# Maritime Security Levels: ISPS Guide for Ship Suppliers

> What ISPS security levels 1, 2 and 3 change for chandlers, bunker suppliers and port agents, how to confirm the level before a port call, and what to do.

URL: https://vesselreach.si/blog/maritime-security-levels-port-supplier-guide | Published: 2026-11-08 | Guide | Topic: Segment playbooks (marine services)

## Key takeaways

- Level 1 keeps standard gate checks, ID verification and delivery booking, with escort rules at the facility's normal baseline.
- Level 2 adds extra inspections of people and goods, tighter access control and more notice before a vehicle or launch enters.
- Level 3 can restrict or suspend access and non-essential deliveries, with the port facility or authority directing what may proceed.
- There is no single global dashboard, so confirm the level with the PFSO, port authority or the ship's CSO, then confirm again on the day.
- The US Coast Guard added security conditions on vessels arriving from Somali ports, effective late October 2026, per Splash247.

## At a glance

- **What: What are the three ISPS security levels?** Level 1 keeps minimum protective measures at all times. Level 2 adds measures when a heightened risk of a security incident is identified. Level 3 applies the strongest measures when an incident is probable or imminent. ([Jurnal Penelitian Transportasi Laut](https://doi.org/10.25104/transla.v27i1.2417))
- **Who: Who sets and applies the level?** The relevant authority sets the level for a port facility or vessel. Facility security officers, ships' company security officers and port authorities apply it, and suppliers serving those facilities work within it. ([American Scientific Research Journal for Engineering, Technology, and Sciences](https://asrjetsjournal.org/American_Scientific_Journal/article/view/3354))
- **Where: Where has ISPS implementation been studied recently?** A 2025 study compared ISPS readiness across ten ASEAN countries, and a separate 2025 evaluation examined implementation at Cirebon port in Indonesia, covering document checks, inspections and drills. ([JPB Jurnal Patria Bahari (Politeknik Pelayaran Sorong)](https://ejournal.poltekpel-sorong.ac.id/index.php/jpb/article/view/181))
- **When: When did the US add conditions for ships calling at Somali ports?** According to Splash247, the additional security conditions on commercial vessels arriving in American waters took effect in late October 2026, after a finding that Somalia was not maintaining effective antiterrorism measures. ([Splash247](https://splash247.com/us-tightens-entry-rules-for-ships-calling-at-somali-ports/))
- **Why: Why does the level matter beyond the gate?** A 2020 IEEE Access study found vulnerabilities in maritime container terminal software and processes leave ports open to cyber-attack, so documents and confirmations sent electronically form part of the security surface. ([IEEE Access](https://doi.org/10.1109/access.2020.3008395))
- **How: How is compliance measured at a port facility?** A 2017 study noted that facilities typically measure ISPS compliance through periodic internal and external audits against the Port Facility Security Plan, rather than through a live performance measure. ([American Scientific Research Journal for Engineering, Technology, and Sciences](https://asrjetsjournal.org/American_Scientific_Journal/article/view/3354))

Maritime security levels are the three settings under the [ISPS Code](https://vesselreach.si/blog/port-security-officer-pfso-vs-cso-at-a-port-call) that tell a port, a ship and the businesses serving it how much protection is required right now. For a chandler, bunker supplier or port agent, the level decides how much lead time, paperwork and access control one delivery will need.

## What are the three maritime security levels?

Level 1 is normal operation with minimum protective measures kept all the time. Level 2 applies when a heightened risk of a security incident is identified and extra measures are added. Level 3 applies when an incident is probable or imminent, even if the target is not known, and the strongest measures are taken.

The level is set by the relevant authority, not by the supplier. The ISPS Code (the International Ship and Port Facility Security Code, which sets minimum security rules for ports and ships) applies it to port facilities and vessels alike.

