Preparing and Responding to a Chemical, Biological or Radiological (CBR) Incident - Guide for Security Managers

  • Knowledge Level: All Levels
  • Protection Stage: All Stages
  • Time to read:

This guidance is for Security Managers and/or Incident Managers, providing strategic and practical considerations for a site that they manage

Last Updated: 27 August 2026
Share this article:

Introduction

This guidance is for the primary stakeholder involved in preparing for and responding to emergencies. Depending on the size and security structure of your organisation, this could be a security manager, an in-house security director or an individual or team of dedicated incident/emergency planners and responders.

This guidance will provide strategic and practical considerations to support your preparation and response to a CBR incident. This includes:

  • Your role in preparing for an incident, including developing a response strategy and communicating and testing this with the appropriate personnel, such as Security Control Room (SCR) staff. 

Your role in responding to an incident, including ensuring a response strategy is implemented correctly with appropriate personnel.

Preparing for a CBR incident

When preparing for a CBR incident, this should be considered within a wider strategic risk management approach for preparing and responding to terrorist incidents. Plans for CBR incidents should be coordinated and communicated collectively as part of a broader plan for addressing terrorist attacks, which will enable greater impact of plans and support overall risk reduction, with greater support from senior leadership.

The following are your key responsibilities:

  • Identify key stakeholders who are involved in preparing and responding to an incident and communicate responsibilities.
  • Develop awareness of building plans, layouts, and vulnerabilities.
  • Develop a CBR response strategy, which includes information on:
    • Evacuation and invacuation.
    • Messaging and communications.
    • Modifying building functions.
  • Training, exercising and guidance

1. Identify and communicate responsibilities to key stakeholders

When preparing for a CBR incident, you should identify all stakeholders who are involved in or are impacted by planning and response activities. This ensures that you have considered necessary roles in your response strategy and can communicate responsibilities during a CBR incident to appropriate personnel in the preparing phase.

Key stakeholders include security personnel such as SCR staff, building managers and engineers, including those responsible for Heating, Ventilation and Air Conditioning (HVAC) systems.

Once you have identified all relevant personnel and developed a CBR response strategy, you should ensure that all staff understand their responsibilities during a CBR incident, understand the responsibilities of other key stakeholders, and know who they should engage with during an incident.

For example, during a CBR incident SCR staff will likely need to consult with an on-duty engineer to change building processes such as HVAC and lift functions if this is outlined in your strategy. They should therefore know who to contact and when they should be contacted.

The contact details of key stakeholders should be readily accessible if further consultation is required depending on who is on site during each working day. A security-focussed organisational chart for CBR incidents can be developed to support this. 

2. Increase awareness of building plans, layouts and vulnerabilities

The vulnerabilities of a site to the release of a CBR material can vary significantly depending on the site and may include, for example:  

  • Accessible areas with minimal search and screening.
  • Groups of people congregating in vulnerable areas, such as queues at entrances/exits.
  • Exposed ground level air inlets which can allow a CBR material to enter a building following an external release.
  • Mail rooms (depending on the mail screening measures in place).

Conducting a site assessment, for example by following the operational requirements process (see Annex A for more information), can help you to identify potential site CBR vulnerabilities and should be carried out with appropriate personnel e.g. a facilities manager and/or engineer. Understanding the vulnerabilities of your site to a CBR release can enable you to build a response around specific vulnerabilities. For example, modifying HVAC functions to limit the ingress of a CBR material.

You should also communicate site vulnerabilities to key stakeholders. For example, it may enable SCR staff to prioritise actions, such as closed circuit television (CCTV) monitoring, around known vulnerabilities. It will also enable a more effective response during an incident.

The SCR do not require an in-depth understanding of all building technologies and functions, as consultation with a building manager or engineer should be enacted. However, a good awareness of conventional safety and security measures, technologies, and their locations and functions can support an effective response. Knowledge of the following is recommended:

  1. Any on site hazards and risks e.g. stored gases.
  2. Entrances, exists and evacuation routes that could be used in an emergency. 
  3. Building utilities and technologies (including controls that change or shut down building functions): 
    •    HVAC systems, controls and air zones. 
    •    Fire alarm control panel(s). •    Lift and escalator control panel(s). 
    •    CCTV. 
    •    Fire protection components e.g. fire hydrants, risers. 
  4. Location of air inlets and outlets.
  5. Location of plant rooms.

