Festival security planning: the complete organiser's playbook

Security team setting up festival entrance barriers

A festival security plan must deliver an approved emergency management or safety management plan, a maintained incident register, coordinated arrangements between security, medical and police, and a tested site map with clear access, egress and crowd controls. Start today by notifying your local police Officer In Charge, booking a medical provider, and drafting your site map, because agency lead times can stretch past 60 days.

TL;DR:
Coordinate with police and medical providers at least one month and 60 to 90 days before the event to ensure all bookings and plans are in place.
Design a site map that includes all entrance points, emergency gates, fences, medical posts, and evacuation routes, and test it thoroughly before the event.
Monitor crowd density and flow continuously during the festival to identify rising risks near barriers or congestion points, adjusting staffing as needed.
Verify licensing and training records for all security staff and crowd controllers, and stagger shifts to prevent fatigue during critical phases like load-in and load-out.
Conduct immediate post-event debriefs within hours and detailed reviews days later to analyze incident data and update risk management strategies accordingly.

What goes into a festival security planning document
How do you design a secure site plan?
What crowd management measures reduce surge risk?
Who’s responsible for security staffing and accreditation?
How do you plan medical and harm-reduction coverage?
What alcohol licensing conditions affect your security plan?
When should you notify police, fire and ambulance?
How should you set up communications and the command post?
How do you test the plan before doors open?
How ABCO Security integrates these elements for organisers
What happens in the post-event debrief?
Get an integrated security plan built for your festival
Where to find the official templates and guidance
What organisers get wrong, and one fix to start today
Sources
FAQ

What goes into a festival security planning document

An emergency management plan (EMP) is the backbone of festival security planning, and regulators expect it to read like an operations manual, not a marketing brochure. Under the Music Festivals Act, subject festivals in New South Wales must submit an approved safety management plan before the gates open, and the legislation prescribes what that plan contains down to the level of incident register fields.

A workable EMP typically covers:

Event descriptor — dates, capacity, site address, licensee details and program outline.
Site layout — a scaled map showing every structure, exit, and hazard zone.
Evacuation plans — trigger points, muster areas and responsibility for calling an evacuation.
Emergency vehicle access — mapped corridors kept clear at all times, not just on paper.
Harm-reduction areas — chill-out zones, water points and peer support locations.
Staffing and command structure — who reports to whom, and who holds final authority.
Communications plan — primary and backup channels, plus public announcement scripts.
Medical arrangements — onsite capacity, ambulance liaison and transfer protocols.
Crime scene preservation — steps staff take if police need to secure an area.

Most state guidance, including the Victorian Guidelines for Planning Safe Public Events, recommends a risk assessment aligned to AS/NZS 31000 before you finalise any of this. Submit drafts early. Agencies almost always send back amendments, and a plan bounced twice in the final fortnight before your event is a plan you’re running without approval.

How do you design a secure site plan?

Your site map is the single document every agency will scrutinise first, and it needs to show far more than stage positions and food trucks. National guidance on managing crowded spaces treats physical layout as the first line of defence, with procedures and trained staff layered on top of it.

At minimum, mark on the map:

Every entrance, exit and emergency-only gate, labelled by capacity.
Fence lines and their type (temporary mesh, solid hoarding, or crowd barrier).
Ticketing and search points, positioned to avoid queue backup onto public roads.
The medical centre and any satellite first aid posts.
The command post and its sightlines to key zones.
Toilets and water stations, spaced to prevent long walks during peak heat.
Harm-reduction and chill-out areas, away from stage noise but not isolated.
Vehicle corridors and evacuation assembly points, kept physically clear.

Perimeter decisions cascade into staffing and medical needs fast. A single-entry, full-search festival needs more gate staff and slower ingress modelling than a multi-gate, bag-check-only event, and a no-pass-out policy changes your medical resourcing because patrons can’t leave to sober up and return. Test the map before the event, not during it: walk every corridor with a loaded stretcher, drive a mock ambulance run through the emergency lanes, and check sightlines to signage from a patron’s eye height in a full crowd.

What crowd management measures reduce surge risk?