A 2025 study in Jurnal Penelitian Transportasi Laut compared ISPS readiness across ten ASEAN countries and treated implementation as both a technical and an institutional challenge shaped by policy enforcement, infrastructure and personnel capacity ([Jurnal Penelitian Transportasi Laut](https://doi.org/10.25104/transla.v27i1.2417)). The same level can therefore look different at two ports in one region.

## What changes for suppliers at each level?

The higher the level, the shorter the window for a normal delivery: routine compliance at Level 1, tighter access, escort and documentation rules at Levels 2 and 3.

LevelWhat changes for a supplier

Level 1Standard gate checks, ID verification and delivery booking. Escort rules are the facility's normal baseline.
Level 2Extra inspections of people and goods, tighter access control, and more notice before a vehicle or launch is allowed in.
Level 3Restricted or suspended access, possible suspension of non-essential deliveries, and direction from the port facility or authority on what may proceed.

A 2025 evaluation of ISPS implementation at Cirebon port in Indonesia found that document checks, individual and goods inspections and drills were in place, but post-drill evaluation was not yet optimal ([JPB Jurnal Patria Bahari](https://ejournal.poltekpel-sorong.ac.id/index.php/jpb/article/view/181)). Expect the checks to be real, and expect the pace to slow when the level rises.

For [ship chandlers running stores deliveries](https://vesselreach.si/solutions/ship-chandlers), that usually means rebooking a slot rather than cancelling the order. [Bunker suppliers](https://vesselreach.si/solutions/bunker-suppliers) face the same squeeze on barge and truck windows, and [port agents](https://vesselreach.si/solutions/port-agents) carry the news between facility and vessel.

## How do you check a port's current security level before a call?

There is no single global dashboard, so the supplier confirms the level with the parties who control the facility.

1. Ask the PFSO (Port Facility Security Officer, responsible for the facility's security plan) or the port authority for the current level.
2. Ask the vessel's master or the CSO (Company Security Officer, the shore-side person responsible for the ship's security) what level the ship is operating at.
3. Check the agent's port call file and any notice from the port or terminal before dispatch.
4. [Confirm again on the day](https://vesselreach.si/blog/port-calls-meaning-stages-parties-and-supplier-work), because levels can change between booking and delivery.

A 2017 study in the American Scientific Research Journal for Engineering, Technology, and Sciences noted that port facilities typically measure ISPS compliance through periodic internal and external audits against the Port Facility Security Plan, rather than through a live performance measure ([ASRJETS](https://asrjetsjournal.org/American_Scientific_Journal/article/view/3354)). The supplier's own confirmation call is what closes that gap.

## Why the level is rising in more ports

Levels are not static. The US Coast Guard added additional security conditions on commercial vessels arriving in American waters after calling at Somali ports, effective in late October 2026, after determining that Somalia was not maintaining effective antiterrorism measures ([Splash247](https://splash247.com/us-tightens-entry-rules-for-ships-calling-at-somali-ports/), October 2026). A ship that called at a port with weak measures can face extra conditions at its next port, and the supplier meets that through the vessel's paperwork and the agent's checklist.

Digital systems carry the same logic. A 2020 study in IEEE Access assessed maritime container terminal software and found that vulnerabilities in the systems and processes used at ports leave them open to cyber-attack ([IEEE Access](https://doi.org/10.1109/access.2020.3008395)). A supplier sending documents, invoices or delivery confirmations electronically is part of that surface, so keep to approved channels.

## What the ISPS review means for suppliers

The International Association of Ports and Harbors is leading port industry efforts to ensure the ISPS Code remains fit for purpose, two decades after its introduction ([Hellenic Shipping News](https://www.hellenicshippingnews.com/iaph-leads-port-efforts-to-ensure-the-isps-code-is-fit-for-the-future/), November 2026). Any change to the code reaches suppliers through the port facility's security plan and the agent's instructions, so watch for updates from the port, not only from the ship.

