Every vessel operating under the ISPS Code is expected to be able to say who came aboard, when they arrived, when they left, and what checks were carried out before they boarded. On most ships that expectation is met by the gangway visitor log book. This article covers where the requirement actually comes from, what the record needs to show, and what a Port State Control officer or Port Facility Security Officer asks to see.
Who the ISPS Code applies to
The International Ship and Port Facility Security (ISPS) Code sits under SOLAS Chapter XI-2 and has been in force since July 2004. It applies to passenger ships and to cargo ships of 500 GT and over on international voyages, and to the port facilities serving them. Commercially operated yachts of 500 GT and over fall within that scope, and flag administrations apply security requirements to large charter yachts through their own codes. Private yachts not engaged in trade are generally outside the mandatory scope, but many operate visitor controls voluntarily, both because ports expect it and because knowing who is aboard is a safety matter before it is a compliance one.
Where the visitor log requirement comes from
The Code never uses the words "visitor log". What it requires is access control. Part A of the Code requires every ship to carry an approved Ship Security Plan (SSP), and that plan must set out the measures the ship takes to prevent unauthorised access to the ship and to restricted areas on board. Part B, the guidance half of the Code, describes what those measures look like in practice at each security level, including checking the identity of all persons seeking to board the ship and confirming their reason for doing so.
The visitor log is how a ship demonstrates that those measures are actually being carried out. Nearly every approved SSP requires a record of visitors at the point of access, which in practice means the gangway. So the obligation is real, but it lives in your Ship Security Plan rather than in a numbered paragraph of the Code, and an inspector treats the log as the evidence that your plan is being followed.
What the record needs to show
A visitor record that satisfies the intent of the SSP shows, for every person who is not crew:
- Who they are: name, and the company or organisation they represent
- Why they are aboard: the purpose of the visit, or the person hosting them
- When they boarded and when they left: both timestamps, not just the arrival
- What was checked: whether identification was verified, and whether a search was carried out and by whom, where the security level called for one
The weaknesses of the paper version are well known to anyone who has stood a gangway watch. Entries are illegible, departures are not filled in, there is no photograph, there is one copy and it lives at the gangway, and searching it for "everyone from that contractor last March" means turning pages. None of that fails an inspection on its own, but each one makes the record weaker as evidence.
The three security levels at the gangway
The Code defines three security levels, set by the flag or the port facility, and the SSP must state what the ship does differently at each:
- Security Level 1 is normal operation: the minimum protective measures, maintained at all times. Identity checks on persons seeking to board are part of the baseline guidance.
- Security Level 2 is heightened risk: additional measures for as long as the elevated risk lasts, typically including a higher rate of screening and searches of persons boarding.
- Security Level 3 is exceptional: the measures applied when a security incident is probable or imminent, typically including search of every person seeking to board.
The visitor record is what shows, after the fact, that the ship's response at each level matched what the SSP says. If the vessel was at Level 2 for a port call, the log should show the additional checks that Level 2 required.
How long to keep it
Part A of the Code requires security records to be kept for at least the minimum period specified by the ship's Administration, so retention is a flag matter rather than a single global figure. In practice, keep visitor records at least as long as your SSP or flag specifies, and longer if charter or insurance requirements ask for it. A digital record makes long retention free; a shelf of filled log books does not.
What an inspector asks for
During a Port State Control inspection or a port facility's verification, the questions about visitors are usually concrete: who was aboard on a given date, show me the record of this contractor's visits, who carried out the search on this person, was the agreement signed before they boarded. What the inspector is testing is whether the access control measures in the SSP are practised rather than laminated. A record that can answer a date-range question in seconds, with photographs and both signatures, closes that line of questioning quickly.
Keeping the log digitally
The Muster App keeps the visitor record as a product of the check-in itself: the visitor signs in on the iPad at the gangway with a photo, a named host and a signed agreement, ID checks and searches follow the security level in force, and the live board shows everyone aboard right now. The history is searchable by name, company, host or date range, and it exports as a PDF showing visitor, arrival, departure, who searched them and both signatures. The visitor management page covers the whole flow.
What to read next
The drill-side equivalent of this article is SOLAS and ISM drill requirements, which covers what the ship must run and record for musters and drills. For the screen the watchkeeper uses day to day, see the visitor board.