Security Intelligence

Protective Security Advisor: What They Do and When to Use One | CloseProtectionHire

Q: "What is a Protective Security Advisor?"

"A Protective Security Advisor (PSA) is a security professional who provides expert advice on protective security -- the measures an organisation takes to reduce its vulnerability to hostile actors. In the UK government context, NPSA (National Protective Security Authority) deploys a network of PSAs to work with organisations that protect critical national infrastructure, government assets, and crowded places. In the private sector, protective security advisory is delivered by independent consultants and security firms. The role covers physical security, personnel security, cyber-physical interfaces, counter-terrorism measures, and the development of security management systems."

Q: "What is the NPSA and how does it differ from CPNI?"

"NPSA (National Protective Security Authority) replaced CPNI (Centre for the Protection of National Infrastructure) in 2023. The NPSA has a broader remit than CPNI -- it covers protective security advice for critical national infrastructure as CPNI did, but also has an explicit public-facing function advising crowded places venues, public bodies, and businesses on counter-terrorism protective measures. NPSA publishes free guidance on hostile vehicle mitigation, hostile reconnaissance, surveillance camera use, and site security assessment. The NPSA PSA network provides free, government-funded protective security advice to eligible organisations."

Q: "What is NaCTSO and what services does it offer?"

"NaCTSO (National Counter Terrorism Security Office) is the police body responsible for delivering counter-terrorism protective security advice to businesses and organisations. NaCTSO Counter Terrorism Security Advisors (CTSAs) work through local police forces to deliver free security advice, venue security reviews, and training (including ACT -- Action Counters Terrorism -- awareness training) to businesses in their area. NaCTSO also manages the ProtectUK platform, which provides free counter-terrorism security guidance. CTSAs do not carry an enforcement function -- the relationship is advisory."

Q: "Does Martyn's Law require venues to use a Protective Security Advisor?"

"The Terrorism (Protection of Premises) Act 2025 (Martyn's Law) does not mandate the use of a specific type of security advisor, but it does require qualifying premises to implement a terrorism protection plan (Standard Tier, 200-799 capacity) or a terrorism protection plan and security document (Enhanced Tier, 800+ capacity). The SIA, as the Act's regulator, has indicated that it expects duty holders to seek appropriate guidance in developing their plans. Engaging a qualified security advisor -- whether through NPSA, NaCTSO, or a private sector consultant -- is the most defensible way for a duty holder to demonstrate they have taken a systematic and informed approach to their obligations."

Q: "What qualifications should a professional protective security advisor hold?"

"There is no single mandatory qualification for protective security advisory in the UK. The most widely recognised credentials in the field are: CPP (Certified Protection Professional, ASIS International) -- the global standard for senior security practitioners; MSyI (Member of the Security Institute) -- the UK's primary professional body for security practitioners; CSMP (Certified Security Management Professional, Security Institute); and the NPSA's own Protective Security Advisor development programme for those working within the NPSA network. For work involving classified environments or government contracts, DV (Developed Vetting) security clearance may be required in addition to professional qualifications."

What a Protective Security Advisor does, the NPSA PSA programme, NaCTSO venue reviews, Martyn's Law compliance, and how professional security advisory adds value. Enquire today.

12 May 2026

Written by James Whitfield, Senior Security Consultant

Speak to the Team

The term “protective security” covers a substantial amount of ground: physical barriers and access control, personnel vetting, information handling, cyber-physical interfaces, counter-terrorism measures, and the management systems that tie them together. No single internal team in a mid-sized organisation will have specialist expertise across all of these domains. That is the space in which a protective security advisor operates.

The advisory role can be delivered through two channels: the government-funded network (NPSA Protective Security Advisors and NaCTSO Counter Terrorism Security Advisors) and the private sector. Both are worth understanding, because the right answer for most organisations involves both.

NPSA: The National Protective Security Authority

The National Protective Security Authority replaced the Centre for the Protection of National Infrastructure (CPNI) in March 2023. The NPSA has a broader remit than CPNI had – CPNI focused primarily on critical national infrastructure operators; NPSA extends that remit to include public-facing guidance for crowded places venues, businesses with counter-terrorism obligations under Martyn’s Law, and any organisation seeking to improve its protective security posture.

NPSA publishes guidance across:

Hostile vehicle mitigation (NPSA HVM Guide 2024, PAS 170:2023 temporary measures, IWA 14-1:2013 permanent vehicle barriers)
Hostile reconnaissance (recognising and countering pre-operational surveillance)
Physical security of buildings (access control, perimeter, CCTV, security glazing)
Personnel security (vetting, insider threat, pre-employment screening)
Mail and deliveries (suspect packages, vehicle-borne IED recognition)
Protective Security Advisor programme (the NPSA network of advisors working directly with organisations)

The NPSA PSA network provides free advice to eligible organisations – primarily those operating critical national infrastructure, government premises, or crowded places. Engagement with the NPSA PSA is typically initiated through the organisation’s sector regulator or through direct contact with NPSA.

