Most Australian workplaces have drilled the fire evacuation procedure dozens of times. Few have ever drilled a lockdown. Yet for several common emergency types, including armed intruder, civil disorder outside the building, hostile vehicle nearby, and certain hazmat releases, lockdown is the correct response and evacuation is the dangerous one. This guide covers when lockdown is the right call, how to execute it, and what to do once it’s underway, framed against Australian Standard AS 3745:2010 and the current Australian threat landscape.

For broader context on the Australian threat environment, see our risk and threat preparedness guide. For how this fits alongside other emergency types, see our guide to emergency evacuation procedures by emergency type.

Why lockdown matters now

Australia’s National Terrorism Threat Advisory level is currently set at PROBABLE, the third level on a five-tier scale. ASIO raised the level from “Possible” to “Probable” in August 2024 and has maintained it since. Probable means credible intelligence indicates that individuals or groups have the intent and capability to conduct a terrorist attack in Australia, and that an attack is assessed as more likely than not within the next twelve months.

This elevated baseline does not mean an attack is imminent at any specific workplace. It does mean that lockdown procedures, long treated as a “we’ll get to it” item on the emergency planning agenda, now need to sit alongside fire evacuation as a procedure every Australian workplace is prepared for. The Australian and New Zealand Counter-Terrorism Committee (ANZCTC) Strategy for Protecting Crowded Places from Terrorism is the underlying policy framework, and AS 3745:2010 Appendix C provides specific guidance on civil disorder, which is the family of incident lockdown most often responds to.

For a deeper look at the threat landscape, see our risk and threat preparedness guide.

What lockdown is, and what it isn’t

A lockdown is a protective response that secures occupants inside a building or area when leaving would be more dangerous than staying. It is not the same as shelter-in-place (which applies to outdoor hazards like hazmat or severe weather), and it is not the same as evacuation (which moves occupants out of the building).

Two distinct triggers are recognised in Australian practice:

• Preventative lockdown is initiated when a threat exists in part of the building or in the immediate vicinity, but is not yet inside the occupied area. The objective is to keep the threat out by securing access points before it can enter. Examples include an armed offender in the street outside, a hostile vehicle approaching, or civil disorder in the neighbourhood.
• Emergency lockdown is initiated when an actual incident is occurring on-site, with potential for imminent harm to occupants. Examples include an armed intruder already inside the building, an active shooter, or a hostage situation in progress. The objective shifts to protecting occupants where they currently are, often by locking individual rooms rather than the whole building.

The training that prepares teams for these scenarios is covered in our Hostage, Lockdown and Active Threat Response training program. This article focuses on the procedure itself.

When lockdown is the correct response

The decision between evacuation and lockdown depends on the nature, location and movement of the threat. The Chief Warden, in consultation with police where possible, makes the call. Lockdown is generally the correct response when:

• An active threat is inside the building or immediately adjacent, and evacuation routes would expose occupants to the threat
• Police have instructed building occupants to remain in place
• Civil disorder is occurring in the street and evacuation would move occupants into harm’s way
• A hostile vehicle attack is in progress or imminent in the surrounding area
• Hazardous conditions exist on the evacuation routes (smoke, structural collapse, contamination)
• The threat is fast-moving and unpredictable, and standard assembly areas may themselves be compromised

Evacuation remains the correct default for fire, where the threat is contained and known and the routes are designed to move occupants away from it. The judgement call is most difficult when the threat type is ambiguous, which is why training and pre-incident scenario thinking matters.

For how procedures differ across all the major emergency types, see our emergency evacuation procedures by emergency type guide.

How to execute a workplace lockdown

The procedure differs by lockdown type and by building. Below is the generic Australian procedure consistent with AS 3745:2010 and ANZCTC guidance. Specific facility procedures should be tailored to the building’s layout, occupant profile and threat exposure.

