IMI Level 2 Diploma in Light Vehicle Maintenance and Repair (IL2DLVMR)

Correct: According to 33 CFR 104.280, the vessel must have procedures to check ship’s stores against manifests or purchase orders and to ensure they are not tampered with. At MARSEC Level 2, these security measures must be intensified, making the combination of documentation matching and physical inspection a regulatory necessity to prevent the introduction of unauthorized substances or devices.

Incorrect: The strategy of allowing uninspected deliveries based on a vendor list fails to meet the vessel’s independent responsibility to secure its own perimeter and stores. Implementing a mandatory 24-hour quarantine is operationally impractical for many stores and does not satisfy the requirement for active verification at the time of delivery. Relying solely on a driver’s affidavit is insufficient because it lacks the necessary physical oversight and independent verification required by United States maritime security standards.

Takeaway: CSOs must ensure the VSP mandates both documentation verification and physical inspection of ship’s stores to maintain security integrity at all MARSEC levels.

Correct: Under 33 CFR 104.285, vessels must have the capability to illuminate the vessel, its surroundings, and its access points during periods of low visibility and at night. The CSO is responsible for ensuring that physical security measures are effective and that the Vessel Security Plan (VSP) accurately reflects the equipment and procedures in use. If the enhancement of lighting represents a significant change to the security infrastructure described in the VSP, the CSO must ensure the plan is updated and, if necessary, submitted to the U.S. Coast Guard for review to maintain regulatory compliance.

Incorrect: The strategy of waiving identification checks for certain personnel during night hours creates a security vulnerability and fails to meet the access control requirements mandated by federal maritime security regulations. Relying on the port facility to provide all necessary illumination is incorrect because the vessel maintains an independent regulatory obligation to secure its own access points and surrounding areas regardless of shore-side support. Choosing portable lanterns as a permanent primary solution for high-traffic access points is typically insufficient for meeting the continuous, reliable illumination standards required for effective security screening and deterrence in a maritime environment.

Takeaway: CSOs must ensure vessel lighting supports effective access control and that any significant physical security upgrades are properly documented in the VSP.

Correct: Under the ISPS Code and 33 CFR Part 104, the CSO is specifically tasked with ensuring the Ship Security Plan (SSP) is approved by the Administration or a Recognized Security Organization. Furthermore, the CSO must provide the Master with the necessary support and resources to address any security deficiencies or non-conformities identified by Port State Control authorities during inspections to ensure the vessel remains in compliance with international and national standards.

Incorrect: Delegating communication entirely to a facility officer ignores the CSO’s specific regulatory duty to oversee the vessel’s security compliance across different jurisdictions. The strategy of restricting the Flag State’s role to initial certification fails to account for the requirement of ongoing audits and plan maintenance mandated by maritime security regulations. Opting to bypass the Master during inspections contradicts established maritime protocols where the Master remains responsible for the vessel’s immediate compliance and the availability of documentation on board.

Takeaway: The CSO must facilitate Flag State approval and support the Master in resolving any security deficiencies identified by Port State Control.

Correct: Under 33 CFR Part 104, the Company Security Officer is responsible for ensuring a Ship Security Assessment is conducted for each vessel. This assessment forms the basis for the Ship Security Plan, which must be submitted to and approved by the U.S. Coast Guard Marine Safety Center to ensure compliance with MTSA and ISPS Code standards for U.S.-flagged vessels.

Incorrect: Simply adopting a previous owner’s plan without formal USCG approval fails to meet the regulatory requirement for a valid, company-specific plan under the new ownership. Relying on a generic manual without a vessel-specific assessment ignores the unique physical and operational vulnerabilities of the specific ship. The strategy of requesting a waiver based on foreign certification is invalid because a change in flag and ownership requires a new verification process to ensure the vessel meets U.S. domestic security standards.

Takeaway: CSOs must ensure every vessel has a USCG-approved Ship Security Plan based on a formal Ship Security Assessment.

Correct: Implementing a continuous training program with simulated phishing and reporting protocols is the most effective strategy. This approach addresses the human element of cybersecurity, which is often the weakest link in maritime operations. By providing hands-on experience and clear procedures, the CSO ensures that crew members can recognize and report threats in real-time. This aligns with United States Coast Guard (USCG) guidance on maritime cyber risk management and the requirements for security training under 33 CFR Part 104.

