ISPS Audit Checklist: SSP, Access Control & Drills
The ship security plan is confidential, which has an awkward consequence for anyone preparing an audit: the document that describes what you do is largely the one thing the auditor will not read. What gets examined instead is the implementation — and implementation, in security terms, means the access points. The gangway, the identity check, the search, the restricted area and the person standing there at three in the morning with the authority to say no. That is where an ISPS audit lands, and it is the part a plan on a shelf does not prepare anyone for.
ISPS audit · Access control
The plan says who may board. The audit asks the watchman.
Make the access routine something the watch can actually carry out
Three things push an ISPS audit toward the gangway rather than the filing cabinet, and they compound.
The plan is not open to inspection
Its confidentiality is the point of it, so an auditor cannot verify compliance by reading the procedure and comparing. They verify by watching what happens and asking the people doing it.
Access control is continuously visible
It is running from the moment anyone approaches the ship. The auditor experiences it before the meeting starts, which makes it the one element nobody can prepare for on the day.
It is carried out by the least senior people
The gangway watch is usually a rating on a rotating duty. Security that depends on officers being present is security that is not in place for most of the port stay.
The records half of the picture — what has to be kept, for how long, and how the certificate cycle works — is covered in our ISPS security audit guide. This page is about the half that happens on deck.
What changes at each security level
The single most common gap is a crew who can describe level 1 and cannot describe what they would do differently at level 2. Since a ship must operate at least at the level set by the port facility it is entering, level 2 is not hypothetical, and the auditor knows it.
Measure
Level 1 — normal
Level 2 — heightened
Level 3 — exceptional
Identity checks
All persons seeking to board identified and their reason for boarding confirmed
Checks tightened, access points reduced, more of them closed and watched
Access limited to those responding to the incident, or stopped entirely
Searching persons and effects
Carried out at a frequency set by the plan, including random checks
Frequency and thoroughness both raised
Everyone searched, or boarding suspended, as directed
Access points
Controlled and watched; unused points secured
Number in use cut back so each remaining one can be properly watched
Restricted to a single controlled point, or none
Restricted areas
Designated, marked and access controlled
Extended, patrolled more often, entry further limited
Additional areas restricted; searching of restricted areas
Unaccompanied baggage
Screened or searched before it comes aboard
Screened more thoroughly, or refused
Not accepted, or handled only as directed
Stores and provisions
Checked against the order and inspected before loading
Checked more intensively, delivery supervised throughout
Restricted or refused; delivery may be suspended
Deck and area watch
Deck and ship’s side monitored as the plan sets out
Patrol frequency increased, lighting and watch strengthened
Continuous watch, with support from the port facility or authorities
The exact measures belong to your own plan, and this grid is the shape rather than the content. What matters for the audit is that the people on watch know their own version of column three exists, and where to find it without asking an officer.
Restricted areas, and the three ways they fail
Designating restricted areas is a plan exercise. Keeping them restricted is not, and the failures are consistent across fleets.
01
Designated but not marked
The area appears in the plan and carries no sign at the door. An auditor who cannot tell a restricted area from a store room is looking at a control that exists only on paper, and so is a visitor.
02
Marked but not secured
The sign is there, the door is open, and the reason is always operational — work in progress, hot weather, a lost key nobody replaced. Each reason is reasonable and the control is still absent.
03
Secured but universally keyed
Everybody holds the key, including people with no reason to enter and contractors who were given one and never handed it back. A lock that does not restrict anyone is a door with extra steps.
The quick self-check is to walk the ship as a stranger and try the doors. Anything you can open without being challenged, and anything you cannot identify as restricted from outside it, is a finding somebody else will write.
Security checks that leave a record, not a memory
Marine Inspection runs access control rounds, restricted-area checks and drill records as logged routines with times and names, so the implementation an auditor asks about is the implementation you can show.
Four questions, in roughly this order, and the answers are the audit. None of them is about the plan.
The fourth question is worth rehearsing deliberately, because it is cultural rather than procedural. A rating who believes that stopping a visitor in a boiler suit might get them in trouble will wave them through, and no amount of plan revision changes that. The fix is a master and an officer who have said out loud, in front of people, that refusing entry is the correct answer and will be backed.
Declarations of Security
A Declaration of Security records what each side will do when a ship interacts with a port facility or another ship and the arrangements are not covered by the normal case. Auditors look at these less for their content than for whether anybody understands when one is needed.
When it is requested
Where the ship is at a higher security level than the facility it is entering, where a ship-to-ship activity raises the risk, or where the plan or the flag State requires it for a given operation or trade.
Who signs it
The master or the ship security officer for the ship, with the port facility security officer or the other vessel’s representative. Knowing this without checking is part of what is being examined.
What it has to show
Which party carries out which security measure, and for how long the declaration applies. A declaration that assigns nothing is a signature exercise.
Where it goes afterwards
Into the records, retained for the minimum period set by the Administration, and reachable on request rather than filed somewhere nobody can find during the audit.
Drills that cover the access routine
The cadence itself is straightforward and covered in the companion guide. What is less often done well is the content, because security drills drift toward the same scenario and that scenario is rarely access control.
Rotate the scenario deliberately
An unidentified person at the gangway, a package left on deck, an attempt to enter a restricted area, a stowaway search, a level change received in port. Four quarters should not produce four of the same.
