## International Maritime Security Policy: The Foundation

International maritime security policy is primarily governed by the International Maritime Organization (IMO), a specialized agency of the United Nations responsible for the safety and security of shipping and the prevention of marine pollution by ships. The cornerstone of this policy framework is the International Ship and Port Facility Security (ISPS) Code, which came into force in 2004.

## The ISPS Code and SOLAS Chapter XI-2

The ISPS Code is an amendment to the International Convention for the Safety of Life at Sea (SOLAS), 1974, specifically mandated under SOLAS Chapter XI-2, 'Special Measures to Enhance Maritime Security'. This chapter makes the ISPS Code mandatory for all signatory states and applies to passenger ships, cargo ships of 500 gross tonnage and upwards, mobile offshore drilling units, and port facilities serving such ships.

• Part A (Mandatory Provisions): Outlines the detailed security requirements for governments, port authorities, and shipping companies. It covers responsibilities, security levels, security assessments, security plans, and declaration of security.
• Part B (Guidance): Provides non-mandatory guidance on how to implement the provisions of Part A, offering best practices and recommendations.

## Key Elements of Maritime Security Policy

• Security Levels: The ISPS Code establishes three Maritime Security Levels to indicate the risk of a security incident:
• Security Level 1 (Normal): The level at which ships and port facilities normally operate.
• Security Level 2 (Heightened): Applies when there is a heightened risk of a security incident.
• Security Level 3 (Exceptional): Applies when a security incident is probable or imminent.
• Roles and Responsibilities: The policy defines clear roles, including the Company Security Officer (CSO), Ship Security Officer (SSO), and Port Facility Security Officer (PFSO), each with specific duties related to maritime security.
• Security Documentation: Key documents include the Ship Security Plan (SSP), developed by the company and approved by the Flag State or a Recognized Security Organization (RSO), and the International Ship Security Certificate (ISSC), issued after verification of compliance.
• Declaration of Security (DoS): An agreement between a ship and a port facility (or another ship) specifying the security measures each will implement during a ship/port interface or ship-to-ship activity, especially at higher security levels or when specific threats exist.

## Compliance and Threats

Compliance with international maritime security policy is verified through audits, inspections, and Port State Control (PSC). The policy aims to protect against various threats, including piracy, armed robbery, terrorism, stowaways, and smuggling, by implementing robust security measures and fostering international cooperation.

The Ship Security Officer (SSO) holds a critical role in ensuring the security of the vessel, acting as the on-board focal point for all security matters. Their primary responsibility is the implementation and maintenance of the Ship Security Plan (SSP), as mandated by the International Ship and Port Facility Security (ISPS) Code.

## Core Responsibilities of the SSO

The SSO's duties are diverse and require continuous vigilance. Key responsibilities include:

• Implementing and Maintaining the SSP: The SSO must ensure that the SSP is understood and followed by all crew members. This involves regular review and updating of the plan in consultation with the Company Security Officer (CSO).
• Conducting Regular Security Inspections: Performing routine checks of the ship to ensure that appropriate security measures are in place and effective, identifying any deficiencies or non-conformities.
• Ensuring Security Equipment Readiness: Verifying that all security equipment, such as access control systems, surveillance equipment, lighting, and alarms, is operational, properly calibrated, tested, and maintained.
• Promoting Security Awareness and Training: Educating the crew on security threats, procedures, and their individual roles within the SSP. This includes conducting security drills and exercises to test the effectiveness of the plan and crew response.
• Liaison with Authorities: Acting as the primary point of contact for ship security with the CSO, Port Facility Security Officers (PFSOs), and relevant port authorities, especially during port calls or security incidents.
• Reporting Security Incidents: Documenting and reporting any security breaches, threats, or suspicious activities to the CSO and, if necessary, to the flag state administration and coastal state authorities.
• Controlling Access: Overseeing and enforcing measures for controlling access to the ship, including monitoring restricted areas and ensuring proper identification procedures for persons and goods boarding the vessel.
• Monitoring Security Levels: Ensuring that the ship's security measures are adjusted to reflect the current security level set by the Flag State or Coastal State, and that the crew is aware of and implements these changes.
• Maintaining Security Records: Keeping accurate records of security training, drills, incidents, inspections, and maintenance of security equipment as required by the SSP and ISPS Code.

The SSO must possess a thorough understanding of the ship's layout, the SSP, and current security threats to effectively discharge these responsibilities, thereby safeguarding the vessel, its crew, cargo, and passengers.

## Ship Security Assessment (SSA)

The Ship Security Assessment (SSA) is a comprehensive, risk-based evaluation of a ship's security. Its primary purpose is to identify potential security threats, vulnerabilities, and the likelihood and consequences of a security incident occurring. The SSA forms the fundamental basis for developing the Ship Security Plan (SSP).

