Editorial note

This article provides general information, not legal, regulatory or financial advice. Requirements depend on the applicable contract, authority and jurisdiction.

Editorial image placeholder — The ISPS Code Explained

What the ISPS Code is

The International Ship and Port Facility Security (ISPS) Code is the mandatory security framework adopted by the IMO in December 2002 and brought into force on 1 July 2004, under SOLAS Chapter XI-2. It was introduced directly in response to the September 2001 attacks, extending a safety-focused regulatory regime to explicitly cover security.

It applies to passenger ships, cargo ships of 500 gross tonnage and above on international voyages, mobile offshore drilling units, and the port facilities that serve them. A ship or port facility operating outside that scope is not bound by it, though many apply equivalent standards voluntarily.

The three security levels

The Code works on a three-tier security level system, and the level in force at a given time determines what security measures a ship and port facility must actually apply.

  • Security Level 1 — normal, the minimum protective measures maintained at all times
  • Security Level 2 — heightened, applied for a period of increased risk of a security incident
  • Security Level 3 — exceptional, applied for the period a security incident is probable or imminent
Diagram placeholder — ISPS security level escalation and the CSO/SSO/PFSO relationship

Who is responsible for what

The Code creates three named roles, and confusion between them is one of the most common practical mistakes in port paperwork.

  • Company Security Officer (CSO) — designated by the shipowner/operator, responsible for security across the fleet
  • Ship Security Officer (SSO) — on board, reports to the master, implements and maintains the Ship Security Plan (SSP)
  • Port Facility Security Officer (PFSO) — the equivalent role on the port side, responsible for the Port Facility Security Plan (PFSP)

What paperwork actually gets checked

In practice, ISPS compliance shows up in port through two documents: the ship's International Ship Security Certificate (ISSC), issued after verification against the ship's approved Ship Security Plan, and the Declaration of Security (DoS), completed jointly by ship and port facility when required — typically at a higher security level, or for specific ship/cargo combinations such as passenger ships or ships carrying certain dangerous cargoes.

A ship without a valid ISSC, or one whose declared security level does not match the port facility's, can be delayed or refused entry — which is why ISPS status sits alongside customs and immigration clearance as a routine part of port-call planning rather than a separate compliance exercise.

How ISPS fits with wider maritime security

ISPS covers the ship and the port interface specifically. It sits alongside, but is distinct from, sanctions compliance (screening counterparties and cargo against restricted-party lists), piracy and armed-robbery risk management in high-risk areas, and flag-state or company-level cybersecurity requirements — each has its own framework, and a ship can be fully ISPS-compliant while still carrying exposure under one of the others.

Zeaclub publishes a free maritime sanctions screening tool alongside its other public utilities.

Frequently asked questions

What does ISPS stand for?

International Ship and Port Facility Security Code — the mandatory maritime security framework adopted by the IMO under SOLAS Chapter XI-2.

When did the ISPS Code come into force?

1 July 2004, following adoption by the IMO in December 2002 in direct response to the September 2001 attacks.

Which ships does the ISPS Code apply to?

Passenger ships, cargo ships of 500 gross tonnage and above on international voyages, mobile offshore drilling units, and the port facilities serving them.

What are the three ISPS security levels?

Level 1 (normal), Level 2 (heightened, for a period of increased risk), and Level 3 (exceptional, for a period where an incident is probable or imminent). Each level requires progressively stricter measures from both ship and port facility.

What is the difference between the CSO, SSO and PFSO?

The Company Security Officer (CSO) is responsible for security across the fleet at the operator level; the Ship Security Officer (SSO) implements the plan on board and reports to the master; the Port Facility Security Officer (PFSO) holds the equivalent responsibility for the port facility.

Primary sources