ISPS Code Security Complete Guide 2026

The ISPS Code — the International Ship and Port Facility Security Code — exists because the September 2001 attacks exposed a gap that SOLAS had never addressed: ships and ports had detailed safety regulation but almost no mandatory security regime. IMO responded quickly, adopting ISPS as a new SOLAS Chapter XI-2 that entered into force on 1 July 2004, and it remains the framework every seafarer works inside whenever a ship enters or leaves port. For a junior officer, ISPS is less about memorising clause numbers and more about understanding a working system: security levels, a plan, an officer responsible for it, and a certificate that proves it is all in place.

The Three Security Levels and What They Actually Change

ISPS operates on three security levels. Level 1 is the baseline — minimum protective measures maintained at all times, such as controlled access and identity checks. Level 2 is heightened, applied when there is an increased risk of a security incident, and requires additional specific measures — more frequent patrols, restricted access points, enhanced screening of stores and visitors. Level 3 is exceptional, applied only when a security incident is probable or imminent, and requires further specific measures, often coordinated directly with port and coastal authorities. The level in force is set by the flag state or the relevant port state authority, and a ship must always work to whichever is higher between its own assessed level and the port facility’s level.

The Ship Security Plan and the Ship Security Officer

Every ship subject to ISPS must carry an approved Ship Security Plan (SSP), a confidential document detailing the specific security measures, procedures, and equipment for that vessel, developed following a Ship Security Assessment. Implementing it day to day is the job of the Ship Security Officer (SSO), a role that must be held by someone who has completed an approved SSO course. The SSO conducts regular security inspections, maintains the ship’s security equipment, ensures crew security training and drills are carried out and recorded, and is the ship’s point of contact with the Company Security Officer (CSO) ashore and the Port Facility Security Officer (PFSO) at each port.

Verification and the International Ship Security Certificate

Compliance is verified the same way SOLAS verifies other statutory requirements — through survey by the flag administration or a recognised organisation acting on its behalf, resulting in the International Ship Security Certificate (ISSC). An expired or missing ISSC is treated by port states as seriously as an expired safety certificate and can result in detention.

The Declaration of Security

A Declaration of Security (DoS) is not exchanged for every port call. It is required in specific higher-risk situations — for instance when the ship is operating at a higher security level than the port facility, when there is a particular security threat concerning the ship-to-ship or ship-to-shore interface, or when instructed by the flag or port state. It records, in writing, exactly which party is responsible for which security measure during the interface, and is signed by both the ship — usually the Master or SSO — and the facility or vessel it is exchanged with.

Why This Matters Beyond the Certificate

ISPS drills and exercises are not a box-ticking formality — a ship that cannot demonstrate a working security response during a PSC or vetting inspection is treated the same way as a ship with an expired safety certificate. Knowing your own duties under the SSP, recognising a change in security level, and understanding when a Declaration of Security is required are basic professional competencies for any officer standing gangway watch or handling access control, not just something the SSO deals with.

Chat with SailorGPT