A concept for one login across port portals. Not a product yet; see what exists and what is only planned.
One account per portal, and it adds up
This page is for whoever owns identity and access across a port operation — the security or IT lead, and the integrators who connect to port portals. It describes a concept, not a product: read it, measure where you stand with the self-check, and tell us whether the idea is worth building. Every claim is tied to a public, dated source.
A shared identity for port actors
The idea is simple: carry what the web already does for identity into the port, on open standards, without any portal giving up control of its own permissions. This is a concept and, at most, a specification in the making. Read the next section before you assume any of it exists.
Run it your way
What exists today, and what is only a concept
Read this before anything else. On this page, Available means there is a resource or running code you can use today. Concept and Coming mean an idea, or something not built yet. Nothing about the PCA Passport itself is Available: the cards marked Available below are existing, separate resources, not the Passport.
Concept · the PCA Passport
The open standards it would build on
Click a standard to read what it is and why it matters. These are what a shared identity would be built on — not a claim that it already exists.
The two open standards most portals use for single sign-on. A shared identity would speak one or both, so a portal could recognise a port actor without holding its own password. Sources: OpenID Connect Core 1.0 (incorporating errata set 2) (15 December 2023) · OASIS, Assertions and Protocols for SAML V2.0 (OASIS Standard) (15 March 2005).
How an application is granted limited, revocable access on behalf of a user or a system. The security best current practice rules out weak flows and recommends strong client authentication. Source: RFC 9700, Best Current Practice for OAuth 2.0 Security (January 2025).
Phishing-resistant authentication bound to the real site, so a one-time code phished on a look-alike page cannot be replayed. For the most sensitive actions. Source: W3C Web Authentication (WebAuthn) Level 2, Recommendation (8 April 2021).
Risk-based levels for how strongly to authenticate, and how to manage the life of an account. Sources: NIST SP 800-63-3, Digital Identity Guidelines (June 2017, updated 2 March 2020) · NIST SP 800-63B, Authentication and Lifecycle Management (June 2017, updated 2 March 2020).
Why access control, supplier access and accountable logging are not optional for port operators. Sources: Directive (EU) 2022/2555 (NIS2), Article 21 (14 December 2022) · 33 CFR 101.650, Security measures for access control (eCFR) (eCFR, checked 11 November 2026) · ASD ACSC, CISA and partners, Best practices for event logging and threat detection (21 August 2024).
Join the waiting list
There is nothing to sign into. If you want to follow the idea, or tell us it would help your operation, register your interest. We will not create any account or charge anything; this only adds you to a list we use to decide whether to build.
What this list is
What it is not
Download the port identity self-check
A worksheet to measure your own position: how many portals, how much sprawl, how much multi-factor, and how fast you can remove access. 15 questions in 5 areas. Version 1.0, published 11 November 2026. Generic: no terminal, port, client or product named, no invented figure.
The concept, honestly: questions
Click a question to read the answer.
No. There is no PCA Passport product, login, sign-up or endpoint. This page describes a concept and a direction. The links on it marked Available point to separate resources that do exist; the Passport itself does not.
No date is promised. This is a concept. If and when a specification or a preview is published, it will be announced on this page and to anyone who registered their interest. Until then, nothing is available.
Open standards already used on the web: OpenID Connect and SAML 2.0 for single sign-on, OAuth 2.0 for delegated access, FIDO2 and WebAuthn passkeys for phishing-resistant authentication, and the risk-based levels of NIST's digital identity guidance. The standards section lists them with their sources.
No. Registering interest uses the Become a member page to reach us. It is a list to gauge whether this is worth building; no identity account is created, nothing is switched on, and nothing is charged.
That page is a buyer's guide to help you choose and run an identity tool yourself today, and it is available now. This page describes a shared identity across port portals, which is a concept, not a tool you can deploy.
Yes. The CSV and PDF are published under the Creative Commons Attribution 4.0 licence (CC BY 4.0): copy and adapt them, including commercially, as long as you credit Port Cyber Alliance and link to this page. The self-check is generic, names no terminal or software vendor, and is not legal advice.
Related pages
If a shared identity across port portals would help your operation, tell us: it is the clearest signal we have for whether to turn this concept into a specification.
There is no service to sign up for — only a list of interest.