A terrorism plan that sits untouched in a shared drive is not preparedness. If your team cannot detect warning signs, make decisions under pressure, protect people quickly and recover control in real time, the plan is only paper.
For security managers, operations directors and duty holders, especially those working under Martyn’s Law expectations, the question is not whether a policy exists. The question is whether capability exists. Modern threats expose old security thinking. A site can appear compliant, well equipped and well briefed, yet still fail at the point where speed, judgement and coordination matter most.
What terrorism preparedness actually means
Preparedness is the organisation’s ability to prevent, recognise, respond to and recover from a terrorism-related incident with enough competence to reduce harm. That includes physical security measures, but it also includes people, leadership, communications, training standards, decision-making and the quality of coordination between teams.
This is where many assessments go wrong. They concentrate on assets and documents because those are easier to inspect. The harder question is whether the operation performs under pressure. A venue may have CCTV, access controls and evacuation plans, but if supervisors are unsure who calls the police, if staff do not understand lockdown triggers, or if senior leaders cannot prioritise conflicting information, the preparedness gap is operational rather than administrative.
A credible assessment therefore needs to test more than compliance. It needs to show whether your arrangements would still function when the situation becomes fast, confusing and incomplete.
How to assess terrorism preparedness without reducing it to paperwork
The most useful way to assess preparedness is to break it into five connected areas – threat understanding, site vulnerability, people capability, incident management and recovery resilience. Looking at only one of these will give you a partial answer.
Threat understanding comes first. Organisations need to know what they are preparing for, not in abstract terms but in relation to their actual exposure. A city-centre retail site, a hotel hosting high-profile guests and a critical infrastructure operator do not face the same risk picture. The threat profile depends on location, public access, symbolic value, footfall, routines, nearby transport links and whether an attack on that site would create wider disruption. If your assumptions are generic, the rest of the assessment will be generic too.
Site vulnerability is the next layer. This is where you examine how an attacker might exploit the environment. Entry points, queueing areas, vehicle approaches, hostile reconnaissance opportunities, blind spots, public circulation zones and back-of-house weaknesses all matter. Good assessors do not just ask what security measures are present. They ask how those measures could fail, be bypassed or create delay at the wrong moment.
People capability is often the deciding factor. Staff awareness, confidence and role clarity determine whether early warning is recognised and whether protective action happens quickly enough. You are looking for more than training completion rates. You are looking for evidence that people understand suspicious behaviour, know their actions in different scenarios and can operate despite noise, uncertainty and stress. That is a much higher standard than asking whether they attended a briefing six months ago.
Incident management is where leadership and control are tested. This covers command structure, communication routes, escalation thresholds, liaison with emergency services, accountability for occupants and the ability to shift from routine operations into emergency mode without paralysis. Plans should support action, not slow it down. If decision rights are unclear or if too many approvals are needed, precious time is lost.
Recovery resilience is the final part and too often ignored. Terrorism preparedness is not only about the first minutes. It also includes business continuity, welfare, reputational management, scene preservation, stakeholder communication and the disciplined return to operations. An organisation that handles the initial incident well can still fail badly in the following hours and days.
The evidence that matters most
If you want an honest picture, rely on evidence from multiple sources. Documents matter, but they are the baseline, not the verdict. You need to compare what is written, what people believe and what the organisation can actually do.
Start with plans, threat assessments, emergency procedures, training records and previous exercise reports. Then test those against interviews with leaders, supervisors and frontline staff. If the written procedure says one thing but three different managers describe three different responses, that is a capability gap.
After that, move into observation and testing. Walk the site as an adversary would. Watch shift handovers. Review control room practices. Examine how visitors are managed during busy periods rather than quiet ones. Look at what happens when the operation is stretched, because terrorism rarely arrives at a convenient time.
Exercises are especially valuable here. Tabletop sessions reveal whether leaders can think clearly and allocate priorities. Live drills show whether staff can move, communicate and control the environment. Digital capability diagnostics can also add value when they provide immediate, objective feedback on knowledge, judgement and organisational readiness rather than generic scorecards. The point is not to create theatre. The point is to identify where performance breaks down.
How to assess terrorism preparedness in real operating conditions
A sterile assessment gives false confidence. Real preparedness should be tested against actual operating conditions, including peak footfall, reduced staffing, contractor presence, simultaneous incidents and technology failure. That is where hidden weaknesses appear.
For example, a hospitality venue may have a clear lockdown procedure on paper, but during service hours the music, public movement and split staffing model may make message delivery far harder than expected. A retail site may rely on radio communications that become overloaded in a fast-moving incident. An events team may know evacuation routes but struggle to distinguish between a fire response and a marauding attack response when seconds count.
This is why scenario selection matters. Assessments should include plausible, site-relevant threats rather than dramatic but unlikely cases. The objective is to test judgement, coordination and practical control measures against the threats your organisation is most likely to face or most likely to mishandle.
There is a trade-off here. Highly realistic exercises can reveal more, but they require time, planning and leadership buy-in. Lighter-touch evaluations are easier to run and can still be useful, especially across large estates, but they may miss behavioural weaknesses. The right approach depends on risk, maturity and available resource. What matters is that the method is honest about its limits.
Common signs your preparedness is weaker than it looks
Some weaknesses appear repeatedly across sectors. One is overconfidence in technology. Cameras, barriers and access systems help, but they do not interpret behaviour, lead frightened people or make difficult decisions. Another is training that is too broad to be useful. Staff are told to stay vigilant but are not taught what to look for, what to report or how to act without waiting for perfect information.
Another problem is fragmentation. Security, operations, facilities, HR and communications each hold part of the picture, but no one tests the whole system together. Terrorist incidents do not respect departmental boundaries. If your response depends on perfect handovers between silos, it is fragile.
The final warning sign is mistaking compliance for readiness. Meeting a legal requirement is necessary. It is not the same as being capable. A board can sign off procedures and still leave frontline teams underprepared. That gap is where avoidable harm lives.
What good looks like after the assessment
A strong assessment should leave you with more than a risk register. It should give you a clear view of what needs to improve first, what can wait and how progress will be measured. Some issues will require physical changes. Others will demand sharper procedures, targeted exercises or better leadership preparation.
The best improvement plans are phased and realistic. Immediate actions might include clarifying incident roles, tightening reporting routes or updating suspicious activity guidance. Medium-term work may involve exercising senior decision-makers, redesigning access arrangements or improving coordination with partners. Longer-term improvement may focus on building a stronger protective security culture across the organisation.
This is also where specialist support can make the difference between a generic review and a useful capability uplift. Mildot Group’s approach is built around turning theory into action, using assessment, learning and diagnostic tools to show where readiness is real and where it only appears to be.
Preparedness is not proved by confidence, nor by paperwork. It is proved when people know what to do, leaders act decisively and systems hold together under pressure. If you want to assess terrorism preparedness properly, test the operation you actually run, not the one you imagine you have.
Apply for consultancy assistence
Mildot Group consultancy capacity is limited to ensure every organisation receives direct practitioner involvement, practical solutions, and support throughout the project.
Useful Links:
.
