The Port Security Regime and the Guarding Contract

Readiness note. This is a private training programme. It builds knowledge and readiness. It does not grant any official certificate, licence, or government recognition, and it does not create any affiliation with a regulator or an agency. On passing, learners receive a Record of Completion.

What this course is not. This is a knowledge course. It is not ISPS Code training, not a port facility security officer course and not STCW training. Only training approved by your country's maritime authority counts for port duty.

This module builds on module M4 (Buying and Running the Guarding Contract) and on the courses Guard — Water (units W1 to W16) and Supervisor — Water (modules WS1 to WS5).

Mission briefing

A terminal operator has invited your agency to bid for its guarding contract: two gates, six berths, a container yard, 24 hours a day. The tender says, "The contractor shall ensure full ISPS compliance." Your sales manager wants to sign that line. You should not let him.

A guarding agency does not "ensure ISPS compliance". Governments and port facilities carry that duty. An agency supplies trained people who work one part of an approved plan, under an officer the port has named. A manager who understands this writes a contract that both sides can keep.

Focus: know the regime in outline, know exactly where an agency fits and where it stops, and build the scope, the manpower and the surge terms of the contract on that. This module is general knowledge and is not legal advice.

Learning objectives

By the end of this module, you will be able to:

• Describe the world framework for ship and port facility security in outline.
• Name the assessment, the plan and the officer, and say who is responsible for each.
• Explain how security in the wider port goes beyond the port facility.
• Say where a private agency fits, and list what it cannot do.
• Write the port-specific parts of a guarding scope and contract.
• Plan manpower for 24-hour posts, ship-call surges and higher security levels.
• Compare, in outline, how the European Union, the United Kingdom and the United States apply the framework.

1. The framework in one page

Unit W1 (Why Ports and Ships Need Security) gave guards the short version. A manager needs one level more.

• SOLAS is the main world agreement on the safety of ships. Its chapter XI-2 is about security.
• The ISPS Code sits under that chapter. Part A is mandatory. Part B is guidance. Some countries and regions have made parts of Part B binding in their own law (section 8).
• The framework applies to passenger ships and to cargo ships of 500 gross tonnage and more on international voyages, and to the port facilities that serve them. A port facility is the place where ship and shore meet.
• It is a framework for governments. Each government puts it into national law, names its authority, and decides the details.

What governments keep. A government may hand some of its security tasks to a recognised security organisation, a body it has approved. But the Code lists tasks that cannot be handed over. They include setting the security level, approving a port facility security assessment, approving a port facility security plan, and setting the requirements for a Declaration of Security.

So the first rule for a manager: the level, the approved assessment and the approved plan are acts of government. No contract can move them to a contractor.

2. The assessment, the plan and the officer

The Code lists what a plan must address. Several items matter directly to a guarding contractor:

• the duties of port facility personnel who have security responsibilities;
• procedures for reporting security incidents;
• measures to protect the information in the plan;
• procedures for auditing the plan;
• procedures for working with the security activities of ships.

Among the PFSO's listed duties are regular security inspections, making sure that adequate training has been given to the people responsible for security, making sure that standards for those people are met, and reporting to the authorities.

The PFSO's own training covers subjects such as international conventions and codes, national law, and the functions of other security organisations. Each country approves the course. The world shipping body publishes a model course for PFSOs, numbered 3.21. None of that is this course. A contract manager needs to understand the PFSO's role in order to work with it, and that is as far as this module goes.

3. The wider port

The ISPS Code stops at the port facility. A port is larger: roads, rail yards, warehouses, offices, fuel stores, marinas, and the town behind the fence.

In 2004 the International Labour Organization and the world shipping body published a code of practice on security in ports. It is not legally binding. It extends security thinking to the whole port. It recommends:

• a port security assessment and a port security plan for the whole port;
• a port security officer to manage and coordinate security in the port;
• a port security advisory committee that brings the port's bodies together;
• security awareness and training for everyone who works in the port, each according to role.

The code says that it is not meant to replace the ISPS Code, and that it does not affect workers' fundamental rights.

Why this matters to you: many guarding contracts at ports cover places outside the ISPS port facility, such as a truck park, a warehouse or an office block. Ask for each post, "Is this post inside a port facility with an approved plan, inside the wider port, or outside both?" The rules, the training and the passes may differ for each.

4. Where a private agency fits

The Code says little about private security companies. Its guidance says that a security assessment should take account of existing agreements with private security companies that provide water-side or shore-side security services. That is the only place they are named.