Crowd management for festivals comes down to reading density and flow before either becomes dangerous, and the warning signs are consistent across almost every serious crowd incident. Watch for rising density near barriers, one-directional flow reversing against itself, and bottlenecks forming at pinch points like narrow gates or merging walkways. A crowd that’s gone quiet and stopped moving is often a worse sign than one that’s loud and pushing.

Staffing follows a rough logic rather than a fixed formula: static posts at chokepoints and stage barriers, roving teams patrolling the open ground between zones, and dedicated stagefront crews trained specifically in crowd-crush response. Larger, high-energy crowds need denser stagefront coverage than a seated or low-tempo event, and mosh or crowd-surf zones need staff briefed on pulling patrons out safely without escalating the crowd’s mood.

Barrier design matters as much as staff numbers. A curved or angled barrier in front of the stage disperses pressure sideways rather than trapping it against a straight line, and secondary barriers (“mixed zones”) give crush-affected patrons somewhere to go that isn’t back into the crowd. Extend your thinking past the gates: nearby transport hubs, queuing lanes and the roads patrons walk down after the show all sit inside your duty of care, according to national crowded-places guidance from the Australian Institute for Disaster Resilience.

Monitor density visually and, where budget allows, with camera coverage over high-risk zones.
Brief stagefront teams on crush signals: raised hands, distressed faces, sudden pushing against barriers.
Stagger set changeovers and announcements to smooth dispersal rather than releasing the whole crowd at once.
Coordinate with transport operators on last-service timing to prevent a station bottleneck.

Pro Tip: Run your egress plan backwards from the transport hub, not forwards from the stage. If 8,000 people hit a train platform built for 2,000, your festival security plan has failed even if nothing went wrong inside the fence.

Who’s responsible for security staffing and accreditation?

Security officers and crowd controllers are not interchangeable, and mixing them up on a roster creates real licensing exposure. A security officer is generally engaged for asset protection, access control and static guarding, while a crowd controller holds specific licensing to manage patron behaviour, remove people from a venue and work directly within crowds. Every state licenses these roles separately, and it’s the organiser’s job, not just the contractor’s, to verify current licences before shift one.

Calculate staffing needs across three distinct phases, because they carry different risks:

Load-in — lower patron risk, higher asset and contractor-access risk; fewer crowd controllers, more static security.
Event time — peak crowd controller demand, concentrated at stagefront, gates and bars.
Load-out — fatigue-affected patrons, alcohol effects peaking, and staff who’ve already worked a long shift.

Roster with fatigue in mind. A crowd controller running a 14-hour shift into load-out is a liability, not a safeguard. Build in staggered breaks and a fresh relief team for the final two hours.

Daily briefings, shift handovers and incident register entries aren’t paperwork for its own sake. Regulators expect to see them, and a well-run event security staffing model treats the handover briefing as the moment risk information actually transfers between shifts. If you’re subcontracting any security function, your contract should require licence verification on request, proof of training records, and a commitment to attend the post-event debrief. Skip that clause and you’ve got no leverage when something goes wrong.

How do you plan medical and harm-reduction coverage?

Medical planning is where regulators focus hardest, and for good reason. NSW guidance requires an onsite medical centre positioned for direct ambulance access, with services operating from at least 30 minutes before doors open until an hour after close for events that need an agreed health and medical plan.

Plan for:

A main medical centre near the highest-density zone, with clear vehicle access separate from patron foot traffic.
Satellite first aid posts spread across large sites so response times don’t depend on a single point.
Harm-reduction spaces: supervised chill-out areas, free water points and peer support workers who patrons will actually approach.
Signage that tells patrons where medical help is, in language and icons that work at 11pm in low light.

NSW guidance on health and medical plans notes that some festivals require an agreed HMP submitted 60 to 90 days before the event, which is longer than most organisers budget for. Regional festivals carry an added layer: local hospital and ambulance transfer times run longer than metro events, so your medical resourcing needs to compensate for distance, not just crowd size.

Define, in writing, how security and medical teams interact. Who has authority to remove a patron from a medical tent? Does police presence near a medical post require the patient’s consent first? Getting this wrong damages trust in your medical service faster than almost anything else on site.

