fThe Maritime Transportation Security Act (MTSA) is the US federal law that sets security requirements for ships, port facilities and their workers. It was signed on 25 November 2002 and is enforced by the US Coast Guard.
The MTSA applies to US-flag ships, foreign ships calling at US ports and waterfront facilities in the United States. It is the US counterpart of the IMO’s ISPS Code and introduced the TWIC identity card for port workers.
What Is the Maritime Transportation Security Act of 2002?
The MTSA, Public Law 107-295, created the US maritime security regime after the 11 September 2001 attacks. Its main provisions sit in Title 46 of the US Code, Chapter 701, and its rules in 33 CFR Parts 101 to 106.
| 33 CFR Part | What it covers |
|---|---|
| 101 | General provisions, MARSEC levels, reporting and, since 2025, cybersecurity |
| 103 | Area maritime security: committees and plans for each port area |
| 104 | Vessel security |
| 105 | Facility security |
| 106 | Outer Continental Shelf facility security |
Before 2002, port security relied on older laws such as the Magnuson Act of 1950 and the Ports and Waterways Safety Act of 1972. These gave the Coast Guard powers, but no system of mandatory security plans.
Why Was the MTSA Needed?
After 9/11, US ports were seen as an open door. Most US overseas trade by volume moves through seaports, and in 2002 few terminals had controlled access or security plans.
Congress passed the MTSA in the same year IMO adopted the ISPS Code, in December 2002. Both entered into force on 1 July 2004, so the US and international regimes were built to work together.
Which Vessels and Facilities Does the MTSA Cover?
The MTSA covers most commercial ships trading in US waters and the waterfront facilities that serve them. Small recreational boats and uninspected fishing vessels are outside its scope.
| Covered | Examples |
|---|---|
| Ships on international voyages | Mechanically propelled vessels over 100 gross register tons, US or foreign flag |
| Passenger vessels | Ships certificated to carry more than 150 passengers, cruise ships, ferries |
| Hazardous cargo ships | Vessels carrying certain dangerous cargoes, including many IMDG cargoes |
| Towing vessels | Towboats over 8 m moving barges with regulated cargo |
| Facilities | Terminals, cruise and ferry terminals, shipyards and plants that receive regulated vessels |
| Offshore facilities | Outer Continental Shelf platforms above set production or crew thresholds |
A tanker, bulk carrier or container ship on a normal trade meets these thresholds. The full range of cargo ship types calling at US ports is covered, as are the thousands of berths in the largest US container ports.
Does the MTSA Apply to Foreign Ships?
Yes. Any foreign ship in US waters that meets the thresholds must comply. A foreign SOLAS ship with a valid International Ship Security Certificate from its flag State is treated as meeting the US vessel security rules.
This means foreign ships do not need a Coast Guard-approved vessel security plan. They must still follow MARSEC levels, Declarations of Security and Coast Guard directions while in US waters.
What Are the Main MTSA Requirements?
The MTSA rests on five requirements: security assessments and plans, security officers, MARSEC levels, training and drills, and controlled access. They mirror the ISPS Code, with extra US rules on identity and reporting.
Vessel and Facility Security Plans
Each US vessel and facility must carry out a security assessment and keep a security plan approved by the Coast Guard. Under the ISPS Code, ship plans may be approved by a recognized security organization; for US-flag ships the Coast Guard keeps that role.
The plan must reflect the actual ship or terminal: its layout, access points, restricted areas, cargo and crew. A generic template fails inspection.
Security Officers
Every plan names a Company Security Officer and a Vessel Security Officer, or a Facility Security Officer for terminals. The ship security officer holds a certificate under STCW Regulation VI/5, which the US accepts for foreign ships.
MARSEC Levels
The Coast Guard sets the Maritime Security (MARSEC) level for each port. Level 1 is normal, Level 2 a heightened threat and Level 3 a probable or imminent incident, matching ISPS security levels 1 to 3.
A ship arriving in a US port must operate at the port’s MARSEC level or higher. The bridge watch handover before arrival should include the next port’s current level.
Declaration of Security
A Declaration of Security (DoS) is an agreement between ship and facility that sets out who does what during a port call. It is required at higher MARSEC levels and in set cases, such as cruise ships and certain dangerous cargo transfers.
The DoS is signed before cargo or passenger operations start. Berthing is usually the trigger point.
Training and Drills
Crew with security duties must be trained, and drills held at least every three months. The STCW Code covers security awareness for all seafarers and training for those with designated security duties.
What Is a TWIC Card?
A Transportation Worker Identification Credential (TWIC) is a biometric identity card issued by the Transportation Security Administration (TSA). It is required for unescorted access to secure areas of MTSA-regulated vessels and facilities.
Applicants pass a TSA security threat assessment, which checks criminal history, immigration status and terrorism watchlists. Some convictions disqualify permanently; others disqualify for seven years after conviction or five years after release from prison. A TWIC is valid for five years.