Incorrect: The strategy of restricting all personal digital access is often impractical and fails to address social engineering attempts directed at official shipboard communication systems. Relying solely on technical solutions like firewalls and antivirus software is insufficient because these tools cannot prevent a user from voluntarily disclosing sensitive information to a deceptive source. Choosing to provide only a one-time handbook during hiring ignores the rapidly evolving nature of cyber threats. This method fails to maintain the high level of vigilance required for long-term security compliance.

Takeaway: Effective maritime cybersecurity requires ongoing personnel training and active reporting mechanisms to counter evolving social engineering tactics.

Correct: According to 33 CFR 104.225, personnel must have knowledge of security-related duties, including recognizing and responding to security threats and understanding the reporting chain. The CSO is responsible for ensuring this training is provided and documented to maintain compliance with MTSA standards. This ensures that personnel can identify vulnerabilities and act as an extension of the security team during their time on the vessel.

Incorrect: Focusing only on access control fails to address the regulatory requirement for broader threat recognition and behavioral awareness. The strategy of relying on gangway briefings is inadequate for establishing a foundational understanding of security culture before personnel enter a restricted area. Choosing to distribute the entire Vessel Security Plan is a violation of Sensitive Security Information (SSI) handling requirements, as personnel should only access parts of the plan relevant to their specific duties.

Takeaway: Effective security training must cover threat recognition and reporting procedures while protecting sensitive security information according to federal regulations.

Correct: According to United States Coast Guard regulations in 33 CFR Part 104, a vulnerability assessment must include an evaluation of the effectiveness of existing security measures. The CSO must analyze how identified weaknesses could be exploited by specific threats and determine the potential consequences for the vessel’s critical systems and personnel. This systematic approach ensures that security resources are prioritized based on actual risk rather than arbitrary upgrades.

Incorrect: The strategy of implementing immediate hardware changes like padlocks without a formal risk analysis fails to address the underlying procedural or structural weaknesses identified in the VSA. Relying on insurance underwriters to conduct security assessments is inappropriate because the CSO is legally responsible for the development and maintenance of the Vessel Security Plan under federal law. Choosing to exclude areas based solely on a lack of prior incidents is a reactive approach that ignores the proactive requirement to identify and mitigate potential vulnerabilities before they are exploited.

Takeaway: A vulnerability assessment must systematically evaluate how existing security measures mitigate specific threats to determine the overall risk to critical vessel infrastructure.

Correct: The IMDG Code, specifically Chapter 1.4, requires that companies and ships involved in the transport of high-consequence dangerous goods must adopt, implement, and comply with a security plan. This plan must address specific elements such as the allocation of duties to competent persons, records of security training, and operational procedures for responding to security threats or breaches. As the CSO, ensuring these specific measures are integrated into the company’s security framework is essential for compliance and risk mitigation.

Incorrect: The strategy of delegating all security responsibility to the port facility is incorrect because the ship and the company maintain distinct regulatory obligations for the cargo while in transit. Relying solely on Safety Data Sheets is insufficient because those documents focus on safety and hazardous properties rather than the security risks of theft or intentional misuse. Focusing only on emergency response training fails to meet the mandatory requirement for security-specific training and awareness for personnel handling high-consequence materials.

Takeaway: CSOs must implement specific security plans for high-consequence dangerous goods that address training, responsibilities, and incident reporting procedures beyond general security measures.

Correct: Integrating a multi-factor analysis is correct because U.S. Coast Guard regulations under 33 CFR Part 104 require the Ship Security Assessment to consider vulnerabilities, threats, and consequences. A comprehensive methodology must evaluate how specific shipboard weaknesses could be exploited by current threats and what the resulting impact would be on the vessel, crew, and environment.

Incorrect: Relying solely on physical hardware inspections fails to account for the evolving tactics of adversaries or the operational context of the vessel. The strategy of using standardized checklists often overlooks unique vessel vulnerabilities and does not provide a qualitative analysis of risk. Focusing only on localized historical breaches ignores the global nature of maritime threats and the possibility of emerging threat vectors that have not yet resulted in a local incident.

Takeaway: Effective maritime security assessments must balance vulnerability identification with intelligence-driven threat scenarios and consequence analysis to mitigate risk effectively.

Correct: Under 33 CFR Part 104, the CSO is responsible for ensuring that a Ship Security Assessment (SSA) is conducted and remains valid. When new threat information becomes available, the CSO must evaluate the existing SSA to identify if the new threat tactics exploit known vulnerabilities or if new vulnerabilities have emerged. This analysis ensures that the Ship Security Plan remains effective and that any necessary modifications to security procedures are based on a formal risk assessment process.