1. Declaration and notification

• The Chief Warden declares the lockdown using a clear, unambiguous code or instruction. Avoid mixing it with fire alarm signals.
• Notify occupants through the public address system, internal messaging platform, SMS cascade or direct radio. Use plain language (“Lockdown. Lockdown. Lockdown. Move to a secure room. Lock the door. Stay quiet.”) rather than coded jargon that occupants may not recall under stress.
• Call Triple Zero (000). Provide the dispatcher with location, nature of incident, number of occupants, last known location of any threat, and any visible weapons or characteristics.
• Do not pull the fire alarm. Pulling the fire alarm during an active threat lockdown may move occupants into the path of the threat. Building managers should ensure the lockdown signal is distinct from the fire alarm.

2. Securing the perimeter (preventative lockdown)

• Lock all external access points. This includes main entrances, side doors, loading docks, fire exits where it is safe to do so (note: fire egress routes must remain available for emergency exit if conditions change).
• Disable lift access from the lobby if the building system permits.
• Manage visitors and contractors. Anyone outside the building stays outside. Anyone unaccounted for is reported to police on arrival.
• Establish a security position at the most likely access point, with communication open to the Chief Warden.

3. Securing the interior (emergency lockdown)

When the threat is inside or imminently inside the building, the strategy shifts from “keep the threat out” to “create as many barriers as possible between the threat and occupants.” This is often called layered or room-by-room lockdown.

• Lock and barricade individual rooms. Lock doors where possible. Push heavy furniture against doors that don’t lock.
• Move occupants away from doors and windows. Stay low, out of sight lines, and quiet.
• Silence devices. Phones to silent (not vibrate, which still makes noise on hard surfaces). Computer notifications off.
• Lights off where it does not compromise occupant safety.
• Do not gather in obvious congregation points like staff rooms, large open meeting rooms or atria.
• Do not attempt to overpower an armed threat unless you are tactically trained and the situation specifically calls for it. The evidence base strongly supports that most occupants increase their survival likelihood by staying hidden and quiet rather than confronting.

4. Communication during lockdown

• Internal communication continues via the PA system, internal messaging or radios. The Chief Warden updates occupants periodically on status. Silence breeds rumour and panic.
• Police communication is critical. The Chief Warden, or a delegated Communications Officer, maintains an open line to police via Triple Zero or a dedicated channel.
• Information police need on arrival: number and last known location of the threat, weapons observed, occupant numbers and locations, building access points and their current status, CCTV access, location of vulnerable occupants requiring assistance, and any information about the perpetrator gathered by staff.
• Do not broadcast information to media or social media during the incident. Speculation creates risk for both occupants and the police response.

5. The Chief Warden’s role during lockdown

The Chief Warden’s role during a lockdown is materially different from a fire response. The key responsibilities:

• Declaring and communicating the lockdown unambiguously
• Maintaining situational awareness through reports from area or floor wardens
• Managing communication with police as the primary site contact
• Accounting for occupants across all locked-down areas, using whatever roll-call or messaging system is available
• Preparing the police briefing for on-arrival
• Authorising the all-clear only after police have confirmed the scene is safe

The Chief Warden cannot perform all these functions alone in a sustained lockdown. A trained Deputy Chief Warden and Communications Officer are essential. For the full ECO framework, see our pillar guide on the AS 3745 Emergency Control Organisation. For Chief Warden-specific training, see our Chief Warden training program.

What occupants need to know

Occupants who have never thought about lockdown procedure will struggle when the lockdown signal is given. Pre-incident briefings should cover:

• The lockdown signal for your building (specific code, alert tone, message)
• The difference between the lockdown signal and the fire alarm
• The location of the nearest securable room from common work areas
• The “lock, light, sound” mental checklist: lock the door, lights off, silence devices and stay quiet
• What to do if caught in an open area: the closest cover or concealment, route to the nearest securable room
• Why you don’t evacuate on a lockdown signal even if the natural instinct is to leave
• What to do when you hear the all-clear and how the all-clear will be communicated (it is not the same as silence after the alarm stops)

This is also the content that needs to be drilled. Annual evacuation exercises that only ever test the fire procedure do not validate the lockdown capability.

