Guidelines for Ship and Port Security Certificates

Legal basis and related mandates

The circular is issued pursuant to E.O. No. 277 and E.O. No. 311.
It is issued in reference to Chapter XI-2 IMO-SOLAS 1974 and the IMO-ISPS Code.
It cites DOTC Department Order No. 2004 (May 28, 2004).
It is grounded on the National Security Program for Sea Transport and Maritime Infrastructure (the Programme).
It is also grounded on OTS-Transportation Security Regulation (OTS-TSR) No. 011-2007 dated October 1, 2007.

Rationale and intent of the guidelines

The circular prescribes updated implementing guidelines for the approval of security plans and issuance of International Ship Security Certificate (ISSC) and National Ship Security Certificate (NSSC).
The circular prescribes implementing guidelines for issuance of Statement of Compliance of Port Facility (SoCPF) and Statement of Compliance of Security Regulated Port (SoCSRP).
The guidelines are designed to support effective, efficient, and sustained implementation of security measures and security plans for covered maritime entities.

Core scope and coverage

The circular applies to a Philippine-registered ship engaged in international and/or national (coastwise/domestic) voyage as covered by the ISPS Code and the Programme.
The circular applies to a Philippine Port facility that caters to ships engaged in international and/or national (coastwise/domestic) voyage.
The circular applies to a Philippine Security Regulated Port (SRP) requiring additional security measures for ships.
The issuance and compliance processes cover certificates and statements of compliance issued by OTS for the ship/port/security-regulated-port security frameworks under the Programme and ISPS requirements.

Definitions and regulated roles

Administration refers to the Office for Transportation Security (OTS) in implementing the ISPS Code, Chapter XI-2 of SOLAS of 1974.
Designated Authority refers to OTS in implementing the National Security Programme for Sea Transport and Maritime Infrastructure.
Company Security Officer (CSO) is the person designated by the company to carry out a Ship Security Assessment (SSA), ensure a Ship Security Plan (SSP) is developed, submitted for approval, and implemented/maintained, and perform liaison with the Port Facility Security Officer (PFSO) and Ship Security Officer (SSO).
Ship Operator is the person/company that assumes responsibility for the operation of the ship.
Ship Security Officer (SSO) is the person onboard the ship accountable to the master, designated by the company as responsible for ship security, including implementation and maintenance of the security plan.
Ship Security Assessment (SSA) identifies ship features, existing security measures and procedures, shipboard operations, potential threats, and vulnerabilities.
Ship Security Plan (SSP) is the plan to apply shipboard security measures to protect persons onboard, cargo, and ship stores from security incident risk.
International Ship Security Certificate (ISSC) is a certificate issued by OTS to a Philippine-registered ship engaged in international voyage, stating compliance with maritime security measures and that associated security equipment is in satisfactory condition and fit for intended service.
National Ship Security Certificate (NSSC) is a certificate issued by OTS to a Philippine-registered ship for coastwise voyage, stating compliance with maritime security measures and that associated security equipment is in satisfactory condition and fit for intended service.
Port is a harbor with facilities for ships to moor and to load or unload cargoes and/or passengers.
Port Facility is a location where the ship/port interface takes place, including harbor, anchorages, waiting berths, and approaches from seaward, as appropriate.
Port Facility Security Assessment (PFSA) is a risk analysis of all aspects of port facility operations to determine parts more susceptible and/or likely to be subject of attack.
Port Facility Security Plan (PFSP) is developed based on approved risk/vulnerability assessment to apply measures protecting the port facility and the ship, persons, cargoes, and ship stores within the 500-meter maritime exclusive zone from security incident risk.
Port Facility Security Officer (PFSO) is the person designated to develop, implement, revise, and maintain the port facility security plan and to liaise with the SSO and CSO.
Statement of Compliance of a Port Facility (SoCPF) is a document issued by OTS to a port facility with an approved PFSP.
Security Regulated Port (SRP) is an area with two or more port facilities intended for use in connection with movement, loading, unloading, maintenance, or provisioning of ships that requires additional security measures for ships engaged in coastwise and international voyage.
Security Regulated Port Security Assessment (SRPSA) is a risk analysis of the security regulated port operation to determine parts more susceptible and/or likely to be subject of attack.
Security Regulated Port Security Plan (SRPSP) is developed to apply measures protecting the security regulated port and the ships, persons, cargoes, and ship stores from security incident risk.
Statement of Compliance of a Security Regulated Port (SoCSRP) is a document issued by OTS to a security regulated port with an approved SRPSP.
Recognized Security Organization (RSO) is an organization with appropriate maritime security qualification/expertise authorized by OTS to perform certain security-regulated activities.
Transportation Security Officer (TSO) is a person trained, skilled, and certified by the Administration to conduct security certification, audit, and/or inspection.
Verification Audit confirms ship, port facility, and/or security regulated port security systems and associated security equipment comply with ISPS Code and the Programme requirements.
Initial Verification Audit is a comprehensive undertaking to ensure the ship’s security system and required equipment are in satisfactory condition and fit for intended service.
Intermediate verification audit ensures the ship’s security system and required equipment remains in satisfactory condition and fit for intended service.
Renewal verification audit ensures the ship’s security system and required equipment fully complies with maritime security measures and the approved SSP, remains in satisfactory condition, and fits intended service.

