Read: 12
The C-TPAT (Customs-Trade Partnership Against Terrorism) Minimum Security Criteria (MSC) form the backbone of supply chain security compliance for over 11,000 certified participants accounting for more than 52% of total U.S. import value (GAO-26-107893). Understanding and implementing these 12 criteria is essential for any company seeking C-TPAT certification — or preparing for revalidation. This guide provides a comprehensive breakdown of each MSC area, practical implementation guidance, and tips for a successful validation.
Overview of the 12 Minimum Security Criteria
According to the U.S. Government Accountability Office (GAO-26-107893), C-TPAT participants must implement security measures across 12 core criteria areas. These criteria are assessed through the CTPAT Portal security profile and verified during on-site validation by a CBP Supply Chain Security Specialist (SCSS). Below is a detailed breakdown of each criterion with practical implementation guidance.
MSC 1: Security Vision and Responsibility
GAO Definition: The participant's C-TPAT point of contact must be knowledgeable about program requirements and provide regular updates to upper management on audit and validation outcomes.
What to Implement: Designate a C-TPAT Security Officer with defined responsibilities and direct access to senior management. Establish a written security policy signed by executive leadership that communicates the company's commitment to supply chain security. Document regular security review meetings and ensure the C-TPAT point of contact maintains current knowledge of program requirements through CBP training resources and the CTPAT Portal. The security profile must demonstrate that security is not just a compliance function but a leadership priority.
MSC 2: Risk Assessment
GAO Definition: Participants must conduct an overall risk assessment to identify where security vulnerabilities may exist and document this.
What to Implement: Conduct annual supply chain risk assessments that evaluate security vulnerabilities at every node in your supply chain — from origin facilities and consolidation points through transit routes, warehousing, and final delivery. The assessment should consider geographic risk, cargo type, partner reliability, and historical security incidents. Document the assessment methodology, findings, and corrective actions taken. CBP reviewers look for evidence that risk assessment drives actual security improvements, not just a static document on a shelf.
MSC 3: Business Partner Requirements
GAO Definition: Participants must have a written, risk-based process for screening new participants and monitoring current participants, including checks on activity related to money laundering and terrorist financing.
What to Implement: Establish written procedures for vetting all new suppliers, carriers, vendors, and other business partners. Include security criteria in all contracts and service agreements, requiring partners to maintain C-TPAT-equivalent security standards where feasible. Conduct periodic reviews of current partners, screening for compliance issues, security incidents, and financial integrity indicators. Maintain a documented partner approval and monitoring process that can be presented during validation.
MSC 4: Cybersecurity
GAO Definition: Participants using network systems must regularly test the security of their information technology infrastructure. If vulnerabilities are found, corrective actions must be implemented as soon as feasible.
What to Implement: Deploy firewalls, antivirus/antimalware protection, and intrusion detection systems across all network systems that handle supply chain data. Conduct regular vulnerability scans and penetration tests — at minimum annually, with more frequent testing for high-risk systems. Enforce multi-factor authentication for all supply chain management platforms and systems. Encrypt sensitive data in transit and at rest. Maintain a patch management policy and cybersecurity incident response plan. Document all tests, findings, and remediation actions.
MSC 5: Conveyance and Instruments of International Traffic Security
GAO Definition: The C-TPAT inspection process must have written procedures for both security and agricultural inspections.
What to Implement: Develop and document written inspection procedures for all conveyances — containers, trailers, railcars, and other instruments of international traffic. Conduct pre-loading inspections to verify structural integrity and post-loading inspections to confirm cargo security. Include agricultural contamination checks in inspection procedures (visual inspection for pests, soil, plant material). Maintain inspection logs with dates, findings, and corrective actions. Train personnel on proper inspection techniques.
MSC 6: Seal Security
GAO Definition: Participants must have detailed, written high-security seal procedures that describe how seals are issued and controlled at the facility and during transit.
