Port Facility Security Officer (PFSO): Role and ISPS Code Duties

Every port facility that serves ships on international voyages must appoint a Port Facility Security Officer (PFSO). The requirement comes from the International Ship and Port Facility Security Code (ISPS Code), which the International Maritime Organization (IMO) adopted in 2002 and which came into force on 1 July 2004.

What a PFSO does

The PFSO puts the Port Facility Security Plan (PFSP) into effect and keeps it up to date. The plan sets out the security measures and procedures the facility follows to protect itself against threats.

The PFSO also works with the other security officers the Code creates: the ship security officer (SSO) on each visiting vessel and the company security officer (CSO) ashore, so that the measures on ship and shore fit together. When a security incident happens at the facility, the PFSO coordinates the response.

Qualification and training requirements for PFSOs vary between countries and between facilities. Most countries expect a PFSO to understand maritime security well and to be able to run effective security measures day to day.

Why the ISPS Code exists

The attacks of 11 September 2001 showed how exposed global transport was, shipping included. The IMO, a specialized agency of the United Nations, led the work that produced the ISPS Code in response.

The Code aims to reduce maritime security risks and to prevent terrorist acts that could disrupt world trade. It sets up a framework for cooperation between governments, their agencies, local authorities and the shipping and port industries, with a common method for assessing security and a requirement for proportionate security measures worldwide. Its main goal is to detect threats early and prevent incidents that affect ships or port facilities in international trade.

Who the ISPS Code applies to

The Code applies worldwide to these ships on international voyages:

• passenger ships, including ferries
• cargo ships of 500 gross tons and above, including container ships, bulk carriers and tankers
• mobile offshore drilling units (MODUs)

It also applies to every port facility that serves those ships. Such facilities must have security plans and measures for the risks posed by the ships and cargo they handle.

Part A: the mandatory requirements

The ISPS Code has two parts. Part A is mandatory, and Part B gives guidance on how to meet Part A.

Security assessment

Ships and port facilities must carry out a security assessment to identify possible threats and decide what measures will prevent incidents.

Security plan

The assessment leads to a security plan. A ship's plan must be approved by its flag state, and a port facility's plan sets out the preventive measures the facility will take.

Security officers

Each ship must have a designated ship security officer responsible for its security. Each shipping company must appoint a company security officer to oversee the security of its fleet and its compliance with the Code. Each port facility must appoint a PFSO to implement and maintain its security plan.

Security levels and procedures

The Code sets measures for three security levels, with level 3 the highest. The measures cover access control, monitoring of the area around the ship or facility, and the handling of cargo, ship stores and personnel.

Part B: guidance

Part B is not mandatory. It sets out good practice for training security personnel, recommends practical security measures for each security level, and provides templates for security assessments and checklists for developing security plans.

How compliance is checked

Flag states and port states share enforcement of the ISPS Code. A ship shows that it complies by carrying a valid International Ship Security Certificate (ISSC), issued by its flag state or a recognized security organization (RSO). A port facility receives a Statement of Compliance of a Port Facility (SoCPF) from its national authority or an RSO approved to act for it.