Bureau of Port Security rules 2026: what Indian port facilities must now prove

What is the Bureau of Port Security?

BoPS is a body for the security of vessels and port facilities, created under section 13 of the Merchant Shipping Act, 2025 (24 of 2025). Section 13(3) makes it responsible for regulatory and oversight functions on such security matters as are prescribed by rules, and says the rules must take the International Ship and Port Facility Security (ISPS) Code into consideration. Section 13(4) lists its core functions: provide a regulatory framework for the security of vessels and port facilities, ensure timely collection and exchange of security information, and coordinate with other agencies.

The Central Government constituted BoPS by notification S.O. 3473(E) dated 27 June 2026, with effect from publication. Until further orders it is headed by the Director General of Maritime Administration, designated Director General of BoPS. A Ministry of Home Affairs press release of 19 December 2025 said the Bureau is modelled on the Bureau of Civil Aviation Security (BCAS), will be headed by an IPS officer at Pay Level-15, and that the Director General of Shipping would act as its head during a one-year transition. The same release said BoPS will have a dedicated division to protect port IT infrastructure from cyber threats.

In plain terms, BoPS is to ports what BCAS is to airports: the regulator that sets security standards, approves plans, audits, and sets response measures. It does not guard ports itself.

What do the Bureau of Port Security Rules, 2026 say?

The Merchant Shipping (Bureau of Port Security) Rules, 2026 were notified as G.S.R. 883(E), dated 14 October 2026, under section 319 of the Act. They apply from publication in the Official Gazette; the e-Gazette copy is numbered CG-DL-E-16102026-277195 and was signed on 16 October 2026. Rule 2 applies them to port facilities and to vessels in port facilities engaged in the vessel-port interface.

The rules describe BoPS's powers rather than duties on each port. Rule 4 makes BoPS responsible for implementing and enforcing them. Rule 5 sets out the regulatory framework it must build. Rule 8 lets it issue security standards, and says they may include standards and specifications for access control, surveillance, monitoring, screening and patrolling, and measures on security technologies, cybersecurity, communication systems and emergency response. Rule 11 provides for periodic audits and inspections of port facilities, at intervals BoPS will specify by order or in approved standard operating procedures. Rule 12 has BoPS specify the measures for each security level set under section 129(3) of the Act, and keep records of security levels, response measures and lessons from incidents and drills.

The final text is narrower than the draft of 12 December 2025. The draft also covered ships on international voyages and companies, and let BoPS regulate armed guards on board vessels. The notified rules drop these and focus on port facilities and the vessel-port interface. Summaries written from the draft are out of date.

• Rule 5(a): standards, guidelines and procedures for port facility security
• Rule 5(b): a risk-based mechanism to categorise port facilities by threat, operations and vessel movement
• Rule 5(c): review, approval and monitoring of port facility security plans
• Rule 5(d): minimum requirements for security equipment, personnel and infrastructure
• Rule 5(e): a mechanism for engaging private security agencies
• Rule 5(f): protocols for inspections, audits and operational monitoring

Who do India's port security rules apply to?

The duties on ports sit in the Merchant Shipping (Ships and Port Facility Security) Rules, 2026, notified as G.S.R. 909(E) dated 23 October 2026 under section 130 of the Act. They supersede the 2024 rules of the same name and apply from publication. Rule 2 applies them to Indian ships, to foreign ships calling at Indian ports or offshore facilities, to any Indian port facility, and to any company owning, operating or managing a covered vessel or port facility. Rule 3(1)(g) names BoPS as the designated authority.

A port facility is defined in section 3(39) of the Act as any location or area, including anchorages, awaiting berths or approaches from seaward, where the interface between vessels, or a vessel and a port, takes place, as determined by the Central Government or the designated authority. That covers major port berths, non-major ports under State Maritime Boards, private and captive jetties, and terminals run by operators inside a major port. The rules draw lines by port type in places: PFSO qualifications differ for major ports, non-major ports with quay length of 300 metres or more, and smaller ports, and EXIM port facilities must also engage a deputy PFSO.

What must a port facility have in place?

The Ships and Port Facility Security Rules, 2026 follow Part A of the ISPS Code, which is mandatory, and refer repeatedly to Part B, which is guidance. The ISPS Code entered into force on 1 July 2004 under SOLAS chapter XI-2. The port facility duties are in rules 17 to 22 and rule 28.

• Security levels (rules 4 and 17): BoPS sets the level for each port facility. At level 1 every facility must perform its security duties, control access, monitor the facility including anchoring and berthing areas, monitor restricted areas, supervise cargo and ships' stores, and keep security communication readily available. Levels 2 and 3 add the measures written into the plan.
• Port facility security assessment (rule 18): carried out by BoPS or a recognised security organisation (RSO) for all Indian port facilities, and approved by BoPS. It must identify assets and infrastructure, threats and their likelihood, countermeasures and weaknesses including human factors. The report must be protected from unauthorised access.
• Port facility security plan (rule 19): prepared and implemented by the PFSO, based on the assessment, covering all three security levels, in English and approved by BoPS. Rule 19(3) lists 15 required contents, from preventing weapons and unauthorised access to responding to a ship security alert.
• Port facility security officer (rules 17(6) and 21): every port must have an independent, qualified and trained PFSO, whose duties include regular inspections, keeping records of security occurrences, and ensuring security equipment is operated, tested, calibrated and maintained.
• Advisory committee (rule 20): a port may constitute a port facility security advisory committee, with members including CISF, Customs, Coast Guard, Navy, police and intelligence agencies. It meets at least once every six months and reviews the plan.
• Drills (rule 22): at appropriate intervals, set by the type of operations, personnel changes and the ships served.
• Verification (rule 28): BoPS issues a statement of compliance after a document review or an audit showing the system has operated effectively for at least three months, followed by annual verifications and an intermediate verification between the second and third anniversary.

