RSO stands for Recognized Security Organization. In shipping, it is an organization a government authorizes to do ship or port security work under the ISPS Code.
After the 9/11 attacks, IMO adopted the International Ship and Port Facility Security (ISPS) Code. It became mandatory on 1 July 2004 through SOLAS Chapter XI-2, and it allows governments to hand some of its work to RSOs.
This guide is written for ship’s officers, ship security officers and port staff. It covers what an RSO may and may not do, who acts as an RSO, how ships are certified, and what inspectors check.
What Is a Recognized Security Organization (RSO)?
An RSO is an organization a government authorizes to approve, verify or certify ship and port security under the ISPS Code. The formal definition reads:
A Recognized Security Organization (RSO) is an organization with relevant security skills and knowledge of ship and port operations that is authorized to carry out an assessment, verification, approval, or certification activity required by SOLAS chapter XI-2 or part A of the ISPS Code.
That definition comes from SOLAS regulation XI-2/1.1.16. An RSO acts for the flag state (the Administration) on ship matters, or for the port state’s Designated Authority on port facility matters.
Most ship RSOs are classification societies, such as DNV, ABS, Lloyd’s Register, Bureau Veritas and ClassNK. Port facility RSOs are often specialist security consultancies approved by the national authority.
What Can a Government Authorize an RSO to Do?
A Contracting Government may authorize an RSO to undertake certain security-related activities.
ISPS Code Part B, section 4.3, lists three main ones:
- Approval of ship security plans, or amendments to them, on behalf of the Administration.
- Verification and certification of ships’ compliance with SOLAS Chapter XI-2 and Part A of the ISPS Code, on behalf of the Administration.
- Port facility security assessments required by the Contracting Government.
In practice, a flag state’s RSO approves the ship security plan, audits the ship, and issues the International Ship Security Certificate (ISSC). The authorization is set out in a formal written agreement between the government and the RSO.
What Can an RSO Not Do?
ISPS Code Part A, section 4.3, keeps six duties with the government. They cannot be delegated to an RSO:
- Setting the applicable security level.
- Approving a port facility security assessment and its amendments.
- Deciding which port facilities must appoint a port facility security officer.
- Approving a port facility security plan and its amendments.
- Exercising control and compliance measures under SOLAS regulation XI-2/9.
- Setting the requirements for a Declaration of Security.
An RSO also cannot approve its own work. IMO guidance, MSC/Circ.1074, states that an RSO may never approve, verify or certify a security assessment or plan that it prepared itself.
What Competencies Must an RSO Have?
ISPS Code Part B, section 4.5, lists the competencies a government should check before authorizing an RSO. They cover security expertise, ship and port knowledge, risk assessment and handling of sensitive information.
- Expertise in relevant aspects of security.
- Knowledge of ship and port operations, including ship design and construction for ship work, and port design and construction for port work.
- Capacity to assess security risks in ship and port operations, including the ship/port interface, and how to reduce them.
- Ability to maintain and improve the expertise of its personnel.
- Ability to monitor the continuing trustworthiness of its personnel.
- Ability to protect security-sensitive information against unauthorized disclosure.
- Knowledge of SOLAS Chapter XI-2, the ISPS Code and relevant national and international law.
- Knowledge of current security threats and patterns.
- Knowledge of how to recognize and detect weapons, dangerous substances and devices.
- Knowledge of how to recognize, on a non-discriminatory basis, people likely to threaten security.
- Knowledge of techniques used to get around security measures.
- Knowledge of security and surveillance equipment and its limits.
MSC/Circ.1074 adds practical conditions. An RSO should have qualified staff, procedures in English, a code of ethics, and an independently certified quality system.
What Is the Difference Between an RSO, an RO and a Private Security Company?
An RSO handles ISPS security work, and a recognized organization (RO) carries out statutory surveys under the RO Code. A private maritime security company supplies guards. The three are often confused.
| Body | Legal basis | What it does |
|---|---|---|
| Recognized Security Organization (RSO) | SOLAS XI-2 and the ISPS Code | Approves ship security plans, verifies ships, issues ISSCs, conducts port facility security assessments |
| Recognized Organization (RO) | SOLAS I/6 and the RO Code (MSC.349(92)) | Statutory surveys and certificates, such as SOLAS, MARPOL and Load Line, for the flag state |
| Private maritime security company (PMSC) | Commercial contract with the shipowner, where the flag state allows it | Armed or unarmed guards for transits through high-risk areas |
A classification society is often both an RO and an RSO for the same flag, under two separate authorizations. Neither role includes guarding ships.