What alcohol licensing conditions affect your security plan?

An alcohol management plan is required wherever your liquor licence conditions call for one, and those conditions shape your entire security operation, not just your bar staff. Typical conditions include Responsible Service of Alcohol (RSA) accreditation for all serving staff, a no-glass policy inside the licensed area, and patron-to-server ratios that scale with crowd size.

Build these conditions directly into your EMP rather than treating them as a separate bar-management document:

Entry checks for outside alcohol, aligned with your search policy at the gates.
Removal of glass bottles and containers before patrons enter licensed zones.
Defined behaviour thresholds that trigger a patron warning, ejection, or police referral.
A clear line of cooperation between licensed venue staff, your crowd controllers and attending police for enforcement.

Alcohol conditions also affect evacuation. A crowd that’s been drinking for six hours moves and reasons differently than a sober one at gates-open, and your evacuation procedures should account for slower compliance and higher confusion in the final hours of a licensed event.

When should you notify police, fire and ambulance?

Multi-agency coordination fails most often because organisers treat notification as a formality rather than the start of a negotiation. Build your outreach timeline like this:

One month or more before the event — notify the local police station’s Officer In Charge with event details, expected numbers and site location, well ahead of any final headcount.
60 to 90 days before, where an agreed HMP is required — submit your health and medical plan to the relevant health authority for review and feedback.
Several weeks before — confirm fire service access requirements and any local government permit conditions tied to your site.
In the final briefing window — run a multi-agency briefing covering the Law Enforcement and Safety Schedule: what police will actively enforce, what falls to your licensed security, and where the line sits.

Large festivals often trigger fee-for-service police attendance, meaning you pay for a dedicated police presence rather than relying on general patrol coverage. Don’t assume this is automatic. Confirm it in writing, because “police will be nearby” and “police are rostered to your event” are very different levels of coverage on the night something goes wrong.

How should you set up communications and the command post?

Your event control centre (ECC) is only as good as its redundancy. Equip it with landlines as a backup to mobile networks, two-way radios on multiple channels, a detailed site map on the wall (not just a screen), a whiteboard for live incident tracking, and backup power that kicks in automatically, not one someone has to remember to switch on.

Communications strategy needs a primary channel, a backup channel, and a plan for blackspots. Testing this in the live environment matters more than most organisers assume. Radios and PA systems tested empty, before patrons arrive, behave completely differently once a packed field of bodies absorbs sound and signal, which is exactly why crowded-places guidance from the AIDR handbook recommends testing at spectator density.

Your incident register should capture, at minimum:

Time, location and nature of each incident.
Staff involved and any agency response.
Actions taken and outcome.
Follow-up required, with a named owner.

Keep the register accessible to your command post team in real time, and expect regulators to ask for it during or after the event. A register reconstructed from memory two weeks later carries far less credibility than one built live.

How do you test the plan before doors open?

A festival security plan that’s never been physically tested is a theory, not a plan. Run these checks in the days before gates open:

Drive an emergency vehicle through every mapped corridor to confirm it’s actually clear, not just clear on paper.
Walk the full evacuation route with your team, timing it from the furthest point on site.
Test every communications channel at expected patron density, not in an empty venue.
Time a mock medical response from the furthest point of the site to the medical centre.

On the day, structure briefings by shift, with a clear handover point where the outgoing team walks the incoming team through open incidents, not just a verbal “all good, mate.” Load-in and load-out carry their own fatigue risk: staff who’ve been on site for 16 hours make worse decisions, so rotate your most experienced people onto the highest-risk windows rather than leaving that to whoever’s still standing.

How ABCO Security integrates these elements for organisers

A professional provider brings the pieces above together as one coordinated deliverable rather than a stack of separate documents. When Abcosecurity works with festival organisers, that means a site-specific security plan tied directly to your EMP, accredited and licence-verified crowd controllers and security officers, CCTV and patrol integration feeding into the same incident register your command post uses, and direct liaison with police and medical agencies on your behalf.