Incorrect: The strategy of unilaterally raising MARSEC levels across the fleet ignores the regulatory framework where MARSEC levels are typically set by the Commandant of the Coast Guard and should be based on specific local conditions. Relying on external boarding teams for every port call is not a sustainable or standard threat analysis practice and shifts the responsibility of security away from the vessel’s established plan. Choosing to postpone all operations until a guarantee of zero risk is provided is unrealistic in maritime operations, as security management is based on risk mitigation rather than the total elimination of all possible threats.

Takeaway: CSOs must use new threat intelligence to re-evaluate Ship Security Assessments and ensure that mitigation strategies remain effective against evolving tactics.

Correct: Under 33 CFR 104.255 and 105.245, a Declaration of Security (DoS) is required when a vessel and a port facility are operating at different MARSEC levels. This document ensures that both parties acknowledge their respective security responsibilities and coordinate their protective measures to address the discrepancy in risk levels.

Incorrect: The strategy of waiting for MARSEC Level 3 is incorrect because the requirement for a DoS is triggered as soon as there is a difference in levels or when Level 2 is reached. The approach of allowing a Ship Security Officer to waive the requirement based on internal measures is not permitted under federal regulations, as the DoS is a mandatory coordination tool. Focusing only on Certain Dangerous Cargo (CDC) is a common misconception; while CDC vessels have additional requirements, the DoS requirement applies to all vessels regulated under the Maritime Transportation Security Act (MTSA) when level discrepancies exist.

Takeaway: A Declaration of Security is mandatory whenever a vessel and facility operate at different MARSEC levels to ensure coordinated security responsibilities.

Correct: Chapter XI-2, titled Special Measures to Enhance Maritime Security, is the specific section of the SOLAS Convention that makes the ISPS Code mandatory for all contracting governments. This chapter defines the roles and responsibilities of companies, ships, and port facilities in maintaining a secure maritime environment.

Incorrect: Relying on Chapter XI-1 is a mistake because that section focuses on special measures to enhance maritime safety, including ship identification numbers and continuous synopsis records. The strategy of using Chapter V is incorrect as it pertains to the safety of navigation and general operational requirements for all vessels. Focusing only on Chapter IX is insufficient because that chapter governs the International Management Code for the Safe Operation of Ships and for Pollution Prevention.

Takeaway: SOLAS Chapter XI-2 is the regulatory pillar that mandates compliance with the International Ship and Port Facility Security (ISPS) Code.

Correct: Under 33 CFR Part 104, the CSO is responsible for ensuring that security equipment is properly maintained and calibrated to perform its intended function. A vulnerability assessment allows the CSO to identify the root cause of the system’s failure to perform under specific environmental conditions, leading to technical adjustments that ensure the system remains a reliable deterrent and detection tool without causing operational fatigue.

Incorrect: Relying solely on manual logging of alarm events fails to address the underlying technical vulnerability or the risk of missed detections during a real security incident. The strategy of replacing audible alarms with silent CCTV monitoring may violate requirements for immediate notification of security breaches and reduces the system’s effectiveness as a real-time alert mechanism. Focusing only on disciplinary measures without addressing the system’s technical flaws fails to mitigate the actual security risk and may lead to further non-compliance or hidden bypasses by the crew.

Takeaway: CSOs must use vulnerability assessments to ensure security equipment remains effective and operational under all environmental conditions encountered during transit.

Correct: Under 33 CFR Part 104, the Company Security Officer is responsible for ensuring that a Vessel Security Assessment is conducted and that the Company Security Plan is developed and implemented based on those specific findings. Tailoring security measures to the unique configuration of different vessel classes ensures that the controls are effective and relevant, while internal audits provide the necessary oversight to ensure ongoing compliance and effectiveness.

Incorrect: The strategy of implementing identical hardware across all vessels regardless of their layout ignores the requirement to address specific vulnerabilities identified during individual vessel assessments. Relying solely on Vessel Security Officers to design their own procedures without centralized coordination fails to meet the CSO’s regulatory obligation to maintain a consistent and approved Company Security Plan. Choosing to wait for external regulatory inspections to identify flaws is a reactive approach that neglects the CSO’s duty to proactively manage and verify security implementation.

Takeaway: CSOs must base security measures on specific vessel assessments and maintain oversight through documented procedures and regular internal audits.