3. Developing a CBR Response Strategy

3.1. Evacuation and Invacuation

An effective evacuation strategy can reduce the number of building occupants that are affected and reduce the overall impact of an incident. In certain limited scenarios, for example when an attack occurs externally and/or there are significant external hazards, an invacuation to a safe internal location, or shelter-in-place, may be more appropriate.

Recognise, Assess, React (RAR) for CBR Incidents lists the key recognition, assessment and response actions that should form the basis of any strategies in place. See Responding to a CBR Incident for more information.

You should develop pre-planned CBR evacuation and invacuation strategies with key stakeholders and ensure all relevant personnel are aware of these. These should detail 
a range of potential routes to use, taking into account the location(s) of the CBR hazard and where people in the building are located.

Affected routes or areas are those that are potentially hazardous, where you can identify indicators of a CBR attack.

Unaffected routes or areas are non-hazardous, where no indicators of a CBR attack are present. 

The indicators of a CBR attack are described in RAR for CBR Incidents on page 22.

Strategies should include identifying where the hazard is located and moving individuals away from these areas along unaffected routes to minimise the risk of exposure to the CBR material. If an evacuation is carried out, assembly points should also not be located near to external air exhausts. 

CBR incidents are complex in nature, for example:

  • There may be multiple affected areas. The areas affected may change in location for example if a CBR material spreads around a building. 
  • The CBR material may not be immediately obvious or difficult to identify, so it may be challenging to identify unaffected routes.
  • Affected individuals may accidentally contaminate other areas within a building or other people during and after their evacuation.

Any pre-planned strategy in place should therefore be dynamic in nature and updated as the incident develops. For example, the routes identified as unaffected may become affected as a CBR material spreads around the building and the SCR should communicate this  to those who have not yet evacuated.

Strategies should act as guidelines to be adapted as necessary as an incident unfolds.

The safety of all security personnel on the site should be considered and referenced in your strategy, as it is important that security personnel do not put themselves in danger when responding to an incident.

Your strategy should involve a specific plan for evacuating the SCR should it become affected during an incident.

When developing your response strategy it is important that you consider the impact of your plan on other processes or procedures in place, such as fire procedures and other counter-terrorism related response plans. This can be achieved by carrying out a risk assessment of your CBR response strategy and comparing this to other response procedures to identify different response activities. Where appropriate, you should consider aligning response activities to reduce the burden on security staff, for example it is likely that both CBR and fire response procedures will involve evacuation.

3.2. Messaging and Communications for SCR Personnel

During a CBR incident, appropriate messaging is critical to reduce the impact of an incident. Preparing and understanding effective messaging can significantly improve incident outcomes by: 

  • Ensuring building occupants clearly understand what they should do and where they should go.
  • Reducing confusion and panic.
  • Enabling an appropriate emergency services response and ensuring those entering your building are sufficiently informed.

In the planning phase, it is your role to develop and agree a messaging strategy for a CBR incident and ensure the SCR have a clear understanding of this.

In your messaging strategy, you should include the communication systems that should be used during an incident. Depending on your organisation this may include a Public Address and Voice Alarm (PAVA) system. If your organisation does not have a wide ranging PAVA system, consider how messages can be communicated to building occupants rapidly e.g. through digital signs or text message alerts.

The following guidelines should be followed when generating  your messaging approach. No CBR knowledge is necessary to develop messaging.

Messaging should:

  • Be clear and concise, providing current, up-to-date information.
  • Prevent unnecessary speculation on the incident type.
  • Not include language that is too complex or unfamiliar, such as CBR-specific terminology.

For building occupants, planned messaging should:

  • State that an incident has occurred, not stating the nature of the incident by avoiding words such as “CBR”, “gas”, “toxic substance” etc.
  • Tell people which areas to avoid and the strategy to follow, such as evacuation or shelter-in-place.
  • Tell people which routes are unaffected and safe to use, to report anything suspicious to security personnel and await further instructions once evacuated.

Your messaging strategy for building occupants should also consider the actions for affected individuals once an evacuation has been initiated and individuals are away from the immediate hazard. These include:

  • Using REMOVE, REMOVE, REMOVE for those evacuating from an affected area, see Annex C for more information. 
  • Ensuring that affected building occupants do not leave the area entirely to prevent the wider spread of CBR material and ensure they receive medical treatment.
  • Ensuring that those evacuating from an affected area remain separated from other building occupants, to prevent the transfer of any material to unaffected individuals.