Drill the watch, not the officers
The people who will actually be at the access point when it happens. A drill attended only by the officers who already know the plan proves nothing about the ones who do not.
Record what did not work
A drill record saying the drill was satisfactory tells an auditor it was not examined. The useful record names the thing that went wrong and what changed afterwards.
Cover crew changes properly
A large simultaneous change can leave most of the watch with no drill behind them, and the requirement to run one promptly after such a change exists precisely because that is the window when the control is weakest.
Running the scenarios against the real access points, at the actual security level, is also the cheapest way to discover that a door designated restricted has been propped open for a month. You can book a demo to see drills and access rounds recorded against each vessel.
The checklist
Twenty checkpoints, grouped the way an audit moves through the ship. Work them in order with the watch on duty rather than with the officer who wrote the procedure, and mark only what you have seen rather than what you have been told.
ACAccess control
A watch is posted at every access point in use, for the whole time it is in use
Access points not in use are secured, and the watch can say which those are
Everyone seeking to board is identified and the reason for boarding is confirmed
Searching of persons and effects happens at the frequency the plan sets, random checks included
The watch knows the security level in force today without asking an officer
The watch knows they may refuse entry, and has been told in person they will be supported
RARestricted areas
Every designated area is marked at the door, legibly, in the working language
Doors are secured, including the ones propped open for an operational reason
Key holding is limited to people with a reason, and contractor keys have come back
Patrols happen at the frequency the plan sets, and leave a record that they did
A stranger walking the ship cannot enter one without being challenged
DRDrills and familiarisation
Drills have been held within the required interval, with no quiet gap after a busy period
Scenarios are rotated across the year rather than repeating one that works
The ratings who stand the access watch took part, not only the officers
Each record names what did not work and what changed afterwards
A drill followed promptly after any large simultaneous crew change
RERecords and equipment
Declarations of Security are filed against the port call they belong to
Security level changes are logged with the time they were received and acted on
Security equipment and the alert arrangements have been tested, with the result recorded
Records are in the working language and can be produced within a few minutes
Anything left unmarked at the end of that pass is a finding you now own, which is the position to be in. You can book a demo to see the same checklist run against each vessel with the evidence attached.
Preparing for the audit itself
1
Walk the ship as a stranger
From the quay inwards. Where were you challenged, what could you open, and what did you learn about the vessel before anybody asked who you were?
2
Ask the watch the four questions
Without warning and without an officer alongside. The answers tell you the state of the implementation more accurately than any document review.
3
Test the equipment rather than the register
Alarms, lighting, communications and the security alert arrangements, tested on the day and recorded, rather than confirmed from the last entry.
4
Check the records are reachable
Drills, declarations, level changes and equipment tests, in the working language and producible within a few minutes. A record that exists but cannot be found behaves exactly like a missing one.
How Marine Inspection supports ISPS implementation
Access rounds as a logged routine
Gangway and restricted-area checks recorded with time, name and condition, so the control leaves evidence instead of relying on somebody remembering the round.
Security level visible to the ship
The level in force shown where the watch can see it, which is the difference between a change being communicated and a change being known.
Drill records with substance
Scenario, participants and what went wrong captured at the drill, with the rotation visible so the same exercise is not run four times a year.
Declarations and level changes held together
Filed against the vessel and the port call they belong to, reachable in the minutes an auditor is prepared to wait.
Security equipment on a test routine
Alarms, lighting and communications on scheduled checks with results recorded, rather than a register that confirms only that a register exists.
Fleet pattern for the shore side
The same weak point appearing across vessels shown as a pattern, which is what turns a ship-level finding into a change to the way the company operates.
Generally no — its confidentiality is central to the arrangement, and inspection of it by port officials is restricted to particular circumstances. That is precisely why the audit concentrates on implementation: the access points, the restricted areas, the records and what the crew can actually do.
What is checked at the gangway?
That a watch is posted, that people seeking to board are identified and their reason confirmed, that searching happens at the frequency the plan sets, that the watch knows the current security level, and that they know they have the authority to refuse entry and will be supported in doing so.
How do restricted areas usually fail an audit?
Three ways: designated in the plan but not marked on the ship, marked but left open for an operational reason, or secured with a key that almost everybody holds, including contractors who never returned theirs. All three leave the designation intact and the control absent.
What changes at security level 2?
Measures tighten and narrow: fewer access points in use so each can be properly watched, more frequent and more thorough searching, restricted areas extended and patrolled more often, stores and unaccompanied baggage handled more strictly, and a stronger deck and ship’s side watch. A ship must operate at least at the level set by the facility it is entering.
When is a Declaration of Security needed?
Where the ship is operating at a higher security level than the facility or vessel it is interacting with, where a ship-to-ship activity raises the risk, or where the plan or the flag State requires one for that operation or trade. Signed for the ship by the master or the ship security officer, and kept with the records.
How should security drills be made useful?
Rotate the scenario across the year rather than repeating one, run them with the ratings who stand the access watch rather than only the officers, record what did not work instead of recording that the drill was satisfactory, and make sure a large crew change is followed promptly by a drill, since that is when the watch is weakest.
ISPS audit preparation
The control is the person at the access point, not the plan in the safe
Marine Inspection records access rounds, restricted-area checks, drills and equipment tests as they happen, keeps declarations and level changes with the port call they belong to, and shows the shore side where the same gap is appearing across the fleet.
