still needs a clear school contact and escalation route.
Do not assume every school needs a permanent security officer. The appropriate arrangement depends on activity, site conditions, existing staffing and the response required.
Compare whole-life costs
There is no universal school-security tariff. A meaningful comparison needs suppliers pricing the same requirement.
Include installation, groundwork, electrical supply, software subscriptions, integrations, maintenance, training and replacement credentials. State whether VAT, call-outs, holiday cover and contract exit costs are included.
Ask for the equipment’s required maintenance and the service’s reporting arrangements. Establish who owns data and how records remain available if a supplier changes.
Acceptance should include functional testing, staff training and usable documentation. Test failures and handovers as well as routine operation before treating the installation as complete.
Use a phased school security action plan
Set priorities according to consequence and likelihood, then record what has been completed. Preparation for new legislation should sit alongside existing safety and child-protection work.
- Establish responsibility. Name the senior leadership security lead, operational owners and deputies. Identify the legal responsible person for qualifying premises under the Act.
- Review the current arrangements. Use the DfE self-assessment alongside incident records, child-protection concerns and a site inspection. Record gaps without distributing sensitive detail widely.
- Resolve immediate defects. Prioritise failed locks, damaged boundaries, uncontrolled secondary access and unclear visitor decisions. Introduce suitable interim arrangements while permanent work is completed.
- Complete the procedures. Align visitor admission, contractor access, lettings and the four public protection procedures. Include accessibility, communication failure and emergency-service access.
- Train and exercise. Brief staff, practise proportionately and record the findings. Assign each improvement to an owner with a completion date.
- Prepare for commencement. Document the scope assessment and readiness work, using the government’s Martyn’s Law statutory guidance. Prepare for SIA notification when the duty takes effect.
Maintain one action register rather than several competing lists. Governors or trustees should be able to distinguish completed work, outstanding risk and decisions awaiting funding.
Review after significant incidents, exercises, building changes and changes in site use. An annual review alone may leave new arrangements unassessed for months.
Frequently asked questions about school security
Must every school have electronic visitor management?
No. A controlled paper process can support admission and attendance records. Its effectiveness depends on consistent identity checks, host approval, supervision and secure record handling.
Electronic systems may improve searching, alerts and temporary permissions. They still require trained staff, appropriate data protection and a usable outage procedure.
Can a school lock its gates during the day?
Schools can control access according to their risk assessment and safeguarding arrangements. Gates must not defeat required emergency escape or prevent necessary emergency-service access.
Provide a clear visitor route and an accessible way to request admission. The site manager should assign opening, closing and fault-reporting responsibilities.
Does a visitor badge mean somebody can walk around alone?
No. A badge shows the status assigned through the visitor process. It doesn’t confirm that the visitor is approved for unsupervised access.
The host and site access arrangements determine where the visitor may go and whether an escort is required. Reception should explain those limits before admission.
Do all schools have to install stronger fencing under the Act?
No general standard-tier requirement makes new fencing compulsory. The Act focuses on appropriate public protection procedures, so far as reasonably practicable.
Schools should assess physical improvements against their wider risks. Repairs or upgrades may be justified independently of the Act, but procurement should identify the actual problem being addressed.
Is April 2027 the confirmed compliance deadline?
As of October 2026, the government expects substantive duties to commence in spring 2027 following an implementation period of at least 24 months.
April 2027 shouldn’t be presented as a confirmed universal deadline. Schools can prepare procedures, responsibilities and training before the duties become operative.
Keep the controls connected
School security depends on decisions that remain clear during a busy arrival, an unexpected visit or an emergency. The boundary, reception process and internal permissions should support the same rules.
Prioritise working controls over additional equipment. Assign owners, repair defects and use exercises to establish whether people can apply the plan.
A welcoming school can maintain firm access boundaries. Admission should be orderly, support should be accessible, and responsibility should remain clear after the visitor has passed reception.
0 Comments