Incident Response Plans & Commissioning

Apply practical response frameworks that function under pressure

Note: Firstly, listen to the audio discussion then read the text.

This lesson builds directly on the previous one, but I’ve chosen to separate and emphasise this topic because “incident” response plans and commissioning are absolutely essential.

Lesson Objectives

This lesson will introduce you to:

The purpose of incident response plans.
The key components of an effective incident response plan.
The principles of operational commissioning.
Practical methods for validating organisational capability.

Learning Outcomes

By the end of this lesson, you will be able to:

Explain the purpose of an incident response plan.
Identify the key components of an effective incident response plan.
Explain the principles of operational commissioning.
Distinguish between document compliance and operational capability.

They form the foundation for “staff” training, ensuring that employees are equipped with the knowledge and confidence to respond effectively. The primary goal of these plans is to empower staff to act decisively when it matters most.

You now understand the Organised Chaos theory, thats a vital requirements to create effective incident response plans.

So, the focus of this lesson is understanding incident response plans, the commissioning and why they are vital in dealing with incidents.

These plans outline the actions staff need to take during emergencies and provide clear, practical steps to follow.

For these plans to work effectively, staff must be well prepared and confident in applying them.

To achieve this, Toolbox Talks and Quick Assessment Questions are the most effective methods to ensure everyone is informed and ready.

Within a 5 to 10 minute time frame on a regular basis, you can have a major impact on the staff ability to make decisions and save lives, using the toolbox talks and QAQ system is the number one option and Ive used it for decades.

No staff down time, no time away from work duties, just a rapid system to develop staff.

Toolbox talks and QAQ’s are covered in another Mildot Group programme.

Back to Incident Response Plans. It’s important to keep things simple. A few well crafted response plans can cover a wide range of threats, as the actions taken will often be similar.

Avoid overcomplicating by creating separate plans for every possible threat, focus instead on common, practical steps that can be adapted as needed, flexibility is crucial.

The plans are also evidence that you have considered the threats and vulnerabilities and documented the mitigation.

They are also an excellent tool to deliver the regular toolbox talks and quick assessment question sessions.

Why do we need them

Protecting Lives

The primary goal of this plan is to help protect everyone in and around the facility during a violent incident.
A quick, organised response prevents panic and confusion, reducing injuries and fatalities.

Clear Roles and Responsibilities

Staff must know exactly what to do, whom to inform, and how to act during an emergency.
Clearly defined roles and procedures ensure coordination and avoid delays in responding. An all-informed approach is the best method.

Legal and Ethical Responsibility

Businesses have a duty of care to provide a safe environment for employees and customers.
Failure to act or respond properly could lead to legal consequences and reputational damage.

Supporting Emergency Services

The quicker and clearer the information given to “emergency” services, the faster they can respond effectively.
Staff who are prepared can provide essential details (e.g., attacker descriptions, threat locations) that help first responders act decisively.
Mitigating the “Emergency” “Services” Response Gap is critical.

Minimising Chaos and Panic

Panic leads to poor decision-making, injuries, and potential further harm.
A structured plan ensures calm communication and organised actions during an “incident“.
The Military term known as Organised Chaos will come into play. Some people will panic, others will freeze, but some will kick into survival mode and spark other people into action. Not all staff will respond appropriately at first, but others will and take control.
Staff “training” using toolbox talks and QAQs is crucial to developing peoples system 1 thinking, that’s fast effortless and automatic.

Preparation for Worst-Case Scenarios

No one can predict when or where a violent incident may occur, but preparation ensures readiness.
Practicing these plans helps staff feel confident and capable of handling real-life threats.

Key Features of a Plan and Their Importance

Incident Detection and Notification

Early detection of suspicious activity or an unfolding attack is critical to prevent escalation.
Rapid communication with the Security Team and emergency services ensures the fastest possible response.

Protective Actions (Shelter, Evacuation, Lockdown)

These actions are designed to respond to different threat scenarios:

Sheltering protects people when evacuation is unsafe.
Evacuation removes people from danger when it is safe to leave.
Lockdown keeps threats out of safe zones and prevents harm inside the facility.

Run, Hide, Tell, Fight

This simple, universally recognised system provides clear guidance for everyone to follow in an active threat situation:
- Run if it’s safe to do so.
- Hide if running isn’t an option.
- Tell other staff, customers and authorities as soon as possible.
- Fight. Not covered in UK advice but history tells us by-stander intervention will happen.

Customer Management

Staff must take charge of customers to prevent panic and ensure their safety.
Calm, assertive communication and guiding customers to safe locations are essential.

Post-Incident Actions (same day)

Accountability and support after the incident ensure that everyone is safe and receives any necessary assistance.
Reviewing the response helps improve future preparedness.

Making the Plan Simple and Understandable

Keep It Simple Stupid is the mantra.
Toolbox Talks to educate.
Quick Assessment Questions to assess and improve staff abilities.

