SOLAS XI-1 · SOLAS XI-2 · ISPS Code · STCW VI/5–VI/6

ISPS Code, Ship Security Plan, SSAS, CSR and Security Levels Checklist

Under SOLAS Chapter XI-2 and the ISPS Code, security checks in port start at the gangway, and clear grounds that the ship does not comply can lead to SOLAS XI-2/9 control measures, from delay and restricted operations to detention or expulsion from port. This guide covers the International Ship Security Certificate, the Continuous Synopsis Record (SOLAS XI-1/5), Ship Security Plan confidentiality, the ship security alert system, security levels 1 to 3 (MARSEC in the US), Declarations of Security, drills and STCW security certificates.

Updated 10 November 2026 · Written by SeaReady in our own words. Not affiliated with OCIMF, RightShip, CDI, any MoU or any administration — always check the current official documents.

1. ISSC, Continuous Synopsis Record, plan confidentiality and the Master's discretion

Accommodation ladder, gangway watch and pilot ladder rigging are in our gangway, pilot ladder and ISPS access checklist, and cyber risk in the safety management system is in the maritime cyber risk management checklist. This guide covers the security certificate and documents behind them, under SOLAS Chapter XI-1, SOLAS Chapter XI-2 and ISPS Code Part A. Company audits are covered in the ISM internal audit and DPA checklist.

Certificate or rule	What it requires	What to check on board
International Ship Security Certificate (ISPS Code A/19)	Ships to which SOLAS XI-2 applies (passenger ships and cargo ships of 500 GT and upwards on international voyages, and mobile offshore drilling units) carry an ISSC valid for up to five years, with at least one intermediate verification; if there is only one, it falls between the second and third anniversary dates. An interim ISSC (A/19.4) covers a new ship, a change of flag or a new company for 6 months, or until the full certificate is issued if sooner, and cannot be extended (A/19.4.4).	Check the ISSC against the current flag, company and ship particulars on the Safety Management Certificate, and that the intermediate verification is endorsed. Internal audits of security activities are done by people independent of the activities audited, unless that is impracticable for the size and nature of the company or ship (ISPS A/9.4.1).
Continuous Synopsis Record (SOLAS XI-1/5)	Passenger ships and cargo ships of 500 GT and over on international voyages keep a Continuous Synopsis Record: a history of the ship’s flag, owners, company, classification society and certificate issuers. After a change, the company or Master records it on the amendment form (Form 2) and index (Form 3) until the Administration issues a revised CSR, as soon as practicable and not later than three months after the change (IMO Res. A.959(23)).	Check the CSR documents in the file are in number order with no gap, that the IMO number, company and owner match the ISSC and SMC, and that any pending amendment form is tracked until the new CSR arrives.
Ship Security Plan confidentiality (ISPS Code A/9.6–9.8.1)	The approved SSP is protected from unauthorised access or disclosure, and an electronic copy is protected against unauthorised deletion, destruction or amendment. Port State officers do not inspect the plan, except that with clear grounds of non-compliance, where reading the plan is the only way to verify or put it right, they may exceptionally see the relevant sections with the consent of the flag State or the Master. Certain sections (for example restricted areas, the SSAS activation points and SSAS procedures) stay confidential unless the Governments concerned agree.	Keep the SSP secure under the Master’s or SSO’s control, and make sure gangway and duty officers know never to hand it over during a routine boarding.
Master’s discretion for safety and security (SOLAS XI-2/8)	The company, the charterer or anyone else may not constrain the Master from a decision that, in the Master’s professional judgement, is needed for the safety and security of the ship. Where safety and security requirements conflict, the Master gives effect to those needed for the ship’s safety, may put temporary security measures in place, and informs the Administration at once and, if appropriate, the port State.	Check the Master and SSO can explain the rule, for example keeping escape routes usable from inside while external doors are secured against unauthorised boarding, and that any conflict is recorded and reported to the CSO.

2. SSAS, security levels, Declarations of Security and drills

Keep covert SOLAS XI-2/6 security alerts separate from distress alerting, which is covered in our GMDSS and bridge equipment checklist. Security drills sit alongside the other drills in the SOLAS drill frequency guide, and security training alongside basic safety training in the crew familiarisation and STCW guide.