After the lockdown: post-incident actions

A lockdown does not end when police arrive. The post-incident phase matters for occupant welfare, compliance and organisational learning.

Immediate

• Wait for the police all-clear. Do not unlock or move occupants based on a perceived end to the incident. The Chief Warden confirms the all-clear with police before broadcasting it.
• Reunify and account for occupants. Compare against the roll-call started during the lockdown. Identify anyone missing.
• Establish a welfare area away from any active scene. Provide water, basic needs, and a calm environment.
• Provide accurate, calm information to occupants. Avoid speculation.

Within 24 to 72 hours

• Provide psychological first aid and Employee Assistance Program (EAP) access. Lockdowns are traumatic events even when no harm occurred. Critical incident stress is common and can persist for weeks.
• Conduct a structured debrief with the Chief Warden, ECO members, the Communications Officer, facility management and a police liaison where possible.
• Document the incident. Timeline, decisions, decision-makers, communications, outcomes. This forms the basis of the post-incident report.
• Notify under WHS Regulations where applicable. The 2025 model WHS amendments extended notification duties to include certain violent incidents, with adoption varying by jurisdiction.

Within two to four weeks

• Lessons-learned review. What worked, what didn’t, what needs to change in the plan.
• Plan revision. Lessons feed back into the emergency plan via the Emergency Planning Committee.
• Re-training. Where the debrief identifies gaps, scheduled re-training rather than waiting for the next routine refresher.
• Drill validation. The plan as revised should be exercised within a reasonable interval, while the experience is still recent.

Common gaps we see in workplace lockdown preparedness

From 30 years of delivering threat preparedness training to Australian workplaces, these are the recurring weaknesses we see:

• No lockdown signal distinct from the fire alarm. Occupants don’t know which event is occurring.
• Lockdown procedure exists on paper but has never been drilled. First time the team operates it is during a real incident.
• The PA system has known dead zones where the lockdown announcement is inaudible. Discovered during the incident, not before.
• Reception and front-of-house staff are not trained despite being the most likely first point of contact for an active threat.
• Securable rooms have not been identified in the building. Occupants are left looking for somewhere to hide.
• All-clear protocol is undefined. Lockdown ends through silence, rumour or impatience rather than confirmed police clearance.
• Post-incident psychological support is improvised. No pre-arranged EAP escalation, no critical incident response plan.
• Multi-tenanted buildings have no coordinated lockdown plan. Each tenant locks down their own space without coordination, leaving common areas unmanaged.

Building lockdown readiness in your workplace

Lockdown preparedness is not a single training session. It is a sustained capability that includes:

• A documented lockdown procedure in your Emergency Management Manual, tailored to your facility
• A distinct lockdown signal that occupants can recognise
• ECO training including specific lockdown scenarios, not just fire (see our Hostage, Lockdown and Active Threat Response training)
• Chief Warden and Communications Officer training in the decision framework and police liaison
• Annual lockdown drills, varied across scenarios over multi-year cycles
• Pre-arranged psychological support and EAP escalation for post-incident
• Coordination with building management in multi-tenanted facilities

First 5 Minutes has been delivering AS 3745-compliant threat preparedness training to Australian organisations for more than 30 years, with the largest Emergency Control Organisation training team in the country. Whether you need Hostage, Lockdown and Active Threat Response training, broader threat preparedness training, or Chief Warden training, we can help.

Contact our team on 1300 321 120 to discuss your facility’s lockdown readiness.

---

Frequently Asked Questions

What is a workplace lockdown?
A lockdown is a protective response that secures occupants inside a building or area when leaving would be more dangerous than staying. It differs from evacuation (which moves people out of the building) and from shelter-in-place (which applies to outdoor hazards like hazmat or severe weather). Two types are recognised: preventative lockdown (threat near the building but not yet inside) and emergency lockdown (threat is already on-site).

