Maritime law, rules and watchkeeping · Level P1 · 5 parts · about 15 min

Security awareness: the ISPS Code and security levels (STCW A-VI/6-1)

5 short parts: ISPS Code · Security levels · Threats · Cyber · Spot and report. Each part explains the idea, then gives the points to remember, the common mistakes, a worked case and a practice question; the Academy unit adds all 27 check questions.

1 · ISPS Code

The ISPS Code and who is responsible for security

Safety protects against accidents; security protects against deliberate harm. The ISPS Code sets security requirements for covered ships and port facilities.

Safety and security

Maritime security means protecting the ship, the people on board and the cargo from deliberate harm: terrorism, piracy, armed robbery, stowaways, smuggling and sabotage. After the attacks of 11 September 2001, the IMO added SOLAS chapter XI-2 and the International Ship and Port Facility Security (ISPS) Code, in force since 1 July 2004. On ships covered by ISPS, STCW regulation VI/6 requires security training appropriate to your role; practical training belongs in your approved course.

Two parts

The ISPS Code has Part A, which is mandatory, and Part B, which gives guidance on how to meet Part A. Some flag states, and the European Union, make parts of Part B mandatory as well. The Code applies to passenger ships, cargo ships of 500 gross tonnage (GT, a measure of enclosed volume) or more, and mobile offshore drilling units (MODUs) on international voyages, and to the port facilities that serve them.

Who is who

The Contracting Government is a state party to SOLAS; it sets security levels and approves plans. The company operates the ship, appoints security officers and supports security arrangements. Its company security officer (CSO) coordinates security ashore. The ship security officer (SSO) coordinates it on board under the master, who has overriding authority for ship safety and security. The port facility security officer (PFSO) coordinates security at the port facility.

The plan

Each ship has a ship security plan (SSP), approved by the flag state, that sets out the security measures for each security level. The plan is confidential: you will be told the parts you need for your duties, but you must not show it or talk about it to outsiders. A ship that complies carries an International Ship Security Certificate (ISSC).

Silent alarm

The ship security alert system (SSAS) sends a hidden alert from the ship to shore when the ship is under threat. It makes no sound or light on board, so attackers do not know it has been used.

Key figures

Legal basis: SOLAS chapter XI-2 and the ISPS Code, in force 1 July 2004
ISPS Part A / Part B: Part A mandatory; Part B guidance
Ships covered: Passenger ships, cargo ships ≥ 500 GT, MODUs, on international voyages
STCW training: Regulation VI/6; Code table A-VI/6-1

Remember

Security is protection against deliberate harm; the ISPS Code has applied since 1 July 2004.
Part A is mandatory; Part B is guidance on how to meet it.
CSO ashore, SSO on board, PFSO in the port; the master has the final say.
The ship security plan is approved by the flag state and confidential.
The SSAS sends a silent alert to shore without any alarm on board.

Common mistakes

Wrong: Security is the same thing as safety.
Right: Safety deals with accidents; security deals with people who intend harm. Both are everyone's job.
Wrong: You can show the security plan to a visitor who asks politely.
Right: The SSP is confidential. Refer anyone who asks about it to the SSO or the master.

Worked case

In port, a friendly man in a hi-vis vest stops you on the quay. He says he is writing a report and asks where the ship's security plan is kept, how many crew stand gangway watch at night and where the SSAS buttons are.

Show the answer

Do not answer. The security plan, watch arrangements and SSAS positions are confidential. Say politely that you cannot discuss the ship's security and that he should speak to the ship security officer. Note what he looks like and report the conversation to the SSO or the officer of the watch at once.

Practice question

Who is responsible for security on board under the authority of the master?

The company security officer
The ship security officer
The port facility security officer
The designated person ashore

Show the answer

Answer: B. The SSO coordinates security on board under the master. The CSO works ashore and the PFSO works at the port facility.

2 · Security levels

Security levels 1, 2 and 3

The security level tells everyone how high the threat is. When it rises, the ship tightens its guard, and you will notice the difference.

Three levels

The ISPS Code uses three security levels. Level 1 (normal) is the level at which the ship normally operates; minimum security measures are kept at all times. Level 2 (heightened) applies while there is a higher risk of a security incident; extra measures are kept for that period. Level 3 (exceptional) applies for a limited time when an incident is probable or about to happen, even if the exact target cannot be named.