System or duty	Rule	What to check on board
Ship security alert system (SOLAS XI-2/6)	The SSAS can be activated from the navigation bridge and at least one other place. It sends a covert ship-to-shore alert, identifying the ship and its position, to a competent authority the Administration designates (which may include the company), without raising an alarm on board or sending it to other ships.	Make sure watchkeepers know the SSAS is not a GMDSS distress alert, that activation points are protected against accidental use and known only to those who need to know, and that tests follow the SSP with the company and flag told in advance.
Security levels 1, 2 and 3 (ISPS Code A/2 and A/7)	Level 1: minimum protective measures kept at all times. Level 2: additional measures for a period of heightened risk. Level 3: further specific measures for a limited period when an incident is probable or imminent, even if the target cannot be identified. In the United States the same levels are called MARSEC 1, 2 and 3.	Check the gangway notice shows the level in force, and that in port the ship meets the port State’s level when it is higher than the level the flag has set for the ship.
Declaration of Security (ISPS Code A/5)	A ship can ask for a Declaration of Security when it operates at a higher level than the port facility or ship it interfaces with, under an agreement between Governments, after a security threat or incident, at a port facility that does not need an approved security plan, or during ship-to-ship activity with a ship that does not need one.	Keep signed Declarations for at least the period the flag sets (A/5.7), and keep records of the security levels and any special measures at the last ten calls at port facilities, which a port State may ask for before entry (SOLAS XI-2/9.2.3).
Drills, exercises and STCW security certificates (ISPS Code B/13.6–13.7, STCW VI/5 and VI/6)	Part B guidance: security drills should be held at least every three months, plus a drill within one week when more than 25 percent of the crew has changed at one time with people who have not drilled on that ship in the last three months; exercises should be held at least once each calendar year, with no more than 18 months between them. The approved SSP or the flag may make these binding; in the EU, Regulation (EC) No 725/2004 makes them mandatory.	Check drill records against crew-change dates, and the certificates: the SSO certificate of proficiency (STCW VI/5), designated security duties (Table A-VI/6-2) for gangway and search teams, and security awareness (Table A-VI/6-1) for everyone else.

3. Control measures, shore leave, yachts and special cases

Security control measures come from SOLAS regulation XI-2/9, not from the safety action codes (see PSC deficiency action codes). Commercial yachts of 500 GT and over can pair these checks with the yacht inspection checklist, shore contractors clear gangway security before a permit to work, dangerous goods security links to the IMDG dangerous goods checklist, and shore leave to the MLC 2006 employment and welfare guide.

Area	Rule or guidance	What to check on board
Control and compliance measures (SOLAS XI-2/9)	In port, officers first check for a valid ISSC. Only where there are clear grounds that the ship does not comply with SOLAS XI-2 or ISPS Part A may they inspect the ship, delay or detain it, restrict its operations (including movement within the port), expel it from port, or take lesser administrative or corrective measures.	Do not mix up these security control measures with the safety deficiency codes used by the regional MoUs. Put minor access-control findings right at once with the PFSO and CSO before they become clear grounds.
Crew shore leave through US terminals (33 CFR 105.237)	In US ports each regulated facility’s security plan must give seafarers, pilots and welfare or union representatives a way between the ship and the facility gate without unreasonable delay and at no cost to them, for example escorts, taxis, welfare transport or monitored walkways. The ISPS Code preamble (paragraph 11) asks Governments approving security plans to bear in mind that crews need shore leave and access to shore-based welfare facilities, and MLC 2006 Regulation 2.4 makes shore leave a seafarer’s entitlement.	Agree shore-leave lists, ID checks and transport with the agent and the facility security officer early, and report problems to the Captain of the Port.
Yachts, contractors and dangerous goods	Commercial yachts of 500 GT and over under the REG Yacht Code Part A Chapter 31 comply with the ISPS Code. Ships carrying high-consequence dangerous goods also apply the security provisions in IMDG Code Chapter 1.4, and ships transiting high-risk waters use the industry’s BMP Maritime Security guidance (2025), which IMO circulated with MSC.1/Circ.1601/Rev.2.	Check visitors and shore technicians at the gangway and issue passes and escorts before any work permit, and keep statutory SOLAS and ISPS records separate from commercial vetting folders (SIRE 2.0, RightShip, CDI, OVID), which are industry inspections, not law.

