Security

The ISPS Code and security levels

Published 28 August 2026 · updated 17 October 2026

The ISPS Code is why almost every port disbursement account (the bill for a port call) has a line called “ISPS”, and why a charterparty (the charter contract) has a clause about security levels. People often confuse it with war risk. War risk is a different system, priced by different people, and it answers a different question. Telling the two apart is most of what a commercial desk needs to know about it.

Where it came from

A diplomatic conference adopted the International Ship and Port Facility Security Code on 12 December 2002, after the attacks of September 2001. It came into force on 1 July 2004 under a new SOLAS chapter XI-2. That is very fast for an IMO rule, and the speed can be seen in how detailed the code is about what to do.

It applies to ships on international voyages: passenger ships, and cargo ships of 500 gross tonnage and over, including high speed craft and mobile offshore drilling units. It also applies to the port facilities that serve them. Part A of the code is mandatory and Part B is guidance. But some governments have made parts of Part B mandatory in their own law. That is why two flags can both comply with the code and still require different things.

What it puts in place

The system requires an assessment, then a plan, then a named person responsible for it, at both ends of the port call: on the ship and at the port.

Ship Security Assessment and Ship Security Plan, approved by the flag state or on its behalf. The plan is confidential, and a port state inspector usually may not read it.
Company Security Officer, ashore, responsible for the whole fleet.
Ship Security Officer, on board, who reports to the master (the captain).
Port Facility Security Officer, for the terminal.
International Ship Security Certificate, the document that says all of the above has been checked. There is an interim certificate for new ships and new operators.
Ship Security Alert System, a hidden alarm that alerts the flag state without warning anyone nearby or showing anything on board.

Two smaller items appear in day-to-day messages. The Declaration of Security is an agreement between a ship and a port facility, or between two ships, setting out which security measures each side will take when one is needed. The continuous synopsis record, required by SOLAS chapter XI-1, is the ship’s running history of flag, name, registered owner and DOC holder (the company responsible for safe operation), kept on board. It is the one document that prevents a ship from being presented as newer than it is without anyone noticing.

The three security levels

The security level is the key idea, and the code defines all three levels.

Level	Meaning	What it looks like
1, normal	The level at which a ship or port facility normally works, with the minimum suitable protective measures kept in place at all times	Gangway watch, access control, identity checks. The default everywhere
2, heightened	Extra protective measures kept in place for a period, because the risk of a security incident is higher	More searches, restricted areas, more patrols, often extra shore guards
3, exceptional	Further specific measures for a limited period, when an incident is probable or about to happen	Rare. In effect, an order from the state to the ship

A contracting government sets the level, for its own port facilities and for ships flying its flag. The owner, the charterer, the terminal and the insurer do not. The ship must then work at whichever is higher, its own flag’s level or the port facility’s level. This is how a ship can face extra costs even though it has done nothing to cause them.

Why it is not war risk

This is the main point to remember. ISPS is a regulatory system: a state declares a level, and set measures follow. War risk is an insurance system: insurers list areas, charge an additional premium to enter them, and require notice. Neither one causes the other.

A port can be at security level 1 and still be inside a listed war risk area. In that case there is additional premium and a crew war bonus to pay, but no extra ISPS measure at all. A port can go to level 2 for a state visit or a local threat with no insurance effect at all. The clauses and the payers are different. In a dispute, the side that mixes them up will lose the argument.

Where the costs are

There are two separate cost lines, and they should stay separate on the disbursement account.

The first is the ISPS charge made by the terminal or the port authority. It is a regular fee for running their own security. It is a normal port cost and is charged almost always, whatever the level.

The second is the cost of meeting a raised level: extra guards, extra searches, escorts, and above all extra time. This is what the charterparty clause deals with. The BIMCO ISPS/MTSA clauses for voyage and time charter parties, published in 2005 and still the common wording, set out who does what and who pays. In outline: the owner must comply with the code and, if asked, provide the ISSC and the full contact details of the Company Security Officer. The charterer must give information about the ports and the previous cargo. Costs and delays from measures the ship itself must take are for the owner. Costs from requirements special to the charterer’s ports and cargo are for the charterer.

The real question is whether the lost time counts. The charterparty wording decides it, not custom. Under a voyage charter, waiting caused by a security requirement at the charterer’s chosen berth usually counts against the charterer if the clause says so, and against the owner if it does not. Under a time charter, the ship stays on hire (the charterer keeps paying) the whole time, unless the delay is an off-hire event. So the argument becomes whether an ISPS delay is an off-hire event. Read the clause before you argue about the general rule.

What an inspector checks

Port state control officers check the security side as well as the safety side. What they can check is limited. The ship security plan is confidential and is not handed over for them to read. So they check the certificate, the records of drills and training, the access control actually in place at the gangway, and whether the crew can explain what the ship does at each level. The ship records its last ten port calls and their security levels, and an inspector may ask for them.

Findings are recorded under the ISPS category and can lead to detention, and detention is what affects the business. A ship detained for a security deficiency is delayed just as much as one held for a faulty lifeboat, and the entry stays on the record that the next charterer reads.

References

IMO, SOLAS XI-2 and the ISPS Code. imo.org
IMO, Maritime security, frequently asked questions. imo.org
IMO, Guide to maritime security and the ISPS Code. imo.org
BIMCO, ISPS/MTSA Clause for Voyage Charter Parties 2005. bimco.org
BIMCO, ISPS/MTSA Clause for Time Charter Parties 2005. bimco.org

War risk areasAn insurers’ list of sea areas, not a report of last week’s attacks. What being inside one does to the premium, the crew, the route and the rate. Port agency and disbursementsSomebody has to meet the ship. Who appoints the agent, who the agent answers to, and how a PDA becomes an FDA. SOLAS explainedThe safety convention every merchant ship is certified under. What is in it, and the few chapters a broker meets by name. Port state control and detentionsA detained ship cannot do its job. What an inspection records, and how to read a ship's record without judging it on a single inspection.

Neptune Atlas

Chartering software for a broking desk, covering the whole cycle: the world merchant fleet, position lists, cargo enquiries, fixtures, laytime and demurrage, and who to write to. Every paid plan starts with 7 free days. A card is needed to start them, and cancelling before they end costs nothing.

Try 7 days free Ship chartering software for brokers What each plan includes