Maritime Security // SOLAS XI-2 & ISPS
ISPS Code: Maritime Security Levels, SSO/CSO/PFSO Roles, Declaration of Security (DoS), Drills, and Cyber Risk Management
A comprehensive professional guide to the International Ship and Port Facility Security Code (ISPS Code) and SOLAS Chapter XI-2. Mandatory Part A vs. recommendatory Part B, enforcement of Security Levels 1, 2, and 3, Ship Security Plan (SSP) duties, Declaration of Security (DoS) protocols, Ship Security Alert System (SSAS) operations, and statutory IMO cyber risk requirements.
1. What Is the ISPS Code? The Essential Distinction Between Safety and Security
The International Ship and Port Facility Security Code (ISPS Code) is a comprehensive set of measures established by the International Maritime Organization (IMO) to enhance the physical and procedural security of ships, port facilities, cargo, and seafarers against terrorism, piracy, armed robbery, and unlawful acts.
Maritime law strictly distinguishes between two operational domains:
- Maritime Safety: Protecting ships and personnel against accidental, operational, and natural perils—such as collisions, groundings, loss of stability, hull failure, and fire—primarily codified within international treaties like the STCW framework detailed in our STCW Convention Manila Amendments guide.
- Maritime Security: Defending against deliberate unlawful acts carried out by hostile third parties—including terrorism, piracy, hostage-taking, contraband smuggling, stowaway incursions, and cyber breaches.
While maritime terror incidents had occurred previously (such as the February 2000 bombing of the Philippine ferry Our Lady of Mediatrix which killed 45 passengers, and the attack on the French tanker Limburg in 2002), the September 11, 2001 terrorist attacks prompted global regulatory reform. The maritime supply chain was recognized as critically vulnerable: a compromised commercial vessel carrying hazardous bulk cargo (such as LNG or toxic chemicals) could serve as a devastating floating weapon directed at major coastal infrastructure.
In December 2002, the IMO adopted historic amendments to the SOLAS Convention. Chapter XI was split into Chapter XI-1 (“Special measures to enhance maritime safety”) and a new Chapter XI-2 (“Special measures to enhance maritime security”), rendering compliance with the ISPS Code mandatory worldwide as of July 1, 2004.
• Part A: Contains mandatory statutory requirements governing security assessments, security plans, designated officers, documentation, and vessel certification.
• Part B: Provides non-mandatory guidelines and practical implementation advice for Part A. However, several coastal states (notably the United States Coast Guard under the Maritime Transportation Security Act of 2002) enforce specific sections of Part B as mandatory national port entry requirements.
Statutory Scope of Application:
- Passenger ships, including high-speed passenger craft, on international voyages;
- Cargo ships of 500 gross tonnage and above on international voyages;
- Mobile Offshore Drilling Units (MODUs);
- Port facilities serving these categories of vessels engaged in international trade.
2. Objectives and Functional Requirements of the ISPS Code
The ISPS Code provides a standardized, standardized risk-assessment framework for Contracting Governments, port authorities, and shipping companies:
- Systematic gathering and evaluation of security intelligence by Contracting Governments;
- Mandatory implementation of Ship Security Assessments (SSA) and Port Facility Security Assessments (PFSA);
- Strict physical prevention of unauthorized access to ships, port facilities, and designated onboard Restricted Areas;
- Interception and denial of unauthorized weapons, incendiary devices, and explosives onto vessels;
- Rigorous verification of cargo operations, container seals, ship’s stores delivery, and unaccompanied baggage handling;
- Ensuring clear contingency plans for seamless escalation between security levels.
3. Maritime Security Levels (Security Levels 1, 2, and 3)
Operational security measures are structured into three distinct tiers. Security levels are set by the Contracting Government for port facilities within its jurisdiction and by the Flag Administration for its registered vessels.
The baseline operational level under which ships and ports normally operate. Basic protective measures are maintained continuously: gangway access control, checking official identification badges (IDs), random search of visitors, personal baggage, and stores, continuous illumination of weather decks and approaches during darkness, and regular patrols of restricted spaces (navigation bridge, engine room, steering gear flat).
Enacted for the period when a heightened risk of a security incident exists. Additional protective measures are applied: increasing the number of gangway watchstanders, limiting access points to a single guarded entrance, elevating search frequencies (50–100% of unaccompanied baggage and stores), locking exterior accommodation doors, deploying shore-side waterside patrols, and intensifying perimeter lighting.
Applied for the duration when a security incident is probable or imminent, even if the specific target is unidentified. Access to the vessel is suspended except for government response forces, cargo handling and bunkering operations are stopped, the crew is mustering in safe muster stations (or citadel), and the ship prepares for immediate unberthing or shift to safe anchorage under armed escort.
Whenever the security level of the ship differs from that of the port facility, the higher security level must always govern operations. If a vessel operates under Level 1 while the port declares Level 2, the ship must immediately upgrade its security measures to Level 2. Conversely, if a ship is instructed by its Flag Administration to maintain Level 2 while berthed in a Level 1 port, it must notify the Port Facility Security Officer (PFSO) and execute a formal Declaration of Security (DoS).
4. Shipboard Security Roles: SSO, CSO, SSP, and the SSAS System
Compliance aboard commercial tonnage relies on designated responsibilities linking the shipboard command with shoreside operational management:
A certificated deck or engine officer (typically the Chief Mate) designated by the Company under STCW Regulation VI/5. The SSO is accountable to the Master for executing the Ship Security Plan, conducting regular security inspections, coordinating security aspects of cargo handling and bunkering with the PFSO, and supervising crew training and drills.
