Security Intelligence

Port Security and Maritime Infrastructure: ISPS Code Compliance and Operational Safety | CloseProtectionHire

Q: "What is the ISPS Code and what does it require of port facilities?"

"The International Ship and Port Facility Security (ISPS) Code was adopted by the International Maritime Organization (IMO) in December 2002, following the September 11 attacks, and entered into force on 1 July 2004. It applies to port facilities serving international shipping. The Code requires each port facility to conduct a Port Facility Security Assessment (PFSA), develop and implement a Port Facility Security Plan (PFSP), and appoint a Port Facility Security Officer (PFSO) responsible for implementing the plan. The plan must address three Security Levels: Level 1 (normal), Level 2 (heightened threat), and Level 3 (exceptional threat requiring additional measures). Specific measures cover: access control to the port facility and ship/shore interface, cargo handling security, delivery of ship's stores, monitoring of the port facility, and handling of security threats and breaches. Compliance is verified through national maritime administrations; in the UK, the Maritime and Coastguard Agency (MCA) is responsible for ISPS Code verification."

Q: "What are the main security threats at working port facilities?"

"Port facilities face a distinct set of security threats that differ from both vessel-at-sea threats and standard corporate premises threats. Container fraud and drug concealment: the IMO/INTERPOL have documented large-scale operations in which narcotics or other contraband are concealed within legitimate cargo containers, sometimes with the cooperation of dock workers (inside operations). Cargo theft: TT Club data shows that port and terminal facilities account for a significant proportion of global cargo crime, with inside information enabling targeted theft of high-value loads. Terrorism threat: post-9/11 concern about the use of containerised cargo to deliver a weapons device (chemical, radiological, or conventional explosives) to a port location remains a live intelligence category for major port authorities globally. Sabotage of critical infrastructure: port facilities serve as critical national infrastructure in most jurisdictions and are assessed for state-actor and organised crime sabotage risk. Crew welfare and shore-based crime: seafarers ashore at port are documented victims of robbery, assault, and recruitment into trafficking."

Q: "What security measures should an executive visiting a working port take?"

"A working port facility is an industrial environment with security hazards that go beyond the standard close protection risk assessment. Specific considerations: obtain the required security pass or visitor authorisation in advance -- unannounced arrivals at ISPS-designated ports are refused entry. Personal protective equipment is mandatory in most working port areas (hard hat, hi-vis vest, safety boots, eye protection in some areas). Stay with the designated escort at all times -- working ports are operational environments where access to berths, crane areas, and waterside locations creates physical hazard that is not mitigated by security alone. Pre-trip advance work should include an assessment of the specific port facility's security posture and any current threat intelligence (OSAC country reports contain port-specific threat information for major P1 ports). In P1 city ports -- Lagos/Apapa, Karachi, Manila -- the approach routes to the port facility are among the most dangerous road environments in each city, with documented vehicle crime, carjacking, and the general security environment of densely populated industrial areas."

Q: "How does port security in P1 cities compare with international standards?"

"ISPS Code compliance creates a minimum international standard for port security, but the quality of implementation varies significantly across P1 port facilities. Lagos/Apapa Port and Tin Can Island Port are among the most challenging port environments in West Africa: severe road congestion on the Apapa corridor (documented in OSAC and multiple logistics sector reports), cargo theft with documented insider involvement, and a general security environment that requires professional advance planning for any executive visit. Karachi's Port and Port Qasim are ISPS-compliant but the approach routes pass through Karachi's more challenging security zones. Manila's international container port at Manila Bay operates within Metro Manila's general security environment. Nairobi's port equivalent (Mombasa Port, the major East Africa hub) is rated as manageable by international shipping operators but requires standard Kenya security protocols for visiting executives. Singapore, Rotterdam, and Dubai's Jebel Ali are among the world's most professionally managed port facilities with security standards that consistently exceed ISPS Code requirements."

