The explanation below retains the historical framework in the original article; the linked files are 2019 editions. This overview does not replace current CBP criteria. Confirm the business category, applicable version and mandatory versus recommended provisions before implementation.

Entity-specific documents — 2019 editions

The security requirements applicable to a business depend on its role in the supply chain.

CTPAT Minimum Security Criteria and Guidelines: participants must meet the criteria for their business category. Original download links are provided below.

Air Carriers — 2019

Consolidators (Air Freight Consolidators, Ocean Transport Intermediaries, and Non-Vessel Operating Common Carriers (NVOCC)) — 2019

Customs Brokers — 2019

Exporters — 2019

Foreign Manufacturers — 2019

Highway Carriers — 2019

Importers — 2019

Long Haul Carriers in Mexico — 2019

Marine Port Authority and Terminal Operators — 2019

Rail Carriers — 2019

Sea Carriers — 2019

Third Party Logistics Providers (3PL) — 2019

Minimum security criteria for foreign manufacturers

The following is an introductory explanation of minimum security criteria for a commonly encountered business category.

These criteria provide a framework for foreign manufacturers to establish effective security practices, improve supply chain performance and reduce loss, theft and contraband risks that could introduce terrorists or terrorist materials into international trade. Criminal activity and internal conspiracies require manufacturers to strengthen their security arrangements.

Foreign manufacturers should comprehensively assess their international supply chains at least annually, and when heightened alerts, security breaches or incidents warrant it. Where facilities, warehouses or other supply chain activities are outsourced, the manufacturer must work with those partners to ensure appropriate controls remain in place. The supply chain extends from origin, including manufacturers, suppliers and contractors, through distribution, recognizing different business models.

C-TPAT recognizes the complexity of international supply chains and supports security measures based on risk, allowing plans to be tailored to the member’s business model.

Appropriate security controls must be implemented and maintained throughout the manufacturer’s supply chain, according to the risks involved.

C-TPAT is a voluntary programme administered by US Customs and Border Protection (CBP). CBP determines membership and conducts validation. Consulting or a customer-requested assessment does not itself confer membership; check current criteria for the relevant business entity.

Eligibility depends on business type and geography. CBP’s foreign manufacturer document specifies active companies incorporated in Mexico or Canada. A supplier in Vietnam may need to implement and undergo assessment of customer security requirements, but that outcome does not automatically confer C-TPAT membership.

CBP — C-TPAT

Business partner requirements

Manufacturers must have documented, verifiable processes for selecting carriers, other manufacturers, suppliers and contractors, including providers of components and raw materials.

Security procedures

For business partners eligible for C-TPAT, such as carriers, importers, ports, terminals, brokers and consolidators, manufacturers must retain evidence of whether the partner is certified, for example programme documentation or status verification information.

Partners not eligible for C-TPAT must demonstrate that they meet relevant security criteria through written or electronic evidence. Examples include contractual commitments, a senior officer’s attestation, a written compliance declaration, participation in an equivalent customs-administered supply chain security programme aligned with WCO principles, or a completed security questionnaire. A documented risk assessment should determine how compliance by ineligible partners is verified.

Point of origin

Business partners must develop security processes protecting shipment integrity at the point of origin, assembly or manufacture. Review partners’ processes and facilities periodically according to risk and maintain the manufacturer’s required security standards.

Participation in foreign customs supply chain security programmes

Current or prospective partners certified under a foreign customs administration’s security programme should disclose their participation status to the manufacturer.

For US-bound shipments, manufacturers must monitor whether C-TPAT carriers subcontract transportation to another approved C-TPAT carrier or to an uncertified carrier that meets the applicable business partner security criteria.

Because manufacturers are responsible for the containers and trailers they load, they must work with carriers to maintain effective controls at the loading point.

Container and trailer security

Protect container and trailer integrity against unauthorized materials or persons. Establish loading-point controls for correct sealing and continuing integrity, and apply high-security seals to loaded US-bound containers and trailers. The original text refers to PAS ISO 17712; the applicable current seal specification must be confirmed.

Where the geographical risk assessment identifies concealment or smuggling of people as a risk, controls at the factory or loading point must address it.

Container inspection

Before loading, verify the container’s physical integrity and the reliability of its door-locking mechanisms. The original guidance recommends these seven inspection areas:

1. Front wall
2. Left side
3. Right side
4. Floor
5. Ceiling and roof
6. Inside and outside the doors
7. Exterior and undercarriage

Trailer inspection

Before loading, verify the trailer’s physical integrity and door-locking mechanisms. The original guidance recommends these ten inspection areas:

1. Fifth-wheel area, including natural compartments and the skid plate
2. Exterior front and sides
3. Rear bumper and doors
4. Front wall
5. Left side
6. Right side
7. Floor
8. Ceiling
9. Inside and outside the doors
10. Exterior and undercarriage

Container and trailer seals

Sealing and maintaining seal integrity are essential parts of supply chain security. Apply high-security seals to US-bound loaded containers and trailers. The original reference uses PAS ISO 17712 terminology; verify the currently applicable specification.

