AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor CTPAT importers, carriers, brokers and other partners whose security profile rests on written procedures, an annual risk assessment and signed Code of Conduct acknowledgments.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
Voluntary: importers, carriers, customs brokers, consolidators, foreign manufacturers, third party logistics providers and other trade entities that choose to join, each meeting the criteria for its business type.
CBP CTPAT Supply Chain Security Specialists, through validations and revalidations
Security profile updated and submitted every year by the CTPAT anniversary date; validations and revalidations on a four-year cycle
Minimum Security Criteria for U.S. Importers, October 2021 edition of the criteria introduced in 2020; separate criteria documents for each partner type, 2021-10. Free to read.
| Date | What happens | Status |
|---|---|---|
| 2026-07 | CBP issues CTPAT alert: Stopping Forced Labor in the Supply Chain | Done |
Each one needs an owner, an approval, and proof it reached the people it covers.
MSC 1.3
The security program includes a written review plan that holds personnel accountable and checks that every security procedure is carried out as designed.
MSC 2.1, 2.3
A documented overall risk assessment identifying threats and vulnerabilities across the supply chain, reviewed at least annually or sooner when risk factors change.
MSC 3.1, 3.9
A written, risk-based process for screening and monitoring business partners, and a documented social compliance program addressing forced labor in imported goods.
MSC 4.1, 4.6
Comprehensive written cybersecurity policies covering every individual cybersecurity criterion, reviewed annually or sooner when risk or events such as a cyberattack dictate.
MSC 5.2, 6.1, 7.23
Written procedures for security and agricultural inspections, high-security seal control and incident reporting with internal escalation, kept at the local operating level.
MSC 11.1, 11.5
Written processes to screen applicants and periodically check employees, plus a Code of Conduct with penalties that each employee or contractor signs as read and understood.
Citations are to the standard or regulation; wording is ours.
What reviewers sample about these documents and the people they cover.
CBP gives at least thirty days' written notice of a validation with a request for supporting documentation, and reviews the security profile against the criteria before the visit.
Members keep training logs, sign-in sheets or electronic training records, which should show the date of training, names of attendees and topics covered.
Each employee and contractor acknowledges the Code of Conduct by signing it, and that acknowledgment is kept in the employee's file for documentation.
The risk assessment, cybersecurity policies, seal procedures and security technology procedures each carry an annual review, so revision dates are visible across the documents.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of CTPAT? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
Yes. The criteria refer to written, paper-based documents, but CBP states that electronic documents, electronic signatures and other digital technologies are also acceptable ways to document required procedures.
Under the CTPAT partnership agreement, partners complete and submit an updated security profile once a year, due on the anniversary date shown in the portal. Validation timing follows the last validation on a four-year cycle.
CBP publishes separate Minimum Security Criteria for each partner type, including highway carriers, customs brokers, foreign manufacturers and third party logistics providers. Criteria ID numbers that do not apply to a business type are left out of its document.
CBP describes validations as joint reviews of the security profile with the partner, focused, concise and lasting no longer than ten working days. CBP does not conduct unannounced validations.
Each criterion in the CBP document is marked Must or Should. Must items are required, and Should items are recommended practices.
free for 30 days