Q: "What is seafarer security and why is it relevant to corporate port operations?"

"Seafarers who come ashore at port are a documented vulnerable population for crime. The International Transport Workers' Federation (ITF) and the International Seafarers' Welfare and Assistance Network (ISWAN) document robbery, assault, and other offences against crew members ashore, particularly in P1 ports where shore-based security for seafarers is limited. For corporate executives visiting port facilities or managing shore-based operations, this is relevant context for two reasons: first, the security environment affecting seafarers is a proxy indicator for the general shore-side security environment around the port; second, organisations with seafarers in their supply chain have a duty of care obligation to those seafarers that extends to their welfare ashore, which intersects with the company's broader operational security programme. The ITF has documented cases of crew members being refused permission to go ashore by vessel operators in high-risk ports, raising both welfare and security considerations that require port-by-port assessment."

Security for port facilities, maritime infrastructure executives, and cargo operations. ISPS Code compliance, port-specific threats, executive safety during port visits, and the security environment at major P1 city ports.

4 May 2026

Written by James Whitfield, Senior Security Consultant

Speak to the Team

Port facilities occupy a specific place in the security landscape: they are critical national infrastructure, industrial hazard environments, and points where goods and people entering or leaving a country can be most efficiently observed and interfered with. They are also among the most challenging environments to operate in safely – physically dangerous, often in parts of cities with elevated crime profiles, and regulated by a compliance framework (the ISPS Code) that sets a minimum standard but does not guarantee operational security quality.

This guide covers the ISPS Code compliance framework, port-specific threat categories, the security requirements for executive visits to working port facilities, and the security environment at major P1 city ports.

The ISPS Code framework

The International Ship and Port Facility Security Code (ISPS Code) was adopted by the IMO in December 2002 in response to the September 11 attacks and entered into force on 1 July 2004. It applies to port facilities that handle international shipping traffic.

The Code’s core requirements for port facilities:

Port Facility Security Assessment (PFSA). An analysis of the facility’s threat profile, vulnerabilities, and required protective measures. Conducted by the national maritime administration or an approved security organisation.

Port Facility Security Plan (PFSP). A documented plan covering access control, cargo handling, delivery of ship’s stores, monitoring, and procedures for escalating through the three Security Levels.

Port Facility Security Officer (PFSO). A designated individual responsible for implementing and maintaining the PFSP, liaising with the ship’s security officer during port calls, and coordinating with national authorities.

Security Levels. Level 1 (normal operations), Level 2 (heightened threat – additional access controls and monitoring), Level 3 (specific threat or incident – extraordinary measures, possible port closure for non-essential traffic).

In the UK, the Maritime and Coastguard Agency (MCA) is responsible for ISPS Code verification and compliance. Compliance is also monitored by port state control during vessel inspections at port calls.

The ISPS Code creates a minimum international standard. Implementation quality varies significantly between jurisdictions and individual port facilities. A port that holds a valid Statement of Compliance is not necessarily a port that meets the security standard implied by that document – the compliance verification process assesses documentation quality more thoroughly than it assesses operational implementation.

Port-specific threat categories

Container fraud and drug concealment. INTERPOL’s Operation Lionfish (targeting narcotics concealment in shipping containers) and Operation SECAN (targeting container fraud) have documented large-scale operations in which contraband is introduced into legitimate cargo streams, sometimes with insider facilitation. For organisations with complex supply chains using containerised shipping through high-risk ports, cargo security standards and integrity monitoring at the port and freight station level are operational requirements.

Cargo theft. TT Club’s annual cargo crime reports consistently identify port and terminal environments as high-theft locations, with organised theft operations specifically targeting high-value loads. Inside information – knowledge of which containers hold high-value cargo, and of security schedules that permit access – is the primary enabler. Structural countermeasures (information segregation, anomaly monitoring, schedule variation) address the insider dimension that perimeter security alone does not.

