Introduction: Why the ISPS Code Shapes Every Vessel Call in Indonesia
The ISPS Code, or International Ship and Port Facility Security Code, is the global maritime security standard that ships and port facilities must follow worldwide. For operators calling at Indonesian ports, understanding the ISPS Code is more than a compliance exercise. It determines whether a vessel can berth on schedule, carry out a crew change, and load or discharge cargo without disruption. A vessel that fails to meet security requirements may be detained, subjected to additional control measures, or even refused entry to port.
Indonesia is an archipelagic nation with hundreds of ports and strategic sea lanes such as the Malacca, Sunda, and Lombok Straits, and it takes maritime security seriously. Every international vessel arriving at Tanjung Priok, Tanjung Perak, Belawan, Balikpapan, Makassar, Batam, Bitung, Pontianak, or Semarang is checked for compliance with the ISPS Code. These checks cover certificates, the applicable security level, and the crew's readiness to apply security procedures on board.
This article explains the background of the ISPS Code, its structure and main obligations, the documents that must be on board, the security levels, and how the Code is applied in Indonesian ports. We also describe how it relates to crew change and port clearance (PKKA) processes, and give practical tips so that your port call is not disrupted by security issues. The guide is written from the perspective of a ship agent who deals with these procedures every day.
What the ISPS Code Is and Its Legal Basis
The ISPS Code was adopted by the International Maritime Organization (IMO) in December 2002 at a SOLAS Diplomatic Conference, in response to the growing threat of terrorism against maritime transport. It entered into force on 1 July 2004 as part of SOLAS Chapter XI-2, which covers special measures to enhance maritime security. Because it forms part of SOLAS, it binds all IMO member states, including Indonesia, which has ratified the convention.
The Code has two parts. Part A is mandatory and sets out detailed requirements for governments, shipping companies, ships, and port facilities. Part B is guidance and provides recommendations on how to implement the Part A requirements. In practice, port authorities and auditors often use Part B as a benchmark when assessing whether the procedures prepared by a company or port facility are adequate.
In Indonesia, implementation falls under the Ministry of Transportation through the Directorate General of Sea Transportation, which acts as the Designated Authority. The national basis is Law No. 17 of 2008 on Shipping and its implementing regulations, which require ships and port facilities to apply security measures in line with international standards. On the ground, oversight is carried out by the Harbour Master and Port Authority Office (KSOP) at each port, which also plays a role in approving vessel arrivals through the PKKA service.
Ship Obligations: SSP, SSO, and the ISSC
Every ship on international voyages of 500 GT and above, including passenger ships and mobile offshore drilling units, must carry a Ship Security Plan (SSP) approved by the flag administration or a recognized security organization. The SSP is a confidential document containing procedures for access control, monitoring of restricted areas, handling of cargo and ship's stores, and responding to security incidents. Because of its sensitivity, the SSP must not be shared with unauthorized parties and may be inspected by officials only under specific circumstances.
Shipping companies must designate a Company Security Officer (CSO), and each ship must have a Ship Security Officer (SSO) responsible for day-to-day implementation of the SSP. The SSO is usually a senior officer and must hold appropriate training as required under the STCW Convention. A change of SSO during crew change needs careful planning so that handover of duties, keys, and security documents is orderly and does not create a security gap.
Evidence of ship compliance is the International Ship Security Certificate (ISSC), issued after an initial verification and valid for a maximum of five years, with an intermediate verification between the second and third anniversary. Ships must also be fitted with a Ship Security Alert System (SSAS), a covert alarm that transmits a signal to the authorities when a threat occurs. In addition, ships must keep records of security activities such as drills, training, and changes in security level for the period required by the flag administration.
Port Facility Obligations: PFSO and PFSP
On the port side, every facility serving international shipping must undergo a Port Facility Security Assessment (PFSA) and hold a government-approved Port Facility Security Plan (PFSP). The facility must also appoint a Port Facility Security Officer (PFSO), who acts as the main link between the ship, the agent, and the authorities on security matters. The PFSO is responsible for access control to restricted areas, screening of persons and goods, and coordination when the security level is raised.
For ship operators, the fences, checkpoints, and strict personnel identification systems at a port are the visible form of the PFSP. Everyone boarding or leaving a vessel, including crew signing on and off, agent representatives, surveyors, and suppliers, must go through identification and logging procedures. This is why names, passport numbers, and arrival schedules of personnel should be sent to the agent early, so that access permits can be prepared before the vessel berths.
A port facility that fails to maintain compliance may lose its status, and ships from other countries may then treat calls at that port with additional precautions. This can affect the reputation and competitiveness of Indonesian ports among international operators. For that reason, port authorities regularly conduct audits and security exercises together with stakeholders, including ship agents and terminal operators.