A shore-based executive appointed by the shipping company, accessible 24/7. The CSO oversees the Ship Security Assessment (SSA), submits the Ship Security Plan (SSP) for approval to the Flag Administration or Recognized Security Organization (RSO), audits fleet compliance, and coordinates emergency response with national maritime security authorities.
A confidential, controlled document detailing security organization, access control protocols, search procedures, response to armed attacks or bomb threats, and communications channels across all three security levels. The operational sections of the SSP are protected from inspection: Port State Control Officers (PSCOs) may only verify that an approved SSP exists on board, unless clear grounds indicate significant non-compliance.
Mandated under SOLAS Regulation XI-2/6, the SSAS is a specialized covert satellite distress facility. When activated via dedicated hidden buttons (with at least one button on the navigation bridge and a second in another accommodation space), it transmits a silent alarm without sounding local sirens or alerting attackers. The distress transmission relays vessel identity, speed, and real-time GPS coordinates directly to the Flag Administration and the designated CSO.
5. Port Facilities and the Declaration of Security (DoS)
The port interface is managed by the Port Facility Security Officer (PFSO) implementing an approved Port Facility Security Plan (PFSP).
When specific security disparities or threats arise between a ship and the port facility (or during ship-to-ship transfers), the parties formalize security arrangements using a Declaration of Security (DoS). The DoS legally allocates responsibilities for access control, cargo screening, waterside monitoring, and emergency communications between the vessel and the terminal.
| Operational Scenario | Mandatory Requirement for a Declaration of Security (DoS) |
|---|---|
| Security Level Disparity | Mandatory when the ship operates at a higher security level than the port facility or an STS partner vessel. |
| Security Level 3 Operations | Mandatory whenever either the vessel or the port facility is operating at Security Level 3. |
| Flag State Instruction | Mandatory when specifically directed by the Flag Administration for designated voyages, ports, or cargoes. |
| Non-Compliant Interface | Mandatory when conducting operations with a port facility or vessel not required to hold an approved security plan. |
| Identified Security Threat | Executed whenever deemed necessary by the Master, SSO, or PFSO due to localized security alerts. |
Note: Executed Declarations of Security must be retained on board in the Security Logbook for the duration specified by the Flag State (typically covering at least the last 10 port calls) for Port State Control verification.
6. Statutory Training, Drills, and Exercises (Part A, Section 13)
An approved security plan remains ineffective without routine verification of crew readiness. The ISPS Code mandates strict drill intervals:
- Onboard Security Drills: Must be conducted at least once every three months. In addition, if more than 25% of the ship’s crew changes at any one time with personnel who have not previously participated in a drill on that ship within the last three months, a security drill must be executed within one week of the crew change. Drill scenarios include stowaway searches, bomb threats, unauthorized access, and hostage situations.
- Comprehensive Security Exercises: Must be conducted at least once each calendar year, with no more than 18 months intervening between exercises. These involve joint participation of the CSO, SSO, PFSO, and relevant government authorities to test communications, multi-agency coordination, and resource deployment.
All drills, exercises, equipment inspections (metal detectors, mirrors, handheld radios), security level changes, and security incidents must be formally entered into the Ship Security Logbook.
7. Modern Threats: Maritime Cyber Risk Management (IMO Resolution MSC.428(98))
Modern merchant vessels operate integrated Information Technology (IT) and Operational Technology (OT) networks. Bridge navigation suites (ECDIS, Radar, GNSS), propulsion controls, and cargo/ballast management systems are linked to satellite internet. Consequently, physical security is no longer separable from digital security.
As of January 1, 2021, the IMO requires cyber risk management to be formally embedded into shipboard Safety Management Systems (SMS) under the ISM Code. Failure to maintain verified cyber protection measures can lead to vessel detention during statutory Document of Compliance (DOC) and Safety Management Certificate (SMC) audits.
Practical Shipboard Cyber Security Controls:
- Network Segmentation: Physical and logical segregation separating critical navigation and machinery OT networks from administrative shipboard computers and crew welfare Wi-Fi;
- Removable Media Protocols: Strict prohibition of private USB flash drives or smartphones connecting to navigation consoles (ECDIS) or cargo computers;
- Countering GNSS Spoofing and Jamming: Cross-verifying satellite navigation fixes against radar ranges, optical bearings, and dead reckoning during coastal navigation;
- Access Control: Enforcing multi-factor authentication, changing default system passwords, and maintaining up-to-date patch baselines.
Formal risk assessments should be conducted using our Marine Risk Assessment Online platform, while anti-piracy hardening should follow established industry practices.
8. Operational Benefits vs. Human Element Challenges
The ISPS Code has standardized global port procedures and reduced cargo pilferage, but its implementation has created ongoing operational burdens for shipboard crews:
| Security Benefits | Operational Challenges & Human Factor Concerns |
|---|---|
| Global Defense Standard: Common security protocols and vocabulary across international ports. | Denial of Shore Leave: Port authorities occasionally cite security restrictions to deny crew shore access, violating rights established under the Maritime Labour Convention. |
| Reduced Cargo Loss: Enhanced gate screening and sealed container chains minimize theft and unauthorized access. | Crew Fatigue: Demanding gangway watches and continuous patrols add significant work hours during port calls. |
| Statutory Protection: Holding a valid International Ship Security Certificate (ISSC) prevents arbitrary port detentions. | Port Delays: Escalations to Security Level 2 or 3 introduce comprehensive cargo and baggage inspections that lengthen turnarounds. |
Statutory ISPS Code Documents (PDF Library)
Download the official English edition of the International Ship & Port Facility Security Code:
Official English Edition
International Ship & Port Facility Security Code (ISPS Code)