How to write an event security plan for a UK event, with a checklist

An event security plan describes how the organiser will keep people safe and the event secure: who is responsible for what, how the crowd will move, how the site is protected, how incidents are reported and handled, and what happens if the event has to stop. Usually it sits inside a wider event management plan, alongside the medical, fire, traffic and welfare plans.

It has several readers. The local authority, usually through its safety advisory group, and the police want to see that the organiser has thought about public order and emergencies. The fire and rescue service wants exits, access routes and the fire risk assessment. The security contractor and the steward supervisors need to know their sectors and their limits. After an incident, your insurer may ask for it as well. Write for all of them, but keep the operational parts short enough that a supervisor will read them at the briefing.

A useful test: if the person who wrote the plan were unreachable for the whole event, could the control room run it from the document alone?

No single UK statute sets out what an event security plan must contain. The duties come from several laws at once, and most organisers lean on recognised guidance to decide what “reasonably practicable” looks like.

In England and Wales, an event that sells alcohol or puts on regulated entertainment needs a premises licence under the Licensing Act 2003, and the licence conditions often require a security and stewarding plan. Smaller events can run on a temporary event notice, which covers fewer than 500 people at a time for no more than 168 hours (section 100). The organiser, as the responsible person, must carry out a fire risk assessment under the Regulatory Reform (Fire Safety) Order 2005. Events on the highway need a temporary traffic order from the traffic authority, usually under section 16A of the Road Traffic Regulation Act 1984, and some councils still use section 21 of the Town Police Clauses Act 1847 for processions. Many councils run a safety advisory group (SAG) that brings the council, police, fire, ambulance and highways together to review the plan. A SAG advises and does not license, but its view carries weight with the licensing authority. Scotland and Northern Ireland have their own licensing and fire safety laws, so check with the local council there.

Contract security staff who guard against unauthorised access, search people or deal with disorder need a licence from the Security Industry Authority (SIA), a door supervisor licence where the event is licensed premises. Stewards who only guide, inform and observe generally do not, and the SIA publishes a checklist to help decide. For the plan itself, the Purple Guide (Events Industry Forum) is the standard reference for health, safety and welfare at outdoor events, and the Health and Safety Executive publishes guidance on managing crowds.

The Terrorism (Protection of Premises) Act 2025, known as Martyn’s Law, received Royal Assent on 3 April 2025. It will apply an enhanced duty to qualifying public events where 800 or more people are expected at once and entry is checked, with the SIA as regulator. The government committed to an implementation period of at least 24 months before the duties start; the Home Office published statutory guidance in April 2026.

Internationally, ISO 22353:2026 (Security and resilience, guidelines for crowd management) was published in August 2026. It covers crowd profiling, capacity assessment, ingress and egress, and crowd management plans for normal and emergency situations.

This order works for most events. Each step feeds the next one, which is why the staffing table comes late.

1. Describe the event. Dates, opening hours, site, expected attendance (peak, not total), audience profile, alcohol, overnight camping, high-profile performers or guests, and anything that has gone wrong at previous editions.
2. Assess the risks. Crowd density and movement, vehicle and pedestrian conflicts, temporary structures, weather, fire, medical, disorder, lost children, theft, and hostile acts. For each, note likelihood, impact and the measure that addresses it. The Purple Guide and the HSE crowd guidance both walk through these hazards, and the Martyn’s Law guidance covers preparing for an attack.
3. Work out capacity. Usable space in each area, entry and exit widths, and how long it takes to fill and to empty the site. Plan for the worst moment, such as the end of the headline act or a sudden storm.
4. Set the command structure. Who leads the event on the day, who can stop the show, who talks to the emergency services, and who replaces each of them if they are unavailable.
5. Plan staffing and sectors. Security, stewards, fire marshals and medical by sector and by hour, with supervisors named, ratios explained and SIA licence types noted for every security role.
6. Plan communications. Radio channels, phone numbers, call signs, the incident log, and what happens when the mobile network is saturated.
7. Write the emergency procedures. Show stop, partial and full evacuation, shelter in place, lockdown, lost child, major medical incident, severe weather. Every procedure needs a trigger, a decision maker and the exact words for the announcement.
8. Brief, rehearse and review. A tabletop exercise with the main contractors, a site walk before opening, and a debrief afterwards that feeds the next edition.

Most event plans are thinnest at the point where incidents go wrong, in the gap between someone noticing a problem and the right person acting on it. Spell out how a steward reports something, who receives it, how it reaches security or medical, and how the control room knows it has been dealt with.

Keep a single incident log that everyone feeds, with the time something happened and the time it was reported kept apart. Plan for a saturated mobile network at peak times: radio for urgent voice traffic, and tools that queue reports instead of losing them. Our page on moving beyond WhatsApp and radio goes into this in more detail, and after-action review explains how to use the log afterwards.

Sinkaos does not write the plan. It runs it on the day: the site map with sectors and exits, stewards joining from a QR code, incidents shared between security, stewards and medical, and a timeline you can export for the debrief. See event security and stewarding.