The Importance of Regular Training and Drills

Repetition Builds Confidence

Regular practice through drills and scenario-based exercises ensures that staff are prepared and can act quickly under pressure.

Improved Coordination

Drills foster teamwork and familiarity with roles, ensuring a seamless response during an actual incident.

Feedback and Continuous Improvement

Each drill provides an opportunity to identify weaknesses in the plan and make adjustments.

Summary of Key Takeaways

Plans Save Lives – A well-structured response minimises chaos and maximises safety.

Clarity is Crucial – Staff must understand their roles and how to communicate effectively.

Preparation Prevents Panic – Regular training ensures everyone knows what to do.

Keep it Simple – Toolbox talks and quick assessment questions sessions help staff retain essential information.

By embedding these practices into daily operations, the organisation can ensure a higher level of preparedness, protect lives, and support emergency services effectively during critical situations.

Incident Response Plan Template for Protective Security Against Terrorist & Hybrid Incidents

The following is an incident response plan example of headings and reasons, all organisations will develop their own similar systems.

The below is intended as a guide and start point, as with all the programme material, its adaptable for any organisation.

1. Incident Detection and Initial Notification

Triggering Event:

A member of staff observes suspicious activity or an unfolding violent attack inside the facility or directly outside the facility or event, or at a neighbouring site.
Or, a member of the public report’s suspicious activity or violence to a member of staff.

Immediate Actions by the First Notifier (Staff or Public):

Mentally record as much detail as possible if time permits:

Location: Exact location of the threat.
Description: Number of attackers, weapons involved, appearance, behaviour, and direction of movement.

If the attack is happening at your location, this stage will not need to happen, move straight to Rapid Risk Communication procedures.

Method of Notification:

Direct verbal communication or radio/phone call to Management or Security.
Use pre-established incident codes if communicating over shared channels.

2. Rapid Communication Between Staff

This stage is critical and must be understood by all staff:

Initiate the Incident Response Procedure:

Notify all staff use all possible options and loudspeaker systems (radio, phone, or messaging system).
Use a pre-determined alert signal (e.g., specific code words or alarms).
The best method is Verbal Communications using loudspeaker systems, using clear basic instructions.
All staff must understand the procedures.
This stage delivers rapid action from staff even in other locations within the facility. Time is of the essence in incident situations and enabling concurrent activity is a priority.

Information to Be Shared:

Exact location and nature of the threat.
Instructions for customer safety measures (evacuation, shelter, etc.).
Status updates as the situation evolves.

3. Emergency Services Notification

Who Alerts Emergency Services:

Designated staff member (e.g., Management, Supervisors or Security Team Leader).
Do not leave this requirement to chance. This is a critical requirement.
Minimising the Emergency Services Response Gap is a priority requirement.

Method of Contact:

Call 999 (UK) or equivalent emergency service number.
Clearly provide:
- Facility name and address.
- Details of the incident (type of threat, location, number of attackers, weapons, injuries).
- “Contact” information for further coordination.

4. Protective Actions

4.1 Shelter in Place (Secure Locations Inside the Facility) and Lockdown.

When to Shelter:

If evacuation is too dangerous due to proximity of the threat.
If instructed by emergency services.

Actions for Staff:

Lockdown. Direct customers to designated secure areas (e.g., reinforced rooms, interior spaces, areas with windows that allow exit onto the street).
Lock doors and barricade entry points.
Ensure everyone stays low, silent, and away from windows.
Use the “Hide” principle:
- Turn off lights.
- Silence phones.
- Maintain calm.

4.2 Mass Evacuation

When to Evacuate:

If the threat is localised and safe evacuation routes exist.

Evacuation Procedure:

Use pre-determined evacuation routes and exits.
Direct customers to exits points and alternative exit points.
Staff should remain visible and guide customers calmly but firmly.
Avoid exits that are exposed to the threat.

4.3 Lockdown Procedures

When to Initiate Lockdown:

If the threat is on-site and evacuation is unsafe.

Steps to Lockdown:

Lock all exterior and interior doors.
Move everyone to pre-designated safe zones.
Maintain communication with emergency services and staff.

5. Customer Management

Controlling Movement:

Use clear, loud instructions to direct customers to safe locations or exits.
Ensure staff are positioned to guide and assist vulnerable individuals (children, elderly, disabled).
Avoid causing panic, use calm and assertive communication.

Using “Run, Hide, Tell”:

Encourage customers to:
- Run to safety if there’s a clear, safe route.
- Hide if evacuation isn’t possible.
- Tell emergency services or staff if they have vital information.
- Fight, this is not a recognised approach in the UK, but history tells us Bystander Intervention will happen in most cases, its human instinct.
- The priority is move everybody away from the threat.

6. Post-Incident Actions

Accountability:

Ensure all staff and customers are accounted for after the incident if possible.
Compile incident details for debriefing and handover to emergency services.

