Five cases in which a ship can request a Declaration of Security and the ten security records kept on board (ISPS Code A/5, A/10 and A/13)

A Declaration of Security (DoS) is the document in which a ship and a port facility, or two ships, write down how they share responsibility for security measures. Section 5 of part A of the ISPS Code fixes when one is needed and who completes it, and leaves the retention period to the Administration and the Contracting Government.

On-board security records are fixed by section 10 of part A. It picks ten activities covered by the ship security plan (SSP), requires records of them on board, and attaches conditions on language, electronic format and access. Training is section 13 of part A. What is mandatory there is “appropriate intervals”. The once-a-quarter figure sits in the guidance of part B.

After the ISSC, these records are what a port State control officer looks at next. Each provision below shows which record is required and in what form.

Whether a Declaration of Security is required is for the Contracting Government, and a ship can request one in five cases

5.1 Contracting Governments shall determine when a Declaration of Security is required by assessing the risk the ship/port interface or ship to ship activity poses to persons, property or the environment.

The body that determines whether a declaration is required is the Contracting Government. It assesses the risk that the ship/port interface or the ship to ship activity poses to persons, property or the environment. The cases in which a ship can take the initiative are listed separately, and there are five.

5.2 A ship can request completion of a Declaration of Security when: .1 the ship is operating at a higher security level than the port facility or another ship it is interfacing with; .2 there is an agreement on a Declaration of Security between Contracting Governments covering certain international voyages or specific ships on those voyages; .3 there has been a security threat or a security incident involving the ship or involving the port facility, as applicable; .4 the ship is at a port which is not required to have and implement an approved port facility security plan; or .5 the ship is conducting ship to ship activities with another ship not required to have and implement an approved ship security plan.

When the ship’s security level is higher than the other side’s, when there is an agreement on declarations between Contracting Governments, when there has been a security threat or incident involving the ship or the port facility, when the ship is at a port not required to have an approved port facility security plan, and when the ship conducts ship to ship activities with a ship not required to have an approved SSP. The last two are cases where the other side has no plan. The other side’s security measures cannot be read from a plan, so they are written into a declaration instead.

The port facility or ship that receives a request has to acknowledge it (5.3). Part B 5.2.1 recommends that the port facility security officer or ship security officer who receives the request discuss appropriate security measures.

The master or the ship security officer completes the declaration for the ship, and the Administration sets how long it is kept

5.4 The Declaration of Security shall be completed by: .1 the master or the ship security officer on behalf of the ship(s); and, if appropriate, .2 the port facility security officer or, if the Contracting Government determines otherwise, by any other body responsible for shore-side security, on behalf of the port facility.

On the ship’s side the signatory is the master or the ship security officer (SSO). On the port facility side it is the port facility security officer (PFSO), or another body responsible for shore-side security if the Contracting Government so determines. For a declaration between two ships, both sides sign through the master or the SSO.

5.5 The Declaration of Security shall address the security requirements that could be shared between a port facility and a ship (or between ships) and shall state the responsibility for each.

The content is two things. The security requirements that could be shared between the port facility and the ship, and who is responsible for each. Part B 5.4.1 recommends adding the signature and date of both sides, the duration, the relevant security level and the contact details. That a change in security level may require a new or revised declaration is also guidance, in part B 5.4.2. The language, English, French or Spanish or a language common to both sides, is part B 5.5.

The retention period is not a number in the Code. The minimum period for port facilities is set by the Contracting Government (5.6), and the minimum period for ships by the Administration (5.7), each bearing in mind regulation XI-2/9.2.3. Unless the period set by the flag State is written into the SSP, the ship has no way of knowing how long to keep the declaration.

Ten security records are kept on board

10.1 Records of the following activities addressed in the ship security plan shall be kept on board for at least the minimum period specified by the Administration, bearing in mind the provisions of regulation XI-2/9.2.3: .1 training, drills and exercises; .2 security threats and security incidents; .3 breaches of security; .4 changes in security level; .5 communications relating to the direct security of the ship such as specific threats to the ship or to port facilities the ship is, or has been; .6 internal audits and reviews of security activities; .7 periodic review of the ship security assessment; .8 periodic review of the ship security plan; .9 implementation of any amendments to the plan; and .10 maintenance, calibration and testing of any security equipment provided on board including testing of the ship security alert system.