What to Implement: Use ISO 17712-compliant high-security seals for all ocean containers. Establish a seal management system covering procurement, storage, issuance, and tracking. Document seal numbers on all shipping documents and verify them at each supply chain handoff. Define procedures for reporting and investigating broken, missing, or incorrect seals. Train staff on proper seal application, verification, and chain-of-custody documentation. A common validation finding is incomplete seal tracking — the SCSS will verify that seal numbers on documents match actual container seals.
MSC 7: Procedural Security
GAO Definition: Participants must initiate their own internal investigations of any security-related incidents immediately after becoming aware of the incident.
What to Implement: Establish documented procedures for cargo handling, manifest verification, and anomaly reporting. Verify cargo manifests against actual shipments — quantity, weight, description, and container number. Implement a cargo tracking and reconciliation system to identify discrepancies quickly. Define a clear incident reporting chain and investigation protocol. Document all security incidents and the corrective actions taken. Maintain records of cargo discrepancies and resolution steps.
MSC 8: Agricultural Security
GAO Definition: Participants must have written procedures designed to prevent apparent pest contamination, including compliance with certain regulations.
What to Implement: Implement pest control and sanitation procedures at all facilities handling cargo destined for the United States. Document agricultural inspection procedures that address pest contamination risks specific to your products and supply chain. Train staff to recognize signs of pest contamination — rodent droppings, insect activity, mold, or soil residue. Maintain records of agricultural inspections, pest control treatments, and corrective actions. For agricultural shippers, additional compliance with USDA and APHIS regulations may apply.
MSC 9: Physical Security
GAO Definition: All cargo handling and storage facilities, including trailer yards and offices, must have physical barriers and/or deterrents to prevent unauthorized access.
What to Implement: Install perimeter fencing (minimum 8 feet with anti-climb features where risk warrants) around cargo handling and storage areas. Ensure adequate lighting at all entry points, loading docks, cargo storage areas, and trailer yards. Implement secured gates with access control and monitoring. Deploy video surveillance covering critical areas — cargo handling, storage, and entry/exit points. Consider intrusion detection systems for high-risk areas. Maintain designated parking and storage areas for empty and loaded containers, separated where possible. The SCSS will walk the entire facility perimeter during validation, so any gaps in physical security will be identified.
MSC 10: Physical Access Controls
GAO Definition: Participants must have written procedures that describe how identification badges and access devices are issued, changed, and removed.
What to Implement: Implement an employee ID badge system with distinct access levels corresponding to job functions. Document procedures for badge issuance, replacement (lost/damaged), and revocation. Ensure access is removed immediately upon employee termination — a common finding during validation is that former employees still have active badges. Maintain a visitor management system with sign-in/sign-out logs, visitor badges, and escort requirements for restricted areas. Review access logs periodically for anomalies.
MSC 11: Personnel Security
GAO Definition: There must be written processes for screening prospective employees and periodically checking existing employees.
What to Implement: Conduct pre-employment background checks covering employment history, criminal record verification, identity verification, and reference checks. Implement periodic re-screening of existing employees — annually at minimum. Document all screening processes and results. Apply equivalent screening standards to temporary, contract, and seasonal personnel who have access to cargo or security-sensitive areas. Maintain personnel files with completed check records that can be presented during validation.
MSC 12: Education, Training, and Awareness
GAO Definition: Personnel must be trained on how to report security incidents and suspicious activities.
What to Implement: Conduct annual security awareness training for all employees, covering cargo integrity, seal verification, incident reporting, and threat awareness. Provide specialized role-based training for security-sensitive positions — loading dock personnel, warehouse staff, IT administrators, and security officers. Include cybersecurity hygiene and forced labor detection in the training curriculum. Document all training sessions with attendance records, training materials, and dates. The SCSS may interview employees during validation to verify that training is effective.
