Start hereRules checked 20 October 2026
Security on a merchant ship is easy to treat as paperwork: a plan in a locked cabinet, a certificate on the bulkhead, a log of visitors at the gangway. Port State control no longer sees it that way. The Procedures for Port State Control, 2025, resolution A.1206(34), added a new appendix on security, giving inspectors an explicit basis to act where security arrangements are ineffective in practice, not just incomplete on paper. In the Tokyo MOU region alone, PSCOs recorded 1,061 deficiencies under the ISPS Code in 2025.
The International Ship and Port Facility Security (ISPS) Code was adopted in December 2002 together with SOLAS chapter XI-2 and entered into force on 1 July 2004. Part A is mandatory. Part B is guidance, which the Administration and port States use to interpret Part A, and which some States (the European Union among them) have made partly binding in their own law.
Free sign-up
Sign up once to open this lesson and every other one in the Academy.
The first 2 lessons of each course are open to all. The rest need a free sign-up, which takes half a minute. We don't issue certificates, and we don't share your details.
In this lesson
- A security week on a container ship
- In plain words
- In detail
- What the rules say
- Flag and class notes
- Key numbers
- What inspectors find
- Quiz: 5 questions
Try it
A security week on a container ship
In plain words
The ISPS Code asks every ship on international voyages to think about who might want to harm it or use it to cause harm, to write a plan to stop them, and to have one person on board in charge of that plan.
The steps are simple. The company appoints a company security officer (CSO), who has the ship assessed for threats and weak points: the ship security assessment. From that, a ship security plan (SSP) is written and approved by, or for, the flag. On board, a ship security officer (SSO), accountable to the master, runs the plan: controlling access, watching the deck, checking stores and baggage, training the crew and keeping records.
The plan has three security levels. Level 1 is normal. Level 2 means a heightened risk. Level 3 means an attack is likely or imminent. The flag tells the ship which level to apply (SOLAS XI-2/3), and the ship adds measures as the level goes up. In port, the ship meets the higher of its own level and the port’s.
When the plan is in place and working, an auditor from the flag or its recognised organisation (RO) verifies it and the ship gets an International Ship Security Certificate (ISSC), valid up to five years, with one check in the middle.
In detail
Which ships
SOLAS chapter XI-2 and the ISPS Code apply to passenger ships (including high-speed passenger craft), cargo ships (including high-speed craft) of 500 gross tonnage and upwards, and mobile offshore drilling units, on international voyages, and to the port facilities that serve them.
The documents and who makes them
| Document | Prepared by | Approved or issued by | Where it lives |
|---|---|---|---|
| Ship security assessment | CSO (may delegate tasks) | Part of the SSP submission | Company and ship, protected |
| Ship security plan | CSO for each ship | Administration or an RO on its behalf | On board, protected from unauthorised access; may be electronic |
| ISSC | Administration or RO, after verification | On board | |
| Declaration of Security | Ship and port facility (or other ship) | Signed by both | On board, kept as the Administration specifies |
| Continuous Synopsis Record | Administration | Administration | On board (SOLAS XI-1/5) |
The SSP must be in the working language of the ship and, if that is not English, French or Spanish, include a translation into one of them. The Administration decides which changes to the plan need approval; approved changes are kept on board.
The SSO’s working records
ISPS Code A/10.1 requires records of these activities to be kept on board for at least the period the Administration specifies:
- training, drills and exercises;
- security threats and security incidents;
- breaches of security;
- changes in security level;
- communications relating to the direct security of the ship, such as specific threats to the ship or to port facilities it is or has been in;
- internal audits and reviews of security activities;
- periodic review of the ship security assessment;
- periodic review of the ship security plan;
- implementation of any amendments to the plan;
- maintenance, calibration and testing of security equipment, including testing of the ship security alert system.
Under SOLAS regulation XI-2/9, the ship must also be able to give a port State information on its last ten calls at port facilities, the security level at each and any special measures taken.
Drills and exercises
| Activity | Frequency | Source |
|---|---|---|
| Security drill on board | At least once every three months | Part B, 13.6 |
| Extra drill after a crew change | Within one week, if more than 25% of personnel changed and they have not drilled on that ship in the last three months | Part B, 13.6 |
| Security exercise (may be tabletop, full-scale or combined) | At least once each calendar year, no more than 18 months apart | Part B, 13.7 |
Part A, section 13.4 says only that drills “shall be carried out at appropriate intervals”. Use the Part B frequencies as the minimum unless your flag has set others.
