ISO Compliance Insights & Best Practices

C-TPAT: The Complete Guide to the Minimum Security Criteria (2026)

C-TPAT — the Customs Trade Partnership Against Terrorism, which U.S. Customs and Border Protection now writes CTPAT — is a voluntary supply chain security partnership launched in November 2001 that today counts, in CBP’s words, “more than 11,400 certified partners spanning the gamut of the trade community”. Members commit to meeting CBP’s Minimum Security Criteria (MSC) for their category, document how they do so in a security profile, and submit to validation by a CBP Supply Chain Security Specialist; in return they receive border benefits that range from fewer examinations and front-of-line inspections to access to FAST lanes and business-resumption priority after a disruption. There is no fee to join. This guide explains who is eligible, how the Minimum Security Criteria are organised — three focus areas, twelve categories and, for U.S. importers, 93 criteria marked Must or Should — what the security profile and validation involve, what the benefits are worth, how C-TPAT relates to AEO and ISO 28000, and where applicants fail.

C-TPAT: the Minimum Security Criteria in three focus areas — Corporate Security (vision, risk assessment, business partners, cybersecurity) · Transportation Security (conveyance and IIT, seals, procedural, agricultural) · People and Physical Security (physical, access, personnel, training) — U.S. importer MSC, October 2021.

Who can join C-TPAT

Category	Eligibility highlights (CBP)
U.S. importers and exporters	Active U.S. importer or non-resident Canadian importer (imported within the past 12 months); active importer-of-record number; valid continuous import bond; business office staffed in the U.S. or Canada; no unresolved debt to CBP
Highway carriers	U.S./Canada and U.S./Mexico cross-border carriers
Rail and sea carriers	Carriers moving cargo into the U.S.
Licensed U.S. customs brokers	Active licence
Marine port authority and terminal operators	U.S. ports and terminals
Consolidators, NVOCCs, ocean transportation intermediaries	Air freight consolidators and ocean intermediaries
Foreign manufacturers	Mexican and Canadian manufacturers; other countries through CBP’s foreign-manufacturer arrangements

Eligibility is by category with a U.S. nexus. An operator outside these categories — a European warehouse with no U.S. trade, for example — cannot join, and reaches equivalent treatment through its own customs programme and mutual recognition; our guide to the Authorised Economic Operator covers that route. Each application is considered individually, and CBP states that issues of concern may make an applicant ineligible.

The C-TPAT Minimum Security Criteria

Focus area	Category	What it covers	Criteria (U.S. importers, Oct 2021)
Corporate Security	1 Security Vision & Responsibility	Statement of support, cross-functional security team, written review component, knowledgeable point of contact	4
Corporate Security	2 Risk Assessment	Overall risk assessment of the supply chain; mapping cargo movement; annual review or more often as risk factors dictate	4
Corporate Security	3 Business Partners	Written, risk-based screening of new partners and monitoring of current ones; account for partners’ CTPAT or AEO status	6
Corporate Security	4 Cybersecurity	Policies and procedures; software and hardware defences; detection of unauthorised access; annual review; training	13
Transportation Security	5 Conveyance and Instruments of International Traffic	Secure storage; inspection procedures; hardware to withstand tampering	10
Transportation Security	6 Seal Security	High-security seals meeting the current ISO 17712 standard; seal inventories and audits; seal verification	5
Transportation Security	7 Procedural Security	Cargo staging and inspection; documentation controls; incident reporting procedures with escalation	16
Transportation Security	8 Agricultural Security	Pest contamination prevention in conveyances and cargo	1
People and Physical Security	9 Physical Security	Barriers and deterrents; manned or monitored gates; lighting, alarms, CCTV	15
People and Physical Security	10 Physical Access Controls	Photo ID for visitors, vendors and service providers; logs; badge control	8
People and Physical Security	11 Personnel Security	Screening and background checks appropriate to position	3
People and Physical Security	12 Education, Training and Awareness	Security and cybersecurity training by role; training for inspectors of empty conveyances	8

Ninety-three criteria in the October 2021 U.S. importer document, each marked Must — required — or Should — expected practice that CBP encourages and will discuss at validation; by our count of that document roughly a third are Must. Criteria ID numbers are not sequential because IDs not applicable to importers are omitted. Other categories have their own MSC documents with the same structure. The criteria are written as outcomes with implementation guidance rather than as a control catalogue, which is why a management-system approach fits them; our guide to ISO 28000 vs C-TPAT maps the two.