Additional Compliance Requirements
Forced Labor Compliance
Since 2022, C-TPAT has integrated forced labor prevention into its supply chain security framework. During validation, the SCSS may review procedures for screening supply chain partners for forced labor risks, training programs on ethical labor practices, and documentation demonstrating compliance with the Uyghur Forced Labor Prevention Act (UFLPA). The C-TPAT Trade Compliance program (introduced 2025) offers enhanced benefits including priority UFLPA admissibility review for qualifying members.
Walmart SCS and SCAN Interoperability
C-TPAT certification directly supports retail compliance. Walmart's Supply Chain Security (SCS) program accepts C-TPAT Tier I, II, or III as Option 4 — eliminating the need for a separate factory SCS audit. Additionally, C-TPAT is a prerequisite for SCAN membership, providing access to the shared audit repository used by major retailers including Walmart, Target, Home Depot, and Costco.
Preparing for SCSS Validation
When a CBP Supply Chain Security Specialist visits your facility for validation (typically 1-3 days), they will:
- Review your CTPAT Portal security profile and compare it against actual practices
- Walk the entire facility perimeter, inspecting fencing, lighting, and physical barriers
- Examine cargo handling areas, loading docks, container yards, and storage facilities
- Review documentation for all 12 MSC areas — security policies, training records, background checks, seal logs, incident reports
- Interview employees at various levels to verify security awareness
- Issue a validation report with findings and recommended corrective actions
FAQ: C-TPAT Security Criteria
Q: How many C-TPAT security criteria are there?
A: C-TPAT has 12 Minimum Security Criteria (MSC) as defined by the U.S. Government Accountability Office (GAO-26-107893): Security Vision, Risk Assessment, Business Partners, Cybersecurity, Conveyance Security, Seal Security, Procedural Security, Agricultural Security, Physical Security, Access Controls, Personnel Security, and Training.
Q: Are all 12 MSC areas equally important?
A: CBP expects all 12 MSC areas to be addressed in the security profile. However, the emphasis during validation may vary based on the company's specific risk profile, industry, and operations. A company handling agricultural products will face greater scrutiny on Agricultural Security, while a technology company will be assessed more heavily on Cybersecurity.
Q: Can security criteria requirements vary by company size?
A: Yes. While all 12 MSC areas must be addressed, the specific implementation measures can be proportionate to the company's size, risk profile, and operational complexity. A small warehouse with 10 employees would not be expected to have the same physical security infrastructure as a major port terminal. CBP's Supply Chain Security Specialist assesses whether measures are appropriate for the specific business context.
Q: How often are the security criteria updated?
A: CBP periodically reviews and updates the Minimum Security Criteria. Participants must stay informed of changes through the CTPAT Portal and adjust their security programs accordingly. The most recent significant expansion was the integration of forced labor compliance into the framework in 2022. The C-TPAT Trade Compliance program was added in 2025.
Q: What happens if a security criteria is not met during validation?
A: If the SCSS identifies gaps during validation, they will be documented in the validation report as findings. The company must submit a corrective action plan addressing each finding. Minor issues are typically correctable within 30-90 days. Significant or willful non-compliance may affect the company's C-TPAT status, potentially resulting in suspension or removal from the program.
Q: Do I need separate documentation for each MSC area?
A: Yes. While the CTPAT Portal security profile is one document, it must address each of the 12 MSC areas individually. Supporting documentation — such as security policies, training records, risk assessments, inspection logs, background check procedures, and cybersecurity test results — should be organized by MSC area for easy reference during validation.
Conclusion
The C-TPAT Minimum Security Criteria provide a comprehensive and practical framework for supply chain security. By systematically addressing each of the 12 MSC areas, companies can build a robust security program that meets CBP's requirements, reduces customs examination rates, and opens doors to major U.S. retail buyers.
Start with a thorough self-assessment against the GAO-defined criteria, implement the necessary measures, and document everything. A well-prepared company not only passes validation more smoothly but also builds a security program that delivers lasting operational value.
Need help meeting C-TPAT security criteria? Our team provides gap analysis, documentation support, and validation preparation services. Contact us for a free consultation.
Tag