You should also consider communications to people external to the site, such as staff travelling to work or neighbouring locations that may become impacted if a CBR material spreads beyond your site.

For the Emergency Services, planned messaging should also be developed as an unprepared caller may provide insufficient or misleading information to emergency services call handlers. This could lead to a delay in the dispatch of suitably trained personnel.

It is likely that SCR staff will be asked to answer scripted questions relating to ETHANE by emergency services call handlers. Further valuable information that has not been specifically requested should also be provided. Refer to Annex C for more information.

When contacting the Emergency Services, personnel should follow the “say what you see” rule. This means that staff describe what they are observing using plain language.

3.3. Modifying Building Functions

You should develop clear processes and plans for how building functions are modified during a CBR incident and include these in your response strategy. You should consult with an experienced engineer where possible who understands the impacts of changing building functions.

Relevant building functions to consider modifying during a CBR incident include:

a) Lifts and escalators

The movement of lifts can create a piston-like effect, moving large volumes of air rapidly around parts of a building. During a CBR incident this can quickly spread the source of the material to contaminate other parts of the building. Furthermore, functioning escalators can also move building occupants towards hazardous areas, increasing their risk of exposure. Lifts and escalators should usually not be used during a CBR incident and building occupants should use stairwells if evacuating the building.

Following consultation with an engineer, shutting down lift functions can be considered.  

It is important however to document if there are any scenarios or building-specific exceptions to this, and any processes should be aligned with existing safety evacuation procedures, such as the evacuation routes for mobility impaired individuals. You should ensure that those modifying building functions during an incident are made aware of these exceptions.

b) HVAC systems

HVAC systems are often complex and can vary significantly depending on the building type and age. Altering the function of HVAC systems can have a range of effects, and may increase or decrease the impact of an incident.

  • Some modern building HVAC systems can provide protection to building occupants when operational, and if air is controlled properly can limit the spread of a CBR material around a building. 
  • Other ventilation configurations could cause contaminated air to spread beyond the initial affected area. For example, purging an affected area of contaminated air could cause the contamination to spread further, affecting more people.
  • In some buildings, turning off HVAC systems in an emergency may reduce the spread of a material and reduce the exposure of people.

The number of possible outcomes means it is critical that there is a clear process in place for changing the function of the HVAC system in your building and that the SCR are aware of this process. This process might involve rapid consultation with an HVAC engineer,  who is likely to direct changes to functions.

The SCR do not require an in-depth understanding of your building HVAC system, as they should consult with an HVAC engineer before any changes are made. However ensuring they have an awareness of the type and function of your building HVAC system and options for modifying its function can be useful to understand HVAC vulnerability and mitigations.

You should have a good understanding of how your building HVAC system works.

4. Training, Exercising and Guidance

Once you have developed a response strategy you should carry out a rehearsal exercise to make sure it is fit for purpose. A suggested approach is to conduct a tabletop exercise, simulating an emergency situation with all key stakeholders to understand the effectiveness of your response strategy, check that all relevant personnel understand their responsibilities and identify improvements. This could be followed by a physical rehearsal to understand how your strategy works in practice.

You should ensure that SCR staff have also reviewed appropriate guidance. An Introduction to Preparing and Responding to a CBR Incident and Preparing and Responding to a CBR Incident for SCR Staff provides information for SCR staff to understand appropriate actions during the preparing and responding phases of a CBR incident. 

For additional guidance, see Annex A.

Responding to a CBR incident

Recognise, Assess, React (RAR) for CBR Incidents posterThe following sections focus on your responsibilities during the responding phase of a CBR incident. These may differ to other attack methodologies and may include additional considerations and complexities. The responsibilities of SCR staff are also included, so that you have an awareness of the measures that they should take and can ensure that these are carried out. 

Your main responsibility during a CBR incident is to coordinate the response strategy set out in the preparing phase.

This includes overseeing:

  • The actions of key stakeholders, to ensure that they are responding effectively.
  • Evacuation or invacuation depending on the incident type including overseeing messaging with building occupants.
  • Communications between key stakeholders for example SCR staff and HVAC engineers.
  • Liaison with the emergency services.