Ship security certification procedures

For international ships, the CSO shall submit the SSA to the Administration/Authorized Agent for evaluation and approval.
An RSO may submit the SSA to the Administration/Authorized Agent when the ship operator/owner enlists an RSO to prepare the SSA.
The approved SSA is the basis for preparing the appropriate SSP.
If an RSO assists in preparing an SSP, that RSO is not authorized as an authorized Agent of the Administration to approve that particular SSP.
After SSP approval by the Administration or Agent, an initial verification audit is conducted to verify the ship’s Security Plan.
If major non-conformances are noted during the initial verification audit, the ship must rectify/comply within 15 days from notice.
After compliance, the Administration or Agent issues the ISSC in compliance with ISPS Code requirements.
For renewal, when the renewal verification audit is completed within three (3) months before the expiry date of the existing certificate, a new ISSC may be issued and is valid from the date of completion of renewal verification to a date not exceeding five (5) years from the date of expiry of the existing certificate.
During the certificate’s validity, at least one (1) intermediate verification audit is conducted preferably between the 2nd and 3rd anniversary dates, and the Administration may order additional verification during the certificate’s lifetime.
For national/domestic (coastwise) ships, the CSO or RSO authorized by the ship owner/operator shall submit the SSA to OTS for approval.
The approved SSA is the basis for the preparation of the appropriate SSP for national/domestic ships.
The SSP is submitted to OTS for evaluation and approval using the Programme template together with an Oath/undertaking by the CSO/authorized representative, attested by the owner/operator, that security equipment/undertakings are in place using the applicable FORM (oath/undertaking template designated as FORM aAa).

Port compliance and SRP certification procedures

For port facility (PF) and security regulated port (SRP), the PSO or PFSO shall submit to OTS for evaluation and approval the SRPSA or PFSA, as applicable.
The OTS-approved SRPSA/PFSA is the basis for developing the respective SRPSP/PFSP.
The PSO and PFSO shall submit to OTS the SRPSP or PFSP, respectively, following the Programme template for evaluation and approval.
Upon approval of SRPSP & PFSP, the PSO or PFSO shall submit the required undertaking as a procedural requirement prior to issuance of the corresponding certificate of compliance (SoCPF and SoCSRP).
The SoCPF and SoCSRP are issued to the corresponding requirements of the Programme, and each certificate is valid for five (5) years.
The undertaking attached for SRPO and PFSO follows the designated FORM attachments labeled as FORMS B & C for SRPO and PFSO, respectively.

Common renewal/verification rules and interim certification

If a verification audit is completed within three (3) months before expiry, a new NSSC, SoCSRP, or SoCPF is issued and is valid from the date of completion of renewal verification to a date not exceeding five (5) years from expiry.
If the Administration finds that the existing Security Plan is no longer responsive, the Administration shall not issue a new NSSC, SoCSRP, or SoCPF as applicable.
During validity of NSSC/SoCSRP and SoCPF, at least one (1) verification audit is conducted preferably between the 2nd and 3rd anniversary dates.
The Administrator may direct additional verification audits in the exigency of service during the certificate/statement lifetime.
For deficiencies observed during audits, the concerned regulated port or port facility is given 30 days from notice to rectify the deficiency.
Failure to rectify deficiency may result in recall of approval of the security plan and the consequential cancellation of the issued certificate.
The OTS may issue interim compliance certification for covered categories—Ship (International & National/Domestic respectively), Port Facility, and Security Regulated Port—for a period of six (6) months, subject to specified conditions.
Interim certification for an international ship covers: delivery or prior to entry/reentry into service; changing flag; assumption of responsibility by a company previously not operating the ship; and cases of ISSC that expired or is expiring provided at least one (1) intermediate audit was conducted during the certificate’s validity.
Interim certification for a national ship (domestic/coastwise voyage) covers: an expired NSSC with pending renewal application; or a NSSC expiring and on travel, provided at least one (1) verification audit was conducted during the certificate’s validity.
Interim certification for a port facility covers: another company/person assumes port facility operation; and SoCPF has expired or is expiring provided at least one (1) verification audit was conducted during the SoCPF’s validity.
Interim certification for a security regulated port covers: another company or government agency assumes SRP operation; and SoCSRP has expired or is expiring provided at least one (1) verification audit was conducted during SoCSRP validity.
A special interim ISSC may be issued to a domestic ship on a special/limited international voyage/engagement with prior MARINA clearance/approval.

Audit authority and schedules

The circular requires that audits be conducted at intervals specified by the Administrator to ensure effective, efficient, and sustained implementation of security measures and/or security plans on board ships, regulated ports, and port facilities.
For international ships, initial, intermediate, and renewal verification audits ensure the ship’s security system and required security equipment are in satisfactory condition, remain satisfactory, and/or fully comply with maritime security measures and the approved SSP, depending on the audit type.
For international ships, additional and other unannounced verification audits are conducted if the Administrator deems it warranted and necessary to check the effective, efficient, and sustained implementation of the ISPS Code.
For national ships (domestic/coastwise), port facility, and security regulated port, a verification audit is a complete determination by OTS of compliance of security systems and associated security equipment with ISPS Code and the Programme, as applicable.
For national ships and covered facilities/ports, at least one (1) verification audit is conducted by the Administration during the lifetime/validity of the Security Certificate or Statement of Compliance.
For national ships and covered facilities/ports, additional and other unannounced verification audits are conducted if the Administrator deems it warranted and necessary to check effective, efficient, and sustained implementation of the Programme.

Effectivity and duration

The guidelines take effect on November 15, 2013 in Pasay City, MM, Philippines.
The circular provides that interim compliance certifications last six (6) months for covered categories.
The circular provides that SoCPF and SoCSRP certificates are valid for five (5) years after issuance following approval and submission of required undertakings.