Who sets them

The Contracting Government sets the level. The flag state sets it for its ships, and a port state sets it for its port facilities and for ships in its waters. A ship must never operate at a lower level than the port facility it is visiting. The ship is told through the company, the port or the authorities, and the SSO tells the crew.

Level 1 on board

At level 1 the gangway is watched, everyone boarding is identified and their reason checked, restricted areas are locked or watched, deck areas and the ship's surroundings are monitored, and stores and baggage are checked. You will see sign-in logs, passes and locked doors.

Level 2 and 3

At level 2, you may see extra patrols, fewer access points and more checks or escorts. Your watches may change. At level 3, listen for urgent instructions; boarding, cargo work or shore leave may stop. Follow the SSO's directions and instructions from the responding authorities. Your ship's plan sets the arrangements.

Key figures

Level 1: Normal: minimum measures at all times
Level 2: Heightened: extra measures while the risk is higher
Level 3: Exceptional: incident probable or imminent, limited time
Set by: The Contracting Government (flag or port state)
Ship vs port: Ship never at a lower level than the port facility

Remember

Level 1 normal, level 2 heightened, level 3 exceptional.
The Contracting Government sets the level: flag state for its ships, port state for its ports.
A ship must not be at a lower level than the port facility it is at.
At higher levels, you may see extra patrols, fewer access points, more checks or escorts; follow the SSO.
At level 3, follow the instructions of those responding to the threat.

Common mistakes

Wrong: The master chooses the security level for the ship.
Right: The Contracting Government sets it. The master and SSO may apply stricter measures, never weaker ones.
Wrong: Level 3 is the normal level in a dangerous port.
Right: Level 3 is exceptional and for a limited time, when an incident is probable or imminent.

Worked case

Your ship is at level 3. The port facility is at level 2. A crewmate says you can now return to level 2 and reopen a closed access point. What should you do?

Show the answer

Do not change the arrangements yourself. The port level is a minimum, not an instruction to lower the ship's level. Continue the measures ordered for the ship and refer the suggestion to the SSO or officer of the watch. Follow their instructions.

Practice question

Which security level applies when a security incident is probable or imminent?

Level 1
Level 2
Level 3
Level 4

Show the answer

Answer: C. Level 3 is exceptional and set for a limited time when an incident is probable or imminent. There is no level 4.

3 · Threats

Piracy, stowaways, smuggling and other threats

Pirates, robbers, stowaways and smugglers all want to use or harm the ship. Knowing how they operate helps you spot them early.

Piracy and armed robbery

Piracy under the UN Convention on the Law of the Sea (UNCLOS, article 101) means illegal violence, detention or plunder for private ends by people on one private ship against another ship. Piracy rules apply on the high seas, in exclusive economic zones (EEZs), and outside state jurisdiction. EEZs lie beyond the territorial sea. Comparable acts or threats in internal waters, archipelagic waters or the territorial sea are armed robbery against ships (IMO resolution A.1025(26)). The territorial sea extends up to 12 nautical miles from the baseline.

Industry guidance

BMP Maritime Security, published in 2025 by BIMCO, ICS, INTERTANKO, OCIMF and other industry bodies, replaced BMP5 and the regional best management practices with one guide. It helps ships plan voyages and detect, deter, delay and report attacks, including attacks by state and non-state groups with missiles or drones in conflict areas. Your ship's plan turns it into simple drills: you learn the alarm, where to go and what to do.

Stowaways and smuggling

Stowaways hide on board to travel without permission, in holds, containers, lockers, spaces around the rudder shaft or inside the funnel (exhaust structure). They endanger themselves and cost the ship time and money. Smugglers use ships to move drugs, weapons or people, sometimes hiding packages in containers, cargo, stores, crew cabins or on the hull underwater. A crew member who carries a package for a stranger can end up in prison.

Other threats

Weapons or explosives can be hidden in cargo, baggage or stores. Sabotage is deliberate damage or interference with the ship or its equipment. Terrorism uses violence or threats to intimidate people or coerce authorities. Criminals bypass security using false identities or uniforms, distracting the gangway watch, climbing anchor chains or mooring lines, or approaching from the side away from the quay.

