ISPS Code: Understanding Global Maritime Security Standards
Updated: Oct 21
Table of Contents
The International Ship and Port Facility Security (ISPS) Code is a maritime security framework adopted by the International Maritime Organization (IMO) in December 2002 and in force since 1 July 2004. It applies to passenger ships on international voyages, cargo ships of 500 gross tonnage (GT) and above on international voyages, mobile offshore drilling units, and the port facilities serving them, subject to the applicable SOLAS provisions (1).
At the end of 2024, the world trading fleet comprised approximately 69,000 vessels and 2.31 billion deadweight tonnes, according to the UK Government's Shipping Fleet Statistics 2024 (2). This fleet-wide count is not the same as the number of ships subject to the ISPS Code, which depends on vessel type, tonnage and international-voyage status. For anyone considering maritime ownership, whether through traditional channels or modern fractional ownership models, understanding this regulatory framework is essential. It determines whether your ship can trade globally and maintain commercial eligibility, or sits idle at dock with no commercial viability.
This guide breaks down the ISPS Code in practical terms: what it requires, who must comply, and why it matters for your potential earnings as a ship owner.
What Is the ISPS Code and Why Was It Created?
The International Ship and Port Facility Security Code represents a comprehensive set of measures designed to enhance the security of ships and port facilities worldwide. The ISPS Code and related SOLAS amendments were adopted at the Conference of Contracting Governments to SOLAS held in London from 9 to 13 December 2002. The security regime entered into force on 1 July 2004 (3).
Beyond the September 11 attacks, the October 2002 bombing of the French oil tanker Limburg off Yemen demonstrated that maritime assets were vulnerable targets. The shipping industry, which handles over 80% of global trade by volume, needed standardized security protocols that could be implemented consistently across borders. The U.S. Coast Guard, serving as the lead agency in the United States delegation to the IMO, advocated strongly for the measure (3).
The resulting framework is embedded within SOLAS Chapter XI-2, making compliance mandatory for all signatory nations. What makes the ISPS Code unique is its focus on intentional acts: terrorism, piracy, smuggling, and other security threats, rather than accidental safety incidents.
Understanding SOLAS XI-2 and the Regulatory Framework
The ISPS Code is implemented through Chapter XI-2 of the International Convention for the Safety of Life at Sea, specifically addressing "special measures to enhance maritime security" (4). SOLAS XI-2 mandates that contracting governments establish security levels and communicate these levels to ships flying their flags. When a ship approaches a port, it must immediately comply with whatever security level that port has established, regardless of what security level the ship's flag state has declared (3).
The Code itself is divided into two parts. Part A contains mandatory requirements that all ships and port facilities must follow. Part B provides guidance on how to implement these requirements, though many contracting governments have elected to treat Part B as mandatory as well (4). This structure allows for both standardization and flexibility across different maritime jurisdictions.
Who Must Comply: Ships and Port Facilities
The ISPS Code applies to specific categories of ships engaged in international voyages (5). Passenger ships of any size must comply, including ferries and high-speed passenger craft. Cargo ships of 500 gross tonnage and above are required to maintain full ISPS compliance, encompassing container ships, bulk carriers, tankers, and general cargo ships. Mobile offshore drilling units also fall under the Code's jurisdiction.
Port facilities serving any of the above ships must implement their own security measures. The Code explicitly does not apply to warships, naval auxiliaries, fishing ships, ships under 500 GT, non-commercial yachts, and wooden ships with primitive construction (2).
For ownership consideration, if you are evaluating a ship for its earnings potential through international charter markets, that ship certainly needs to be ISPS compliant. UNCTAD's Review of Maritime Transport 2025 reports that, on 1 January 2025, the global fleet comprised approximately 112,500 commercial vessels of at least 100 GT, with a total carrying capacity of 2.44 billion deadweight tonnes (6). This is a broader fleet measure than the approximately 69,000-vessel world trading fleet reported for the end of 2024 in the UK Government's statistics. The vast majority of commercially viable ships in international trade fall under ISPS requirements.
ISPS Code Part A and Part B
Part A of the ISPS Code contains mandatory provisions that give legal force to SOLAS Chapter XI-2 (4). Sections 5 through 13 and Section 19 apply specifically to shipping companies and their ships, while Sections 5 and 14 through 18 govern port facilities (7).
The mandatory requirements include developing and maintaining a Ship Security Plan approved by the ship's flag state administration, conducting security assessments to identify potential vulnerabilities, appointing designated security officers, establishing communication protocols for different security levels, and implementing specific security measures ranging from access control to cargo monitoring.
