How BoPS Strengthens India’s Port Security Governance, Putting the ISPS Framework to Work

Which governance gaps did the Bureau of Port Security (BoPS) address, even when Indian ports already had ISPS-based assessments, approved security plans and established agency responsibilities?

Since 2004, the International Ship and Port Facility Security Code has provided the foundation for security at ports serving international shipping. Indian port facilities already assess security risks, maintain approved security plans, designate responsible officers, control access, conduct drills and adjust protective measures according to the applicable security level.

If the security framework already existed, why was the Bureau of Port Security needed? The answer is hidden in the difference between establishing security requirements and assuring their consistent implementation across a national port ecosystem. ISPS remains the international, risk-based foundation. BoPS addresses the regulation, oversight, coordination and national assurance surrounding that foundation.

1. The security framework was already in place — so what was missing?

The ISPS Code entered into force through SOLAS Chapter XI-2 on 1 July 2004. It establishes an international framework through which governments, agencies, port authorities and the maritime industry assess and address threats to ships and port facilities involved in international trade. Part A contains mandatory requirements, while Part B provides guidance on implementation. The International Maritime Organization explains the ISPS framework, while DGMA describes its application in India.

At the port-facility level, two instruments remain central:

• Port Facility Security Assessment (PFSA): identifies relevant assets, threats, vulnerabilities and security needs.
• Port Facility Security Plan (PFSP): translates the assessment into approved responsibilities, procedures and protective measures.

Port Facility Security Officers, port authorities, recognised security organisations and government agencies already operated within this environment. BoPS was therefore not created because India lacked a security framework. The strategic challenge was consistency across facilities, authorities, jurisdictions and risk profiles. National assurance requires visibility into whether approved controls are applied effectively, coordinated across organisational boundaries and improved when weaknesses are identified.

2. BoPS changes the level of governance, not the foundation of security

Section 13 of the Merchant Shipping Act, 2025 authorises the Central Government to constitute a body for the security of vessels and port facilities and assigns it regulatory and oversight responsibilities. These include providing a regulatory framework, ensuring timely exchange of security-related information and coordinating with other agencies. The Act also requires the Government to consider the ISPS Code when framing the detailed rules — connecting the new institution to ISPS rather than positioning it as a replacement.

DGMA describes BoPS as a statutory body constituted under Section 13 and functioning under the Ministry of Ports, Shipping and Waterways. DGMA’s Port Security and ISPS page sets out this institutional position.

The relationship becomes clearer when the architecture is separated into three levels:

BoPS does not remove the need for a facility-specific assessment or plan. Nor does it convert every port into an identical operating environment. It creates a stronger institutional mechanism for examining how the existing framework is interpreted, implemented and verified across the system.

3. Why distributed responsibility creates an assurance challenge

Port security is necessarily multi-agency. Port authorities and Port Facility Security Officers manage approved facility arrangements; CISF may provide security and specialist support where deployed; and the Coast Guard, Navy, Customs, State Marine Police, intelligence bodies and other authorities operate within their respective mandates. Multiple organisations are necessary because the environment spans different jurisdictions, capabilities and risks. The assurance challenge appears at the points between them:

• Information: Who receives, validates and communicates relevant threat information?
• Authority: Does the information reach the correct facility and authorised decision-maker?
• Escalation: Are responsibilities understood across organisational boundaries?
• Verification: Can an inspection establish whether an approved control works during normal operations?
• Improvement: Are lessons from incidents and exercises converted into measurable corrective action?

Without a dedicated coordinating structure, these questions may be addressed differently across facilities and agencies. BoPS is intended to create a clearer national focal point for regulatory oversight, inspection, information exchange and coordination.

National assurance does not mean that BoPS performs every operational task. It means that distributed responsibilities can be examined as parts of one security architecture rather than as isolated institutional activities.

4. BoPS has been constituted, but the detailed rulebook is still developing

The Merchant Shipping Act, 2025, provides the statutory basis for the security body. DGMA describes BoPS as constituted, and an official July 2026 order records the assumption of charge by the Director General of Maritime Administration as Director General, BoPS.

However, the Ministry of Ports, Shipping and Waterways continues to list the Bureau of Port Security Rules, 2026 as draft. The draft states that the rules would come into force on publication in the Official Gazette. MoPSW’s draft-rules page remains the authoritative status reference as of September 2026.

5. What the draft rules reveal about the intended direction

Although draft provisions are not final requirements, they indicate the direction in which the oversight architecture is being developed. The draft assigns BoPS proposed functions relating to:

These are proposed operating mechanisms, not final obligations. They nevertheless indicate a governance model in which port security becomes more consistently risk-based, reviewable and evidence-led.

6. The real test begins where the security plan meets operations

Consider an authorised contractor arriving at a restricted port area with a vehicle. Several separate controls may be involved. The sequence below is an illustrative operating scenario, not a workflow prescribed by BoPS.

If every stage functions separately, the port may still possess the required technologies and procedures. But when an exception occurs, an authorised reviewer should be able to determine:

• who requested and approved the visit;
• whether the person and vehicle matched the approved permission;
• which area and time window were authorised;
• what checks were completed at entry;
• whether surveillance or perimeter systems generated an exception;
• who received the alert and what action followed; and
• what evidence remains available for review.

Harbour Entry Permit, access control, ANPR, CCTV, perimeter, screening and command systems may support different parts of the approved security arrangement. Their value lies not in how many systems are installed, but in whether authorised personnel can connect information around an event, reconstruct the sequence and verify that the appropriate action was taken in accordance with the approved procedure.

7. What BoPS does not automatically change

BoPS should not be interpreted as requiring every port to rebuild its security architecture immediately. Facilities differ in cargo profile, traffic, layout, threat environment and operating constraints. A container terminal, cruise terminal, liquid-bulk facility and smaller non-major port cannot be expected to use identical controls. The Government’s stated direction is graded and risk-based, taking account of vulnerability, location and trade potential.

The draft rules also contain a proposed savings and transitional provision under which existing security plans, procedures and measures would continue until modified or superseded under the rules. Because this remains a draft provision, its final operation cannot yet be assumed.

Existing technology is not automatically obsolete. The priority is to determine whether it can support the approved security plan, exchange relevant information, maintain traceable records and accommodate future changes without unnecessary replacement.

8. What ports can strengthen without treating the draft rules as final

Ports do not need to wait passively for every detail to be finalised. They can strengthen existing ISPS-based arrangements without presenting draft provisions as mandatory.

Conclusion: BoPS moves the question from existence to operational efficiency

ISPS remains the foundation for security assessments, approved plans, defined responsibilities and risk-based protective measures. BoPS wraps it with a governance layer by adding a dedicated statutory focus for regulation, oversight, information exchange and coordination.

The detailed operating framework is still developing, and draft provisions must remain identified as draft. The next phase will not be defined only by whether a facility possesses a plan, procedure or technology. It will depend on whether controls are proportionate to assessed risk, connected across operations, understood by responsible personnel and supported by evidence that enables review and improvement.