Port Facility Security Assessment (PFSA): A Step-by-Step Guide

Introduction: Why PFSA Compliance Is Non-Negotiable in 2026

For terminal operators, port managers, and Port Facility Security Officers (PFSOs) across the United Kingdom, the Port Facility Security Assessment (PFSA) is the cornerstone of a legally compliant and operationally effective security regime. Required under the ISPS Code — which was incorporated into UK law following the country’s departure from the EU via the Merchant Shipping (ISPS Code) Regulations — the PFSA is not a paper exercise. It is the foundation upon which every port facility’s security plan is built, and it must be conducted, documented, and reviewed to an exacting standard.

Despite the clear legal obligation, the PFSA remains one of the least well-understood compliance requirements in the UK port sector. Many terminal operators rely on outdated assessments that no longer reflect the current threat environment. Others use assessment methodologies that are technically compliant but insufficiently rigorous to identify genuine vulnerabilities. And in an environment where the UK’s Department for Transport actively enforces ISPS obligations, the consequences of non-compliance — detention, prosecution, and reputational damage — are very real.

This step-by-step guide is designed to give UK terminal operators and PFSOs the practical knowledge they need to conduct, document, and maintain a PFSA that meets regulatory standards and genuinely enhances the security of their facility.

1. What Is a Port Facility Security Assessment?

The Port Facility Security Assessment is a comprehensive risk analysis of all aspects of a port facility’s operation, designed to identify which parts of the facility are most susceptible to a security incident. Under Section 15 of the ISPS Code’s mandatory Part A, every port facility that serves ships on international voyages is required to have a current, approved PFSA. In the UK, this requirement is administered by the Department for Transport (DfT), which designates approved Recognised Security Organisations (RSOs) to conduct and review PFSAs on behalf of the government.

The PFSA informs and underpins the Port Facility Security Plan (PFSP) — the operational document that describes the measures the facility will implement to mitigate the risks identified in the assessment. Without a robust PFSA, the PFSP has no credible analytical foundation, and the facility’s security framework is correspondingly weak.

2. Step-by-Step: How to Conduct a PFSA

Step 1: Identify the Scope of the Assessment

Begin by defining the physical and operational boundaries of the assessment. A port facility may include the berths where ships moor, cargo handling areas, passenger terminals, warehousing, restricted zones, and the waterside approaches from seaward. Each distinct operational area within the facility boundary must be included in scope.

For large ports containing multiple independently operated facilities, each facility will typically require its own separate PFSA and PFSP, even where they share common infrastructure with the wider port estate.

Step 2: Identify Assets and Critical Infrastructure

Systematically identify and document all assets within the facility that could be the target of a security incident, could be used to facilitate an attack, or whose damage or compromise would have significant consequences. These typically include:

• Vessel berths and mooring infrastructure
• Cargo handling equipment including cranes, forklifts, and conveyors
• Dangerous goods storage areas including fuels, chemicals, and hazardous materials
• Passenger processing areas and terminal buildings
• Security systems including CCTV, access control, and alarm systems
• Utilities infrastructure including power, water, and communications
• Shore-side areas providing access to ships or restricted zones

Step 3: Assess the Threat Environment

The PFSA must be developed in consultation with the relevant national security organisations. In the UK, this means engaging with the DfT’s Maritime Security team and, where appropriate, the National Counter Terrorism Security Office (NaCTSO) and port police. The assessment must identify the threat level applicable to the facility and consider the full spectrum of possible security incidents:

• Damage to or destruction of the port facility or ships
• Hijacking or seizure of ships or persons on board
• Tampering with cargo, essential equipment, or systems
• Unauthorised access or movement
• Smuggling of weapons, persons, or dangerous substances
• Use of the port facility as a base for an attack against another facility or ship

Step 4: Conduct the Vulnerability Assessment

For each critical asset identified in Step 2, assess the vulnerability to each credible threat identified in Step 3. Vulnerability analysis should consider both physical vulnerabilities (inadequate fencing, poor lighting, insufficient CCTV coverage) and procedural vulnerabilities (inadequate access control, poor document verification, insufficient security training).