The Three Security Levels and the Declaration of Security
The ISPS Code defines three security levels that reflect the degree of risk. Level 1 is the normal condition, where minimum protective measures are maintained at all times. Level 2 applies when there is a heightened risk of a security incident, and additional protective measures are maintained for that period. Level 3 applies when a security incident is probable or imminent, even if the specific target has not been identified, and requires specific, strict protective measures.
Security levels are set by governments, and a ship must comply when entering a port that applies a higher level than the one the ship is operating at. A ship may not operate at a lower level than the port it is visiting. Where the levels differ, or where a ship-to-ship activity involves risk, the two parties may agree on a Declaration of Security (DoS), a document that sets out the security responsibilities of each party during the activity.
In daily practice, a raised security level shows up as stricter checks at the gate, limits on the number of people boarding, and longer processing times. An experienced agent will inform the operator of any change in security level as early as possible and adjust the schedule for crew change, delivery of provisions, and surveyor visits. Building this extra time into your planning is far cheaper than paying daily charter costs caused by delays.
Pre-Arrival Information and Inspections at Indonesian Ports
Under SOLAS Regulation XI-2/9, a ship may be asked to submit security information before entering port, including proof of a valid ISSC, the security level at which the ship is operating, a list of ports visited during a specified earlier period, and any special measures taken during ship-to-ship activity. This information is usually submitted before arrival and coordinated by the agent together with the other documents filed for the vessel's arrival.
Upon arrival, KSOP officials and, where necessary, other security officers may carry out compliance checks. These usually include verifying the ISSC, checking whether the SSO is familiar with ship procedures, observing access control at the gangway, and reviewing records of security drills. Any non-conformity can lead to additional control measures, operational delays, or follow-up through the Port State Control mechanism, as discussed in our article on PSC regulations in Indonesia.
Ship security also intersects directly with immigration and crew change. Crew joining a ship must be verifiable by identity, and the crew list must match the documents submitted. Using a crew change service from an agent who understands port access procedures helps ensure that crew movements are safe, orderly, and in line with ISPS Code requirements at every terminal.
Practical Tips to Keep ISPS Compliance from Disrupting Operations
First, make sure the ship's ISSC remains valid and that the intermediate verification is not missed, because an expired or invalid certificate is the main cause of problems in port. Second, carry out security drills regularly and record the results neatly, since auditors will ask for these records. Third, make sure the SSO understands the SSP and can explain access control procedures to inspecting officers with confidence.
Fourth, send data on personnel who will board, such as joining crew, surveyors, and technicians, at least two to three days before arrival. Fifth, nominate one contact on board and one in the office who can be reached by the agent 24 hours a day for coordination when the security level changes. Sixth, keep digital copies of all compliance documents, except the confidential SSP, so they can be sent quickly on request. Additional services such as provisions and other arrangements can be coordinated through our support services.
Finally, avoid treating the ISPS Code as paperwork only. Genuine implementation, from gangway control to vigilance over baggage and stores, protects the ship, crew, and cargo from theft, smuggling, and more serious threats. Vessels with a good security record also tend to receive smoother treatment in port, so investment in compliance brings tangible benefits for operational efficiency.
FAQ
Q: Do all ships need an ISSC?
A: An ISSC is mandatory for ships on international voyages, namely passenger ships including high-speed craft, cargo ships including high-speed craft of 500 GT and above, and mobile offshore drilling units. Vessels operating only in domestic waters follow applicable national rules, although many operators still apply similar standards.
Q: How long is an ISSC valid?
A: An ISSC is valid for a maximum of five years and must undergo at least one intermediate verification between the second and third anniversary. Renewal verification is carried out before expiry so that the ship does not experience a gap in certification.
Q: What happens if a ship fails to meet ISPS Code requirements in Indonesia?
A: The authorities may apply additional control measures, delay operations, require corrective action, or in serious cases refuse the ship entry to port. The impact is usually delay and extra cost for the operator.
Q: Does the ISPS Code affect the crew change process?
A: Yes. Everyone boarding or leaving a vessel must pass port access control. For this reason crew lists, passports, and transfer schedules should be sent to the agent early so that terminal access permits can be arranged.
Conclusion
The ISPS Code is the foundation of global maritime security and is applied consistently in Indonesian ports. Vessels that understand the requirements for the SSP, SSO, ISSC, security levels, and access procedures will pass through arrival processes faster and with less risk. Good cooperation between ship, company, agent, and port authority is the key to successful implementation.
As a ship agent operating at nine major Indonesian ports, Nusantika helps operators coordinate documentation, port access, crew change, and other vessel needs in line with the rules. For arrival documentation, foreign crew, or logistics, our team is ready to assist, including through our maritime logistics service.
Need help with crew change in Indonesia? Contact Nusantika via WhatsApp — we are ready 24/7.