Written procedures must govern seal control and application, including how to recognize and report compromised seals, containers or trailers to CBP or the appropriate foreign authority.

Only designated personnel may issue seals to maintain their integrity.

Container and trailer storage

Store containers and trailers under the manufacturer’s control in a secure area to prevent unauthorized access or interference. Procedures must address and report unauthorized entry into the equipment or its storage area.

Physical access controls

Access controls prevent unauthorized entry, regulate employee and visitor access and protect company assets. Positively identify employees, visitors and vendors at every entry point.

Employees

Use an identification system to control employee access. Grant access only to secure areas needed for assigned duties. Management or security personnel must control the issue and withdrawal of employee, visitor and vendor identification.

Document the issue, removal and alteration of access devices such as keys and access cards.

Visitors

Check visitors’ photographic identification on arrival. Escort visitors and require them to display temporary identification visibly.

Deliveries, including mail

Check appropriate vendor identification and photographic documents when vendors arrive. Screen incoming packages and mail periodically before distribution.

Unauthorized or unidentified persons

Maintain procedures to identify, challenge and deal with unauthorized or unidentified persons.

Personnel security

Screen prospective employees and review existing employees periodically.

Pre-employment verification

Verify application information, including employment history and references, before hiring.

Background checks and investigations

Conduct background checks in accordance with applicable local rules. After hiring, carry out periodic checks or reinvestigations where justified by circumstances or the sensitivity of the role.

Employment termination procedures

Remove identification credentials, facility access and system access when employment ends.

Procedural security

Protect the integrity and security of processes involved in transporting, handling and storing cargo throughout the supply chain.

Documentation processing

Ensure customs-clearance information is complete, legible and accurate, and protected against substitution, loss or false data. Document controls must also protect computer and information access.

Manifest procedures

Ensure information received from business partners is reported accurately and promptly to protect cargo integrity.

Shipping and receiving

Reconcile departing cargo with the manifest. Verify accurate descriptions, weight, labels, marks and quantities against purchase or delivery orders. Positively identify drivers before releasing or accepting cargo and maintain procedures to track incoming and outgoing movements promptly.

Cargo discrepancies

Resolve or investigate shortages, overages and other significant discrepancies or anomalies. Notify customs or other appropriate law enforcement authorities of illegal activity or suspicious irregularities as warranted.

Physical security

International cargo-handling and storage facilities must have barriers that protect against unauthorized access. Apply relevant physical-security criteria throughout the manufacturer’s supply chain.

Fencing

Perimeter fencing should enclose cargo-handling and storage areas. Internal fencing should segregate domestic, international, high-value and hazardous cargo. Inspect fencing regularly for damage and integrity.

Gates and gatehouses

Staff or monitor gates used by vehicles or personnel. Keep the number of gates to the minimum compatible with appropriate access and safety.

Parking

Do not allow private passenger vehicles to park in or adjacent to cargo-handling or storage areas.

Building structure

Use construction materials that resist unauthorized entry, and maintain structural integrity through inspection and repair.

Locks and key controls

Protect external and internal windows, gates and fences with locking devices. Management or security staff must control the issue of locks and keys.

Lighting

Provide adequate lighting inside and outside the site, including entrances, exits, cargo-handling and storage areas, fence lines and parking areas.

Alarms and video surveillance

Use alarms and video surveillance to monitor the premises and deter unauthorized access to cargo-handling and storage areas.

Information technology security

Password protection

The original guidance requires individually assigned accounts and periodic password changes. Establish IT security policies, procedures and standards and train employees in them; use the current applicable cybersecurity criteria when implementing controls.

Accountability

Maintain controls that identify IT misuse, unauthorized access and tampering with business data. Apply appropriate disciplinary measures for violations, consistent with applicable requirements.

Security training and threat awareness

Security staff must maintain a programme that helps employees recognize terrorist and smuggling threats throughout the supply chain. Employees must know response and reporting procedures. Provide additional training for shipping, receiving and mail-handling personnel.

Provide targeted training on cargo integrity, internal conspiracies and access control, with arrangements that encourage active employee participation.

Risk assessment notes

Note 1. Maintain a documented, verifiable risk-assessment process appropriate to the business model, considering volumes, origin countries, routes, C-TPAT participation, open-source threat information, inadequate controls and previous security incidents.

Note 2. Maintain a documented, verifiable process for identifying supply chain risks in light of the business model, including volumes, origin countries, routes and open-source threat information.

Related articles

Introduction to C-TPAT

Benefits of C-TPAT

C-TPAT consulting process

C-TPAT requirements

C-TPAT container inspection

C-TPAT truck and trailer inspection