The ship security alert system
SOLAS regulation XI-2/6 requires a ship security alert system (SSAS). When activated it sends a covert ship-to-shore alert to the competent authority designated by the Administration, identifying the ship and its position, without raising an alarm on board or alerting other ships. It can be activated from the bridge and at least one other place. Its activation points and the instructions for using and testing it are confidential parts of the SSP. Tests must be recorded under A/10.1.10. Follow the flag’s instructions on how tests are announced to the recipient, so that a test is not mistaken for a real alert.
The ISSC verification cycle
| Verification | When | ISPS Part A |
|---|---|---|
| Initial | Before the ship is put in service or the ISSC is first issued | 19.1.1.1 |
| Intermediate | At least one; if only one, between the 2nd and 3rd anniversary dates | 19.1.1.3 |
| Renewal | At intervals not exceeding five years | 19.1.1.2 |
| Additional | As the Administration decides | 19.1.1.4 |
Renewal timing follows the same pattern as the SOLAS certificates: completed within three months before expiry, the new ISSC runs to five years from the old expiry date; completed more than three months early, five years from completion. If the new ISSC cannot be placed on board in time, the old one may be endorsed for up to five months. Extensions to complete a voyage are limited to three months, or one month for ships on short voyages.
An interim ISSC can be issued for a new ship, a change of flag or a change of company, once the security assessment is complete, a copy of the SSP has been submitted for approval and is being implemented, and the other conditions in A/19.4.2 are met. It is valid for six months, or until the full ISSC is issued if sooner, and cannot be extended. No consecutive interim ISSC may be issued if one purpose of asking for it is to avoid full compliance beyond the first interim period (A/19.4.5).
The verification audit on board
The auditor checks that the SSP is approved and the version on board is current, that the SSO and crew know their duties and can show them (access control at the gangway, restricted areas, handling of stores and visitors), that drills and exercises are done and recorded, that the SSAS and other security equipment are tested and maintained, and that internal audits and reviews have been done. The ISSC is endorsed after a satisfactory intermediate verification.
Security at port State control
PSC under SOLAS XI-2/9 begins with the ISSC. Inspectors look for clear grounds, such as an invalid ISSC, crew not familiar with security procedures, poor communication between key security staff, or serious deficiencies in security equipment or records. The plan itself is normally not examined. The 2025 Procedures (A.1206(34)) added appendix 20 on security aspects, so security deficiencies showing ineffective implementation can now lead to escalation and, where safety is affected, detention.
What is coming
The security appendix of the 2025 PSC Procedures is new, and port State regimes are still adopting it into their own procedures. Expect more questions at the gangway about how security measures are actually carried out, and fewer about the binder.
What the rules say
- ISPS Code A/9.1 requires each ship to carry a ship security plan approved by the Administration, covering the three security levels.1
- ISPS Code A/9.8 states that ship security plans are not subject to inspection by port State officers except, under 9.8.1, limited access to specific sections relating to a non-compliance with the consent of the Contracting Government or the master.1
- ISPS Code A/10.1 lists ten categories of security records that must be kept on board for at least the minimum period specified by the Administration.1
- ISPS Code A/5.2 allows a ship to request a Declaration of Security, for example when it operates at a higher security level than the port facility.1
- ISPS Code A/19.1.1.3 requires at least one intermediate verification, which, if only one is done, “shall take place between the second and third anniversary date of the certificate”.1
- ISPS Code A/19.3.1 limits the ISSC to five years, and A/19.3.5 and 19.3.6 limit extensions to three months, or one month for short voyages.1
- ISPS Code A/19.4.4 makes an interim ISSC valid for six months and says it may not be extended; A/19.4.5 bars a consecutive interim certificate where the purpose is to avoid full compliance.1
- ISPS Code B/13.6 recommends security drills at least once every three months, and an extra drill within one week when more than 25% of personnel change; B/13.7 recommends exercises at least once each calendar year, no more than 18 months apart.2
- SOLAS regulation XI-2/6 requires a ship security alert system, and XI-2/9 sets out the control and compliance measures port States may apply.3