Key figures

Piracy (UNCLOS art. 101): High seas, EEZs or outside state jurisdiction; private ends
Armed robbery (IMO A.1025(26)): Inside internal waters, archipelagic waters or territorial sea
Territorial sea: Up to 12 nautical miles from the baseline
Industry guide: BMP Maritime Security (2025), replacing BMP5

Remember

Piracy rules apply on the high seas and in EEZs; armed robbery occurs in internal, archipelagic or territorial waters.
BMP Maritime Security (2025) replaced BMP5 and the regional guides.
Stowaways hide in holds, containers, lockers, spaces around the rudder shaft and inside the funnel.
Smugglers hide drugs and weapons in cargo, stores, cabins and on the hull.
Never carry a package on board for someone you do not know.

Common mistakes

Wrong: A robbery at anchor inside a port's waters is piracy.
Right: Comparable private-end attacks in internal, archipelagic or territorial waters are armed robbery against ships. Piracy rules apply on the high seas, in EEZs and outside state jurisdiction.
Wrong: Pirates are only a problem off Somalia.
Right: Piracy and armed robbery occur in several regions, and robbery at anchor happens worldwide. Follow the current guidance.

Worked case

Before sailing, a man on the quay offers you money to take a small sealed parcel aboard "for a friend" in the next port. He says it is only medicine.

Show the answer

Refuse. You cannot know what is inside, and you would be the one carrying it through customs: drug smuggling can mean years in prison. Do not touch the parcel. Note the man's description and report the offer at once to the SSO or the officer of the watch, who can tell the port authorities.

Practice question

Robbers board a ship at anchor inside a state's territorial sea. Under IMO definitions, what is this?

Piracy under UNCLOS
Armed robbery against ships
An act of terrorism at sea
A stowaway incident

Show the answer

Answer: B. Comparable private-end attacks in internal waters, archipelagic waters or the territorial sea are armed robbery against ships. Piracy rules apply on the high seas, in EEZs and outside state jurisdiction.

4 · Cyber

Cyber security awareness on board

Ships run on computers, from the engine to the chart. One careless click or infected USB stick can put the whole ship at risk.

Why ships are targets

Modern ships depend on computer-based systems. Some are IT (information technology): email, crew welfare networks, cargo records and office software. Others are OT (operational technology): the electronic chart display and information system (ECDIS), engine and ballast controls, cargo controls and communications. If criminals infect or block them, the ship can lose navigation, propulsion or cargo control, or have its data stolen and held for ransom.

The rules

IMO resolution MSC.428(98) calls for cyber risks to be addressed in the safety management system (SMS). The IMO Guidelines on Maritime Cyber Risk Management, MSC-FAL.1/Circ.3/Rev.3 of 2025, give the current guidance. For you this becomes simple ship rules: what you may plug in, which networks you may use and whom to tell when something looks wrong.

Common attacks

Phishing is an email or message that pretends to be from a trusted sender and tries to make you click a link, open an attachment or give your password. Infected USB sticks and connected personal devices can introduce malware, harmful software, into ship systems. Weak or shared passwords let attackers in. Fake websites and false calls can trick you too.

Good habits

Use only your own account and a strong password, and never share it. Never plug a personal USB stick, phone or laptop into a ship's navigation or engine computer. Do not open unexpected attachments or links. Use the crew network, not the ship's business network, for personal devices. If a screen behaves oddly, a file locks or a message asks for urgent action, tell the officer of the watch or the officer responsible for IT at once.

Key figures

IMO guidance: MSC-FAL.1/Circ.3/Rev.3 (2025)
Cyber in the SMS: MSC.428(98): address cyber risk in the safety management system
IT vs OT: Office and data systems vs systems that control the ship

Remember

Ships rely on IT (office, email) and OT (navigation, engine, cargo control) systems.
Phishing messages try to make you click, open or give a password.
Never plug personal USB sticks or phones into ship control computers.
Use your own strong password and the crew network for personal devices.
Report anything odd on a screen or in a message at once.

Common mistakes

Wrong: Charging your phone from the electronic chart computer USB port does no harm.
Right: Any connection can carry malware into navigation systems. Use only approved charging points.
Wrong: An email that uses the company logo must be genuine.
Right: Logos are easy to copy. Check the sender and ask before you click a link or attachment.