4. Ship Security Officer's pre-arrival walk-round

Check the original ISSC and its intermediate verification endorsement, and that the CSR documents are in number order with any pending amendment form.
Confirm the port’s security level with the agent and the port facility security officer, post it at the gangway, and brief the gangway watch on ID checks, searches and visitor passes as the SSP sets them.
Walk the restricted areas named in the SSP (for example the bridge, machinery spaces, steering gear room and ventilation and air-conditioning rooms) and check locks, seals and that escape routes still open from inside.
Confirm the last SSAS test is recorded and was acknowledged by the company, that activation-point covers are intact, and that their locations are not shared with visitors.
Check the security drill record (every three months, and after a large crew change) and the STCW VI/5 and VI/6 certificates of everyone on security duties.
Check stores and bunker deliveries against what was ordered at the access point before they are loaded.
Have the security levels and special measures for the last ten calls at port facilities ready for the pre-arrival security information, with the Declarations of Security kept for the period the flag sets.
Keep statutory SOLAS and ISPS records apart from commercial vetting folders (SIRE 2.0, RightShip, CDI, OVID), which are industry inspections, not law.

Questions seafarers ask

Can a Port State Control officer ask to read the whole Ship Security Plan?

No. Under ISPS Code Part A section 9.8 the plan is not open to inspection by port State officers. Only where there are clear grounds that the ship does not comply, and reading the plan is the only way to verify or put it right, may they exceptionally see the specific sections concerned, and then only with the consent of the flag State or the Master. Some sections, such as restricted areas and the SSAS activation points, stay confidential unless the Governments concerned agree.

How is an SSAS alert different from a GMDSS distress alert?

Under SOLAS regulation XI-2/6 the SSAS sends a covert ship-to-shore security alert to the authority the flag designates (often through the company), without any alarm on board and without alerting other ships. A GMDSS distress alert under SOLAS Chapter IV is meant to be heard by rescue coordination centres and ships nearby.

How often should security drills and exercises be held?

ISPS Code Part B paragraphs 13.6 and 13.7 recommend drills at least every three months, plus a drill within one week when more than 25 percent of the crew has changed at one time with people who have not drilled on that ship in the last three months, and an exercise at least once each calendar year with no more than 18 months between exercises. Follow your approved SSP; some flags and the EU make these frequencies mandatory.

What does the Master do if security measures conflict with safety?

Under SOLAS regulation XI-2/8 the Master gives effect to the requirements needed for the safety of the ship, for example keeping an escape route usable, may put temporary security measures in place, and informs the flag Administration at once and, if appropriate, the port State.

What should be in the Continuous Synopsis Record file on board?

Under SOLAS regulation XI-1/5 and IMO Resolution A.959(23), the file holds the CSR documents issued to the ship in number order, with any amendment forms (Form 2) and the index of amendments (Form 3), so the record of flags, owners, companies and certificate issuers is unbroken. After a change the Administration issues a revised CSR as soon as practicable and not later than three months after the change.

Run the ISPS checks in SeaReady

ISSC and SSP, gangway access control, drills, restricted areas, last ten port calls and SSAS tests, with the evidence the inspector asks for. Works offline on board.

Offline SIRE 2.0, RightShip RISQ and PSC checklists
AI mock inspector and orals examiner
AI photo review of defects and ship-work photos
Rest-hour planner and record-book tools

Start your 3-day free trial See plans Open this tool in the app

Crew $39.99/mo · Officer Pro $99.99/mo · Ship licence $899/mo per ship + 5% sales tax

3-day free trial, no card needed. Before sailing, open the app online and check the "Kept offline" card in Settings on each device you use. Saved preparation content works offline. AI, live updates and syncing need internet.

Related guides

All 75 guides →