Security drills themselves are under review. A 2024 study in Maritime Research and Technology explored integrating immersive technologies into tabletop security exercises to make scenarios more realistic for port facility teams, seafarers and authorities ([Maritime Research and Technology](https://doi.org/10.21622/mrt.2024.03.1.747)).

For the wider risk picture, the [maritime security risk checks for port suppliers](https://vesselreach.si/blog/maritime-security-risk-2026-what-suppliers-do) cover sanctions, ownership and war-risk screening. This post stays on the levels themselves.

## How VesselReach helps

Security levels change what a supplier can do on the day, but the sales work still starts with knowing which vessels are heading to your ports. VesselReach turns that into a workflow.

- **Vessel intelligence** shows vessels near your selected ports and scheduled or expected arrivals, which means you can prepare the delivery and the security questions before the ETA.
- **Decision-maker discovery** finds operations, procurement and fleet contacts at the company behind each vessel, which means you reach the person who can confirm access rules.
- **Multichannel outreach** on email, WhatsApp and phone keeps the conversation moving when a call has to be rebooked because the level changed.

Book a VesselReach demo to see how it works on your ports, with a 10-day free trial offered after the demo meeting.

## Key facts

- According to the ISPS Code, a port facility or vessel operates at one of three maritime security levels, and the level is set by the relevant authority, not by the supplier. ([Jurnal Penelitian Transportasi Laut](https://doi.org/10.25104/transla.v27i1.2417))
- According to a 2025 study in Jurnal Penelitian Transportasi Laut, ISPS readiness across ten ASEAN countries is shaped by policy enforcement, infrastructure and personnel capacity, so the same security level can look different at two ports in the same region. ([Jurnal Penelitian Transportasi Laut](https://doi.org/10.25104/transla.v27i1.2417))
- According to a 2025 evaluation of ISPS implementation at Cirebon port in Indonesia published in JPB Jurnal Patria Bahari, document checks, individual and goods inspections and drills were in place, but post-drill evaluation was not yet optimal. ([JPB Jurnal Patria Bahari (Politeknik Pelayaran Sorong)](https://ejournal.poltekpel-sorong.ac.id/index.php/jpb/article/view/181))
- According to a 2017 study in the American Scientific Research Journal for Engineering, Technology, and Sciences, port facilities typically measure ISPS compliance through periodic internal and external audits against the Port Facility Security Plan rather than through a live performance measure. ([American Scientific Research Journal for Engineering, Technology, and Sciences](https://asrjetsjournal.org/American_Scientific_Journal/article/view/3354))
- According to Splash247 in October 2026, the US Coast Guard added additional security conditions on commercial vessels arriving in American waters after calling at Somali ports, effective in late October 2026, after determining that Somalia was not maintaining effective antiterrorism measures. ([Splash247](https://splash247.com/us-tightens-entry-rules-for-ships-calling-at-somali-ports/))

## Frequently asked questions

### What are the three ISPS maritime security levels?

Level 1 is normal operation with minimum protective measures kept at all times. Level 2 applies when a heightened risk of a security incident is identified. Level 3 applies when an incident is probable or imminent, even if the target is unknown.

### Who sets the security level for a port facility?

The relevant authority sets the level, not the supplier or the vessel's agent. Suppliers confirm it with the Port Facility Security Officer or port authority, and separately with the ship's Company Security Officer.

### How does a ship chandler confirm the level before dispatch?

Ask the Port Facility Security Officer or port authority, check the agent's port call file and any terminal notice, then confirm again on the day of delivery because the level can change between booking and arrival.

### Why can a vessel face extra security conditions at its next port?

According to Splash247, the US Coast Guard added conditions on commercial vessels arriving in American waters after calling at Somali ports, effective late October 2026, after finding Somalia was not maintaining effective antiterrorism measures. ([Splash247](https://splash247.com/us-tightens-entry-rules-for-ships-calling-at-somali-ports/))

### How can a maritime supplier find vessels before the security level changes the plan?

VesselReach shows vessels near your selected ports and expected arrivals, identifies the company and decision-makers behind each vessel, and runs email, WhatsApp and phone outreach so access questions are settled before the ETA.

