Supply Chain Security Study Guide

1	What it does Sets mandatory security standards for ships and port facilities engaged in international trade through the ISPS Code.
2	When it applies Sea cargo; ships and port facilities covered by the SOLAS Convention.
3	Who is responsible Contracting governments, port authorities, and shipping companies.
4	Status ISPS Code adopted December 2002; in force since 1 July 2004. Mandatory under Part A; Part B contains supporting guidelines.

In December 2002, 108 member states of the IMO adopted a series of measures to strengthen maritime security, with the aim of preventing and suppressing acts of terrorism against shipping. Adopting an international security code for shipping and ports was seen as essential, given the central role shipping plays in international trade.

The IMO adopted a number of amendments to the 1974 Safety of Life at Sea Convention (SOLAS), the most far-reaching of which enshrines the new International Ship and Port Facility Security Code (ISPS Code). The Code contains detailed security-related requirements for Governments, port authorities and shipping companies in a mandatory section (Part A), together with a series of guidelines about how to meet these requirements in a second, non-mandatory section (Part B). The IMO also adopted a series of resolutions designed to add weight to the amendments, encourage the application of the measures to ships and port facilities not covered by the Code, and pave the way for future work on the subject (IMO 2006).

The International Ship and Port Facility Security Code

In essence, the Code takes the approach that ensuring the security of ships and port facilities is fundamentally a risk management activity. To determine appropriate security measures, an assessment of the risks must be made in each particular case.

The purpose of the Code is to provide a standardized, consistent framework for evaluating risk, enabling governments to offset changes in threat with changes in vulnerability for ships and port facilities.

To begin the process, each Contracting Government conducted port facility security assessments.

01 Identify critical assets Identify and evaluate important assets and infrastructures that are critical to the port facility, as well as any areas or structures that, if damaged, could cause significant loss of life or damage to the port facility’s economy or environment

02 Identify threats Identify the actual threats to those critical assets and infrastructure in order to prioritize security measures

03 Identify vulnerabilities Identify weaknesses in physical security, structural integrity, protection systems, procedural policies, communications systems, transportation infrastructure, utilities, and other areas within a port facility that may be a likely target

This risk management concept is set out in the Code through a number of minimum functional security requirements for ships and port facilities.

Ships	Port facilities	Both
Ship security plans	Port facility security plans	Monitoring and controlling access
Ship security officers	Port facility security officers	Monitoring the activities of people and cargo
Company security officers	Certain security equipment	Ensuring security communications are readily available
Certain onboard equipment

Each ship (or class of ship) and each port facility presents different risks. The way each will meet the specific requirements of the Code is determined and ultimately approved by the Administration or Contracting Government, as the case may be.

To communicate the threat at a port facility or for a ship, the Contracting Government will set the appropriate security level. Security levels 1, 2, and 3 correspond to normal, medium, and high threat situations, respectively. The security level creates a link between the ship and the port facility, since it triggers the implementation of appropriate security measures for both.

The preamble to the Code states that, as threat increases, the only logical counteraction is to reduce vulnerability. The Code provides several ways to reduce vulnerabilities. Ships will be subject to a system of survey, verification, certification, and control to ensure that their security measures are implemented. This system will be based on a considerably expanded control system as stipulated in the 1974 SOLAS Convention. Port facilities will also be required to report certain security-related information to the Contracting Government concerned, which in turn will submit a list of approved port facility security plans, including location and contact details, to IMO.

The Code entered into force on July 1, 2004. According to IMO in 2005 (IMO 2005), 94% of contracting parties to SOLAS have approved security plans for over 97% of declared port facilities.

Further Reading: IMO ISPS Code For a contemporary view of the Code, see IMO ISPS Code