What is CISF's role in port security?

CISF's role comes from government orders, not from the BoPS rules. DG Shipping Circular 22 of 2026, dated 6 May 2026, records that the Government authorised the Technical Consultancy Wing of the Central Industrial Security Force (CISF) as an RSO for all port facilities in India. It may carry out port facility security assessments and prepare and revise port facility security plans, which then go to the designated authority for approval. Port authorities and State Maritime Boards are asked to use it as they see fit. Under rule 4(5) of the 2026 rules, an RSO can never approve an assessment or plan itself: that stays with BoPS.

The Ministry of Home Affairs release of 19 December 2025 also said CISF will train and build the capacity of private security agencies engaged in port security, and that only certified, licensed agencies should operate. At a review on 10 July 2026, reported by All India Radio, the Home Minister directed that only CISF-trained personnel be deployed at ports, that all ports under the BoPS framework have container-scanning facilities, and that CISF run trial runs of the proposed arrangements at Visakhapatnam, Jawaharlal Nehru and Mundra ports. These are ministerial directions. They are not yet written into the rules.

What do the rules mean for security systems?

The rules set outcomes, not products. Nothing in either set of rules names CCTV, a retention period, an access control technology or a command centre. What they require is that a facility controls access, monitors its area and berths, supervises cargo, keeps records of security occurrences, maintains its security equipment, and can show all of this at audit. Systems are how a facility produces that evidence.

Three practical points follow. First, the audit route to a statement of compliance needs at least three months of effective operation, so logs and recordings should be running before the audit is booked. Second, the plan may be held electronically but must be protected from unauthorised access, deletion, destruction or amendment (rule 19(5)), and the assessment report must be protected from unauthorised access or disclosure (rule 18(8)). That is an access-control and backup requirement for the document system itself. Third, rule 17(2) says measures must cause minimum interference to passengers, crew, visitors, cargo and services, so screening and gate systems have to be sized for peak throughput or they will be bypassed.

DG Maritime Administration Circular 46 of 2026, dated 4 August 2026, adds cyber risk. It names access control and identification systems, CCTV and surveillance systems, terminal operating systems and remote access among the systems to consider, and suggests port facilities include cyber risk in the assessment, segregate IT and operational technology networks, and test backup and recovery. The circular is worded mostly as 'may' and 'should': it is guidance under the ISPS framework, not a binding rule. Separately, CERT-In's directions of 28 April 2022 already apply to Government organisations and body corporate, which covers port authorities and terminal operators, including 6-hour incident reporting and 180-day retention of ICT system logs.

What does non-compliance cost?

Schedule VII of the Ships and Port Facility Security Rules, 2026 sets fees for services and for non-compliance, paid through the Bharat Kosh portal. For ports, approval of a port facility security assessment costs Rs 50,000 to Rs 1.5 lakh and approval of a plan Rs 1 lakh to Rs 2 lakh, scaled by quay length, with separate rates for anchorage and single buoy mooring ports.

• Loss of the port facility security assessment or plan: Rs 5 lakh
• One person acting as PFSO for multiple port facilities: Rs 2.5 lakh
• Security or stowaway incident not reported by the PFSO or agent: Rs 2 lakh
• Audit observations not closed within the time allowed: Rs 2 lakh
• Annual or renewal audits missed within the window: Rs 2 lakh
• Allowing a ship to berth without a valid ship security certificate: Rs 2 lakh
• Repeat non-conformity at the next external audit: Rs 2 lakh and an extra audit after six months

What is still unclear or pending?

Most of the detail that drives system design has not been published yet. The BoPS rules empower the Bureau to issue it, but as of 30 October 2026 we found no BoPS standards, categorisation or minimum equipment list in the public record. Buyers writing tenders now should design to the ISPS outcomes and leave room to adjust.

• Security standards under rule 8, including any specifications for surveillance, access control and screening
• The risk-based categorisation of port facilities under rule 5(b), which will likely decide which facilities need what
• Minimum security equipment, personnel and infrastructure under rule 5(d)
• Intervals for BoPS's own periodic audits under rule 11 of the BoPS Rules (statement-of-compliance verifications are already annual, with an intermediate check, under rule 28 of the 2026 security rules)
• The licensing and engagement mechanism for private security agencies under rule 5(e)
• CCTV retention: no period is set in either set of rules
• How assessments, plans and statements of compliance approved by DG Shipping under the 2024 rules carry over; the 2026 rules save only things done before supersession
• Whether cyber guidance moves from advisory (Circular 46 of 2026) to a binding standard

How Ahuva approaches port security systems

Ahuva delivered its first command and control centre in 2015 for the Visakhapatnam Port Authority, integrating security systems across the port estate under centralised monitoring. Its scope covers video surveillance and analytics, access control with boom barriers and visitor management, and command centres with incident management. It holds ISO 9001:2015 and ISO 27001:2022 certification.