Terrorism threat at port infrastructure. Post-9/11 threat intelligence has consistently included scenarios involving the use of containerised cargo to deliver a chemical, radiological, or conventional explosive device. US CBP’s Container Security Initiative (CSI) and the IMO’s ISPS Code were both developed in response to this threat category. For corporate travel security purposes, port facilities in cities with elevated terrorism threat are in the enhanced-duty venue category for the purposes of Martyn’s Law analysis in England and Wales.

Sabotage of critical infrastructure. Port facilities are designated critical national infrastructure in most jurisdictions. State-actor and organised crime sabotage risk – particularly for energy infrastructure (LNG terminals, fuel storage, pipeline connections at port) – is a live threat assessment category for ports in geopolitically active regions.

Shore-based crime affecting seafarers. ITF and ISWAN data document robbery, assault, and other offences against seafarers ashore at port, with particular concentrations at ports in West Africa, parts of South Asia, and Latin America. The security environment affecting seafarers is a reliable indicator of the general shore-side security context around a port facility.

Executive visits to port facilities

A working port is not a corporate campus. Access, physical hazard, and the general security environment require specific planning that differs from an office or conference venue visit.

Access and authorisation. ISPS-regulated ports require visitor authorisation in advance. Unannounced access to secure port areas is refused. Pre-visit administration includes the security pass application, vehicle pass if driving into the facility, and identification of the relevant PFSO or facility contact.

Personal protective equipment. Hard hat, hi-vis vest, and safety boots are mandatory in most working port areas. Eye protection, gloves, and hearing protection may be required for specific areas. A CP officer or executive who arrives without PPE cannot access operational areas.

Escort requirement. Visitor escorts are required in secure areas of ISPS-regulated facilities. The escort provides navigational guidance in a complex industrial environment and serves as the liaison with port security staff. Self-navigation in a working port is both prohibited and physically hazardous.

Advance work. For executives with elevated threat profiles visiting port facilities in P1 cities, advance work should include: route assessment to the facility (not just within it), current threat intelligence for the specific port (OSAC country reports contain port-specific entries), the facility’s PFSO contact, and the local emergency services contact within the port authority.

P1 city port security context

Lagos (Apapa Port, Tin Can Island Port). The Apapa corridor is one of the most challenging road environments in West Africa, with severe chronic congestion, carjacking documented in the queuing lorry approach routes, and cargo theft with documented insider involvement at the terminal. Executive visits to Lagos port facilities require: vetted ground transport with a driver experienced in the Apapa corridor, pre-trip timing assessment (avoid peak congestion periods which extend exposure time), and physical security support for the duration of the facility visit.

Karachi (Port of Karachi, Port Qasim). Both facilities are ISPS-compliant but the approach routes pass through parts of Karachi with elevated security risk. Port Qasim, south-east of Karachi city, is accessed via routes that require security assessment. Professional ground transport and pre-advance route planning are standard requirements.

Manila (Manila International Container Terminal, South Harbour). The Manila port area operates within Metro Manila’s general security environment. The approach routes through the port district require standard Manila security precautions – vetted driver, no stopping.

Mombasa Port (Kenya). The main East Africa hub for container traffic, serving the DRC, Uganda, Rwanda, and Ethiopia in addition to Kenya. Manageable by international shipping standards with standard Kenya security precautions. Ground transport from Nairobi to Mombasa (and the port visit itself) requires pre-trip planning that accounts for the Nairobi-Mombasa highway security environment.

For the vessel-at-sea security operations that operate alongside port security, see our maritime security and vessel personnel guide. For supply chain security across port and inland transportation segments, see our security for supply chain and logistics guide. For organised cargo crime in the port-adjacent freight environment – TAPA FSR/TSR warehouse and trucking standards, FreightWatch/Overhaul US 692 incidents (2023), INTERPOL Operation Pandora cargo crime, and the specific risk environment at Lagos Apapa, Manila, and Sao Paulo port corridors – see our security for cargo theft and freight logistics guide.