Support:

Provide medical aid if required.
Offer psychological support to affected individuals.

Review:

Conduct a post-incident review to evaluate the effectiveness of the response and update the plan if necessary.
These procedures will be detailed in the Business Continuity Plan or similar document.

Real-World Commissioning of Counter Terrorism Mitigation

For the next part of the lesson, firstly listen to the audio discussion then read the text on commissioning.

Throughout my career, I’ve audited and commissioned numerous protective security systems.

A common mistake I’ve observed in many organisations is how they approach the commissioning phase.

They often focus solely on confirming that each element, both technical and procedural, is in place and functioning individually.

I’ve frequently been assured; everything is in place and working. However, it’s at that moment, when I explain what I’m actually going to assess, that the reality of true operational readiness begins to set in.

When commissioning a protective security system, focusing solely on paperwork and ensuring technical systems work is insufficient for real-world operational effectiveness.

Having the best paperwork in the world is meaningless on its own, you must commission and assess any CT Policy and Procedures applying real-world application.

Here’s why and how the system must be assessed for real-world responses and how benchmarking and KPIs enhance its functionality:

1. Paperwork and Technical Compliance Do Not Guarantee Real-World Effectiveness

Paperwork. While essential for accountability, legal compliance, and record-keeping, it does not reflect the dynamic realities of how staff will respond during an actual incident. Paperwork is meaningless if it doesn’t translate into practical realities.

Technical Systems. Even if alarms, cameras, or locks work perfectly, their effectiveness depends on how staff interpret, respond to, and manage those systems in real-world scenarios.

The Void. A system can be technically compliant yet fail catastrophically during a practical incident if staff are unprepared or response procedures are poorly designed. The bottom is, if nobody knows the response plan, do not expect people to respond as per the theoretical plan. The ultimate goal of counter terrorism is empower people and save lives.

2. Why Real-World Assessment is Critical

Human Element. Security systems are only as strong as the people who operate and respond to them. Staff must be trained to respond swiftly, accurately, and consistently.

Dynamic Situations. Incidents often unfold unpredictably, requiring real-time judgment, communication, and coordination that cannot be fully anticipated in technical specifications. Practical application is key.

Stress Testing. Real-world assessments expose weaknesses in procedures, communication breakdowns, or equipment usability under pressure.

3. Response Time Benchmarking

Key Metric. Response time is a measurable and critical factor in determining the effectiveness of a security system. How quickly staff react to incidents directly impacts outcomes.

Incident Response Standards. By measuring how long it takes staff to detect, assess, and respond to simulated incidents (e.g., unauthorised access, alarms, or emergencies), organisations can establish benchmarks.

Continuous Improvement. These benchmarks serve as targets for improvement and maintenance, ensuring staff remain prepared and systems remain efficient.

4. Creating KPIs for Protective Security

Key performance indicators (KPIs) transform abstract goals into measurable outcomes.

Examples include:

Response Time KPIs. Time taken to respond to specific incidents, such as alarms, breaches, bomb threat etc.

Incident Resolution Rate. Percentage of incidents successfully responding to within the benchmark response time.

System Usability. Percentage of staff successfully completing response drills without errors.

Training Effectiveness. Time to train staff to reach proficiency in handling incidents.

Error Rates. Frequency of poor responses.

5. Benefits of Real-World Testing and KPIs

Operational Readiness. Staff develop the muscle memory and confidence needed to act decisively in actual emergencies.

Identify Weaknesses. Regular testing reveals vulnerabilities in procedures, staff training, or system functionality that might otherwise go unnoticed.

Standardisation. Benchmarks provide a consistent standard for performance, ensuring all team members know what is expected and how to achieve it.

Accountability: KPIs enable organisations to monitor and evaluate the performance of their security systems and staff, ensuring sustained effectiveness.

6. Incorporating Real-World Scenarios into Commissioning

Simulations: Conduct realistic drills, including worst-case scenarios, to evaluate both staff responses and system functionality.

Feedback Loops: Use insights from assessments to refine procedures, improve training, and enhance system design.

Incident Reviews: Analyse responses to past real incidents to improve future benchmarks and training.

7. Long-Term Impact

Culture of Preparedness: Regular real-world assessments foster a proactive security culture where staff understand their role and responsibilities. Remember, test and exercises parts of a response drill before testing the whole incident response plan.

Adaptability: Benchmarks and KPIs allow organisations to adapt to evolving threats, ensuring the system remains relevant and effective.

Stakeholder Confidence: Demonstrating a commitment to operational readiness reassures stakeholders (e.g., employees, clients, regulators) that security is prioritised.
“Psychological” Support systems for staff and customers.

Summary

Focusing on real-world response ensures that protective security systems function not just in theory but in practice.

By benchmarking and creating KPIs based on real-world performance, organisations establish a measurable standard that builds resilience, reduces risk, and enhances overall security effectiveness.