When you’re comparing proposals from any supplier, ask for these in writing before you sign:

Current licence numbers for every crowd controller and security officer proposed.
Training records, not just a claim of “fully trained staff.”
Any quality-standard certifications, such as ISO 9001, that back their claimed processes.
A defined incident-reporting service level, including how fast you’ll be notified of a serious event.
Written confirmation they’ll attend your post-event debrief.

Pro Tip: If a proposal doesn’t mention debrief attendance, that’s a sign the provider sees your festival as a one-off job, not an ongoing safety relationship.

What happens in the post-event debrief?

Run two separate debriefs, not one. A “hot” debrief happens within hours of gates closing, while details are fresh, and covers immediate safety concerns, near-misses and anything that needs fixing before your next show. A formal lessons-learned review happens days later, with time to pull the full incident register and analyse patterns rather than reacting to the loudest complaint from the night.

Collect concrete metrics: incident counts by category, average response times from report to resolution, and any point where you were short-staffed or under-resourced relative to demand. Feed every finding back into your EMP directly, not into a separate “notes for next time” file that nobody reopens.

Update your risk assessment with any hazard that materialised, even minor ones.
Adjust staffing ratios in areas that ran hot on incidents.
Revise training content for any gap the debrief exposed.
Carry contract changes into your next supplier agreement, particularly around reporting speed.

Get an integrated security plan built for your festival

Planning all of this internally eats weeks you probably don’t have, especially once you’re also managing artists, vendors and ticketing. Abcosecurity builds the security side of your festival as one integrated package: a site-specific plan mapped to your EMP, accredited crowd controllers and security officers, CCTV and mobile patrol coverage, and an incident register your command post can hand straight to regulators if asked.

To get a proposal you can actually compare against other suppliers, provide your site map, expected patron numbers, medical requirements and any known site risks upfront. That’s the same information regulators will ask you for anyway, so pulling it together once serves both purposes. Abcosecurity’s integrated security solutions page outlines how planning, staffing, monitoring and reporting come together as a single deliverable rather than four separate contracts you have to stitch together yourself. If you’re still building your procurement shortlist, our guide on hiring event security walks through exactly what to put in your request for proposal. Reach out with your site details and we’ll scope what your festival actually needs, not a generic package.

Where to find the official templates and guidance

Keep physical or digital copies of your approved plans on site. Regulators frequently ask to inspect them during the event, not just review them beforehand.

The Music Festivals Act sets the legal content requirements for safety management plans and incident registers in NSW.
NSW’s music festival guidance covers health and medical plan submission windows and required content.
The Victorian Guidelines for Planning Safe Public Events detail risk assessment and evacuation planning expectations.
WA’s event guideline provides operational checklists for medical, crowd and site planning.
For accessible-event planning, review guidance on accessibility policy examples to fold inclusion measures into your harm-reduction and site plan.

What organisers get wrong, and one fix to start today

The three mistakes we see most often: agencies notified too late to negotiate properly, medical resourcing sized for an average night rather than a bad one, and communications plans with no real backup when the primary channel drops. None of these are complicated to fix, but they all take lead time you can’t buy back once the countdown’s on.

If you take one action from this piece today, make it this: confirm your police notification and medical provider booking before you finalise your site map. Everything else in your plan bends around those two commitments.

— Abco

Sources

FAQ

What Is an Emergency Management Plan for a Festival?

It’s the document that sets out your site layout, evacuation procedures, emergency vehicle access, staffing structure and medical arrangements. Some jurisdictions legally require an approved version before a subject festival can proceed.

How Far in Advance Should I Notify Police?

Notify the local police Officer In Charge at least one month before your event, and expect an agreed health and medical plan to need submission 60 to 90 days out where one is required.

What’s the Difference Between a Security Officer and a Crowd Controller?

A security officer typically handles asset protection and access control, while a crowd controller holds separate licensing to manage patron behaviour and remove people from crowded areas.

How Long Should Medical Services Operate at a Festival?

NSW guidance sets a baseline of medical coverage starting at least 30 minutes before gates open and continuing for one hour after the event closes, for festivals requiring an agreed HMP.

Who Should Attend the Post-Event Debrief?

Security leadership, medical providers, and key organiser staff should attend the immediate hot debrief, with a wider group joining the formal lessons-learned review days later to update the EMP.