Joining C-TPAT: application, security profile, validation

Confirm eligibility for your category and clear any CBP debt issue.
Apply through the CTPAT Portal. Participation is voluntary and there is no cost to join.
Complete the supply chain security profile in the Portal, identifying how the company meets and maintains each criterion in its MSC. This is the document that takes the time: every criterion needs a description of the control and, in practice, the evidence behind it.
Certification. CBP reviews the profile; on acceptance the company becomes a certified partner and is assigned a Supply Chain Security Specialist.
Validation. The specialist verifies the profile against the operation — site visits, including foreign supply chain locations where relevant — and issues findings and, where needed, required actions.
Annual review. The profile is reviewed and updated annually; revalidation follows on CBP’s cycle.

What C-TPAT membership is worth

Benefit (CBP list)	What it means operationally
Reduced number of CBP examinations; possible exemption from stratified exams	Lower demurrage, faster release, fewer supply interruptions
Front-of-line inspections	When examined, examined first
Advanced Qualified Unlading Approval (AQUA) lane; shorter border wait times	Time at ports and land borders
Access to FAST lanes at land borders	Dedicated lanes for eligible highway carriers and importers
Assigned Supply Chain Security Specialist	A named CBP contact
Mutual recognition with foreign customs administrations	Treatment as a trusted trader in partner programmes such as the EU’s AEO
Business resumption priority after a natural disaster or terrorist attack	Your cargo moves first when ports reopen
Eligibility for other programmes	Trade Compliance Program; priority at Centers of Excellence and Expertise; FDA Secure Supply Chain pilot

Where C-TPAT applicants fail

A profile written from the criteria, not the operation. Validation compares the profile to the yard; a described control that does not exist is the finding.
No documented risk assessment. Category 2 requires it documented, mapped and reviewed annually.
Partners unscreened. Category 3 requires a written, risk-based process for new and current partners — including foreign manufacturers and carriers you do not control.
Seals without a programme. ISO 17712 seals bought but not verified at receipt, inventoried or audited.
Cybersecurity as an IT afterthought. Thirteen criteria for importers, reviewed annually, with role-based training.
Training records missing. Category 12 expects training by function, including for staff who inspect empty conveyances.

Frequently asked questions

What is C-TPAT?
The Customs Trade Partnership Against Terrorism (CTPAT), a voluntary U.S. Customs and Border Protection programme launched in November 2001 in which eligible trade companies meet CBP’s Minimum Security Criteria, document a security profile, undergo validation and receive border benefits. CBP reports more than 11,400 certified partners.

Does it cost anything to join?
No. CBP states participation is voluntary and there are no costs associated with joining. The cost is meeting the criteria and preparing for validation.

How many criteria are there?
For U.S. importers, 93 in the October 2021 Minimum Security Criteria, in twelve categories across three focus areas, each marked Must or Should. Other categories have their own MSC documents.

Is C-TPAT a certification?
CBP uses the term certified partner, but it is a programme membership validated by CBP rather than a third-party certificate. ISO 28000 is the certifiable standard that covers the same ground.

How does it relate to AEO?
Both implement the World Customs Organization SAFE Framework. CBP has mutual recognition arrangements with partner customs administrations, so an AEO in a partner jurisdiction receives comparable treatment and vice versa.

Where this leaves you

Treat C-TPAT as a security management exercise with a customs audience: map the chain, assess the risk, screen the partners, run the seal and access programmes, train by role, and write the profile from what the validator will see. Members that build the criteria into a management system keep the benefits through every annual review; members that wrote a profile once lose them at validation.

References

CBP: Customs Trade Partnership Against Terrorism (CTPAT) — Programme overview, benefits list, partner count.
CBP: CTPAT Importers — eligibility and application — Importer eligibility requirements and the security profile.
CBP: CTPAT Minimum Security Criteria — U.S. Importers (October 2021) — The criteria document.

More on supply chain security

C-TPAT — you are here
ISO 28000 vs C-TPAT
ISO 28000:2022 explained
Authorised Economic Operator
Supply chain security risk assessment
Supply chain security: two assurance routes

The security risk assessment, business partner screening procedure, seal control procedure, access control and visitor procedures, training records and the C-TPAT/AEO cross-mapping are in the ISO 28000 Supply Chain Security Toolkit, or start with the free templates.

Governance Docs

Governance Docs LLC