Item	Record	What accumulates
.1	Training, drills and exercises	Date, participants, scenario
.2	Security threats and security incidents	Time, content, response
.3	Breaches of security	The breach and the action taken
.4	Changes in security level	Time of change and source of the instruction
.5	Communications relating to the direct security of the ship	Specific threats to the ship or to port facilities
.6	Internal audits and reviews of security activities	Audit date and result
.7	Periodic review of the ship security assessment	Review date and conclusion
.8	Periodic review of the SSP	Review date and conclusion
.9	Implementation of amendments to the plan	Amendment and date it took effect
.10	Maintenance, calibration and testing of security equipment	Including tests of the ship security alert system

The ten fall into two kinds. Items .1 and .10 are records that accumulate dates steadily. Every drill and every equipment test adds a line. The rest only come into being when something happens. If there was no security incident, an empty .2 is the normal state. So when records are checked, the gaps in .1 and .10 come before the empty items.

The period follows the same structure as the declaration. Records stay on board for at least the minimum period the Administration sets, bearing in mind regulation XI-2/9.2.3.

Records are kept in the working language, and electronic records need procedures against deletion and amendment

10.2 The records shall be kept in the working language or languages of the ship. If the language or languages used are not English, French or Spanish, a translation into one of these languages shall be included.

The language is the working language of the ship. If the working language is not English, French or Spanish, a translation into one of them is included. A drill record written only in a national language meets the provision only once that translation is attached.

10.3 The records may be kept in an electronic format. In such a case, they shall be protected by procedures aimed at preventing their unauthorized deletion, destruction or amendment.

Electronic records are allowed. The condition is procedure. There have to be procedures aimed at preventing unauthorized deletion, destruction or amendment. Who can change a record, and where the history of changes is kept, is the substance of that procedure. The records also have to be protected from unauthorized access or disclosure (10.4).

Part B 10.1 recommends that records be available to duly authorized officers of Contracting Governments to verify that the SSP is being implemented. Protection and access pull in opposite directions, so the SSP carries both the procedure for showing records and the procedure for guarding them.

Drills run at appropriate intervals, and once a quarter is a recommendation in part B

13.4 To ensure the effective implementation of the ship security plan, drills shall be carried out at appropriate intervals taking into account the ship type, ship personnel changes, port facilities to be visited and other relevant circumstances, taking into account the guidance given in part B of this Code.

What part A makes mandatory is “appropriate intervals”. They are set with regard to the ship type, changes in ship personnel, the port facilities to be visited and other relevant circumstances. The company security officer has to take part in exercises at appropriate intervals to ensure the coordination and implementation of SSPs (13.5). No number appears up to this point.

13.6 To ensure the effective implementation of the provisions of the ship security plan, drills should be conducted at least once every three months. In addition, in cases where more than 25 percent of the ship’s personnel has been changed, at any one time, with personnel that has not previously participated in any drill on that ship, within the last 3 months, a drill should be conducted within one week of the change. These drills should test individual elements of the plan such as those security threats listed in paragraph 8.9.

The number is in part B 13.6. Drills at least once every three months, and where more than 25 percent of the personnel changed at one time with people who have not taken part in a drill on that ship in the last 3 months, one more drill within one week of the change. The verb is should. Read it apart from the shall of part A 13.4. Where the SSP has adopted this frequency, however, it becomes part of the plan on that ship.

Exercises are part B 13.7. Exercises with company security officers, port facility security officers and the relevant authorities of Contracting Governments are recommended at least once each calendar year, with no more than 18 months between them. Full scale, tabletop simulation, or combined with a search and rescue or emergency response exercise are all acceptable forms.

Worth confirming

The passages above come from sections 5, 10 and 13 of part A and sections 5, 10 and 13 of part B of the ISPS Code as adopted in SOLAS/CONF.5/34. This article covers that text only.

• The minimum retention period for declarations and records is not a number in the Code. Check the period the Administration set, in the SSP.
• Regulation XI-2/9.2.3, which the Code refers to, is a provision of SOLAS chapter XI-2. This article does not cover the content of that regulation.
• The three-month drill cycle and the 18-month exercise interval are part B guidance. The actual standard is the cycle written into that ship’s SSP.
• A model declaration is in the appendix to part B. For a declaration between two ships, that model is adjusted.

You can consult the cited source documents

These links lead to the official publishers of the documents discussed here. Match the edition and provisions cited in the article, and check subsequent amendments and flag-state implementation before applying them.

• IMO · SOLAS XI-2 and the ISPS Code

Continue with the related operational guidance

• Four ISSC verifications, the five-year validity and the four grounds on which the certificate ceases to be valid (ISPS Code A/19)
• Three layers of STCW security qualification and who each one applies to (Regulations VI/5 and VI/6)