The main reason for the ISPS code is to improve security across all shipping ports. The code also ensures the safety of ships and their crew members as they navigate international waters with cargo.

The ISPS code functions by delegating responsibilities to all parties involved in the shipping industry, including government regulatory agencies, shipping companies, port operators, and the general shipping staff. Some of its responsibilities include detecting threats and raising alert levels while enforcing strict preventative measures across all ports and shipping personnel.

There are three security levels within the ISPS code, they are:

Security Level One (Regular)

Level one is the standard security protocol for the normal operations of ships and port facilities. At this level, threats are minimal or even negligible, and only minimum security measures must be maintained regularly by all ISPS-compliant ports and ships.

Also, the ports and ships can implement security measures according to their unique security framework, while keeping the "No Access" areas under surveillance round-the-clock and monitoring the loading and unloading of cargo.

Security Level Two (Heightened)

Level two ISPS activates when there is a perceived heightened security risk within the port facility or ship. At this level, additional security measures must be implemented and maintained at all times until the increased threat is averted.

These extra security measures include increased lookouts in “No Access” areas, use of security cameras and metal detectors, preparation for full or partial security sweep within and around the port’s perimeter and ship, and reinforced access control using security escorts aboard ship.

Security Level Three (Exclusive)

This level is case-specific, hence the "exclusive" designation. Often, ports and ship operations will cease for a full investigation and assessment of the security risk. Stricter security measures get deployed within the threat window, such as limited access to controlled access points, frequent security checks and rounds by both port and ship owners, and access to port and ship only granted to authorized personnel or responders in the event of an attack.

In the level three code, it may be impossible to identify the specific target of the threat. However, level three comes into play when there is credible intelligence from a reputable source that there is a potential security incident within the ship or port facility.

ISPS is mandatory for all ships and ports operating under contracting governments or parties of the Safety Of Life At Sea (SOLAS) International Convention. The ISPS code is part of the SOLAS Convention, enshrined in Chapter XI - 2/3 of the maritime treaty. However, part A of the ISPS code is mandatory, while part B is only recommendatory as it contains guidelines on the best measures to comply with the code.

There are several security measures that all complaint parties must adhere to under the ISPS code. They include:

• All ships must have a security alert system to detect security threats.
• Every ship should have a security official who knows his responsibility according to the security level of the ISPS code.
• All contracting government agencies, port state officials, onboard officials, shipping and port authorities, and local authorities should comply with their respective roles according to the ISPS code.
• Ports and ship authorities should ensure they monitor cargo and personnel activities regularly.
• Ports and ships must obtain international data of security threats to ships and ports, and come up with solutions to avert them.
• The security data obtained must be shared with the general public, ship owners and merchants, and International Port Authorities.
• Ports and ship authorities should evaluate security leaks within their facilities and resolve them to make the industry safer for all personnel.