NaCTSO: Counter Terrorism Security Advisors

NaCTSO (National Counter Terrorism Security Office) operates through local police Counter Terrorism Security Advisors (CTSAs), who are embedded in regional counter-terrorism policing units. CTSAs deliver:

Venue security reviews: A CTSA will visit a premise and conduct a structured assessment of its counter-terrorism vulnerability – perimeter, access control, CCTV coverage, evacuation capability, staff training, and the quality of the terrorism protection plan (where one is required). This is delivered free of charge.

ACT Awareness training: Action Counters Terrorism (ACT) is the public sector counter-terrorism awareness programme, covering threat recognition, hostile reconnaissance, the Run Hide Tell response protocol, and suspicious item procedures. ACT training is free and available to any business or organisation.

ProtectUK guidance: NaCTSO manages the ProtectUK platform, which consolidates counter-terrorism protective security guidance for businesses, venues, and event organisers. It includes Martyn’s Law compliance guidance, sector-specific resources, and the ACT training portal.

CTSAs do not have enforcement powers. The relationship is purely advisory.

Martyn’s Law and the Advisor Role

The Terrorism (Protection of Premises) Act 2025 – known as Martyn’s Law, named for Martyn Hett who was killed in the Manchester Arena attack on 22 May 2017 – creates a statutory duty on operators of qualifying premises and events.

Standard Tier (premises with a capacity of 200 to 799): duty holders must implement a terrorism protection plan and ensure staff are trained in its contents. The plan must address response to a terrorist attack – evacuation, invacuation, communication, and notification procedures.

Enhanced Tier (premises or events with a capacity of 800 or more): duty holders must produce both a terrorism protection plan and a security document – a more comprehensive assessment of terrorism vulnerability and the security measures in place to address it. They must also designate an individual responsible for the security document’s implementation.

The SIA is the designated regulator for Martyn’s Law. It will have powers to issue compliance notices and financial penalties for non-compliance.

The Act does not specify that a Protective Security Advisor must be used to develop the plan or document. But it does require that the plan and document reflect a genuine, systematic assessment of the premises’ vulnerability and the measures in place to address it. An organisation that has engaged with NPSA, NaCTSO, or a qualified private sector advisor is substantially better placed to demonstrate that standard has been met than one that has produced a plan internally without specialist input.

CONTEST and the Broader Counter-Terrorism Framework

CONTEST – the UK’s counter-terrorism strategy, most recently updated in 2023 – operates across four workstreams: Prevent (stop people becoming terrorists), Pursue (disrupt and prosecute terrorists), Protect (reduce vulnerability of people and places), and Prepare (mitigate the impact of attacks that do occur).

Protective security advisory sits primarily within the Protect strand. The specific measures it promotes – hostile vehicle mitigation, access control, staff training, suspicious item procedures – are designed to make it harder for an attacker to carry out an attack and to reduce the casualty potential if they do.

For venue operators, crowded places businesses, and event organisers, understanding where their obligations sit within the CONTEST framework is useful context for engaging with both government advisors and private sector consultants. A security advisor who presents recommendations within this framework – rather than as a disconnected list of technical measures – is communicating the purpose and priority of the work in a way that is useful for internal sign-off and governance.

The Private Sector Advisory Role

Government advisory services are free, high quality, and designed to meet the operational needs of most qualifying organisations. They have limitations: capacity constraints on the government side mean that advice is not always available at the speed a commercial programme requires, and the government advisor cannot carry commercial liability for the advice given or become embedded in an organisation’s procurement process.

Private sector protective security consultants fill these gaps:

Independent security reviews with professional indemnity cover
Expert witness and litigation support
Security specifications for architectural projects and major refurbishments
Procurement support for security equipment (CCTV systems, access control, vehicle barriers)
Ongoing retainer relationships providing access to specialist advice for new projects and events
Programme management for multi-site security improvement programmes

For event organisers with Martyn’s Law obligations, see our event security planning guide. For the crowd dynamics and capacity planning considerations that sit alongside the counter-terrorism measures, see our crowd management for public events guide.

Summary

Key takeaways

Free government security advice should be the starting point

NPSA and NaCTSO provide free, credible, and practically useful protective security guidance and advisory services to eligible organisations. For crowded places operators, venues with Martyn's Law obligations, and businesses assessed as having counter-terrorism vulnerability, engaging with the NPSA PSA or NaCTSO CTSA network before commissioning private security consultancy is good sense. The government advice establishes a baseline, identifies issues the organisation may not have considered, and can reduce the scope and cost of subsequent private sector engagement.

