Over my twenty years of auditing, I have worked in some of the most challenging environments on earth, but nothing quite matches the isolation and high stakes of auditing maritime security. When a merchant vessel transits through high-risk waters, such as the Gulf of Aden or the waters off West Africa, help is not minutes away. It can be days away. In these vast, isolated stretches of ocean, shipping companies rely on Private Maritime Security Companies to deploy Privately Contracted Armed Security Personnel. ISO 28007 is the highly specialized international standard that governs these companies. As a specific offshoot of the ISO 28000 family, it outlines the rigorous requirements for security providers offering armed guards on board ships. This is not a standard about corporate security policies written in a comfortable office. It is a standard about life-and-death decision-making, international maritime law, and the disciplined management of lethal force on the high seas.
The most fundamental concept in maritime law, and one that I scrutinize heavily during an audit, is the absolute authority of the Ship Master. Under international law, the Captain has ultimate, overriding authority over the safety and security of the vessel, its crew, and its cargo. A private security team, no matter how highly trained or heavily armed, does not operate independently. They are there to advise and support the Master. During audits, I look for explicit evidence of this relationship in the team operational procedures and pre-transit briefings. I verify that there is a documented agreement signed by both the Master and the Security Team Leader before transit begins, establishing who makes the decisions under what circumstances. I also check if the security team conducts joint drills with the ship crew, ensuring that everyone knows their role during an attempted boarding. The security team must fully understand that they cannot discharge a weapon or initiate an armed response without the explicit or standing authorization of the Master, except in cases of immediate, life-threatening self-defense. If a security company operates with a mercenary mindset, viewing the crew as secondary to their mission, they are a massive liability to the shipowner and will fail an ISO 28007 audit.
Just as in land-based operations, the Rules for the Use of Force are the legal and ethical backbone of a private maritime security company. However, at sea, the application of these rules is incredibly complex. An approaching skiff in the ocean could be a pirate attack, or it could simply be local fishermen seeking assistance, lost, or trying to protect their nets. A mistake in judgment can lead to international incidents, loss of innocent life, and severe criminal charges for the guards and the shipowner. When I audit compliance in this area, I look for a highly disciplined, graduated response plan. This begins with preparation and deterrence, showing a visible armed presence, preparing the vessel physical defenses like razor wire and water cannons, and using non-lethal deterrents like long-range acoustic devices or searchlights. If the threat persists, the team must use warning signals, firing flares or warning shots into the water ahead of the approaching craft to signal intent. The next step is disabling fire, targeting the outboard motors of the skiff if it continues to close in aggressively. Lethal force is used only as a last resort in response to an immediate, life-threatening attack on the vessel or its crew. I interview the security operators to ensure they can walk me through this escalation path under extreme stress, demonstrating a deep understanding of proportionality, necessity, and the legal jurisdictions of the territorial waters they pass through.
Managing firearms on land is heavily regulated, but managing them across international waters is a logistical nightmare. Security companies cannot easily transport automatic rifles and ammunition through commercial airports or across national borders. To solve this, the industry relies on floating armories, which are vessels anchored in international waters that legally store and lease weapons to security teams before they enter high-risk transit zones. Under ISO 28007, the traceability of weapons and ammunition must be absolute. During an audit, I trace the lifecycle of a weapon from end to end. I verify that the company has valid, legally binding export licenses and end-user certificates for every single firearm in their inventory. I look for an unbroken digital and physical log showing exactly when a weapon was checked out of a floating armory, who it was assigned to, and when it was returned. Ammunition accountability is equally critical, and I check if ammunition counts are verified at the start and end of every transit. If a single round is missing, there must be a documented investigation explaining why. If a company cannot account for its weapons, or if they are using unlicensed floating armories to bypass international maritime regulations, they pose an unacceptable risk to the global shipping industry.
The environment on a merchant ship is cramped, stressful, and monotonous. Security teams must live in close quarters with a crew of diverse nationalities for weeks at a time, often with little to do until a crisis strikes. This requires a very specific type of security operator. It is not enough to hire former military personnel; they must be vetted for psychological stability, cultural adaptability, and absolute discipline. When auditing human resources under ISO 28007, I look for comprehensive background checks, verifying military discharge papers, criminal records, and psychological evaluations. I also ensure operators are medically cleared for sea duty, including sea-survival training and trauma-medicine capabilities. Finally, I verify that operators are trained in international humanitarian law and the preservation of human rights, even when dealing with captured suspects.