## Sources

1. [Comparative Readiness Assessment of ISPS Code Implementation in ASEAN Ports](https://doi.org/10.25104/transla.v27i1.2417), Jurnal Penelitian Transportasi Laut, 2025-06-30
2. [EVALUASI PENERAPAN INTERNATIONAL SHIP AND PORT FACILITY SECURITY (ISPS) CODE DI PELABUHAN CIREBON](https://ejournal.poltekpel-sorong.ac.id/index.php/jpb/article/view/181), JPB Jurnal Patria Bahari (Politeknik Pelayaran Sorong), 2025-05-27
3. [The Application of the Tripod Beta Approach in Assessing the Effectiveness of the Port Security Measures in Compliance to the International Ship and Port Facility Security Code](https://asrjetsjournal.org/American_Scientific_Journal/article/view/3354), American Scientific Research Journal for Engineering, Technology, and Sciences, 2017-10-22
4. [An In-Depth Security Assessment of Maritime Container Terminal Software Systems](https://doi.org/10.1109/access.2020.3008395), IEEE Access, 2020-01-01
5. [IAPH leads port efforts to ensure the ISPS Code is fit for the future](https://www.hellenicshippingnews.com/iaph-leads-port-efforts-to-ensure-the-isps-code-is-fit-for-the-future/), Hellenic Shipping News, 2026-11-06
6. [US tightens entry rules for ships calling at Somali ports](https://splash247.com/us-tightens-entry-rules-for-ships-calling-at-somali-ports/), Splash247, 2026-10-29

## More on this topic

Maritime security levels are the three ISPS settings that decide how much protection a port or ship needs at a given moment. For a supplier, the level changes access, paperwork and lead time, so confirm it with the PFSO or the vessel's CSO before dispatch. The level can rise quickly, and a ship's previous port can affect its next call. VesselReach helps suppliers see expected arrivals and reach the right operations and procurement contacts before the ETA.

What is ISPS in shipping? The ISPS Code is the International Ship and Port Facility Security Code, which sets minimum security rules for ports and ships. Who sets the security level? The relevant authority sets it for a port facility or vessel, so a ship chandler confirms the level with the Port Facility Security Officer or the vessel's Company Security Officer before dispatch. What changes at level 2? Extra inspections of people and goods, tighter access control and more notice before a vehicle or launch is allowed in. A ship's previous port can also add conditions at its next call.

The level is set by the relevant authority, not by the supplier, so a ship chandler should confirm it with the Port Facility Security Officer or the vessel's Company Security Officer before dispatch and again on the day. At Levels 2 and 3 the access, escort and documentation rules tighten and the window for a normal delivery closes, which is why the confirmation call matters more than the booking. A ship that has called at a port with weak measures can also face extra conditions at its next call.

The ISPS Code, the International Ship and Port Facility Security Code, sets the three maritime security levels that a port facility or vessel operates at, and the relevant authority sets the level. A ship chandler, bunker supplier or port agent confirms it with the Port Facility Security Officer or the vessel's Company Security Officer. Audits against the Port Facility Security Plan measure compliance, not live performance, so the supplier's own call counts. The US Coast Guard conditions for vessels arriving from Somali ports show how a previous call reaches the next one.

Related searches: maritime security levels; port security officer; port security unit; ship chandler; ship chandlery

---

VesselReach, built by CatalystIQ. CatalystIQ Data Classification and Analysis Services, Al Qusais, Dubai, P.O. Box 129882, United Arab Emirates. info@catalystiq.ae, +971 58 599 7894. Book a demo: https://vesselreach.si/#demo. Pricing: contact us for a quote (https://vesselreach.si/pricing).