Crowded Places Guidance See the latest guidance for your sector. Click on your sector to begin: NIGHT-TIME ECONOMY CINEMAS AND THEATRES STADIA AND ARENAS RETAIL HEALTH EDUCATION PLACES OF WORSHIP HOTELS AND RESTAURANTS MAJOR EVENTS VISITOR ATTRACTIONS COMMERCIAL CENTRES TRANSPORT NaCTSO National Counter Terrorism Security Office © NaCTSO Crown copyright 2017 © Crown copyright 2017. This guidance is available under the Open Government Licence v3.0. Disclaimer: This guidance is issued by the National Counter Terrorism Security Office NACTSO with the aim of helping organisations that provide protective security to Crowded Places to improve their protective security. It is general guidance only and needs to be adapted for use in specific situations. To the fullest extent permitted by law, NACTSO accept no liability whatsoever for any expense, liability, loss or proceedings incurred or arising as a result of any error or omission in the guidance or arising from any person acting, relying upon or otherwise using the guidance. You should make your own judgement as regards use of the guidance and seek independent advice as appropriate. Version 1.00 June 2017 © NaCTSO Crown copyright 2017 Crowded Places Guidance 3 Introduction 1. INTRODUCTION principles for protecting an asset areD eter, Detect, Delay The threat we face from terrorism is significant. As we and initiate an effective response. have seen in the UK and across Europe attacks can happen 1.2 Personnel and people security at any time and any place without warning. Understanding Personnel and people security requires the integration the threat we all face and of the ways we can mitigate of physical, personnel, people and cyber security. To it can help keep us safer. Everyone can play a role in achieve effective personnel security a system of policies this effort by taking steps to help boost their protective and procedures are required to reduce the risk of an security whether that’s at work, at home or away; when organisation’s assets from being exploited. This guidance travelling, when out and about or just simply when online. will signpost you towards the objective of vigilant staff Having better security for all these areas makes it harder and an effective security culture. Organisations should for terrorists to plan and carry out attacks. It also helps determine how to get the best from their staff in security reduce the risk of other threats such as organised crime. matters and disrupting hostile reconnaissance and insider This document provides protective security advice in a threats. number of sectors and scenarios. It has been developed 1.3 Cyber security through extensive research and analysis of previous The cyber threat as one of the most significant risks to incidents, and the assessment of current known threats. UK interests. The National Cyber Security Centre role is to It covers the key forms of protective security: physical, reduce the cyber security risk to the UK by improving its personnel, cyber and personal, and helps give guidance on cyber security and cyber resilience. They work together how different sectors can act to help make their business, with UK organisations, businesses and individuals to institutions or organisations safer. provide authoritative and coherent cyber security advice This guidance is primarily aimed at those in the and cyber incident management. They are able to provide security sector and those who own or run businesses, effective incident response to minimise harm to the UK, organisations, amenities or utilities. Some of the help with recovery, and learn lessons for the future. terminology may be unfamiliar to some readers. However, 1.4 Personal security we hope the advice can also be of use to anyone who Our own security, and the safety of those close to us, is of wishes to improve their own security. utmost importance. The more you do to protect yourself, To deliver protective security effectively a security the safer you and your family will be. There are three plan is essential along with a full risk assessment. It is key areas that can affect your safety. These are physical important to identify an individual responsible for security security, your situational awareness and online security. and to identify what are the important assets, people, Exactly which security measures you adopt will depend on products, services, processes and information within your the extent, or level, of threat you are likely to encounter organisation. You can then begin to introduce mitigation and vulnerabilities you have. This may be dependent upon to reduce vulnerabilities. A strong security culture must be your profession or role, a specific threat, the location you supported and endorsed from a senior level. work and or your personal history. 1.1 Physical security No-one has more responsibility for your personal security Effective physical security is best achieved by multi- than you. With an evolving threat we must all consider layering different measures. An adversary will attempt our own personal security, particularly when in crowded to identify and exploit perceived weaknesses. The core places. © NaCTSO Crown copyright 2017 Crowded Places Guidance Introduction 2/3 4 LAW AND LIABILITY • Co-operate and co-ordinate safety arrangements between owners, managers, security staff, tenants There are legal and commercial reasons why venues and others involved on site, including the sharing of should plan to deter terrorist and criminal acts, or at least incident plans and working together in testing, auditing to minimise their impact. and improving planning and response. The commercial There is the potential of criminal prosecution and tensions which naturally arise between landlords and penalties under health and safety legislation for tenants, and between retail tenants who may well be in companies and individuals, particularly when statutory direct competition with each other, must be left aside duties that have not been met. Where sectors are entirely when planning protective security. regulated it is important to liaise with the appropriate • Ensure adequate training, information and equipment body. are provided to all staff, and especially to those involved directly on the safety and security side. 2.1 The Health and Safety at Work Act 1974 and the • Put proper procedures and competent staff in place to Management of Health & Safety at Work Regs. 1992 deal with imminent and serious danger and response to (updated 1999) outlines the responsibilities of an terrorist incidents. organisation: 2.2 Civil Contingencies Act 2004 Part 1 places a legal • The Health and Safety at Work Act 1974 and the obligation upon emergency services and local authorities regulations made under it, requires organisations who to assess the risk of, plan, and exercise for emergencies, as are duty holders to do what is reasonably practicable to ensure people’s health and safety. The Act sets well as undertake business continuity management. out the general duties that employers have towards Go to the Health and Safety Executive website their employees whilst at work. The Act also requires employers and the self-employed to protect people 3. REPUTATION other than those at work e.g. volunteer staff and spectators. These people should be protected from risks Reputation and goodwill are valuable, but prone to serious to their health and safety arising out of, or in connection and permanent damage if it turns out that you gave a with, an employer’s work activities. less than robust, responsible and professional priority to • The Management of Health and Safety at Work protecting people against attack. Being security minded Regulations 1999 (the Management Regulations) and better prepared reassures your customers and staff require organisations to assess and control risks to that you are taking security issues seriously. protect employees and others who may be effected Further information their work activity. Where two or more employers share For specific advice relating to your venue contact the a workplace (whether on a temporary or a permanent nationwide network of specialist police advisers known as basis) each employer shall have systems in place to co-operate and co-ordinate with the other employers Counter Terrorism Security Advisers (CTSAs) through your concerned so far as is necessary to manage interfaces local police force. They are co-ordinated by the National between activities and any shared risks. Counter Terrorism Security Office (NaCTSO). Go to the Emergency Planning College website Go to the Health and Safety Executive website Go to the Occupiers’ Liability Act 1957 © NaCTSO Crown copyright 2017 Crowded Places Guidance Introduction 3/3 5 CONTENTS Click on the relevant section. At the end of each section Search planning .................................96 there is a link to return to the general contents page. Mail handling. 98 Hostile Vehicle Mitigation (HVM) ..................102 How to use this guide Digital built assets and environments ..............105 Sectors Night-time economy .............................. 6 Personnel and people security Cinemas and theatres ............................. 8 Personnel and people security introduction .........107 Stadia and arenas ...............................10 Personnel security training and good practice .......113 Retail ..........................................13 Hostile reconnaissance (suspicious behaviour). 117 Health .........................................15 Document awareness ...........................120