What is the difference between a port ICCC and a VTS centre?

A VTS centre manages ship traffic and is staffed by trained VTS operators. A port ICCC watches security, gates, utilities and operations across the estate. The ICCC usually receives a feed from the VTMS but does not run vessel traffic.

Does the ISPS Code require a command and control centre?

The ISPS Code is built around security assessments, port facility security plans, and named security officers such as the Port Facility Security Officer. A command centre is one way to run the monitoring a plan describes.

How long must a port ICCC keep logs in India?

CERT-In's directions of 28 April 2022 require logs of all ICT systems to be kept for a rolling period of 180 days, within Indian jurisdiction. Video retention is a separate decision the port sets in its own policy.

Should a port ICCC control SCADA directly?

A read-only view is the safer default, with control kept by the utility operators. IMO's 2026 cyber guidelines also advise keeping OT networks separate from IT networks.

Port integrated command and control centre (ICCC): what it integrates and how to specify one

What a port ICCC connects (VTMS, gates, CCTV, access control, perimeter, fire and PA, SCADA, PCS and TOS), the reference architecture, the RFP, and the Indian rules that apply.

Ahuva Electronic Technologies · Published 30 October 2026

Key points

A port ICCC is one room and one software platform where security, marine and operations staff see events from many separate port systems together and act on them under written procedures.
It usually connects VTMS, gate automation, CCTV and video analytics, access control, perimeter intrusion detection, fire alarm and PA, SCADA and utilities, and the terminal operating and port community systems.
Each source system keeps its own control. The ICCC reads events and video, and sends back only the commands the owner has agreed in writing.
The ISPS Code has been mandatory since 1 July 2004, and since 27 June 2026 India has a Bureau of Port Security for vessels and port facilities.
CERT-In's 2022 directions apply to the ICCC's own IT: report listed incidents within 6 hours, keep ICT logs for 180 days in India, and sync clocks to NIC or NPL.

What is a port ICCC?

A port integrated command and control centre (ICCC) is a control room and a software platform. It pulls alarms, video, vessel positions and gate events from separate port systems onto one screen. Operators then handle each event through a written standard operating procedure (SOP).

A city ICCC watches traffic and civic services. A port ICCC watches a mix of ship traffic, cargo flow, people and vehicles entering a restricted area, and plant such as power and water. It also has to fit a security regime that city centres do not: the ISPS Code, which covers port facilities used for international trade.

The ICCC should not replace any of the systems it connects. The vessel traffic service should keep its own operators. The fire panel should keep working if the ICCC is down. The ICCC is an overview and coordination layer.

Which systems does a port ICCC integrate?

The list depends on the port. The table covers eight systems a port ICCC scope can include. It shows what each one sends to the ICCC, a common interface, and who should keep control. Interfaces are examples, not fixed; the real list comes from a survey of what each installed system exposes.

Systems a port ICCC usually integrates
System	What the ICCC receives	Typical interface	Who keeps control
VTMS (vessel traffic)	Vessel tracks, AIS identity, radar targets, berth and anchorage events	Data link from the VTS system, usually one-way	VTS operators in the VTS centre
Gate automation	ANPR and RFID reads, boom status, vehicle and driver match results, exceptions	Vendor API or database feed	Gate system; ICCC sees exceptions
CCTV and video analytics	Live and recorded video, analytics alarms such as intrusion or loitering	VMS SDK or API	VMS; ICCC can call up and steer cameras
Access control	Door and turnstile events, denied entries, forced or held doors	Vendor API or SDK	Access control server and security staff
Perimeter intrusion detection (PIDS)	Zone alarms from fence, buried or radar sensors	Alarm contacts or vendor API	PIDS controller; ICCC links alarms to cameras
Fire alarm and PA	Fire and fault alarms by device or zone; PA zone status	Panel gateway, PA system API	Fire panel always leads; ICCC is read-only
SCADA and utilities	Power, water and pump status and alarms	Protocol gateway, read-only	SCADA operators; ICCC read-only
PCS, TOS and port community system	Vessel calls, berth plans, cargo and container status	Web services or message exchange	Terminal and port operations teams

What does the reference architecture look like?

Think of a port ICCC as six layers. Each layer has its own owner and its own failure points, so the tender should name an owner for each one.

Field layer: cameras, gate readers, access readers, perimeter sensors, fire panels, radar and AIS, meters and PLCs
Network layer: fibre ring around the port estate, wireless links to jetties, and separate zones for security, operations and OT traffic
Data centre layer: servers, storage and the VMS, sized for the video retention the port sets, with a disaster recovery plan
Integration layer: one connector per source system, which turns each vendor's format into common events
Application layer: event correlation, SOP workflows, GIS map of the estate, incident logs and reports
Presentation layer: video wall, operator desks, and mobile access for patrols and the port facility security officer

Which Indian rules and standards apply?

None of the sources below mandates a port ICCC as such. They shape what it must record, how its network is run, and what equipment it may use. The table quotes each one from the source. For the full port security regime, including how the Bureau of Port Security works, see the note on port security rules linked below.