Part B, while technically recommendatory, provides the practical guidance on how to achieve Part A compliance (4). Think of Part A as the "what" and Part B as the "how." Many maritime administrations have chosen to make Part B mandatory in their national regulations.
Key Personnel: SSO, CSO, and PFSO Responsibilities
The ISPS Code establishes a clear chain of responsibility through three designated security officers (8).
The Ship Security Officer (SSO) is the person on board directly accountable to the Master for the ship's security. The SSO's responsibilities include implementing and maintaining the Ship Security Plan, ensuring security equipment is properly operated, coordinating with the Company Security Officer, and conducting crew training on security procedures.
The Company Security Officer (CSO) operates from shore-side and ensures that security assessments are properly conducted for all company ships, that Ship Security Plans are developed and maintained, and that the company's overall security posture meets regulatory requirements (3).
The Port Facility Security Officer (PFSO) holds responsibility for developing, implementing, and maintaining the port facility's security plan (8). The PFSO coordinates with ships entering the port and manages the facility's response to changing security levels.
For ship owners, these personnel requirements translate directly into operational costs and compliance obligations. Your ship must have a qualified SSO, and your management company must employ a certified CSO.
The Three Security Levels Explained
One of the ISPS Code's most practical innovations is its tiered security level system (5).
Security Level 1 represents normal operating conditions where minimum protective measures are maintained at all times. Ships conduct standard access control, routine security rounds, and normal cargo monitoring. This is the baseline every ISPS-compliant ship maintains continuously.
Security Level 2 indicates a heightened threat environment where additional protective security measures must be maintained (9). Ships increase patrol frequency, implement additional restrictions on access points, conduct more rigorous identification checks, and provide crew with specific threat briefings.
Security Level 3 represents exceptional circumstances where a security incident is probable or imminent (9). Ships may implement partial closure of access points, halt non-essential operations, and work in direct coordination with government security forces.
The security level is set by the flag state for ships and by national authorities for port facilities. Ships receive updates through official notices and must adjust their security posture accordingly (10).
ISPS Compliance and Ship Value
A cargo ship on ocean with world map background. Blue boxes display maritime stats: 69,000 vessels, 2.31B tonnes, ISPS compliance needed.
Here is where the ISPS Code becomes directly relevant to maritime ownership: without compliance, your ship cannot trade internationally.
The International Ship Security Certificate (ISSC) proves your ship meets ISPS requirements (12). Without a valid ISSC, ports may deny your ship entry, conduct extensive inspections, or expel the ship from port facilities (2). Standard charter contracts (such as BIMCO clauses) explicitly require ISPS compliance. No charterer will contract a ship that might be denied entry to ports along their trade route.
ISPS compliance affects ship valuation. When you evaluate a ship for potential ownership, the ship's compliance status is a critical factor. A ship with up-to-date certifications holds greater value than one with compliance gaps. The costs of bringing a non-compliant ship into compliance can be substantial, including security assessments, plan development, equipment upgrades, and personnel training. UNCTAD research indicates that ISPS implementation costs vary significantly based on ship size, with initial compliance ranging from thousands to millions of dollars (14).
From the Helm: Practical Insight
Insider's View from the Shipfinex Team:
When we evaluate ships for potential tokenization, ISPS compliance is one of the first items on our due diligence checklist. We examine the entire compliance history, the quality of the security management system, and the competence of the designated security officers.
We have seen cases where ships with attractive purchase prices revealed compliance gaps upon closer inspection: outdated security plans, lapsed officer certifications, or security equipment that had not been properly maintained. These seemingly minor issues can translate into major costs and operational delays.
The practical advice: treat ISPS compliance as you would treat the ship's seaworthiness. Just as you would not purchase a ship with structural deficiencies, you should not consider maritime assets with security compliance gaps.
Conclusion
The International Ship and Port Facility Security Code represents more than regulatory bureaucracy. It is the framework that enables global maritime trade to function securely. Your ship's ability to trade internationally, attract quality charter contracts, and maintain commercial eligibility depends fundamentally on maintaining ISPS compliance. The costs of compliance, while significant, pale in comparison to the costs of non-compliance: denied port access, detention, damaged reputation, and a stranded asset that cannot fulfill its commercial purpose.
As the global fleet continues to grow, with fleet capacity reaching 2.31 billion deadweight tons at the start of 2025, the ISPS Code will remain the cornerstone of maritime security standards. Any serious consideration of maritime ownership must include assurance that your asset meets the highest compliance standards.
FAQS
What is the ISPS Code?