• Who Conducts It: The Ship Security Officer (SSO) with input from the Company Security Officer (CSO), or a Recognised Security Organisation (RSO).
• Key Elements: An SSA involves an on-scene security survey (physical inspection) to identify:
• Existing security measures, procedures, and operations.
• Potential threats (e.g., piracy, terrorism, stowaways, smuggling, cyber-attacks).
• Physical and operational vulnerabilities (e.g., access points, critical areas like the bridge, engine room, cargo holds).
• Human factors (crew training, awareness, fatigue).
• Security equipment and systems (alarms, lighting, CCTV, access control).
• Output: The SSA culminates in a report detailing findings, identified vulnerabilities, and recommendations for security measures.

## Ship Security Plan (SSP)

The Ship Security Plan (SSP) is a detailed, ship-specific plan developed based on the findings of the SSA. Its purpose is to ensure the application of measures designed to protect persons on board, cargo, ship's stores, and the ship itself from the risks of a security incident.

• Approval and Implementation: The SSP must be approved by the Flag State Administration or an RSO acting on its behalf. The SSO is responsible for its implementation and maintenance on board.
• Key Components (as per ISPS Code Part A, Section 9): The SSP details procedures and measures for:
• Preventing unauthorized access to the ship.
• Identifying and controlling restricted areas.
• Handling cargo, ship's stores, and unaccompanied luggage securely.
• Monitoring the security of the ship and its surroundings.
• Defining security duties for all shipboard personnel.
• Maintenance and testing of security equipment.
• Security training, drills, and exercises.
• Responding to security threats or incidents.
• Procedures for Declaration of Security (DoS) and communication with Port Facility Security Officers (PFSOs).
• Addressing all three Ship Security Levels.
• Confidentiality and Review: The SSP is a confidential document, with restricted access. It must be reviewed and updated periodically, or whenever there are significant changes to the ship, its operations, or the threat environment.

## Threat Identification and Response

The Ship Security Officer (SSO) plays a critical role in safeguarding the vessel, crew, and cargo from security threats. This involves both proactively identifying potential dangers and having robust procedures to respond effectively when an incident occurs. The ISPS Code provides the international framework for these responsibilities.

## Identifying Threats

Threat identification begins with understanding potential dangers and recognizing their indicators. Common maritime security threats include piracy, armed robbery, terrorism, stowaways, smuggling, cyber-attacks, and sabotage.

Key tools and methods for identification:

• Ship Security Assessment (SSA): This foundational document identifies the ship's vulnerabilities, potential threats, and associated risks. It forms the basis for the Ship Security Plan (SSP).
• Monitoring and Surveillance: Utilizing equipment like CCTV, radar, AIS, and maintaining vigilant lookouts and patrols helps detect unusual activity.
• Access Control: Strict control over access points prevents unauthorized persons from boarding.
• Intelligence Sharing: Receiving and assessing information from the Company Security Officer (CSO), Port Facility Security Officers (PFSO), flag states, coastal states, and other vessels is crucial.
• Suspicious Indicators: Recognizing unusual vessel movements, loitering small boats, suspicious packages, or individuals exhibiting unusual behavior.
• ISPS Security Levels: The SSO must be aware of the current security level (Level 1: Normal, Level 2: Heightened, Level 3: Imminent/Actual Threat) as this dictates the required vigilance and security measures.

## Responding to Threats

Once a threat is identified, a swift and coordinated response is essential. The SSP is the primary guide, detailing specific procedures for various scenarios.

Key response actions:

• Alarm Activation: Immediately activate the appropriate alarms, such as the Ship Security Alert System (SSAS) to notify authorities, or the general alarm to alert the crew.
• Reporting: Promptly report the incident to the CSO, PFSO, flag state, coastal state, and relevant law enforcement agencies.
• Hardening the Ship: Implement physical defensive measures as per the SSP, which may include deploying razor wire, activating water cannons, increasing patrols, and securing all access points.
• Crew Muster and Protection: Direct non-essential crew to a designated citadel (a hardened, safe space) if under attack, ensuring their protection.
• Communication: Maintain clear internal communication with the crew and external communication with authorities and the company.
• Incident Management: Follow the SSP's detailed procedures for managing the incident, which may involve challenging unauthorized persons, using non-lethal deterrents, or, in extreme cases, self-defense measures following strict guidelines.
• Post-Incident Actions: After an incident, conduct a thorough investigation, document all details, report to relevant parties, and review the SSP to identify lessons learned and improve future responses. Regular drills and exercises are vital to ensure crew proficiency.