You will likely be the main point of contact for liaising with the emergency services once they have arrived on site. You should ensure that they have the most up-to-date information utilising ETHANE as a framework for gathering this information.

The SCR are the main stakeholder when responding to a CBR incident. NPSA has developed a three-stage approach for SCR to respond to a CBR incident. These are shown in Recognise, Assess, React (RAR) for CBR Incidents. This campaign can be accessed on the NPSA public website, and includes a range of additional materials which can be downloaded to embed effective response principles within an organisation.

There are three main stages to responding to a CBR incident. These are:

  • Recognise the indicators of a CBR attack
  • Assess the incident to inform an appropriate response strategy
  • React appropriately to reduce harm to yourselves and others

This method has replaced Steps 1,2,3+ for recognising and responding to a CBR incident.

Recognise, Assess, React (RAR) for CBR  Incidents – Important Information

The opportunity to reduce the impact of a CBR attack beyond prevention is greatest towards the start of the incident. The first stage – RECOGNISE – involves identifying the indicators of a CBR attack to understand that a potential attack is underway. This is followed by the ASSESS and REACT stages which you should rapidly work through.

Where possible, the activities within the ASSESS stage should be carried out prior to the REACT stage, as the information gathered in the ASSESS stage will inform the most appropriate response activities, outlined in the REACT stage, with the least risk for additional harm to building occupants.

It may not be practically viable however during an incident to conduct a thorough scene assessment prior to initiating response actions. For example, where there are individuals in the direct vicinity of the area where a CBR attack has occurred, or is suspected to have occurred, and there is subsequent threat to life, priority should be given to provide immediate instructions to these individuals to evacuate the area and prevent further access.

The order of activities within the ASSESS and REACT stages should therefore be dynamically considered within the specific context of  an ongoing CBR incident, as it may be necessary to carry out  stages in parallel. 

The process of recognising, assessing and reacting to an incident should be completed as many times as necessary as the incident changes, for example as a CBR material spreads to a different part of a site.

The activities described within RAR for CBR Incidents should be carried out rapidly and in parallel. To support this, you should assign key roles to individuals within the SCR and ensure they understand what they need to do.

When recognising, assessing and reacting to an incident, it is important that you do not put yourself, or others, in danger. 
All staff should follow this rule, for example security personnel should not be directed by SCR into a potentially hazardous area if a CBR incident is expected.

The following sections provide additional information on RAR for CBR Incidents. It is your responsibility to ensure this is understood by SCR staff when preparing for an incident and is followed during an incident.

RAR for CBR Incidents is available alongside this guidance to support embedding this method within an organisation (see Annex A).

1. Recognise the indicators of a CBR attack

It is important that all security personnel are aware of the indicators of a CBR attack to be able to recognise before attack initiation or when an attack is underway.

Visible signs and symptoms monitored via CCTV or reported by staff are likely to be the only indicators that a CBR incident has occurred.

The signs and symptoms of a CBR incident can vary significantly depending on the material used and its specific effects. Any one of these may be an indicator of a CBR incident, and multiple indicators increase the likelihood that an incident is CBR-related. It is important that SCR staff consider these indicators in the context of your normal environment, to check there is no explainable reason for a given indicator.

Indicators of a CBR incident may include:

  1. Unexplained physical symptoms such as:
  • Eye and skin irritation
  • Twitching and convulsions
  • Disorientation and sweating 
  • Airway irritation and breathing difficulties
  • Nausea and vomiting.
  1. Other signs such as:
  • Two or more people incapacitated for no explainable reason 
  • The presence of unusual/unattended materials, devices or equipment
  • Unexplained vapour, mist clouds, powder, liquids or oily drops
  • Unexplained smells or tastes
  • Withered plant life or vegetation
  • Distressed birds or animals.

The onset of some symptoms can occur rapidly indicating that an attack is currently underway. In some circumstances, however, signs and symptoms may not appear for several days after an incident has occurred, and early symptoms could be mistaken for that of a common cold or flu.

In these instances, monitoring staff sickness patterns to identify abnormalities, for example a large number of staff off sick, can help to identify these incident types.

Another method for identifying whether a CBR attack is underway is through installed CBR detectors. There are a range of possible CBR detectors which can vary in their size, detection parameters, including range of target materials and whether they are fitted in buildings or person borne.