The Code does speak of port facility personnel having specific security duties. They must understand their duties under the plan and have enough knowledge and ability to carry them out. When your guards work the gates and berths of a port facility, this is what they are.

Five things follow.

1. The port facility stays responsible. It cannot contract its duty away. Your contract is how it gets people to carry out part of its plan.
2. Your guards' duties come from the plan. They reach you as post orders and instructions that the PFSO has approved. You do not write security measures for the port.
3. The training requirement is set by the port and its authority. You deliver trained people and prove it with records (module WM2, Supporting the Port Facility Security Officer).
4. You hold protected information. You and your supervisors are told parts of the plan. You must protect them like the port does.
5. You are inside the port's audit and inspection system. Your posts, records and people will be checked by the PFSO and by government officers.

5. What an agency does not do

Put these limits into your proposal in plain words. A client who expects more has misunderstood the regime, and it is better to find that out before you sign.

Three kinds of work belong to roles that a regulator controls: the PFSO and the PFSO's approved course; the ship security officer, who is an officer of the ship; and the work of a recognised security organisation. A guarding agency does not offer these under a guarding contract and does not let its sales papers suggest it.

Firearms. The Code's guidance warns that firearms on or near ships and in port facilities may pose particular safety risks, especially near dangerous goods, and says that any decision to use armed personnel is for the government. An armed post at a port is never a matter for the agency and the client alone.

6. The port parts of the contract

Module M4 (Buying and Running the Guarding Contract) taught the scope of work, fair tendering, service levels and liability. Add these port matters. Take legal advice on the wording.

Scope

• Each post, marked as inside the port facility, in the wider port, or outside.
• The posts and numbers at level 1, level 2 and level 3, as the PFSO gives them to you. The contract should contain a schedule for each level.
• Ship-call posts: posts that exist only while a ship is at a berth, with the notice the port will give.
• What is out of scope (section 5).

People

• Vetting and pass requirements before a guard starts, and who pays the fees.
• The training each role must have before posting, who delivers it, and who pays for the time.
• The PFSO's right to refuse or remove a guard, and your right to a reason in writing.
• No subcontracting without the client's written approval.

Authority and information

• Who may instruct your supervisors on security: the PFSO and named duty officers.
• Confidentiality: what plan information you receive, who in your agency may hold it, and how it is returned when the contract ends.
• Incident reporting: to whom, how fast, and in what form.
• Access for the PFSO and for inspectors to your posts and records.

Safety and equipment

• Who provides lifejackets, radios, bright vests and vehicles, and who maintains them.
• The port's safety induction and how the two employers cooperate on safety (module WM4, Port Safety, Cyber and Resilience for Contractors).

Measures of service. Choose measures that show the work, such as posts filled on time, passes and training that are still valid, drills attended, check findings closed on time, and reports sent on time. Do not use "number of incidents" as the only measure. It rewards silence.

A sentence such as "the contractor shall ensure full ISPS compliance" should be replaced. Offer this in its place: "The contractor shall carry out the security duties given to its posts under the port facility security plan, as instructed by the PFSO, and shall keep the records set out in schedule X."

7. Manpower: 24 hours, ship calls and surges

Module M3 (Manpower, Rosters and the Cost of a Post) taught the relief factor and the true cost of a post. A port adds three pressures.

1. Posts that come and go. Gangway and berth posts follow the ships. Ask the port for its ship schedule each week. Plan the roster from it, and keep a daily check, because ships are early and late.

2. Higher levels. Level 2 and level 3 need more guards, sometimes within the hour. The contract should say how many, how fast, for how long, and at what rate. Agree these terms before the level ever rises.

3. Lead time. A new guard cannot be put on a port post tomorrow. Vetting, the port pass, the safety induction and the required training all take time. So the number of guards ready for the port must be larger than the roster.

Build a ready pool

1. Count the posts at level 1 and apply your relief factor (module M3, Manpower, Rosters and the Cost of a Post).
2. Add the average ship-call posts for a busy week.
3. Add the extra posts for level 2 from the contract schedule.
4. The difference between step 1 and the total of steps 1 to 3 is the number of extra guards you must be able to supply in a surge.
5. Decide how to supply them: part-time port-ready guards, guards from nearby sites who have port passes and the training, paid standby, or overtime within legal limits.
6. Keep the list current. A guard whose pass expired last month is not a ready guard.