The security review produces the brief for implementation

A protective security advisory engagement that produces a report with 47 recommendations and no implementation priority is not useful. The output of a security review should be a risk-prioritised action plan: which measures address the highest-severity vulnerabilities, which can be implemented at low cost and high speed, and which require capital investment and a longer implementation timeline. The advisor should be involved in implementation planning, not just observation.

Counter-terrorism measures and crime prevention overlap substantially

Hostile vehicle mitigation, hostile reconnaissance countermeasures, perimeter security, and access control -- all of which are standard counter-terrorism protective measures -- also provide significant deterrence and delay capability against criminal actors. A security investment justified on Martyn's Law compliance grounds often produces benefits that extend well beyond the counter-terrorism rationale. This dual-use value should be part of the business case for security investment.

Martyn's Law creates a legal duty, not just a best-practice obligation

The Terrorism (Protection of Premises) Act 2025 imposes a statutory duty on qualifying premises operators. Non-compliance can result in enforcement action by the SIA, including compliance notices and financial penalties. Duty holders who have not engaged with their Martyn's Law obligations -- identified their tier, understood their obligations, and begun developing their terrorism protection plan -- are in a materially weaker legal position if an incident occurs at their premises.

The advisor relationship is most effective when it is ongoing

A one-off security review produces a point-in-time assessment. Threats evolve, operations change, and the security measures implemented at the time of the review may not remain appropriate twelve months later. Organisations that treat protective security advisory as an ongoing engagement -- with periodic review, threat landscape updates, and access to specialist advice when new projects or events create new risk -- maintain a better security posture than those who treat security reviews as a compliance exercise to be filed and forgotten.

FAQ

Frequently Asked Questions

A Protective Security Advisor (PSA) is a security professional who provides expert advice on protective security – the measures an organisation takes to reduce its vulnerability to hostile actors. In the UK government context, NPSA (National Protective Security Authority) deploys a network of PSAs to work with organisations that protect critical national infrastructure, government assets, and crowded places. In the private sector, protective security advisory is delivered by independent consultants and security firms. The role covers physical security, personnel security, cyber-physical interfaces, counter-terrorism measures, and the development of security management systems.

NPSA (National Protective Security Authority) replaced CPNI (Centre for the Protection of National Infrastructure) in 2023. The NPSA has a broader remit than CPNI – it covers protective security advice for critical national infrastructure as CPNI did, but also has an explicit public-facing function advising crowded places venues, public bodies, and businesses on counter-terrorism protective measures. NPSA publishes free guidance on hostile vehicle mitigation, hostile reconnaissance, surveillance camera use, and site security assessment. The NPSA PSA network provides free, government-funded protective security advice to eligible organisations.

NaCTSO (National Counter Terrorism Security Office) is the police body responsible for delivering counter-terrorism protective security advice to businesses and organisations. NaCTSO Counter Terrorism Security Advisors (CTSAs) work through local police forces to deliver free security advice, venue security reviews, and training (including ACT – Action Counters Terrorism – awareness training) to businesses in their area. NaCTSO also manages the ProtectUK platform, which provides free counter-terrorism security guidance. CTSAs do not carry an enforcement function – the relationship is advisory.

The Terrorism (Protection of Premises) Act 2025 (Martyn’s Law) does not mandate the use of a specific type of security advisor, but it does require qualifying premises to implement a terrorism protection plan (Standard Tier, 200-799 capacity) or a terrorism protection plan and security document (Enhanced Tier, 800+ capacity). The SIA, as the Act’s regulator, has indicated that it expects duty holders to seek appropriate guidance in developing their plans. Engaging a qualified security advisor – whether through NPSA, NaCTSO, or a private sector consultant – is the most defensible way for a duty holder to demonstrate they have taken a systematic and informed approach to their obligations.

There is no single mandatory qualification for protective security advisory in the UK. The most widely recognised credentials in the field are: CPP (Certified Protection Professional, ASIS International) – the global standard for senior security practitioners; MSyI (Member of the Security Institute) – the UK’s primary professional body for security practitioners; CSMP (Certified Security Management Professional, Security Institute); and the NPSA’s own Protective Security Advisor development programme for those working within the NPSA network. For work involving classified environments or government contracts, DV (Developed Vetting) security clearance may be required in addition to professional qualifications.

Get in Touch

Request a Consultation

Describe your security requirements below. All enquiries are confidential and handled by licensed consultants.