 You should consider the installation of any detectors only if this is proportionate to your organisation following a detailed operational requirement process. Further consultation should always be sought before buying and installing detectors.

If CBR detectors are already fitted on your site you should make sure key stakeholders are aware of these, how to identify when they are activated and detail appropriate responses following their activation in your response strategy.

2. Assess the incident to inform a safe response strategy

Once a potential CBR incident has been identified, a rapid incident assessment should be conducted to ensure that the response strategy in place is appropriate and minimises further harm to people on the site.

The nature of a CBR incident can change over the course of the incident, for example a CBR material can spread to different parts of a building and routes may become unsuitable to use. It will likely be necessary to adapt any pre-planned response strategy according to the unfolding incident, and the SCR team should continue to assess the ongoing incident throughout to update this strategy. Whilst coordinating a response strategy, you should ensure that any response is adapted appropriately.

There are five key assessment activities that should be carried out rapidly and in parallel to inform the response strategy. These are:

Why is this important?

So that people on the site are not moved through affected routes or areas, for example where a visible gas is located or where there are people showing physical symptoms, in order to limit the potential for further exposure and harm to people. CBR indicators could be isolated to a single room such as a reception or mail room, or across an entire floor or section of a building. 

How do I support this?

Make sure that you and all security personnel have a clear understanding of the indicators of a CBR incident.

Why is this important?

Identifying casualties and those who have been affected helps to advise and support the response of the Emergency Services, to make sure casualties are attended to as quickly as possible once responders arrive on the site.

How do I support this?

The location of casualties should be confirmed using CCTV and/or reports from personnel on the site and the number of people affected should be communicated to the Emergency Services.

Why is this important?

Identifying where people are located on a site, particularly if there are any large groups of people in specific locations, can help you to identify who might be at risk of exposure, as well as possible nearby unaffected routes for evacuation/invacuation..

How do I support this?

Be aware of building works and ongoing events involving large groups of people and visitors on a day-to-day basis, such as conferences, and other particular times throughout the day when people gather in locations such as reception areas. Communicate these to the SCR team.

Why is this important?

Confirming which routes are unaffected will help to identify appropriate routes for evacuation/invacuation of people on the site that reduce their risk of exposure.

How do I support this?

Make sure that you and all security personnel have a clear understanding of the indicators of a CBR incident to identify suitable evacuation/invacuation routes. Unaffected routes should be prioritised near large gatherings of people.

Why is this important?

During a CBR incident, secondary devices and/or attack methodologies could be used to cause additional harm and increase the impact of an initial CBR attack. For example, an improvised explosive device (IED) attack or bladed attack may be carried out simultaneously or following a CBR incident. SCR staff should therefore check for secondary threats to reduce the impact of a further non-CBR attack.

It is important to note however that during a CBR incident the immediate priority should be appropriately recognising, assessing and reacting to the CBR incident underway.

How do I support this?

Make sure that yourself and SCR staff have a clear understanding of the indicators of other attack methodologies. These are described in NPSA’s Recognising Terrorist Threats guide. See Annex A for more information

If there are sufficient SCR personnel to assess and react to the CBR incident underway, you should assign a role to an individual in the SCR to look for any additional immediately apparent threats. However assessing and reacting to the unfolding incident should take priority. 

3. React appropriately to reduce harm to yourself and others

There are six key activities to be performed when reacting to a CBR incident. You should oversee the implementation of these activities by key stakeholders and ensure that they are carried out in a timely and effective manner.

1. COMMUNICATE …with the Emergency Services as soon as possible, and ‘say what you see’

Emergency Services should be contacted immediately as soon as it is recognised that an incident is occurring, even if there is uncertainty about its exact nature. For example, SCR staff do not need to be certain that it is a CBR incident to make contact with the Emergency Services.

As the security manager, it is your responsibility to act as the main point of contact with the Emergency Services when they arrive on site.

In a CBR-specific incident, you should provide additional information collected during the incident regarding the location and symptoms of the casualties and whether casualties have been segregated from other staff to Emergency Services as it will aid their response.

