Security levels and the plan
ISPS works on three security levels, 1 (normal), 2 (heightened) and 3 (exceptional), and each ship operates to an approved Ship Security Plan (SSP) that sets the measures for each level. A Declaration of Security may be completed at the ship/port interface where the parties need to agree responsibilities.
People and certificates
Each ship has a Ship Security Officer (SSO) and each company a Company Security Officer (CSO); port facilities have their own security officers. Compliance is evidenced by the International Ship Security Certificate (ISSC), and ships carry a Ship Security Alert System (SSAS) that can quietly signal a security threat to the authorities.
Demonstrable, not theoretical
As with ISM, the standard is practical: access control, restricted areas, drills and exercises must be real and evidenced. Port State Control will test whether the crew can actually operate the plan, not just produce it.