Sources

IMO: International Ship and Port Facility Security Code (ISPS Code), International Maritime Organization, 2003. Maritime and Coastguard Agency: Port Facility Security – Guidance and Verification, MCA, 2024. INTERPOL: Operation SECAN and Container Crime Reporting, 2024. TT Club: Cargo Crime – Annual Intelligence Report 2024. OSAC: Nigeria Security Report 2024, Pakistan Security Report 2024, Philippines Security Report 2024, Kenya Security Report 2024. US CBP: Container Security Initiative, Customs and Border Protection, 2024. ITF: Seafarers’ Rights International – Shore-Based Crime Reporting, International Transport Workers’ Federation, 2024. ISWAN: Seafarer Welfare Ashore, International Seafarers’ Welfare and Assistance Network, 2024. BIMCO: Port Security and Ship Security Officer Guidance, 2024.

Summary

Key takeaways

ISPS Code compliance is the floor, not the ceiling, of port facility security

The ISPS Code creates minimum standards for port facility security globally. Major international port facilities in Singapore, Rotterdam, and Dubai operate significantly above this minimum. Port facilities in West Africa, South Asia, and parts of Southeast Asia are ISPS-compliant on paper but face implementation challenges -- insider cargo crime, perimeter access control gaps, and road approach security that the ISPS Code does not regulate. Assessment of actual implementation quality, not certificate of compliance, is the relevant evaluation criterion.

The approach route to a P1 port is often more dangerous than the port facility itself

Port facilities typically have security infrastructure at their perimeter. The road network approaching them in P1 cities often does not. The Apapa corridor in Lagos is a documented carjacking and robbery environment. The approach to Karachi Port passes through some of the city's more challenging security zones. Pre-visit route planning and vetted ground transport are security requirements for port visits in P1 cities, not only the access control arrangements at the facility.

Insider cargo crime requires structural countermeasures, not only access control

TT Club cargo crime data consistently shows that the most damaging cargo theft operations involve insider information -- dock workers, logistics personnel, or freight forwarders with knowledge of high-value shipments and the ability to facilitate access. Access control addresses uninformed external threats. Insider risk requires structural mitigations: segregation of knowledge (no single individual has full visibility of cargo value, schedule, and security arrangements), anomaly monitoring, and staff rotation at high-value cargo handling points. These are supply chain security standards, not just port security measures.

PPE in a working port is a mandatory security and safety requirement

A close protection officer or visiting executive who does not have appropriate PPE cannot access most working areas of an ISPS-regulated port facility. Beyond the access issue, the physical hazards of a working port -- crane movements, heavy vehicle traffic, waterside falls, confined space gas risks -- require PPE compliance as a genuine safety matter. Advance work for port visits should confirm the required PPE for each area and ensure all visiting personnel arrive equipped.

Container shipping and cargo security is a high-value supply chain security domain

The TT Club and BSI estimate that cargo crime costs the global shipping industry over USD 35 billion annually. For organisations with high-value goods in the supply chain -- pharmaceutical products, electronics, luxury goods, energy equipment -- port and terminal theft is a material financial and operational risk. TAPA (Transported Asset Protection Association) certification for freight facilities and TAPA FSR/TSR standards for service providers are the industry benchmarks for securing cargo through port and terminal environments.

FAQ

Frequently Asked Questions

The International Ship and Port Facility Security (ISPS) Code was adopted by the International Maritime Organization (IMO) in December 2002, following the September 11 attacks, and entered into force on 1 July 2004. It applies to port facilities serving international shipping. The Code requires each port facility to conduct a Port Facility Security Assessment (PFSA), develop and implement a Port Facility Security Plan (PFSP), and appoint a Port Facility Security Officer (PFSO) responsible for implementing the plan. The plan must address three Security Levels: Level 1 (normal), Level 2 (heightened threat), and Level 3 (exceptional threat requiring additional measures). Specific measures cover: access control to the port facility and ship/shore interface, cargo handling security, delivery of ship’s stores, monitoring of the port facility, and handling of security threats and breaches. Compliance is verified through national maritime administrations; in the UK, the Maritime and Coastguard Agency (MCA) is responsible for ISPS Code verification.

