- The International Ship and Port Facility Security Code entered into force on 1 July 2004 under SOLAS chapter XI-2; Part A is mandatory and Part B is guidance.
- Port facilities operate at three security levels set by the government, with measures increasing as the level rises in line with the port facility security plan.
- Every port employee needs to know their part of the security plan, and the Code recommends drills at least every three months and an annual exercise.
This article is for general awareness. Actual implementation follows the approved port facility security plan and the instructions of the competent national authority in each country; refer to the official text of the Code published by the International Maritime Organization.
Why was the ISPS Code introduced?
After the events of September 2001, the international maritime community moved to close security gaps in ships and ports. The International Maritime Organization (IMO) introduced the International Ship and Port Facility Security Code (ISPS Code) under chapter XI-2 of the International Convention for the Safety of Life at Sea (SOLAS), and it entered into force on 1 July 2004. [1]
The Code has two parts: Part A is mandatory and sets security requirements for governments, port authorities and shipping companies, while Part B is guidance on how to meet those requirements. [1]
What does the Code aim to achieve?
The IMO summarises the Code’s objectives as: [1]
- Establishing an international framework of cooperation to assess and detect threats to ships and port facilities.
- Defining roles and responsibilities at national, regional and international levels.
- Ensuring the timely exchange of security information.
- Providing a methodology for security assessments, so that plans can respond to changing security levels.
- Ensuring adequate and proportionate maritime security measures are in place on ships and in ports.
To achieve this, the Code requires the designation of Port Facility Security Officers (PFSOs), Ship Security Officers (SSOs) and Company Security Officers (CSOs), who assess risks and prepare and implement security plans. [1]
The three security levels
Port facilities operate at three security levels: [3]
- Level 1: the normal operating level, at which minimum protective measures are maintained at all times.
- Level 2: a heightened level applied when there is an increased risk of a security incident, with additional protective measures.
- Level 3: for exceptional circumstances when a security incident is probable or imminent, with further specific measures.
The Contracting Government sets the security level, and the facility applies the matching measures with as little interference or delay to ships and cargo as possible. [3]
What happens at level 1 every day?
Even in normal conditions, Part A requires the port facility to carry out a range of activities through appropriate measures, including: [3]
- Performing all port facility security duties.
- Controlling access to the facility.
- Monitoring the facility, including anchoring and berthing areas.
- Monitoring restricted areas to ensure only authorised people have access.
- Supervising the handling of cargo and ship’s stores.
- Ensuring security communication is readily available.
At level 2, the additional protective measures specified in the port facility security plan apply to each of these activities, and at level 3 further specific measures apply, together with any instructions from the government. [3] If a ship has difficulty complying, or is operating at a higher security level than the facility, the PFSO coordinates with the SSO and reports to the competent authority where needed. [3]
Training, drills and exercises
Part A requires the PFSO and staff with security duties to have the necessary knowledge and training, for each of them to understand their duties and responsibilities, and for drills to be carried out at appropriate intervals. [4]
Part B, the guidance section, adds detail: [4]
- PFSO and staff with security duties: knowledge of current security threats and patterns, and of drills and exercises, including those with ships.
- All other port facility staff: knowledge of, and familiarity with, the relevant provisions of the port facility security plan.
- Drills: at least every three months, unless circumstances dictate otherwise.
- Exercises: at least once each calendar year, with no more than 18 months between exercises.
The aim is for staff to be proficient in their duties at all security levels and for any deficiencies to be identified and addressed. [4] The Solomon Islands Maritime Authority’s guidelines note that exercises validate procedures for detecting and deterring threats, practise skills, test equipment and keep staff ready. [2]
- The current security level and its effect
- Restricted areas
- How to report something suspicious
- Their duties at each level
- Access control procedures
- Current threats and patterns
- Plan sections for their team
- Taking part in drills
- Coordinating with the PFSO
A hypothetical example: raising the security level at a container terminal
A container terminal receives notice from the national authority that the security level is being raised to level 2. The PFSO activates the measures the plan sets for that level: fewer gates open, a higher proportion of trucks searched, more frequent patrols around restricted areas, and notice to berthed ships so they can coordinate with their security officers.
A crane operator notices a person without a pass near a restricted area and reports it at once through the channel set out in the plan. That speed did not come from luck, but from an earlier quarterly drill that showed non-security staff how to report. The case is hypothetical, to illustrate the idea.
Common mistakes at port facilities
- Treating the security plan as a document for the security department only, without briefing other staff on their part.
- Running drills as a formality, with the same scenario every time.
- Not updating the plan after changes to gates, systems or contractors.
- Weak coordination with ships when the ship’s and facility’s security levels differ.
Conclusion
The ISPS Code is a framework for managing security risk in ports: assessment, then a plan, then measures that step up with the security level. Making it work depends on every employee knowing their role, drills being realistic and regular, and reporting anything suspicious being quick and easy.
Frequently asked questions
Who does the ISPS Code apply to?
Ships covered by SOLAS on international voyages and the port facilities that serve them; each Contracting Government determines which port facilities in its territory are covered. [1]
What is the difference between a Port Facility Security Officer and a Ship Security Officer?
The Port Facility Security Officer (PFSO) is responsible for the port facility security plan and its implementation, and the Ship Security Officer (SSO) for the ship security plan; they coordinate when the ship is at the facility. [1, 3]
How often must security drills be held at a port facility?
Part A requires them at appropriate intervals, and Part B recommends drills at least every three months and an exercise at least once each calendar year, with no more than 18 months between exercises. [4]
Who sets the security level at a port?
The Contracting Government in whose territory the facility is located; the facility then applies the measures its plan sets for that level. [3]
References
- International Maritime Organization (IMO). SOLAS XI-2 and the ISPS Code
- Solomon Islands Maritime Authority. Guidelines on Maritime Security Exercises (2024)
- EduMaritime. ISPS Code Part A Section 14: Port Facility Security
- EduMaritime. ISPS Code Section 18: Training, Drills and Exercises on Port Facility Security
Recommended programmes