The assessment should produce a risk matrix that allows the PFSO and management to prioritise the vulnerabilities that present the greatest combination of likelihood and consequence. This matrix becomes the basis for the risk mitigation measures captured in the PFSP.

Step 5: Identify Risk Mitigation Measures

For each identified vulnerability, document the existing security measures in place and assess their adequacy. Where gaps are identified, recommend specific additional measures. These might include physical measures (additional fencing, lighting, CCTV), procedural measures (enhanced access control procedures, improved cargo verification processes), or personnel measures (additional security staff, enhanced PFSO training).

Step 6: Document the PFSA Report

The completed PFSA must be documented in a formal report that meets the requirements of Section 15 of the ISPS Code and the DfT’s guidance for UK port facilities. The report must be protected as sensitive security information and access restricted to those who need to know its contents.

The report must be submitted to the DfT for approval. In the UK, the DfT may conduct its own review of the PFSA or delegate the review to an approved RSO. Approval is a prerequisite for the associated PFSP to take effect.

Step 7: Review and Update

The PFSA is not a one-time exercise. The ISPS Code requires that it be reviewed when changes in the threat environment, changes to the facility’s infrastructure or operations, or the occurrence of security incidents warrant a reassessment. In practice, UK port operators should plan for a comprehensive review at least every five years, with interim reviews following any significant change in threat level, physical infrastructure, or operational profile.

3. Common PFSA Failures in UK Port Facilities

Neptune P2P Group’s ports and terminal security advisors regularly identify the following shortcomings in PFSA documentation and methodology across UK facilities:

• Outdated threat assessments: PFSAs that have not been updated to reflect current threat intelligence, including the elevated cyber threat to port systems and the state-sponsored threat to maritime infrastructure.
• Incomplete asset identification: Key assets — particularly utilities, communications infrastructure, and waterside approaches — omitted from the scope of the assessment.
• Generic vulnerability assessments: Boilerplate vulnerability text that has not been tailored to the specific physical layout, operational profile, and threat environment of the individual facility.
• Inadequate consultation: PFSA methodology that does not demonstrate meaningful engagement with the DfT, port police, or other relevant national security stakeholders.
• Poor documentation controls: Sensitive security information within the PFSA report not adequately protected against unauthorised access or disclosure.

4. The Role of the PFSO in the PFSA Process

The Port Facility Security Officer bears the primary responsibility for ensuring that the PFSA is conducted, documented, and maintained to the required standard. This is a significant and demanding role that requires both technical knowledge of the ISPS Code framework and practical security expertise in risk assessment methodology.

Neptune P2P Group’s PFSO training course, delivered in Manchester and available as bespoke in-facility training across the UK, provides PFSOs with the skills and knowledge to conduct PFSAs, develop PFSPs, manage security drills and exercises, and maintain compliance with UK port security regulations. The course is ISPS-compliant and meets the requirements of the DfT for PFSO qualification.

Conclusion: A Rigorous PFSA Is Your First Line of Defence

The Port Facility Security Assessment is not a compliance burden — it is the most important tool available to a UK terminal operator for understanding and managing the security risks facing their facility. A rigorous, current, and well-documented PFSA provides the analytical foundation for an effective PFSP, supports meaningful engagement with law enforcement and government security agencies, and demonstrates to port state control inspectors and the DfT that the facility takes its security obligations seriously.

Neptune P2P Group’s ports and terminal security in UK has the expertise to support UK terminal operators at every stage of the PFSA process — from initial scoping and threat assessment through to final documentation, DfT submission, and PFSO training. Contact our team to discuss your facility’s requirements.

About Neptune P2P Group

Neptune P2P Group is a global security risk solutions company founded in 2009 and owned by former British and French Special Forces personnel. With over 8,500 completed security tasks across the AMEA region and a 100% success record for anti-piracy operations, Neptune P2P Group delivers maritime security services, ports and terminal security, protective security, maritime security training, and travel risk management to shipping companies, port operators, corporations, and governments worldwide.