Correct: Under 33 CFR Part 101 and 104, individuals requiring unescorted access to secure areas of MTSA-regulated vessels must possess a valid Transportation Worker Identification Credential (TWIC) issued by the TSA. The CSO is responsible for ensuring that the Vessel Security Plan (VSP) includes procedures for verifying these credentials and maintaining an authorized access list to prevent unauthorized entry into restricted areas.

Incorrect: Relying on private investigations or psychological evaluations exceeds standard regulatory mandates and does not satisfy the federal TWIC requirement for unescorted access. Simply accepting a notarized letter or a state driver’s license is insufficient because these documents do not meet the federal biometric and background vetting standards required for maritime security areas. Focusing only on NDAs and briefings fails to address the legal necessity of identity and background verification through the federal credentialing system.

Takeaway: Personnel requiring unescorted access to secure areas on MTSA-regulated vessels must hold a valid federal TWIC credential for identity verification and vetting.

Correct: According to 33 CFR 104.415 and the ISPS Code, internal audits of the Ship Security Plan must be conducted by personnel who are independent of the activities being audited. This independence is critical to ensure an objective evaluation of the security measures and to identify deficiencies without a conflict of interest. While the regulations allow for flexibility if the company’s size makes total independence impossible, the primary goal is to have an unbiased reviewer assess the effectiveness of the security implementation.

Incorrect: Assigning the Ship Security Officer to audit their own vessel is a violation of the independence principle because the SSO is the primary individual responsible for the security activities being reviewed. Requiring a third-party Recognized Security Organization for every annual internal audit is an over-application of the rules, as the regulations specifically allow for company personnel to perform these internal reviews. Selecting a crew member who was simply not involved in a specific upgrade fails to address the broader requirement for organizational independence from the vessel’s security management and daily operations.

Takeaway: Internal security audits must be conducted by personnel independent of the audited activities to ensure objective compliance and effectiveness.

Correct: Under 33 CFR Part 104 and the MTSA framework, security measures must be effective under all conditions, including darkness and weather. Upgrading to thermal or low-light technology ensures that the surveillance system provides the continuous monitoring capability mandated by the approved Ship Security Plan without gaps in coverage.

Incorrect: Relying solely on increased physical patrols is insufficient because it does not correct the technical deficiency in the primary surveillance system required for continuous monitoring. The strategy of increasing frame rates or storage capacity is ineffective because digital processing cannot recover visual data that was never captured due to poor lighting or environmental interference. Choosing to move cameras behind bridge windows often results in glare and reflections that further degrade image quality and fails to provide the direct line of sight needed for external security.

Takeaway: Surveillance systems must be technically capable of maintaining continuous monitoring standards under all environmental and lighting conditions specified in the security plan.

Correct: According to USCG regulations under 33 CFR Part 104, the CSO is responsible for ensuring that security equipment is properly operated, tested, calibrated, and maintained. These operational and maintenance procedures must be clearly defined in the Ship Security Plan to ensure the equipment remains reliable and that the vessel stays in compliance during USCG inspections.

Incorrect: The strategy of seeking a universal type-approval certificate is flawed because the USCG typically evaluates the effectiveness of the security system as part of the overall Ship Security Plan rather than issuing individual type-approvals for every piece of security hardware. Relying on automated notifications to the National Response Center for minor breaches is incorrect as the NRC is intended for reporting actual transportation security incidents or major threats, not routine sensor triggers. Choosing to remove physical guards entirely in favor of technology often violates the requirement for a multi-layered security approach and fails to provide the necessary human intervention required by most approved security plans.

Takeaway: Regulatory compliance for security technology requires documented procedures for testing and maintenance within the approved Ship Security Plan.

Correct: Under 33 CFR Part 104 and the ISPS Code, the Company Security Officer is responsible for ensuring that security equipment is professionally maintained and tested at the frequencies specified in the approved security plan. Establishing a standardized schedule with documented verification ensures that critical systems like the SSAS remain operational and that the company fulfills its regulatory oversight obligations for the entire fleet.

Incorrect: Relying solely on the Master and annual inspections fails to meet the specific regulatory duty of the CSO to provide continuous oversight and ensure the security plan is being actively followed. The strategy of testing only after incidents or MARSEC changes ignores the legal requirement for periodic maintenance intended to prevent equipment failure before a crisis occurs. Choosing to replace equipment annually instead of performing routine tests is insufficient because new equipment can still malfunction or be improperly installed, and it does not satisfy the mandatory requirement for documented periodic functional checks.

Takeaway: The CSO must ensure the Company Security Plan includes rigorous, documented schedules for the periodic testing and maintenance of all security equipment.