2. COMMUNICATE…with people on the site to move them to an unaffected location, via unaffected routes

You should oversee the deployment of a pre-planned response strategy tailored to the current incident. The SCR should provide appropriate clear instructions to people on the site using pre-agreed communication channels and messages that you have outlined in the planning phase. These should be provided at a regular frequency, and when changes to the ongoing incident occur, for example, if additional routes become affected and unsuitable to use, additional update announcements should be made. Communications can be given to people on the site using PAVA systems.

3. COMMUNICATE…REMOVE, REMOVE, REMOVE to all affected building/site occupants

You should ensure that messages to building/site occupants affected during an incident consider REMOVE, REMOVE, REMOVE (see Annex C for more information).

If at any point the SCR becomes affected during the incident, for example there is an unexpected smell, you should follow the REMOVE protocol and  ensure that you evacuate with the SCR and the rest of the building. 

4. ACT…to prevent all but essential access to affected locations

You should ensure that people on the site are prevented from entering areas that are potentially affected. By preventing access to affected locations, the likelihood of people on the site from unknowingly entering an affected area and becoming exposed to a CBR hazard will be reduced.

SCR staff can prevent or reduce access to affected locations by communicating these to security personnel who can prevent entry, or including in communications to building/site occupants to avoid particular affected areas.

You should ensure that the Emergency Services and specialist responders gain access to affected locations when required in order to provide medical treatment to those affected.

5. ACT…on planned processes to modify building functions e.g. lifts and HVAC systems, if appropriate

Modifying building functions can reduce the impact of a CBR incident by reducing the spread of a CBR material around a building. By ensuring that there is a clear pre-planned process in place for your site to change building functions and that SCR staff are aware of this, the timeframe for modifying building functions can be reduced.

Building/site occupants should avoid the use of lifts to evacuate the building, as lift functioning should be stopped during a CBR incident.

You should ensure that alteration of the HVAC system (emergency stop, reverse flow, increase ventilation, etc.) is considered according to the process in place for your site. For example enacted by the site or building manager, or after consultation with them.

6. ACT…potentially exposed individuals to remain in an unaffected location nearby, separate from those unexposed

It is important that individuals who have been exposed to a CBR material, for example those showing symptoms or who have come into contact with a CBR material, do not leave the general area entirely following an incident, unless it is unsafe to do so, for example if there are indicators of a secondary threat.

You should oversee the isolation of exposed individuals separate to those who are unexposed. This is to reduce the hazard posed to unexposed individuals via the accidental contamination or direct transfer of a CBR material, and to enable the Emergency Services to more rapidly provide medical support to those who are exposed.

Annex A - Further Support and Guidance

If you require further advice, you should contact the organisation who has remit for your site.

This will likely be the National Counter-Terrorism Security Office (NaCTSO) and/or your local Counter-Terrorism Security Adviser for Publicly Accessible Locations (PALs) and hazardous sites.

Additional NPSA resources and guidance can be found on the NPSA public website and are flagged below.

Annex B - Preparing and Responding to a CBR Incident – A Checklist

The following section provides a summary of actions outlined in this document. 

Annex C - Additional Information

style=The ETHANE mnemonic is an established reporting framework which provides a common structure for responders and their control rooms to understand share incident information. When security personnel contact the emergency services, they will be asked questions to collect the following information.

For more information on the ‘REMOVE, REMOVE, REMOVE’ advice, including a downloadable version visit: https://www.protectuk.police.uk/advice-and-guidance/response/remove-remove-remove-guidance-hazardous-substance-exposure

ETHANE

  • Confirm: nearest junction or exact address, and size of incident.
  • State that the incident is: an explosion, building collapse, firearms incident, fire/smoke, suspicious package etc.
  • Identify the hazards present or suspected (e.g. number of hostiles, types of weapons, suspected CBR incident). It is important to describe simply what you are seeing, in familiar terms. Do not try to predict what is occurring or use CBR language that you are not familiar with, as this may lead to confusion during a conversation with a 999 call handler.
  • Consider potential secondary devices or methodologies.
  • Describe actions taken so far. If evacuation or invacuation has not taken place, ask whether it is necessary.
  • Update which routes are safe to use and those that are blocked.
  • Nominate and search the Rendezvous Point (RVP).
  • List type and severity (e.g. approximate number of dead, injured, survivors and witnesses).
  • List services present and those required.
  • Conduct a joint hazard assessment with emergency services.
Did you find this page useful?
helpfulness rating

Related Pages