The International Ship and Port Facility Security Code is a comprehensive maritime security framework developed by the International Maritime Organization following the September 11, 2001 attacks. It establishes mandatory security requirements for ships engaged in international voyages and the port facilities that serve them, ensuring coordinated global security measures.
What ships must comply with the ISPS Code?
The ISPS Code applies to passenger ships of any size, cargo ships of 500 gross tonnage and above engaged in international voyages, and mobile offshore drilling units. It does not apply to warships, fishing ships, ships under 500 GT, or ships operating solely in domestic waters.
What are the three ISPS security levels?
Security Level 1 is normal operating condition with minimum protective measures. Security Level 2 indicates heightened threat requiring additional protective measures. Security Level 3 represents exceptional circumstances where a security incident is probable or imminent.
Who is responsible for ISPS compliance on board ships?
Three key officers share responsibility: the Ship Security Officer implements daily security measures on board, the Company Security Officer ensures security assessments and plans are developed and maintained, and the Port Facility Security Officer manages security at port facilities.
What happens if a ship is not ISPS compliant?
Non-compliant ships may be denied entry to international ports, detained for inspection, or expelled from port facilities. Without a valid International Ship Security Certificate, a ship cannot trade internationally.
References (APA Style with Active Links)
International Maritime Organization. (n.d.). SOLAS XI-2 and the ISPS Code. https://www.imo.org/en/OurWork/Security/Pages/SOLAS-XI-2%20ISPS%20Code.aspx
SafetyCulture. (2025, March 27). A Quick Guide to the Requirements and Levels of ISPS Code. https://safetyculture.com/topics/isps-code
Wikipedia. (2025, October 12). International Ship and Port Facility Security Code. https://en.wikipedia.org/wiki/International_Ship_and_Port_Facility_Security_Code
International Maritime Organization. (n.d.). SOLAS XI-2 and the ISPS Code. https://www.imo.org/en/OurWork/Security/Pages/SOLAS-XI-2%20ISPS%20Code.aspx
Tideworks. (2024, April 18). International Ship and Port Facility Security Requirements. https://tideworks.com/international-ship-and-port-facility-security-requirements/
UNCTAD Data Hub. (n.d.). Data Insights: International Freight Transport. https://unctadstat.unctad.org/insights/theme/107
EduMaritime. (n.d.). ISPS Code Requirements for Seafarers, Ships and Ports. https://www.edumaritime.net/isps-code
EduMaritime. (n.d.). ISPS Code Requirements for Seafarers, Ships and Ports. https://www.edumaritime.net/isps-code
The Master Mariner. (2021, March 24). ISPS Code: Responsibilities and Security Levels. https://www.themastermariner.com/stcw-a-ii2/isps-code-security-levels/
AVS Global Supply. (n.d.). What is ISPS Code? A Guide to Maritime Security Compliance. https://www.avsglobalsupply.com/blog-detail/isps-code
Marine Insight. (2024, April 30). The Ultimate Guide to the ISPS Code for Ships - Enhancing Maritime Security. https://www.marineinsight.com/maritime-law/the-isps-code-for-ships-a-quick-guide/
Lloyd's Register. (n.d.). International Ship and Port Facility Security (ISPS) Code. https://www.lr.org/en/services/statutory-compliance/solas/isps-code/
UK Government. (2025, February 26). Shipping Fleet Statistics: 2024. https://www.gov.uk/government/statistics/shipping-fleet-statistics-2024/shipping-fleet-statistics-2024
UNCTAD. (2007). ISPS Code Implementation, Costs and Related Financing. https://unctad.org/system/files/official-document/sdtetlb20071_en.pdf
Regulatory disclosure: Shipfinex FZCO holds VARA In-Principle Approval (IPA/26/01/002) for Virtual Asset Broker-Dealer Activity. This is an In-Principle Approval, not a full operational licence. Shipfinex is not authorised to commence operations or conduct virtual asset activities until it obtains final authorisation from the Virtual Assets Regulatory Authority (VARA). This article is for informational purposes only and does not constitute legal advice, regulatory guidance, or an offer or invitation to deal in virtual assets or securities.
All investments carry significant risk, including the potential for total loss. This is a high-risk asset. See the full Risk Disclosure Statement.
Capt. Anuj Chopra
Managing Director / Contributing Author
Capt. Anuj Chopra, ExC FNI FICS, is a maritime industry executive with over 40 years of experience. A former VP Americas at RightShip and co-founder of ESGplus LLC, he specialises in maritime risk, environmental compliance, and ESG. He also serves as an Adjunct Professor at the University of Houston and is a Fellow of both The Nautical Institute and the Institute of Chartered Shipbrokers.