ISO 28007 was created to clean up an industry that, in its early days, resembled the Wild West. Today, it serves as a shield of legitimacy. For shipowners, hiring a certified security company is a non-negotiable requirement for insurance compliance and risk management. For the security companies themselves, achieving this certification is proof that they operate not as cowboys, but as highly disciplined, legally compliant professionals who understand that the ultimate goal of maritime security is to protect life and trade without firing a single unnecessary shot.
The most fundamental concept in maritime law, and one that I scrutinize heavily during an audit, is the absolute authority of the Ship Master. Under international law, the Captain has ultimate, overriding authority over the safety and security of the vessel, its crew, and its cargo. A private security team, no matter how highly trained or heavily armed, does not operate independently. They are there to advise and support the Master. During audits, I look for explicit evidence of this relationship in the team operational procedures and pre-transit briefings. I verify that there is a documented agreement signed by both the Master and the Security Team Leader before transit begins, establishing who makes the decisions under what circumstances. I also check if the security team conducts joint drills with the ship crew, ensuring that everyone knows their role during an attempted boarding. The security team must fully understand that they cannot discharge a weapon or initiate an armed response without the explicit or standing authorization of the Master, except in cases of immediate, life-threatening self-defense. If a security company operates with a mercenary mindset, viewing the crew as secondary to their mission, they are a massive liability to the shipowner and will fail an ISO 28007 audit.
Just as in land-based operations, the Rules for the Use of Force are the legal and ethical backbone of a private maritime security company. However, at sea, the application of these rules is incredibly complex. An approaching skiff in the ocean could be a pirate attack, or it could simply be local fishermen seeking assistance, lost, or trying to protect their nets. A mistake in judgment can lead to international incidents, loss of innocent life, and severe criminal charges for the guards and the shipowner. When I audit compliance in this area, I look for a highly disciplined, graduated response plan. This begins with preparation and deterrence, showing a visible armed presence, preparing the vessel physical defenses like razor wire and water cannons, and using non-lethal deterrents like long-range acoustic devices or searchlights. If the threat persists, the team must use warning signals, firing flares or warning shots into the water ahead of the approaching craft to signal intent. The next step is disabling fire, targeting the outboard motors of the skiff if it continues to close in aggressively. Lethal force is used only as a last resort in response to an immediate, life-threatening attack on the vessel or its crew. I interview the security operators to ensure they can walk me through this escalation path under extreme stress, demonstrating a deep understanding of proportionality, necessity, and the legal jurisdictions of the territorial waters they pass through.
Managing firearms on land is heavily regulated, but managing them across international waters is a logistical nightmare. Security companies cannot easily transport automatic rifles and ammunition through commercial airports or across national borders. To solve this, the industry relies on floating armories, which are vessels anchored in international waters that legally store and lease weapons to security teams before they enter high-risk transit zones. Under ISO 28007, the traceability of weapons and ammunition must be absolute. During an audit, I trace the lifecycle of a weapon from end to end. I verify that the company has valid, legally binding export licenses and end-user certificates for every single firearm in their inventory. I look for an unbroken digital and physical log showing exactly when a weapon was checked out of a floating armory, who it was assigned to, and when it was returned. Ammunition accountability is equally critical, and I check if ammunition counts are verified at the start and end of every transit. If a single round is missing, there must be a documented investigation explaining why. If a company cannot account for its weapons, or if they are using unlicensed floating armories to bypass international maritime regulations, they pose an unacceptable risk to the global shipping industry.
The environment on a merchant ship is cramped, stressful, and monotonous. Security teams must live in close quarters with a crew of diverse nationalities for weeks at a time, often with little to do until a crisis strikes. This requires a very specific type of security operator. It is not enough to hire former military personnel; they must be vetted for psychological stability, cultural adaptability, and absolute discipline. When auditing human resources under ISO 28007, I look for comprehensive background checks, verifying military discharge papers, criminal records, and psychological evaluations. I also ensure operators are medically cleared for sea duty, including sea-survival training and trauma-medicine capabilities. Finally, I verify that operators are trained in international humanitarian law and the preservation of human rights, even when dealing with captured suspects.
ISO 28007 was created to clean up an industry that, in its early days, resembled the Wild West. Today, it serves as a shield of legitimacy. For shipowners, hiring a certified security company is a non-negotiable requirement for insurance compliance and risk management. For the security companies themselves, achieving this certification is proof that they operate not as cowboys, but as highly disciplined, legally compliant professionals who understand that the ultimate goal of maritime security is to protect life and trade without firing a single unnecessary shot.