Worked case

You receive an email that looks as if it comes from the crewing office. It says your wages will be stopped unless you log in today through a link and confirm your bank details.

Show the answer

Do not click the link or reply. The urgency and the request for bank details are signs of phishing. Report the email to the master or the officer responsible for IT, and check with the crewing office through a known contact. If you already clicked, say so at once and change your password from a safe device.

Practice question

What is phishing?

A fake message that tricks you into clicking or sharing data
Using the crew network to call home in port
A software update installed by the IT officer on board
A drill in which the crew test the SSAS buttons each month

Show the answer

Answer: A. Phishing messages pretend to come from a trusted sender to make you open a link or attachment, or give passwords or bank details.

5 · Spot and report

Recognising suspicious activity and reporting it

Every crew member is part of the ship's security. Notice what is out of place, report it at once, and leave the tackling to others.

Your role

Every seafarer is part of the ship's security, whatever their job. Security depends on many eyes noticing small things: a door that should be locked, a stranger in an alleyway, a box nobody owns. You are not expected to fight or arrest anyone. Your job is to stay alert, report what you see and follow the SSO's instructions.

Suspicious behaviour

Be alert to people who are where they should not be, have no pass or a reason that does not fit, ask unusual questions about the ship's security, take photos of access points or security equipment, watch the ship for a long time, or try to avoid the gangway watch. Also watch for small boats hanging around the ship, especially at night or at anchor.

Suspicious items

Look out for unattended bags or packages, items in odd places, signs of tampering with locks, seals or containers, wires or devices that do not belong, and unusual smells or liquids. Do not touch, move or open a suspicious item. Keep people away; do not use a radio or phone near the item; report from a safe location using the ship's approved method.

How to report

Report at once to the officer of the watch or the SSO, by the quickest means the ship's plan allows. Say what you saw, where, when, how many people and what they look like. Do not challenge or follow a person who may be armed. Keep security information to yourself: do not talk about it ashore or post it on social media.

Shore leave

Security measures should allow for seafarers' shore leave and access to welfare services; carry the required identity documents and follow port access rules.

Key figures

Report to: Officer of the watch or the ship security officer
Suspicious item: Do not touch, move or open; keep people away
Your role: Observe and report; do not tackle

If you find a suspicious item

Do not touch, move or open it. — It may be a device that reacts to movement.
Move to a safe distance and keep other people back. Do not use a radio or phone near the item. — Distance protects you; some devices can be set off by radio signals.
From a safe location, report its exact position and description to the officer of the watch or SSO using the ship's approved reporting method. — The SSO starts the plan and calls the right authorities.
Stay clear and follow the SSO's instructions. — The SSO coordinates the response and tells you what to do next.

Remember

Every seafarer is part of the ship's security: stay alert and report.
Watch for people out of place, odd questions, photos of security points, loitering boats.
Never touch, move or open a suspicious item; keep people away.
Report what, where, when, how many and descriptions to the OOW or SSO.
Keep security information private, ashore and online.

Common mistakes

Wrong: If you see an intruder, you should catch him yourself.
Right: Do not tackle or follow; he may be armed. Report at once and let the SSO organise the response.
Wrong: Moving a strange bag out of the alleyway makes the area safer.
Right: Never move a suspicious item. Keep people away and report its position.

Worked case

At anchor at night you see a small boat with its lights off drifting close to the stern. A few minutes later you hear a metallic knock near the aft mooring station.

Show the answer

Raise the alarm at once: call the officer of the watch on the radio and give the position (stern, near the aft mooring station) and what you saw and heard. Do not go to look alone. Move to a safe place, keep watching if you can do so safely, and follow the bridge's instructions. The SSO and master will decide on lighting, alarms and a crew muster.

Practice question

You find an unattended bag in a stairway. What should you do first?

Open it to find the owner's name and cabin
Carry it to the gangway watch for inspection
Stay clear, keep others back and report safely
Throw it overboard to keep the ship safe

Show the answer

Answer: C. Never touch, move or open a suspicious item. Keep people away and do not use a radio or phone near it. From a safe location, report its exact position using the ship's approved method.