ISPS Code in plain words: security levels, the SSO, the gangway watch and interview questions

The ISPS Code is why there is always someone at the gangway with a visitors' log, why the bridge and engine room doors are locked in port, and why the ship has a security officer and a plan most of the crew never sees in full. It came into force in 2004, in the wake of the attacks of 2001, and it now governs every international cargo ship of 500 GT and above and every passenger ship. Officers are asked about it at interviews, and the gangway watch is where ratings meet it every day. This page sets out how the Code works, the security levels, the roles and documents, what the gangway watch actually has to do, the mistakes that let the wrong person on board, and questions to test yourself.

What the ISPS Code is

After the attacks of 11 September 2001, IMO looked at how a ship could become a target, a weapon or a way to move people and goods illegally. In December 2002 a diplomatic conference added chapter XI-2 to SOLAS and adopted the ISPS Code; both came into force on 1 July 2004. Part A of the Code is mandatory; Part B is guidance, though many states apply much of it as if it were mandatory.

The Code applies to passenger ships, including high-speed passenger craft, on international voyages; to cargo ships, including high-speed craft, of 500 GT and above on international voyages; to mobile offshore drilling units; and to the port facilities that serve them. Its approach is risk management: assess the threat, plan the measures, set the level, practise.

Next to it, chapter XI-1 gives every ship an IMO number and a Continuous Synopsis Record — the ship's history of names, flags, owners and managers on board.

Key numbers

The three security levels

• Level 1 — normal: the minimum protective measures kept up at all times.
• Level 2 — heightened: additional measures for a period of time because the risk of a security incident has risen.
• Level 3 — exceptional: further, specific measures for a limited period when an incident is probable or imminent, even if the exact target cannot be identified. Instructions may come directly from the authorities.

The flag state sets the level for its ships, the port state for its port facilities. Before entering port the ship compares levels: if the port's level is higher, the ship raises its own to match; if the ship's level is higher, it does not lower it, and the two sides agree the measures.

Roles and documents

• Company security officer (CSO) — ashore; arranges the ship security assessment, develops the plan and has it approved, organises audits and keeps contact with the ships.
• Ship security officer (SSO) — on board, accountable to the master; implements and maintains the plan, inspects the ship regularly, trains the crew, holds drills, reports security incidents and keeps the security equipment working. Often the chief officer; the certificate is STCW VI/5.
• Port facility security officer (PFSO) — ashore, for each port facility; the SSO's counterpart in port.
• Ship security assessment (SSA) — the CSO's study of the ship's vulnerabilities, made before the plan is written.
• Ship security plan (SSP) — approved by the flag and kept on board. It covers access control, restricted areas, handling of cargo and stores, monitoring, responses to threats and breaches, and the SSAS. Parts of it are confidential: they are shown to a port state control officer only with the flag's consent.
• International Ship Security Certificate (ISSC) — valid for up to five years, with an intermediate verification; an interim ISSC is issued for up to six months.
• Declaration of security (DoS) — an agreement between the ship and the port facility, or another ship, on which security measures each side will take. It is completed when the ship is at a higher level than the port facility or the other ship, when one side is not covered by the Code, after a security threat or incident, when the authorities require it, or when either side asks for one.

The ship security alert system

The SSAS is a covert alarm required by SOLAS chapter XI-2. When activated, it sends an alert ashore — to the authority the flag has designated, usually including the company — giving the ship's identity and position and saying that its security is under threat. It does not sound on board and does not alert other ships, so that whoever is threatening the ship does not know the alarm has gone. It can be activated from the bridge and from at least one other place, and those places are known only to the people who need to know. It is tested under the plan, and a test is announced to the receivers first so it is not mistaken for a real alert.

The gangway watch and access control

At level 1 the plan typically requires:

• checking the identity of everyone boarding and their reason for coming — agents, surveyors, chandlers, crew changes, pilots and port officials included;
• a visitors' log with names, organisations, times on and off, and visitor passes;
• searching persons, baggage and vehicles to the extent the plan sets, more at higher levels;
• restricted areas — bridge, engine room, steering gear, the cargo control room and others — locked or guarded;
• watching the deck and the water around the ship, especially at night;
• checking stores and cargo against the documents, and searching the ship for stowaways before departure.

At level 2 these measures tighten — fewer access points, more searches, escorts for visitors, extra patrols. At level 3 access may be limited to authorised people only, and the ship follows the authorities' instructions.

Drills, exercises and training

• Security drills at least every three months, and within a week if more than a quarter of the crew has changed with people who have not taken part in a drill on that ship within the last three months.
• Security exercises — with the CSO, port facilities and authorities — at least once every calendar year, with no more than 18 months between them.
• Training: security awareness for every seafarer and designated security duties for those who have them (STCW VI/6); the SSO holds STCW VI/5.
• Records kept on board: training, drills and exercises, threats and incidents, breaches, changes of security level, communications on the ship's security, internal audits, maintenance of security equipment, and declarations of security.

In high-risk areas for piracy, companies add the industry's Best Management Practices — the citadel, barriers, watches and reporting to the regional centres — to the measures in the ship security plan.

What they ask at the interview

• Chief officers and masters: the three levels and who sets them; what to do when the port's level is higher than the ship's; when a declaration of security is needed; what the SSAS does and why it is silent; the SSO's duties; drill and exercise intervals; what a port state control officer may and may not see in the plan.
• Junior officers: gangway procedures; restricted areas; a stowaway search before departure; what to do on finding an unidentified package.
• Ratings: checking ID at the gangway and the visitors' log; who may board without a check (nobody); reporting anything suspicious to the officer of the watch or the SSO.

Common mistakes

1. Letting someone board without checking ID because they "look like the agent" or are in a hurry. Everyone is checked, every time.
2. Leaving restricted areas open in port — the engine room door propped open for ventilation, the bridge unlocked.
3. Telling outsiders where the SSAS buttons are, or showing them the plan. The confidential parts are confidential from everyone without a need to know.
4. Posting photos and the ship's schedule on social media. Routes, cargo and crew lists are information someone else may use.
5. Skipping the stowaway search before sailing because the stay was short. A stowaway found at sea becomes the ship's problem for weeks.
6. Mixing up the SSAS with a distress alert. A distress alert calls for help from everyone; the SSAS warns the shore and keeps silent on board.

Test yourself

Who on board needs this

Everyone who stands a watch in port — the able seaman and the ordinary seaman at the gangway, the bosun who sets the watch — and above all the chief officer, who is usually the SSO, and the master. The second and third officer are the officers of the watch the gangway reports to. The training certificates are STCW VI/5 and VI/6 — see STCW in plain words; the legal frame is SOLAS chapter XI-2 — see SOLAS in plain words.

Put your security certificates — VI/6 and, for officers, VI/5 — with their dates into your maritime CV.

Source: the International Ship and Port Facility Security (ISPS) Code and SOLAS chapter XI-2. The detail of what your ship does lives in its ship security plan; on board, the plan and the SSO's instructions prevail. This page is a study aid, not a legal text.