ISPS Code in Shipping: 2026 Security Compliance Guide

Compliance

Why every cargo owner must know the ISPS Code

Maritime security · SOLAS Chapter XI-2

Since July 2004, every international voyage involving SOLAS-registered vessels and relevant port facilities has been governed by the ISPS Code. Non-compliance means denied port access, sizable fines, or cargo detention. Rising drone incidents and shipboard cyber-attacks are lengthening the security checklists that brokers, forwarders, and cargo owners must coordinate.

Definition

What is the ISPS Code?

The ISPS Code is a comprehensive framework adopted by the International Maritime Organization (IMO) as an amendment to SOLAS (Safety of Life at Sea Convention) Chapter XI-2, establishing minimum security arrangements for ships, ports, and governmental bodies involved in international trade.

✓Detect and assess security threatsStandardized vulnerability assessment protocols identify threats to ships and port facilities before they materialize.

✓Establish preventive measuresPhysical access controls, restricted security zones, and cargo screening requirements are set and verified.

✓Define response and contingency protocolsMandatory communication channels and security emergency procedures ensure consistent incident handling.

Structure

Part A vs Part B: the two halves of the code

Aspect	Part A (Mandatory)	Part B (Recommendatory)
Legal status	Mandatory SOLAS requirements	Non-mandatory guidance
Covers	SSP, PFSP, security officers, ISSC, MARSEC levels	How to implement plans, assessment templates
Adoption	Ships & port facilities must comply	Guidelines to reach compliance
Amendments in 2026	Mandatory cyber-security & drone-threat sections	Updated threat assessment matrices

MARSEC

The three MARSEC security levels

MARSEC (Maritime Security) Levels dictate the intensity of security measures in force at any given time. They are set by flag states and port coastal authorities.

Level 1 — Normal

Everyday security. Baseline screening, patrols, and access control maintained continuously.

Level 2 — Heightened

Enhanced security. Extra patrols, random scanning, and suspicious-vessel response procedures.

Level 3 — Exceptional

Maximum security. Emergency response for probable/imminent threats; coordinated with authorities and nations.

Cargo owners' checklist during Level 3

During MARSEC Level 3, expect extended container X-ray screening, security hold notices, and longer transit times. Confirm your broker has pre-validated ISPS-compliant routing and access to the vessel's security officer before cargo tender.

Officers

Three key ISPS security roles

Company Security Officer (CSO)

Appointed by the shipping company; oversees ship security across the entire fleet.

Ship Security Officer (SSO)

Appointed on each vessel; manages the Ship Security Plan and daily security drills on board.

Port Facility Security Officer (PFSO)

Appointed by the port facility; implements the PFSP and coordinates port-side vigilance.

Plans

SSP & PFSP: the compliance backbone

Every complying ship and port facility maintains an approved security plan.

Ship Security Plan (SSP)

A vessel-specific plan enumerating restriction systems, crew response roles, CCTV schedules, and security training. The SSP reviews and must be approved by the vessel's flag state.

Port Facility Security Plan (PFSP)

The matching plan for the port facility, created and approved by the port facility government or responsible authority, covering terminal access and cargo screening.

Threats

2026: cyber threats & drones change ISPS compliance

The latest ISPS revisions extend security obligations to the modern threat landscape.

Cyber threats

Navigation systems, cargo documents, and EDI gateways are now attack surfaces. The 2026 amendments make maritime cyber risk assessments a mandatory Part A obligation, not a recommendation.

Drone & small-craft threats

Suspicious drone overflights and low-profile craft approaches are common in high-risk transits (Strait of Hormuz, Red Sea, South China Sea). Updated guidelines require counter-UAS procedures and heightened MARSEC declarations.

Enforcement

ISSC certificates & enforcement consequences

Compliance is proven with the ISM/ISSC Certificate—the International Ship Security Certificate issued by the flag administration or a recognized organization.

How the ISSC works

Issued after validating the approved SSP, the ISSC confirms the ship operates securely. Port officials check ISS/Certificate validity during every port State control inspection before berthing.

Fines & operational consequences

Without a valid ISSC, vessels face fines that can exceed $50,000, denied port entry, cargo detention, and blacklisting from major western gateways. Cargo owners must verify their carrier's compliance before shipment.

ISPS surcharge

Ocean carriers recover SSP and terminal security overhead through the ISPS surcharge (approx. $5–$25 per container), itemized on most freight invoices.

FAQ

Frequently asked questions

Who enforces the ISPS Code?

The IMO sets the framework under SOLAS Chapter XI-2, while each flag state's national authority (e.g., US Coast Guard, MPA Singapore, China MSA) enforces compliance through vessel registration, port State control inspections, and national legislation.

What is the ISPS surcharge and who pays it?

The ISPS surcharge is a small fee (typically $5–$25 per container) carriers add to ocean freight to recover the security screening, CCTV, and access-control costs mandated by the code. It is paid by the cargo owner as part of the total freight or transit time costs.

Is the SSP the same as the PFSP?

No. Ship Security Plans (SSP) apply to vessels and are approved by the flag state. Port Facility Security Plans (PFSP) are created and approved by the port facility government or the responsible body. Each ship's SSP must be reviewed against counterpart PFSPs during port calls.

Why us

Compliant cargo routing with Super International Shipping

Confirming your vessel and routing comply with ISPS, IMO 2026 cyber guidelines, and local port regulations is our job—so your cargo stays moving.

✓Security-verified carrier vettingWe only book space with carriers holding valid ISSC certificates and current security audit records.
✓Route risk coordinationMARSEC declaration and threat assessments synchronized with port authority schedules before departure.
✓Customs & security alignmentDocumentation aligned with ISPS screening so your cargo clears terminal access without hold notices.

Need a freight partner that handles security compliance end to end?

Get a free quote today →