CTPAT Foreign Manufacturer Security Criteria: The 2020 Overview

This overview introduces CTPAT minimum security criteria for foreign manufacturers as reviewed by ITVC in 2020. The content is arranged into twelve groups to help businesses compare responsibilities, procedures and implementation evidence.

1. Corporate security

Security commitment and responsibilities

Management should demonstrate commitment, appoint responsible contacts and coordinate relevant departments. The security programme needs arrangements for checking implementation, reporting results and following corrective actions.

Supply-chain risk assessment

Map cargo movements from origin to distribution, including partners, transport legs, intermediate storage and dwell times. Identify vulnerable points, assess threats and update the assessment when circumstances change. Prepare incident-response and business-continuity arrangements.

Selecting and monitoring business partners

Screen new partners, collect security evidence and monitor existing partners according to risk. Communicate security expectations to outsourced providers. Address weaknesses through corrective measures and retain evidence of follow-up checks. Supply-chain management should also consider prohibited labour risks.

Cybersecurity

• Use individual accounts, assign access according to duties and adjust permissions when personnel change.
• Maintain endpoint protection, software updates, secure remote access and rules for personal devices.
• Back up and protect data, respond to incidents and securely dispose of information-bearing equipment.
• Train staff to recognise phishing and periodically assess the effectiveness of safeguards.

2. Transportation and cargo security

Inspecting conveyances and containers

Inspect before loading for unusual modifications, unauthorised entry and pests. The 2020 material discusses seven-point container inspections, with the fan housing added for refrigerated containers. Tractor and trailer inspections have a different scope depending on the transport route.

• Record the container or conveyance number, date and time, inspector and areas checked.
• Retain inspection records with shipping documents and supervise activities in a controlled area.
• Monitor the journey and stops, and report unusual signs to the responsible contact.

Managing security seals

Control seal purchasing, storage, issue, fitting and number verification. Apply VVTT: View the locking mechanism, Verify the number, Tug and Twist. If a seal is replaced or shows signs of interference, record the incident and replacement number and follow notification and investigation procedures.

Cargo security procedures

Reconcile physical cargo with documents, protect import and export information and supervise loading. Procedures should address shortages, overages, discrepancies, unauthorised people and security incidents. Record internal investigations without obstructing competent authorities.

Agricultural security

Control visible pests on cargo and containers and in storage areas. Consider requirements for wood packaging materials and the associated treatment evidence.

3. People and facilities

Physical security

Provide fencing, gates, lighting and restricted areas according to risk. Check and maintain cameras and alarms, control access to them and retain evidence appropriate for investigations.

Access controls

Manage employee, visitor, contractor and driver identification; record visits and deliveries; and withdraw access when no longer needed. Limit sensitive areas to authorised personnel.

Personnel security

Verify recruitment information within the law, communicate a code of conduct and assign responsibilities. Personnel checks must comply with applicable employment and data-protection requirements.

Training and awareness

Train people to identify and report threats and respond according to their roles. Tailor training for security-sensitive duties, retain attendance records and check practical implementation.

Getting started at your business

• Identify the applicable criteria and appoint a responsible contact.
• Assess gaps against the twelve groups above and assign owners and correction deadlines.
• Test procedures, exercise incident scenarios, check evidence and improve periodically.

Compiled by Pham Xuan Canh and ITVC Global’s consultancy and training team.

Official references

CTPAT — criteria by business entity

CBP’s December 2019 notice on criteria effective from January 2020