When should a workplace lockdown rather than evacuate?
Lockdown is generally the correct response when an active threat is inside or immediately adjacent to the building, when police have instructed occupants to remain in place, when evacuation routes would expose people to the threat, when civil disorder or a hostile vehicle attack is occurring nearby, or when the standard assembly area may itself be compromised. Evacuation remains the default for fire, where the threat is contained and routes are designed to move occupants away from it.

Should you pull the fire alarm during a lockdown?
No. Pulling the fire alarm during an active threat may move occupants directly into the path of the threat. AS 3745:2010 contemplates a separate, distinct lockdown signal. Buildings should ensure the lockdown signal is unambiguous and recognisably different from the fire alarm.

Does AS 3745:2010 cover lockdown procedures?
Yes. AS 3745:2010 Appendix C provides guidance on civil disorder, the family of incidents that lockdown most often responds to. The Australian and New Zealand Counter-Terrorism Committee (ANZCTC) Strategy for Protecting Crowded Places from Terrorism provides the broader policy framework. Facility-specific procedures should be documented in the Emergency Management Manual.

What is the difference between preventative and emergency lockdown?
Preventative lockdown is initiated when a threat exists in part of the building or its immediate vicinity, but has not yet reached occupants. The objective is to keep the threat out by securing access points. Emergency lockdown is initiated when an actual incident is occurring on-site, with potential for imminent harm. The objective shifts to protecting occupants where they are, often by securing individual rooms rather than the whole building.

What should occupants do during a lockdown?
Move to the nearest securable room. Lock the door, push heavy furniture against it if it doesn’t lock. Move away from doors and windows. Stay low and quiet. Silence phones and devices. Turn off lights where it is safe to do so. Do not gather in obvious congregation areas. Wait for the all-clear from police, communicated through the Chief Warden, before moving.

Who takes control during a lockdown?
The Chief Warden declares the lockdown and manages the on-site response, including communication with occupants, police, and the broader ECO. Police take operational control of the threat response on arrival. The Chief Warden briefs the senior officer with the situation report and thereafter follows police direction.

How do you signal a lockdown without using the fire alarm?
The lockdown signal should be a distinct, unambiguous alert that occupants will not confuse with the fire alarm. Common methods include a dedicated PA announcement (“Lockdown, Lockdown, Lockdown”), a specific tone or signal separate from the fire alarm, SMS or app-based cascade messaging, and direct communication via warden radio. The signal must be communicated to all occupants during induction and reinforced through drills.

How often should lockdown drills be conducted?
At least annually, alongside the AS 3745-required annual evacuation exercise. Best practice is to vary the lockdown scenario across multi-year cycles (preventative versus emergency, armed intruder versus civil disorder versus hostile vehicle) so the ECO has practiced the range of scenarios it may face.

How do you know when the lockdown is over?
The lockdown ends only when police confirm the scene is safe and the Chief Warden communicates the all-clear. Lockdown does not end through silence, rumour, or the perceived absence of threat. Occupants should remain in their secured location until a clear, unambiguous all-clear is given.

What support should occupants receive after a lockdown?
Lockdowns are traumatic events even when no physical harm occurred. Critical incident stress is common and can persist for weeks. Pre-arranged psychological first aid, Employee Assistance Program (EAP) access, and a structured debrief should be available within 24 to 72 hours. Where the lockdown involved a violent incident, recent (2025) model WHS notification amendments may also apply depending on the jurisdiction.

What’s the difference between lockdown and the active threat response?
Lockdown is the procedural framework for securing a building when leaving would be dangerous. The active threat response, often summarised as “Escape, Hide, Tell,” is the individual behavioural guidance for occupants facing an immediate threat. Lockdown is the organisational response; Escape, Hide, Tell is the individual response. For more on active threat behaviour, see our risk and threat preparedness guide.