Rules for a surge

• Never fill a port post with a guard who lacks the pass, the induction or the required training. Tell the PFSO that the post is not filled.
• Watch hours. A surge that is met with double shifts fails on the third night (module S4, Rosters, Fatigue and Welfare).
• Price standby honestly. A ready pool costs money even when no ship comes. A client who will not pay for readiness has chosen a slower response, and the contract should say so.
• After each surge, review with the PFSO: how fast, how many, what was missing.

8. Three examples of national practice

The framework is the same everywhere. The way it is applied differs. These three examples are for comparison. Each is an outline, checked on 8 October 2026, and each jurisdiction has more rules than are shown here.

The India and Australia editions give their rules in a country note and in the country unit of the Guard course. If you bid in a country you do not know, find the national maritime security law, the authority, the pass system and the training rule before you price.

What you do / What you never do

Worked example

The people, companies and places in this example are invented.

Nisha manages bids at Trident Guarding. Coral Point Terminal asks for a price. The tender has the line about "full ISPS compliance" and a list of level 1 posts: 14 guards per shift.

Nisha asks four questions in writing. Which posts are inside the port facility? What are the posts at level 2 and level 3? How much notice is given for a ship-call post? What training and passes must a guard hold before the first shift, and how long does the port take to issue a pass?

The answers: all posts are inside the port facility except the truck park. Level 2 adds 6 guards per shift within two hours. A ship-call post is confirmed 12 hours ahead. A pass takes about three weeks.

Nisha's roster needs 14 per shift at level 1, on three shifts a day. With her relief factor, that is 60 guards on the roll. Ship calls add up to 4 per shift in a busy week. On the same factor, that is 17 more guards. Level 2 adds 6 per shift, which is 26 more. So she must be able to supply up to 43 extra guards in a surge. She proposes a ready pool of 103 port-passed guards: the 60 on the roll, and 43 who normally work at nearby warehouse sites or part-time. Six of them are on paid standby each night, so that the first two hours of a level 2 order are covered.

In her proposal she replaces the compliance line with the wording from section 6, lists what the agency does not do, and prices level 2 as a separate rate. The terminal's PFSO calls her. "You are the first bidder who asked what happens at level 2."

Activity — rewrite the tender line

A tender for a bulk terminal contains these lines.

• "The contractor shall be responsible for the security of the port facility."
• "The contractor shall provide 10 guards per shift."
• "The contractor shall increase manning when required."

1. Rewrite each line so that it matches the regime and can be checked.
2. List six questions you will ask the port before you price.
3. The port can give two hours' notice of level 2. Level 2 needs four more guards per shift. Describe your ready pool.
4. Write five lines for your proposal under the heading "What our service does not include".

There is no single right answer. Check that the port keeps what only the port and the government can do, and that every number in your offer can be delivered by guards who hold the pass, the induction and the training.

Key points

• SOLAS chapter XI-2 and the ISPS Code are a framework for governments. Part A is mandatory, Part B is guidance, and national law decides the details.
• Setting the level and approving the assessment and the plan are acts of government. They cannot be contracted out.
• The PFSO sees that the plan is carried out. Your guards are personnel with security duties under that plan.
• The wider port may have its own plan, officer and committee, under a non-binding international code or under national law.
• An agency supplies trained people for posts. It does not ensure "ISPS compliance", sign Declarations of Security, or do the work of a PFSO, a ship security officer or a recognised security organisation.
• Write the contract by post and by level, with ship-call posts, surge terms, training and pass conditions, confidentiality and reporting.
• Keep a ready pool larger than the roster, because passes, induction and training take time.
• Never fill a port post with a guard who is not ready. Tell the PFSO.
• National practice differs. Find the law, the authority, the pass and the training rule before you price.

Where to go next

• Module M4 (Buying and Running the Guarding Contract) and module M3 (Manpower, Rosters and the Cost of a Post): the base for this module.
• Unit W1 (Why Ports and Ships Need Security) and unit W3 (Security Levels 1, 2 and 3): the guard's view of the regime.
• Module WS2 (Security Level Changes and Working with Ships): what a level change asks of a shift.
• Module WM2 (Supporting the Port Facility Security Officer): records, vetting, training and reporting from the contractor side.
• Module WM4 (Port Safety, Cyber and Resilience for Contractors): safety cooperation and emergency planning.

Conclusion

You have completed this module. You can now describe the port security regime in outline, place your agency inside it, write the port parts of a guarding contract, and plan manpower for ship calls and higher levels.

The next module is WM2 (Supporting the Port Facility Security Officer).

Complete the Learning Check for this module before you move on.