## Ship Security Actions & MARSEC Levels

The International Ship and Port Facility Security (ISPS) Code establishes a comprehensive framework for maritime security, with MARSEC Levels and corresponding ship security actions being fundamental components. MARSEC Levels signify the prevailing threat environment and dictate the necessary security posture a ship must adopt.

## Understanding MARSEC Levels

There are three MARSEC Levels, which are set by the Contracting Government (or its designated authority) based on current threat intelligence:

• MARSEC Level 1: This is the normal, minimum appropriate security level at which a ship or port facility operates. It means that there is always a baseline risk of a security incident, and routine, minimum protective security measures must be consistently maintained. Actions typically include basic access control, monitoring of personnel, and general surveillance.
• MARSEC Level 2: This level is applied when there is an increased risk of a security incident. Specific additional protective security measures must be maintained for a period as a result of a heightened risk. Actions are more stringent than Level 1, such as increased frequency of searches, more rigorous access control, heightened identification checks, and enhanced surveillance of restricted areas.
• MARSEC Level 3: This is the highest level, applied when a security incident is probable or imminent, even if the specific target may not be identifiable. The most stringent protective security measures must be maintained for a limited period. Actions are highly restrictive and specific, often involving complete access lockdown, full searches of the ship, suspension of non-essential operations, and close coordination with security authorities.

## Ship Security Actions

The Ship Security Plan (SSP) is the critical document that details the specific security actions to be taken at each MARSEC Level. The Ship Security Officer (SSO) is directly responsible for implementing, maintaining, and overseeing the SSP, ensuring all crew members understand and fulfill their security roles.

Key areas for security actions, which escalate in intensity with each MARSEC Level, include:

• Access Control: Regulating entry to the ship, including screening of persons, identification checks, and visitor management.
• Restricted Areas: Establishing, marking, and controlling access to sensitive or vital areas onboard.
• Cargo Handling: Ensuring the security and integrity of cargo during loading, unloading, and stowage operations.
• Delivery of Ship's Stores and Bunkers: Screening and monitoring suppliers, their vehicles, and goods before they come onboard.
• Monitoring and Surveillance: Utilizing security equipment (e.g., CCTV) and personnel to observe the ship and its immediate surroundings.
• Communications: Maintaining secure and reliable internal and external communication channels.

It's crucial to remember that security actions are cumulative; measures for Level 1 are maintained at Level 2, with additional measures added, and so on for Level 3. If a ship's MARSEC Level differs from that of the port facility it is interfacing with, the ship must always operate at the higher of the two levels. The SSO must ensure compliance and maintain effective liaison with the Company Security Officer (CSO) and Port Facility Security Officer (PFSO).

## Security Equipment and Systems for SSO

Effective ship security relies heavily on the proper functioning and strategic deployment of various security equipment and systems. As a Ship Security Officer (SSO), understanding these tools is crucial for implementing and maintaining the Ship Security Plan (SSP) and ensuring compliance with the ISPS Code.

## Access Control Systems

These systems are designed to prevent unauthorized access to the ship or specific restricted areas.

• Physical Barriers: Include robust fences, gates, doors, and hatches, which must be lockable and regularly inspected.
• Identification Systems: ID cards, biometric scanners (fingerprint, facial recognition), and visitor logging procedures are used to verify personnel and control entry.
• Personnel Screening Equipment: Metal detectors (handheld and walk-through) and X-ray scanners (for baggage/cargo, where applicable) are used to detect prohibited articles on individuals or their belongings.
• Security Lighting: Essential for illuminating access points, deterring intruders, and aiding surveillance.

## Surveillance and Detection Equipment

These systems provide monitoring capabilities and alert personnel to potential threats.

• Closed-Circuit Television (CCTV): Cameras (fixed, PTZ - Pan-Tilt-Zoom) monitor vulnerable areas, record activity, and provide real-time visual information to the security control station. Effective lighting significantly enhances CCTV performance.
• Intrusion Detection Systems (IDS): Comprise sensors (motion detectors, door/window contacts, vibration sensors) that trigger an alarm upon unauthorized entry or movement within restricted areas or the ship's perimeter.
• Perimeter Security: May include infrared beams, pressure mats, or other sensors to detect approaches to the ship's boundary.

## Communication Systems

Reliable communication is paramount during security incidents.

• Internal Communication: Public Address (PA) systems, intercoms, and internal telephones facilitate communication amongst the crew and security team.
• External Communication: VHF radios, satellite phones, and GMDSS (Global Maritime Distress and Safety System) equipment are used for communicating with port authorities, company security officers, and emergency services.

## Ship Security Alert System (SSAS)

The SSAS is a critical security system mandated by the ISPS Code.