- The Procedures for Port State Control, 2025 (A.1206(34)) introduced appendix 20 on security aspects, giving PSCOs a basis to act on ineffective security implementation.45
Flag and class notes
Flags decide who approves SSPs and issues ISSCs: many authorise ROs that are “recognized security organizations”, while others keep SSP approval for themselves. Flags also set the retention period for security records and how SSAS tests are to be arranged, so read the flag’s ISPS circulars and the RO’s instructions.1 In the European Union and in states that took over EU law, Regulation (EC) No 725/2004 made certain Part B paragraphs mandatory for ships trading there, so treat B/13.6 and 13.7 as binding when in doubt.2 Panama and the Bahamas have both told owners to expect PSC action on security implementation under the 2025 Procedures.45
Key numbers
| What | Value |
|---|---|
| ISSC maximum validity | 5 years1 |
| Intermediate verification (if only one) | Between the 2nd and 3rd anniversary dates1 |
| Interim ISSC | 6 months, cannot be extended1 |
| Extension to complete a voyage | Up to 3 months (1 month for short voyages)1 |
| Endorsement if new ISSC cannot be placed on board | Up to 5 months from expiry1 |
| Security drills | At least every 3 months2 |
| Drill after crew change of more than 25% | Within 1 week2 |
| Security exercises | Once each calendar year, max 18 months apart2 |
| ISPS deficiencies, Tokyo MOU 2025 | 1,0616 |
What inspectors find
- Access control that exists only on paper: an unattended gangway, no identification checks, visitors not logged.2
- Drill records signed but the crew cannot describe their security duties, which is listed as clear grounds for a more detailed inspection.2
- No record of SSAS testing, or a test that was never coordinated with the flag.1
- An SSP version on board that does not match the approved one, or amendments implemented without the required approval.1
- An ISSC with an intermediate verification overdue, so the certificate is no longer valid.1
FAQ
Can the PSCO see the ship security plan?
Not normally. Only if there are clear grounds, and then only limited access to the specific sections concerned, with the consent of the flag or the master. Some sections, such as the SSAS activation points, stay confidential.
Who can be the SSO?
A person on board, accountable to the master, designated by the company and trained to the standard required by the Code and by STCW. On many ships the chief officer or master holds the role.
Is the ISSC audited every year?
No. There is no annual verification. At least one intermediate verification is needed during the five years.
Does a Declaration of Security have to be completed at every port?
No. The Contracting Government decides when one is required, and the ship can request one in the situations listed in A/5.2.
Quiz5 questions
Sources
- 1
International Ship and Port Facility Security (ISPS) Code, Part A, sections 2, 5, 9, 10, 13 and 19 (IMO publication; text as reproduced in Annex II to Regulation (EC) No 725/2004, legislation.gov.uk point-in-time version of 31 January 2020). https://www.legislation.gov.uk/eur/2004/725/annex/II/2020-01-31
- 2
ISPS Code, Part B, paragraphs 1.12 to 1.14, 4.32 to 4.43, 9.2, 13.6 and 13.7 (text as reproduced in Annex III to Regulation (EC) No 725/2004, point-in-time version of 31 January 2020); Article 3(5) of that Regulation lists the Part B paragraphs, including 13.6 and 13.7, that EU Member States apply as if mandatory. https://www.legislation.gov.uk/eur/2004/725/annex/III/2020-01-31
- 3
International Convention for the Safety of Life at Sea (SOLAS), 1974, as amended, chapter XI-2, regulations 2, 6 and 9, and chapter XI-1, regulation 5 (IMO publication). https://www.imo.org/en/About/Conventions/Pages/International-Convention-for-the-Safety-of-Life-at-Sea-(SOLAS),-1974.aspx
- 4
Bahamas Maritime Authority, Technical Alert 26-04, IMO Procedures for Port State Control 2025, section 3.1 (3 March 2026). https://www.bahamasmaritime.com/wp-content/uploads/2026/03/TA004-IMO-Procedures-for-Port-State-Control-2025.pdf
- 5
Panama Maritime Authority, Merchant Marine Circular MMC-379, Procedure for Port State Control, 2025 amendments, section 3.1 (updated July 2026). https://www.panamashipregistry.com/wp-content/uploads/2024/07/MMC-379-Procedure-for-PSC-2025-30-07-2026.pdf
- 6
Tokyo MOU, Annual Report on Port State Control in the Asia-Pacific Region 2025, table 7 (deficiencies by category). https://www.tokyo-mou.org/wp/wp-content/uploads/ANN25.pdf
Rules checked 20 October 2026. VSL Safety is not an approved training provider and doesn't issue certificates. These lessons don't replace STCW training, or the manufacturer's training and certification that service technicians need.