How Is a Ship Certified Under the ISPS Code?
A ship is certified in five steps: security assessment, security plan, plan approval, an on-board audit, and issue of the International Ship Security Certificate (ISSC).
- Ship security assessment (SSA): done by the company security officer to identify threats and weak points.
- Ship security plan (SSP): written from the assessment and approved by the Administration or its RSO.
- Initial verification: an audit on board confirms the plan is in place and the crew can apply it.
- ISSC: valid for up to five years, with an intermediate verification between the second and third anniversary.
- Interim ISSC: valid for up to six months, for a new ship or a ship changing flag or company.
The structure mirrors the ISM Code, where the company holds a Document of Compliance and each ship a Safety Management Certificate. The same RSO or RO often does both audits on one visit.
What Are the ISPS Security Levels?
The ISPS Code has three security levels, set by the Contracting Government: level 1 (normal), level 2 (heightened) and level 3 (exceptional). The ship security plan sets out measures for each level.
| Level | Meaning | Typical measures |
|---|---|---|
| 1 | Normal: minimum protective measures at all times | Access control, restricted areas, monitoring of deck and surroundings |
| 2 | Heightened: increased risk for a period | Extra watches, more searches of people and baggage, limited access points |
| 3 | Exceptional: incident probable or imminent | Specific measures ordered by the authorities; operations may be suspended |
A ship must comply at least with the level set by the port state when in port. Threats at sea, such as pirate attacks, are handled under the plan with industry guidance and, in some areas, armed guards.
What Do PSC Inspectors Check Under the ISPS Code?
Port state control officers check ISPS compliance under SOLAS regulation XI-2/9. They start with the certificate and records and look at access control on arrival.
- Valid ISSC or interim ISSC, matching the ship’s name and flag.
- A named ship security officer who knows the plan and their duties.
- Security drills at least every three months, and records of them.
- Records of the last ten port calls, with the security level at each and any Declarations of Security.
- Ship Security Alert System (SSAS) tested and the test recorded.
- Access control at the gangway: visitors identified, logged and escorted.
- Restricted areas, such as the bridge and engine room, locked or watched.
The ship security plan is confidential. Inspectors may see only limited parts of it, and only when they have clear grounds to believe the ship is not compliant.
Common findings are no drill records, untested SSAS, and an unmanned gangway. In the United States, ISPS is applied through the Maritime Transportation Security Act.
Related Topics
Frequently Asked Questions
What is the full form of RSO in shipping?
RSO stands for Recognized Security Organization. It is an organization authorized by a government to carry out ISPS Code security work on its behalf.
What does an RSO do on a ship?
It approves the ship security plan, audits the ship’s security arrangements, and issues the International Ship Security Certificate for the flag state.
Who can be an RSO?
Any organization the government authorizes after checking its competence. For ships, RSOs are mostly classification societies; for ports, often security consultancies.
Can an RSO set the security level?
No. Setting the security level is one of six duties under ISPS Part A, section 4.3, that a government cannot delegate to an RSO.
What is the difference between an RSO and an RO?
An RSO does ISPS security work. An RO does statutory surveys and certificates under the RO Code. One class society can hold both authorizations.
Do RSOs provide armed guards?
No. Armed guards come from private maritime security companies hired by the shipowner. RSOs do assessment, approval and certification work.
How long is an ISSC valid?
Up to five years, with an intermediate verification between the second and third anniversary. An interim ISSC is valid for up to six months.
When did the ISPS Code come into force?
On 1 July 2004, through SOLAS Chapter XI-2. It was adopted in December 2002 after the 9/11 attacks.
- Great Lakes Maritime Academy: Programs, Cost and Admission – October 14, 2026
- Bunker Delivery Note (BDN): Contents, MARPOL Rules and Checks – October 11, 2026
- Oil Record Book: Part I and Part II Entries, Rules and PSC Checks – October 11, 2026
