On October 7, 1985, four armed men boarded the MV Achille Lauro in the Mediterranean, took 400 passengers hostage, and killed one American passenger before negotiations ended the standoff. The incident exposed that international shipping had no standardised security framework, even though vessels crossed borders and carried thousands of people and millions of tonnes of cargo. Ships sailed under no common security obligations beyond the goodwill of individual operators. Sixteen years later, the September 11, 2001, attacks and the bombing of the French tanker MV Limburg in October 2002 made it impossible to ignore this fact. Hence, the International Maritime Organisation adopted the International Ship and Port Facility Security (ISPS) Code in December 2002. From July 1, 2004, every vessel had to carry an approved Ship Security Plan. This article explains what the SSP is, how it is developed, who is responsible for it, and what it requires in practice. What Is the ISPS Code & Why Does the SSP Exist? Image Credits: Marine Insight. The ISPS Code includes a set of measures aimed at improving the security of ships and ports. It was adopted by the IMO at a Diplomatic Conference in December 2002 and entered into force on July 1, 2004. It is an intrinsic part of the SOLAS Convention under Chapter XI-2, and makes compliance a treaty obligation for all flag states party to SOLAS. The Code has two parts, A and B. Part A mentions the mandatory requirements; what ships, companies, and port facilities must do, while Part B explains how to meet those requirements. The Ship Security Plan is mandated under Part A, Section 9, meaning it is not optional, not discretionary, and not subject to individual interpretation by the shipowner. It applies to all passenger ships regardless of size, going on international voyages; all cargo ships of 500 gross tonnage and above on international voyages; and mobile offshore drilling units. A vessel below 500 GT on a domestic route is not required to comply, but many flag states extend the obligation to domestic shipping through national legislation. The SSP does not exist in isolation and sits within a broader security management framework that includes the Ship Security Assessment, the Company Security Officer, the Ship Security Officer, the International Ship Security Certificate, and the Ship Security Alert System, all of which are explained in this article. What Is a Ship Security Plan (SSP)? A Ship Security Plan is a confidential document which is made specifically for a vessel, as it lays down the processes and responsibilities by which the ship will meet the ISPS Code requirements at each of the 3 security levels. The plan is made by the Company Security Officer (CSO), based on the findings of the Ship Security Assessment. It is compulsory to write the plan in the working language of the vessel. If that language is not English, Spanish or French, then a certified translation into one of the three languages must be included. The Ship Security Plan can be maintained in electronic form, given that safeguards are in place to prevent its deletion, modification or destruction. Approval The SSP must be approved by the flag State Administration or by a Recognised Security Organisation (RSO) acting on behalf of the administration. Additionally, the RSO that conducted the Ship Security Assessment must not be the same organisation that approves the SSP. This measure helps prevent an organisation from validating its own risk