The ISPS Code transformed maritime security from an afterthought into a structured, auditable discipline. Enacted through SOLAS Chapter XI-2 in response to the September 11 attacks and the bombing of the French tanker Limburg, the International Ship and Port Facility Security Code establishes a comprehensive framework requiring ships, port facilities, and their operators to assess threats, develop security plans, designate trained security officers, and maintain graduated readiness across three security levels. It applies to all passenger ships and cargo ships of 500 GT and above on international voyages, plus the port facilities that serve them. For Company Security Officers (CSOs), Ship Security Officers (SSOs), and fleet managers, ISPS compliance is verified through the International Ship Security Certificate (ISSC), with PSC officers checking security documentation, crew familiarity, SSAS functionality, and drill records at every port call. This guide covers every ISPS requirement — from conducting Ship Security Assessments to passing PSC security inspections — with practical implementation guidance for 2026. Start a free trial of Marine Inspection to manage security drills, access control logs, and ISSC tracking digitally across your fleet.
The Three Security Levels
The ISPS Code operates through a tiered security level system that allows protective measures to scale with the assessed threat. Port authorities and flag states set and communicate security levels — ships must comply with the higher of their own level or the port's level.
The Security Officer Architecture: CSO, SSO & PFSO
The ISPS Code creates a three-role security structure connecting shore management, shipboard operations, and port facilities. Each role has distinct responsibilities, required training, and accountability — and PSC officers verify that these roles are actively filled and functioning, not just named on paper. Book a Marine Inspection demo to see how digital workflows support CSO oversight and SSO daily operations.
| Role | Based At | Core Responsibilities | Training Required | PSC Verification |
|---|---|---|---|---|
| CSO Company Security Officer |
Shore office | Conducts Ship Security Assessments. Develops and maintains SSPs for all fleet vessels. Ensures SSO training. Coordinates with flag state and RSOs. Arranges ISSC certification. | Approved CSO course per STCW and flag state requirements | Name and 24hr contact must be documented. Communication records with SSOs may be checked. |
| SSO Ship Security Officer |
Onboard each vessel | Implements SSP onboard. Conducts security inspections. Manages access control. Coordinates with PFSO at ports. Conducts and documents security drills. Reports security incidents. | Approved SSO course per STCW Section A-VI/5 | Must demonstrate SSP familiarity, know CSO contact, explain duties at each security level, show drill records. |
| PFSO Port Facility Security Officer |
Each port facility | Develops and maintains Port Facility Security Plan. Conducts port security assessments. Coordinates with SSOs of visiting vessels. Manages port access control and surveillance. | Approved PFSO course per flag/port state | Not directly verified on ship, but Declaration of Security between ship and port may be checked. |
From Ship Security Assessment to Ship Security Plan
The SSA and SSP are the operational core of ISPS compliance. The assessment identifies vulnerabilities; the plan addresses them. Both must be approved by the flag state administration or a Recognized Security Organization (RSO). Sign up for Marine Inspection to manage SSP updates and security equipment tracking digitally.
Ship Security Alert System (SSAS)
The SSAS is a silent alarm system that transmits a covert distress signal to the flag state when the vessel is under security threat — piracy, terrorism, armed robbery. Unlike distress signals, SSAS alerts generate no audible or visible alarm onboard to avoid endangering crew if captured.
PSC Security Inspection: What Officers Check
Although security may not always be the PSC officer's primary focus, the following items are routinely verified — and deficiencies in any of them create a formal record that affects your vessel's risk profile.
| PSC Code | Inspection Item | What Officers Verify | Common Failures |
|---|---|---|---|
| 16101 | Security-related defects | Overall security posture — lighting, CCTV, locks, access barriers | Broken security lighting, non-functional CCTV, damaged door locks on restricted areas |
| 16102 | Ship Security Alert System | SSAS activation points accessible, tested, crew knows locations and procedures | Crew unable to locate activation points, no test records, SSAS programming errors |
| 16103 | Ship Security Plan | SSP approved, current, stored securely, confidential sections protected | SSP not updated after vessel modification, confidential sections stored in non-restricted areas |
| 16104 | Ship Security Officer | SSO identified, trained, can explain duties at each security level, knows CSO contact | SSO cannot describe Level 2/3 procedures, doesn't know CSO 24hr contact number |
| 16105 | Access control to ship | Gangway watch, visitor log, ID verification, security badges in use | No gangway watch, incomplete visitor log, security badges not issued to visitors |
| 16106 | Security drills | Drill records with dates, scenarios, participants, findings, corrective actions | Drills not conducted quarterly, identical scenarios repeated, no documented findings |
Security Drill & Exercise Requirements
ISPS mandates regular security drills to ensure crew can respond effectively to threats. PSC officers and auditors check both the frequency and the quality of drill documentation. Schedule a demo to see how Marine Inspection automates drill scheduling and documentation with photo evidence.
ISPS Compliance Checklist
Use this before every PSC arrival and during internal security audits. These items map directly to the PSC deficiency codes that create formal findings. Sign up for Marine Inspection to run these checklists digitally with timestamped records.