Port facilities face a distinct set of security threats that differ from both vessel-at-sea threats and standard corporate premises threats. Container fraud and drug concealment: the IMO/INTERPOL have documented large-scale operations in which narcotics or other contraband are concealed within legitimate cargo containers, sometimes with the cooperation of dock workers (inside operations). Cargo theft: TT Club data shows that port and terminal facilities account for a significant proportion of global cargo crime, with inside information enabling targeted theft of high-value loads. Terrorism threat: post-9/11 concern about the use of containerised cargo to deliver a weapons device (chemical, radiological, or conventional explosives) to a port location remains a live intelligence category for major port authorities globally. Sabotage of critical infrastructure: port facilities serve as critical national infrastructure in most jurisdictions and are assessed for state-actor and organised crime sabotage risk. Crew welfare and shore-based crime: seafarers ashore at port are documented victims of robbery, assault, and recruitment into trafficking.

A working port facility is an industrial environment with security hazards that go beyond the standard close protection risk assessment. Specific considerations: obtain the required security pass or visitor authorisation in advance – unannounced arrivals at ISPS-designated ports are refused entry. Personal protective equipment is mandatory in most working port areas (hard hat, hi-vis vest, safety boots, eye protection in some areas). Stay with the designated escort at all times – working ports are operational environments where access to berths, crane areas, and waterside locations creates physical hazard that is not mitigated by security alone. Pre-trip advance work should include an assessment of the specific port facility’s security posture and any current threat intelligence (OSAC country reports contain port-specific threat information for major P1 ports). In P1 city ports – Lagos/Apapa, Karachi, Manila – the approach routes to the port facility are among the most dangerous road environments in each city, with documented vehicle crime, carjacking, and the general security environment of densely populated industrial areas.

ISPS Code compliance creates a minimum international standard for port security, but the quality of implementation varies significantly across P1 port facilities. Lagos/Apapa Port and Tin Can Island Port are among the most challenging port environments in West Africa: severe road congestion on the Apapa corridor (documented in OSAC and multiple logistics sector reports), cargo theft with documented insider involvement, and a general security environment that requires professional advance planning for any executive visit. Karachi’s Port and Port Qasim are ISPS-compliant but the approach routes pass through Karachi’s more challenging security zones. Manila’s international container port at Manila Bay operates within Metro Manila’s general security environment. Nairobi’s port equivalent (Mombasa Port, the major East Africa hub) is rated as manageable by international shipping operators but requires standard Kenya security protocols for visiting executives. Singapore, Rotterdam, and Dubai’s Jebel Ali are among the world’s most professionally managed port facilities with security standards that consistently exceed ISPS Code requirements.

Seafarers who come ashore at port are a documented vulnerable population for crime. The International Transport Workers’ Federation (ITF) and the International Seafarers’ Welfare and Assistance Network (ISWAN) document robbery, assault, and other offences against crew members ashore, particularly in P1 ports where shore-based security for seafarers is limited. For corporate executives visiting port facilities or managing shore-based operations, this is relevant context for two reasons: first, the security environment affecting seafarers is a proxy indicator for the general shore-side security environment around the port; second, organisations with seafarers in their supply chain have a duty of care obligation to those seafarers that extends to their welfare ashore, which intersects with the company’s broader operational security programme. The ITF has documented cases of crew members being refused permission to go ashore by vessel operators in high-risk ports, raising both welfare and security considerations that require port-by-port assessment.

Get in Touch

Request a Consultation

Describe your security requirements below. All enquiries are confidential and handled by licensed consultants.