Crew of foreign-flag ships do not need a TWIC. Their security is covered by the ISPS Code and the ship’s security plan. They may need an escort to leave the terminal.
On my first Gulf Coast terminal visit as a surveyor, the gangway TWIC check was done before the agent finished the paperwork.
Electronic TWIC reader requirements have been delayed several times. The Coast Guard has moved the compliance date for most remaining facilities to 8 May 2029.
How Does the MTSA Relate to the ISPS Code?
The ISPS Code is the international standard under SOLAS Chapter XI-2. The MTSA is the US law that applies it in US waters and adds national requirements. ISPS compliance gets a ship most of the way, but not all.
The US Coast Guard runs its own port State control program and is not a member of the Paris or Tokyo port state control MoUs. It can deny entry or detain a ship under the MTSA as well as under SOLAS.
What Does the MTSA Cybersecurity Rule Require?
The Coast Guard’s cybersecurity final rule took effect on 16 July 2025. It applies to US-flag vessels, Outer Continental Shelf facilities and MTSA-regulated facilities, not to foreign-flag ships.
| Requirement | Deadline |
|---|---|
| Report cyber incidents to the National Response Center | From 16 July 2025 |
| Cybersecurity training for all personnel | By 12 January 2026, then yearly |
| Cybersecurity Officer, cyber assessment and Cybersecurity Plan | By 16 July 2027 |
What Happens During a Coast Guard Security Boarding?
The Coast Guard checks security on foreign ships during port State control examinations and can board ships before they enter port. Officers check documents, test access control and ask crew about their security duties.
A tanker I surveyed in Texas City had immaculate paperwork and a gangway access log with a gap of three hours that nobody could explain. That gap was the finding.
What Do Coast Guard Inspectors Check?
- A valid International Ship Security Certificate and an approved ship security plan on board.
- The ship operating at the port’s MARSEC level, with records of the security level at its last ten port calls.
- Gangway control: ID checks, visitor log and escort of visitors.
- Drills every three months and exercises at least once a calendar year, with records.
- The security officer able to explain the plan, and crew able to describe their duties.
- Security equipment, such as lighting and alarms, working as described in the plan.
Ships must send a Notice of Arrival at least 96 hours before arrival, including security information on their last five ports. Ships that called at ports listed as lacking effective antiterrorism measures face extra conditions of entry, such as posting guards at the gangway.
Serious failures can lead to denial of entry, expulsion or detention. Civil penalties are set per violation, and falsified records or unreported incidents can be prosecuted.
What Is the Port Security Grant Program?
The MTSA created the Port Security Grant Program, now run by FEMA. It funds port authorities, terminal operators, ferry systems and agencies for security projects such as surveillance, access control and training.
Recent rounds have provided about 90 to 100 million dollars a year. Grants are competitive and awarded by risk, with the largest port areas receiving the most.
What Does MTSA Compliance Mean for Ship Operators?
For a ship calling at a US port, MTSA compliance is part of normal pre-arrival preparation. The master checks the port’s MARSEC level, prepares the Declaration of Security if needed and confirms drill records are current.
The same habits, from gangway control to crew briefings, protect ships in high-risk areas where piracy and maritime crime remain a threat. Charterers’ vetting inspections also check ship security records, so weak practice also has a commercial cost outside US ports.
Related Topics
Frequently Asked Questions
What is the MTSA?
The Maritime Transportation Security Act of 2002. It is the US law that sets security rules for ships, port facilities and port workers.
Who enforces the MTSA?
The US Coast Guard, through its Captains of the Port. The TSA runs the TWIC program, and FEMA runs the Port Security Grant Program.
Does the MTSA apply to foreign ships?
Yes, when they are in US waters. A valid ISSC under the ISPS Code is accepted, but the ship must follow MARSEC levels and Coast Guard directions.
What is the difference between the MTSA and the ISPS Code?
The ISPS Code is the international standard under SOLAS. The MTSA applies it in US law and adds TWIC, area security plans and a cybersecurity rule.
What is an MTSA-regulated facility?
A US waterfront facility that receives ships covered by the MTSA, such as a cargo terminal, cruise terminal or shipyard. It needs a Coast Guard-approved facility security plan.
Who needs a TWIC card?
Anyone needing unescorted access to secure areas of MTSA-regulated ships or facilities, such as US longshore workers, terminal staff and US mariners. Foreign crew do not.
What are MARSEC levels?
The three US maritime security levels set by the Coast Guard: 1 normal, 2 heightened threat and 3 probable or imminent incident.
What happens if a ship fails an MTSA inspection?
It can be detained, denied entry or expelled, and the operator fined. Falsified records or unreported incidents can lead to criminal prosecution.
- Great Lakes Maritime Academy: Programs, Cost and Admission – October 14, 2026
- Bunker Delivery Note (BDN): Contents, MARPOL Rules and Checks – October 11, 2026
- Oil Record Book: Part I and Part II Entries, Rules and PSC Checks – October 11, 2026
