Maritime Security Levels: ISPS Guide for Ship Suppliers

Maritime security levels are the three settings under the ISPS Code that tell a port, a ship and the businesses serving it how much protection is required right now. For a chandler, bunker supplier or port agent, the level decides how much lead time, paperwork and access control one delivery will need.

What are the three maritime security levels?

Level 1 is normal operation with minimum protective measures kept all the time. Level 2 applies when a heightened risk of a security incident is identified and extra measures are added. Level 3 applies when an incident is probable or imminent, even if the target is not known, and the strongest measures are taken.

The level is set by the relevant authority, not by the supplier. The ISPS Code (the International Ship and Port Facility Security Code, which sets minimum security rules for ports and ships) applies it to port facilities and vessels alike.

A 2025 study in Jurnal Penelitian Transportasi Laut compared ISPS readiness across ten ASEAN countries and treated implementation as both a technical and an institutional challenge shaped by policy enforcement, infrastructure and personnel capacity (Jurnal Penelitian Transportasi Laut). The same level can therefore look different at two ports in one region.

What changes for suppliers at each level?

The higher the level, the shorter the window for a normal delivery: routine compliance at Level 1, tighter access, escort and documentation rules at Levels 2 and 3.

LevelWhat changes for a supplier Level 1Standard gate checks, ID verification and delivery booking. Escort rules are the facility's normal baseline. Level 2Extra inspections of people and goods, tighter access control, and more notice before a vehicle or launch is allowed in. Level 3Restricted or suspended access, possible suspension of non-essential deliveries, and direction from the port facility or authority on what may proceed.

A 2025 evaluation of ISPS implementation at Cirebon port in Indonesia found that document checks, individual and goods inspections and drills were in place, but post-drill evaluation was not yet optimal (JPB Jurnal Patria Bahari). Expect the checks to be real, and expect the pace to slow when the level rises.

For ship chandlers running stores deliveries, that usually means rebooking a slot rather than cancelling the order. Bunker suppliers face the same squeeze on barge and truck windows, and port agents carry the news between facility and vessel.

How do you check a port's current security level before a call?

There is no single global dashboard, so the supplier confirms the level with the parties who control the facility.

1. Ask the PFSO (Port Facility Security Officer, responsible for the facility's security plan) or the port authority for the current level.
2. Ask the vessel's master or the CSO (Company Security Officer, the shore-side person responsible for the ship's security) what level the ship is operating at.
3. Check the agent's port call file and any notice from the port or terminal before dispatch.
4. Confirm again on the day, because levels can change between booking and delivery.

A 2017 study in the American Scientific Research Journal for Engineering, Technology, and Sciences noted that port facilities typically measure ISPS compliance through periodic internal and external audits against the Port Facility Security Plan, rather than through a live performance measure (ASRJETS). The supplier's own confirmation call is what closes that gap.

Why the level is rising in more ports

Levels are not static. The US Coast Guard added additional security conditions on commercial vessels arriving in American waters after calling at Somali ports, effective in late October 2026, after determining that Somalia was not maintaining effective antiterrorism measures (Splash247, October 2026). A ship that called at a port with weak measures can face extra conditions at its next port, and the supplier meets that through the vessel's paperwork and the agent's checklist.

Digital systems carry the same logic. A 2020 study in IEEE Access assessed maritime container terminal software and found that vulnerabilities in the systems and processes used at ports leave them open to cyber-attack (IEEE Access). A supplier sending documents, invoices or delivery confirmations electronically is part of that surface, so keep to approved channels.

What the ISPS review means for suppliers

The International Association of Ports and Harbors is leading port industry efforts to ensure the ISPS Code remains fit for purpose, two decades after its introduction (Hellenic Shipping News, November 2026). Any change to the code reaches suppliers through the port facility's security plan and the agent's instructions, so watch for updates from the port, not only from the ship.

Security drills themselves are under review. A 2024 study in Maritime Research and Technology explored integrating immersive technologies into tabletop security exercises to make scenarios more realistic for port facility teams, seafarers and authorities (Maritime Research and Technology).

For the wider risk picture, the maritime security risk checks for port suppliers cover sanctions, ownership and war-risk screening. This post stays on the levels themselves.

How VesselReach helps

Security levels change what a supplier can do on the day, but the sales work still starts with knowing which vessels are heading to your ports. VesselReach turns that into a workflow.

• Vessel intelligence shows vessels near your selected ports and scheduled or expected arrivals, which means you can prepare the delivery and the security questions before the ETA.
• Decision-maker discovery finds operations, procurement and fleet contacts at the company behind each vessel, which means you reach the person who can confirm access rules.
• Multichannel outreach on email, WhatsApp and phone keeps the conversation moving when a call has to be rebooked because the level changed.

Book a VesselReach demo to see how it works on your ports, with a 10-day free trial offered after the demo meeting.