New FIA and NFCC Guide on Secure Information Boxes
New FIA and NFCC Code of Practice for Secure Information Boxes
The Fire Industry Association and National Fire Chiefs Council have issued Version 4 of their Code of Practice for Secure Information Boxes in residential buildings. It is a significant update for responsible persons, managing agents, housing providers, designers and fire risk assessors.
Secure information boxes are not a paperwork exercise. They are intended to give firefighters fast access to clear, current and operationally useful information during an emergency.
The new FIA and NFCC Code of Practice sets out practical recommendations for the location, security, signage, contents and maintenance of secure information boxes, known as SIBs. It also explains what should be included in the Emergency Response Pack, or ERP, kept inside the box.
London Fire Consultants view: the most important message is simple. A secure information box is only useful if the information inside it is accurate, concise, maintained and accessible to the fire and rescue service when needed.
Why this guide matters
The Code of Practice has been updated against the background of the Grenfell Tower Inquiry Phase 1 recommendations, the Fire Safety (England) Regulations 2022, the Fire Safety (Residential Evacuation Plans) (England) Regulations 2025 and changes to Approved Document B.
These changes place greater emphasis on useful operational information. Firefighters need to know the building layout, firefighting facilities, evacuation strategy, serious fire safety defects and the location of residents who may need assistance.
This is particularly important in residential buildings where residents may have mobility, cognitive or sensory impairments. Poor information can delay decision-making. Out-of-date information can create operational risk.
What buildings does the Code apply to?
The Code focuses on secure information boxes and Emergency Response Packs for high-rise residential buildings. It is relevant to both new and existing buildings, but the legal triggers differ.
| Building type | Relevant trigger | Practical implication |
|---|---|---|
| New blocks of flats | Storeys over 11 metres, as described in Approved Document B Volume 1 | A secure information box should be considered as part of the fire strategy and building design process. |
| Existing high-rise residential buildings | At least 18 metres above ground level or at least seven storeys under the Fire Safety (England) Regulations 2022 | The responsible person must provide a suitably secure information box and key building information. |
| Residential buildings over 11 metres with simultaneous evacuation | Relevant where the fire and rescue service has chosen to receive RPEEP information as hard copy in the SIB | The ERP may need to include resident evacuation information, subject to the correct legal and data protection controls. |
| Other complex premises | Outside the main scope of the Code | The principles may still be useful for complex layouts, unusual buildings or buildings with fire engineered solutions. |
What is a secure information box?
A secure information box is a protected enclosure that stores key information for the fire and rescue service. It should be located where firefighters can readily find it and gain access to it during an incident.
The Code uses the term secure information box, or SIB. It also makes clear that the contents of the box are described as the Emergency Response Pack, or ERP.
Where should the secure information box be located?
The SIB should normally be positioned at the entrance where the fire and rescue service is most likely to arrive. Where this is not obvious, the location should be agreed in consultation with the fire and rescue service.
The Code also recommends considering whether the SIB should be close to other equipment used by firefighters, such as:
- Evacuation Alert Control and Indicating Equipment.
- Smoke control equipment.
- Rising main inlets.
- Fire alarm panels or other operational controls.
In most blocks of flats, one SIB will be sufficient. Larger estates, complex blocks or buildings with multiple fire service access points may need more than one.
Security is now a major issue
The Code gives detailed recommendations on physical security, key control and code management. This matters because the ERP may contain sensitive information about building systems, responsible person contact details and residents who may need assistance in an evacuation.
A weak or poorly managed SIB creates two serious problems.
- It may expose sensitive personal information.
- It may undermine resident confidence in sharing evacuation information.
Responsible persons should not treat the SIB as a standard metal cabinet. The box, lock, key system, fixings and management arrangements all need to form a secure system.
Critical point: if a SIB contains information about residents who may need evacuation assistance, the responsible person must think about UK GDPR, consent, data minimisation, access control and information accuracy.
What should the Emergency Response Pack include?
The ERP should contain information that is relevant to firefighters during an incident. It should not become a dumping ground for general fire safety paperwork.
The Code recommends that the ERP should include, as a minimum:
- A log book recording access, maintenance, updates and emergency use.
- An off-the-run notice for unavailable firefighting systems or unresolved fire safety issues.
- A summary of useful information for the fire and rescue service on arrival.
- An orientation plan showing the building in relation to surrounding streets, buildings and water supplies.
- Up-to-date floor plans showing the internal layout.
- Plans showing firefighting facilities, including lifts, rising mains, smoke control and sprinkler controls.
- Information on residents with mobility, cognitive or sensory impairments where relevant and lawfully shared.
- Significant fire safety issues, including compartmentation defects, external wall issues or other matters affecting fire behaviour.
- The current evacuation strategy, such as stay put or simultaneous evacuation.
- The Building Emergency Evacuation Plan where required.