• Purpose: To silently alert the Flag State administration (or a designated authority) of a security threat to the ship.
• Activation: It must have at least two distinct activation points on the bridge and other strategic locations.
• Silent Alarm: Crucially, the SSAS does not raise an alarm on board the ship, preventing potential escalation of a threat by alerting an intruder.

## Maintenance and Testing

All security equipment must be regularly tested and maintained as per the SSP and manufacturer guidelines to ensure operational readiness. Records of all tests and maintenance must be kept.

## Importance of Emergency Preparedness

Effective emergency preparedness is fundamental to maintaining a secure ship and ensuring the safety of personnel and cargo. The Ship Security Plan (SSP), mandated by the ISPS Code, is the central document outlining all security measures, procedures, and responsibilities. It must include clear procedures for responding to security threats or breaches, and for maintaining security operations during different security levels. The Ship Security Officer (SSO) is responsible for the implementation and maintenance of the SSP, including ensuring that all crew members are familiar with their security duties and the ship's emergency response procedures.

## Security Drills

Security drills are practical, hands-on training sessions designed to ensure that shipboard personnel are proficient in their assigned security duties at all security levels and to identify any deficiencies in the SSP. These drills help crew members practice specific security procedures, such as responding to unauthorized access, bomb threats, or piracy attacks.

• Frequency: Drills must be conducted at least once every 3 months.
• If more than 25% of the ship's personnel has been changed at any one time, a drill must be conducted within one week of the change.
• Purpose: To test individual crew member's knowledge and response, and to maintain the effectiveness of security measures.

## Security Exercises

Security exercises are more comprehensive events that test the overall effectiveness of the SSP, coordination, and communication. They often involve the Company Security Officer (CSO) and, where appropriate, the Port Facility Security Officer (PFSO) or other relevant authorities. Exercises simulate realistic security scenarios to evaluate the ship's entire security system and its ability to integrate with external entities.

• Frequency: Exercises must be conducted at least once every calendar year, with no more than 18 months between consecutive exercises.
• Purpose: To test the coordination, communication, resource availability, and overall effectiveness of the SSP, identifying areas for improvement.

## Documentation and Review

All drills and exercises must be meticulously documented. Records should include the date, participants, the scenario tested, observations, lessons learned, and any corrective actions taken. These records are vital for demonstrating compliance with the ISPS Code and for the continuous improvement of the SSP. Any deficiencies identified during drills or exercises must lead to a review and, if necessary, amendment of the SSP by the CSO, in consultation with the SSO.

## Ship Security Plan (SSP)

The Ship Security Officer (SSO) is primarily responsible for the implementation and maintenance of the Ship Security Plan (SSP). The SSP is a vessel-specific document detailing measures to protect the ship, its personnel, cargo, and stores from security incidents. It must be approved by the Flag State Administration or a Recognised Security Organisation (RSO). The SSO conducts regular reviews of the SSP, recommending amendments to the Company Security Officer (CSO), especially after incidents, changes in ship structure/equipment, or lessons learned from drills and exercises.

## Record Keeping

Accurate and comprehensive record keeping is a vital administrative duty. The SSO ensures records are maintained for a minimum of 3 years (or longer if required by the Flag State). These records include: security activities (e.g., patrols, access control), all training, drills, and exercises conducted, security incidents and breaches, maintenance and testing of security equipment, changes in security levels, and communications related to ship security. These records serve as evidence of compliance and aid in continuous improvement.

## Reporting and Coordination

The SSO serves as the ship's central point of contact for security matters. They must promptly report all security incidents, breaches, and suspicious activities to the CSO and, where appropriate, to the Port Facility Security Officer (PFSO) and relevant authorities. Effective coordination with the CSO is crucial for integrated company security management. The SSO also liaises with PFSOs to ensure seamless ship/port interface security and with other SSOs when operating in close proximity.

## Training and Drills

The SSO ensures that all shipboard personnel receive appropriate security training and familiarization. This encompasses general security awareness for all crew, specific duties for those with security responsibilities, and SSP familiarization for new personnel. Drills and exercises are essential for testing the SSP's effectiveness and crew preparedness. Security drills must be conducted at least every 3 months, and a security exercise must be conducted at least once every calendar year, with no more than 18 months between exercises. These activities must be recorded, evaluated, and lessons learned incorporated into future planning.

## Continuous Improvement

The SSO is responsible for fostering a culture of continuous improvement in ship security. This involves regularly assessing security measures, learning from incidents, drills, and exercises, and proposing enhancements to the SSP and security procedures. Regular reviews of security equipment functionality and personnel competency ensure the ship remains resilient against evolving security threats and maintains compliance with the ISPS Code.