Rules and standards that touch a port ICCC (sources checked 30 October 2026)
Rule	What the source says	What it means for the ICCC
ISPS Code (IMO, SOLAS chapter XI-2)	In force "on 1 July 2004". "Mandatory Part A outlines detailed maritime and port security-related requirements"; Part B gives "recommendatory guidelines".	The ICCC supports the port facility security plan and its officer. It does not replace either.
Bureau of Port Security (S.O. 3473(E), 27 June 2026)	The Central Government "constitutes a body for the security of vessels and port facilities, to be called as the Bureau of Port Security (BoPS)".	A dedicated body now covers vessel and port facility security. Check its current rules before the ICCC scope is frozen.
CERT-In directions (28 April 2022)	Report listed incidents "within 6 hours"; keep logs of all ICT systems "for a rolling period of 180 days" "within the Indian jurisdiction"; sync clocks to NIC or NPL NTP servers.	Applies to the ICCC's servers, network and VMS. Size log storage and set up time sync from day one.
CERT-In incident list (Annexure I)	Lists "Attacks on Critical infrastructure, SCADA and operational technology systems" and "Attacks on Internet of Things (IoT) devices".	An attack on a camera, gate controller or SCADA link is reportable, not just an IT problem.
STQC security testing of CCTV	"STQC will issue the test report for Security as per the Essential Requirements (ERs) under CRO which would be applicable for compliance to PPP-MII." CCTV cameras are a covered category of its IoT scheme.	Ask for the STQC security test report for every network camera model in the bid.
IMO cyber risk guidelines (MSC-FAL.1/Circ.3/Rev.4, 28 May 2026)	"collect and securely store logs for intrusion detection and incident response, and segment OT device networks from IT networks."	Keep SCADA, fire and gate controllers on their own network zones, with logged and controlled links to the ICCC.

What should a port ICCC RFP specify?

An RFP should start from the systems and the procedures, not from the size of the video wall. Settle these items before the bid, so the centre still works after handover.

An inventory of every system to connect, with vendor, version, interface and who owns the licence
For each link: read-only or two-way, and the exact commands the ICCC may send
The SOPs the platform must run, written with security, marine, fire and operations teams
Video and event retention periods, and log retention of at least the 180 days CERT-In requires
Time sync to NIC or NPL for every server, recorder and controller, so evidence lines up
Network zoning between IT and OT, and who manages the firewalls between them
STQC security test reports for network cameras, and ONVIF conformance where cameras are mixed
Staffing per shift, training, and who pays for operators after go-live
What keeps working if the ICCC or its data centre goes down
Acceptance tests run end to end: a real alarm, through the SOP, to a closed incident

What goes wrong in port ICCC delivery?

Plan for these risks. Most of them sit in the interfaces and the people, not in the screens.

A source system turns out to have no usable interface, or its vendor charges for one late in the project
The VTMS, gate or SCADA owner refuses write access, so planned two-way features shrink to view-only
Too many alarms reach the wall, operators stop trusting them, and real events are missed
Clocks are not synced, so video, gate and access records cannot be matched after an incident
OT and IT share one flat network, which breaks both good practice and the port's own security plan
SOPs are written by the integrator alone, not by the teams who must follow them
The maintenance contract covers the ICCC software but not the field devices that feed it

How Ahuva approaches port ICCC work

Ports and maritime is one of the sectors Ahuva serves. Its ICCC scope covers integrated command and control centre design, video walls, consoles and AV, and CCTV, GIS, IoT, SCADA and analytics integration, with incident management. The same contract can cover the systems that feed the centre, from data centre and network to surveillance, access control, fire detection and public address.

Frequently asked questions

What is the difference between a port ICCC and a VTS centre?: A VTS centre manages ship traffic and is staffed by trained VTS operators. A port ICCC watches security, gates, utilities and operations across the estate. The ICCC usually receives a feed from the VTMS but does not run vessel traffic.
Does the ISPS Code require a command and control centre?: The ISPS Code is built around security assessments, port facility security plans, and named security officers such as the Port Facility Security Officer. A command centre is one way to run the monitoring a plan describes.
How long must a port ICCC keep logs in India?: CERT-In's directions of 28 April 2022 require logs of all ICT systems to be kept for a rolling period of 180 days, within Indian jurisdiction. Video retention is a separate decision the port sets in its own policy.
Should a port ICCC control SCADA directly?: A read-only view is the safer default, with control kept by the utility operators. IMO's 2026 cyber guidelines also advise keeping OT networks separate from IT networks.

Sources

SOLAS XI-2 and the ISPS Code · International Maritime Organization
Constitution of the Bureau of Port Security (S.O. 3473(E), 27 June 2026) · Ministry of Ports, Shipping and Waterways, Gazette of India
Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 (28 April 2022) · CERT-In
IoT System Certification Scheme (IoTSCS): Certified product list as per the Essential Requirements · STQC Directorate, MeitY
MSC-FAL.1/Circ.3/Rev.4: Guidelines on Maritime Cyber Risk Management (28 May 2026) · International Maritime Organization

Scoping a system like this? Talk to the team that designs, builds and maintains it.