Building plans must be simple and operationally useful
One of the most practical parts of the Code is its approach to plans. It makes clear that complex architectural drawings are not suitable for firefighters during an emergency.
Plans should be clear, simple and easy to interpret under pressure. The Code recommends A3 plans and two sets of all plans. It also recommends that plans are encapsulated or placed in plastic wallets so they can withstand operational use.
Plans should show important firefighting and evacuation information, including:
- Floor numbers as signed in the building.
- Flat numbers as signed in the building.
- Protected escape routes.
- Firefighting shafts.
- Fire resisting compartment lines.
- Firefighting lifts, evacuation lifts and lift motor rooms.
- Rising main inlets and outlets.
- Smoke control panels and vents.
- Sprinkler or suppression controls.
- Service isolation points.
- Bin stores, risers, car parks and hazardous areas.
RPEEP information requires careful handling
The Code links secure information boxes to Residential Personal Emergency Evacuation Plans, known as RPEEPs. This is a sensitive area and should not be handled casually.
The Code advises that the minimum possible information should be stored in the SIB to achieve the operational purpose. The aim is to tell firefighters where assistance may be needed and what level of assistance may be required.
The prescribed information may include:
- The resident’s flat number.
- The resident’s floor number.
- Basic information about the degree of assistance required.
- An estimate of the number of people needed to assist evacuation or rescue.
- Whether the resident has an emergency evacuation statement.
The Code uses a simple categorisation approach:
Category 1
A person requiring rescue or evacuation by three or more people, including any additional equipment.
Category 2
A person requiring rescue or evacuation by one or two people, with no additional equipment required.
Key control
Information must be kept current, secure and limited to what firefighters need during an incident.
Maintenance is not optional
A secure information box is not compliant in practical terms if nobody checks it. The Code recommends regular inspection and maintenance by a competent person.
The responsible person, or their appointed agent, should ensure that the SIB and ERP are checked after any incident, monthly and annually.
| Check type | What should be checked |
|---|---|
| Post-incident check | Confirm the contents remain complete and available after the SIB has been used. |
| Monthly check | Check the physical contents, plans, wallets, resident information, locks, seals, housing and fixings. |
| Annual check | Review the ERP for accuracy, adequacy, scope and detail. |
| Change-triggered check | Update the ERP after physical works, changes in occupation, changes in evacuation strategy or changes to fire safety systems. |
Common failures we expect to see
Based on our experience reviewing fire safety information for residential buildings, the biggest risk is not usually the absence of a box. It is the poor quality of the information inside it.
Common failures include:
- Plans that do not match the building.
- Floor numbering that differs from the signage on site.
- Missing riser, lift, smoke control or sprinkler information.
- No clear indication of serious fire safety defects.
- Out-of-date responsible person contact details.
- Resident evacuation information stored without clear controls.
- Too much irrelevant paperwork inside the SIB.
- No inspection log showing regular review.
- No evidence that the fire and rescue service has been consulted.
What responsible persons should do now
Responsible persons and managing agents should not wait until the next fire risk assessment to look at this. The SIB and ERP should be treated as part of the building’s emergency response arrangements.
We recommend the following actions:
- Check whether your building falls within the scope of the Fire Safety (England) Regulations 2022 or the Fire Safety (Residential Evacuation Plans) (England) Regulations 2025.
- Confirm whether a SIB is present and whether its location is suitable.
- Check whether the SIB is secure, properly fixed and accessible to the fire and rescue service.
- Review the ERP contents against the FIA and NFCC Code of Practice.
- Check that the floor plans are simple, current and operationally useful.
- Confirm that RPEEP and BEEP information is handled lawfully and proportionately.
- Set up monthly and annual review arrangements.
- Record all access, maintenance, updates and fire service use in the SIB log book.
Our professional view
The new Code is helpful because it moves the sector away from vague expectations and towards a more practical operational standard. It recognises that firefighters need fast, clear and accurate information.
However, responsible persons should be careful. The Code is not a substitute for legal compliance. It also does not remove the need for competent judgement. Each building still needs to be reviewed on its own facts, including its height, layout, fire strategy, resident profile, firefighting facilities and current fire safety defects.
The weakest approach would be to install a box, place generic plans inside it and assume the issue is resolved. That would miss the point.
The right approach is to create a controlled, maintained and auditable Emergency Response Pack that supports firefighters and protects residents.
Need your secure information box or Emergency Response Pack reviewed?
London Fire Consultants can review your secure information box, Emergency Response Pack, building plans, evacuation information and fire safety documentation against the new FIA and NFCC Code of Practice.
We can also assist with fire strategy reviews, high-rise residential fire risk assessments, RPEEP arrangements, BEEP preparation and fire and rescue service information packs.
Contact London Fire ConsultantsThis article provides general guidance only. Building owners, responsible persons and managing agents should obtain competent advice based on the specific building, current legal duties, fire strategy, resident profile and local fire and rescue service requirements.