Under the Cayman flag, the ISM and ISPS Codes apply in full to yachts engaged in trade of 500 GT and above: the managing company holds a Document of Compliance (DOC), the yacht a Safety Management Certificate (SMC) and an International Ship Security Certificate (ISSC) — and the Cayman Islands Shipping Registry (CISR) conducts the audits itself, except in exceptional circumstances. Below 500 GT, a commercial yacht must still keep a working “mini-ISM” on board, checked at every annual survey; pleasure yachts in strictly private use sit outside the mandatory scope of both codes.
Who is caught: the applicability matrix
The trigger is not size alone but the combination of use and gross tonnage. Strictly speaking, ISPS applies through SOLAS Chapter XI-2 to ships on international voyages; in practice, the registry treats every commercial yacht of 500 GT and above as subject to it.
| Category | ISM | ISPS | Key certificates |
|---|---|---|---|
| Pleasure yacht (strictly private use) | Not mandatory | Not mandatory | Voluntary Statement of Compliance possible |
| Commercial <500 GT | Mini-ISM (REG Yacht Code Part A, Ch. 23A) | No ISSC required | Checked at annual survey; annual confirmatory MLC inspection (yachts without an MLC certificate) |
| Commercial ≥500 GT | Full ISM: DOC + SMC | CISR-approved SSP, ISSC | Plus MLC certificate, CSR on board |
| Passenger yacht Part B (13–36 passengers) | ISM regardless of tonnage | ISPS regardless of tonnage | SOLAS passenger ship |
Part B of the REG Yacht Code — 13 to 36 passengers on international voyages, private or commercial, any size — targets passenger ships under SOLAS: ISM and ISPS apply whatever the tonnage (CIGN 02/2025 Rev 1.2, January 2026).
ISM above 500 GT: DOC, SMC and an auditor called the CISR
ISM rests on two linked certificates: the DOC attests that the operating company runs a compliant safety management system; the SMC, that this system actually lives on board. No SMC without a valid DOC (CISR Yachtmaster’s Handbook, 2018 edition).
The Cayman specificity lies in who audits: the CISR normally conducts all DOC audits of companies operating commercial yachts itself, as well as shipboard ISM audits; only interim audits may be delegated to class (CIGN 02/2025 Rev 1.2 “Instructions to ROs”, section 11.2.2, January 2026; IACS Procedure No. 9 Rev.3, IMO Res. A.1118(30)).
The cycle as described by the registry (2018 edition):
- interim DOC of 12 months maximum for the first vessel over 500 GT taken under operational control; full-term DOC of 5 years, audited annually;
- interim SMC and ISSC of 6 months, then 5-year certificates;
- a 12-month intermediate audit window between the 2nd and 3rd anniversary, with no extension possible;
- renewal within the 3 months before expiry.
Before the initial CISR audit, the company must have carried out at least one internal audit — then at intervals of no more than 12 months — and shipboard audits are arranged via the yacht’s Designated Person Ashore. Cursorio holds that role on an outsourced basis — DPA — with a mock ISM/ISPS audit before the administration steps on board.
Below 500 GT: the Chapter 23A mini-ISM
Every yacht engaged in trade under 500 GT must maintain a working mini-ISM on board (Yachtmaster’s Handbook, §7.4, 2018 edition). The framework is Chapter 23A of the REG Yacht Code Part A: a simple safety management system, specific to the yacht, which may be developed on board — health and safety policy, operational procedures, communication, accident reporting, emergencies and drills, training, maintenance, review at least every three years.
An important nuance: the mini-ISM is not audited — in the registry’s own words, it “is not auditable” — but whether it is genuinely in use is checked at every annual survey. And Chapter 23A requires neither a DOC nor a DPA below 500 GT — market practice: insurers and charter brokers frequently expect a shore-based structure.
ISPS: a Ship Security Plan only the CISR can approve
On the security side, the scope covers cargo ships of 500 GT and above, all passenger ships, and pleasure yachts as soon as they engage in commercial activity — always on international voyages (the registry’s Maritime Security page).
A Ship Security Assessment (SSA) underpins the Ship Security Plan (SSP). The Cayman rule: every SSP must be approved by the CISR — class is not authorised, and a recognised organisation issuing the ISSC may only approve amendments (CISN 01/2020). The interim audit only takes place after the CISR has acknowledged receipt of the SSP and the SSA (CIGN 02/2025 Rev 1.2, section 12).
In operation:
- security records kept in English, retained for at least 3 years (1 year on board plus 2 years at the office is accepted);
- SSAS tested functionally at intervals not exceeding 3 months, with a live test at every audit, interim included;
- Continuous Synopsis Record (CSR) on board from 500 GT (CISN 04/2007), maintained by the master, checked by Port State Control;
- real SSAS alert: the Company Security Officer reports it immediately to the CISR and to MRCC Falmouth, then again once the status has been determined (CISN 02/2015 Rev 2.2, 2020).
Security audits take place at approximately 30-month intervals, synchronised with ISM audits and MLC inspections; for security officers, the CISR accepts training approved by any administration on the STCW White List.
Pleasure yachts: out of scope, voluntary compliance available
A pleasure yacht in strictly private use is subject to neither ISM nor ISPS. A private yacht voluntarily complying with the REG Yacht Code Part A, with omissions — typically ISPS or MLC —, can obtain at the CISR’s discretion an annually endorsed Statement of Compliance listing the non-compliant items (CIGN 02/2025 Rev 1.2, section 10.3). Even without the obligation, a structured voluntary SMS carries weight with insurers, with Port State Control and at resale.
The YET case: commercial compliance at all times
The Yacht Engaged in Trade programme (CIGN 06/2026 Rev 1.0, June 2026) creates no relief: permanent compliance with the REG Yacht Code as applicable to commercial yachts, chartering or not, and certification to the same requirements as a permanently registered commercial vessel. A YET of 500 GT and above therefore keeps its SMC and ISSC even during private use. Status drives the obligations — see pleasure vs commercial under the Cayman flag.
What this means in operation
Four disciplines sum up the cycle: anticipate the intermediate window, which does not extend; book every CISR audit via the DPA; keep security records in English on a rolling three-year basis; test and document the SSAS every quarter. The corresponding budget is quantified on our Cayman flag costs page. Cursorio holds the DPA and CSO roles on an outsourced basis, under the direct responsibility of an unlimited Master Mariner.