|
C-TPAT Security Guidelines for Air Freight
Consolidators, Ocean Transportation Intermediaries and Non-Vessel Operating
Common Carriers (NVOCC)
To be eligible
for C-TPAT, the Consolidator must meet the following
eligibility requirements:
-
Be an active Air Freight
Consolidator, Ocean Transportation Intermediary or
Non-Vessel Operating Common Carrier (NVOCC).
-
Have a business office
staffed in the U.S.
-
If applicable, have an
active Federal Maritime Commission (FMC) issued
Organization Number or an International Air Transport
Association (IATA) issued Organization Number in the
following format.
-
Possess a valid
continuous international carrier bond and/or in
bond/export Consolidator bond (IBEC) registered with CBP.
-
Have a designated
company officer that will be the primary cargo security
officer responsible for C-TPAT.Commit to maintaining the
C-TPAT supply chain security guidelines as outlined in the
C-TPAT Consolidator agreement.
-
Create and provide CBP
with a C-TPAT supply chain security profile, which
identifies how the Consolidator will meet, maintain and
enhance internal policy to meet the C-TPAT Consolidator
security guidelines.
C-TPAT
Security Guidelines for Consolidators
Consolidators must conduct a comprehensive assessment of their international
supply chains based upon the following C-TPAT security guidelines. Where a
consolidator out sources or contracts elements of their supply chain, such
as a foreign facility, conveyance, domestic warehouse, or other elements,
the consolidator must work with these business partners to ensure that
pertinent security measures are in place and adhered to throughout their
supply chain. The supply chain for C-TPAT purposes is defined from point of
origin (manufacturer/supplier/vendor) through to point of distribution and
recognizes the diverse business models C-TPAT members employ.
C-TPAT
recognizes the complexity of international supply chains and endorses the
application and implementation of security measures based upon risk
analysis. Therefore, the program allows for flexibility and the
customization of security plans based on the member’s business model.
Appropriate security measures, as listed throughout this document, must be
implemented and maintained throughout the consolidator’s supply chains.
Business Partner Requirements
Consolidators must have written and verifiable processes for the screening
and selection of business partners including foreign consolidators,
customers, contractors, carriers, and vendors. Ensure that contracted
service provider companies who provide transportation, cargo handling, and
security services commit to C-TPAT Security Guidelines. Periodically review
the performance of the service providers to detect weakness or potential
weaknesses in security.
Security Procedures
Point of Origin
C-TPAT Consolidators must ensure business partners develop security
processes and procedures consistent with the C-TPAT security guidelines to
enhance the integrity of the shipment at point of origin. Periodic reviews
of business partners’ processes and facilities should be conducted based on
risk and should maintain the security standards required by the
Consolidator.
Participation/Certification in Foreign Customs Administrations Supply Chain
Security Programs
Current or prospective business partners who have obtained a certification
in a supply chain security program being administered by foreign Customs
Administration should be required to indicate their status of participation
to the C-TPAT Consolidator.
Service
Provider Screening and Selection Procedures
The C-TPAT Consolidator should have documented service provider screening
and selection procedures to screen the contracted service provider for
validity, financial soundness, ability to meet contractual security
requirements, and the ability to identify and correct security deficiencies
as needed. Service Provider procedures should utilize a risk-based process
as determined by an internal management team.
Customer
Screening Procedures
The C-TPAT Consolidator should have documented procedures to screen
prospective customers for validity, financial soundness, the ability of
meeting contractual security requirements, and the ability to identify and
correct security deficiencies as needed. Customer screening procedures
should utilize a risk-based process as determined by an internal management
team.
Container Security
Consolidators should ensure that all contracted service providers have
procedures in place to maintain container integrity. Container integrity
must be maintained to protect against the introduction of unauthorized
material and/or persons. At point of stuffing, procedures must be in place
to properly seal and maintain the integrity of the shipping containers. A
high security seal must be affixed to all loaded C-TPAT importer containers
bound for the U.S. All seals must meet or exceed the current PAS ISO 17712
standards for high security seals.
Container Inspection
Procedures must be in place to verify the physical integrity of the
container structure prior to stuffing, to include the reliability of the
locking mechanisms of the doors. A seven-point inspection process is
recommended for all containers:
-
Front wall
-
Left side
-
Right side
-
Ceiling/Roof
-
Inside/Outside doors
-
Outside/Undercarriage
Container Seals
Written procedures must stipulate how seals are to be controlled and affixed
to loaded containers. Procedures must be in place for recognizing and
reporting compromised seals and/or containers to U.S. Customs and Border
Protection or the appropriate foreign authority. Only designated employees
should distribute container seals for integrity purposes.
Container Storage
Containers must be stored in a secure area to prevent unauthorized access
and/or manipulation. Procedures must be in place for reporting and
neutralizing unauthorized entry into containers or container storage areas.
Physical Access
Controls
Access controls prevent unauthorized entry to facilities, maintain control
of employees and visitors and protect company assets. Access controls must
include the positive identification of all employees, visitors and vendors
at all points of entry.
Employees
An employee identification system must be in place for positive
identification and access control purposes. Employees should only be given
access to those secure areas needed for the performance of their duties.
Company management or security personnel must adequately control the
issuance and removal of employee, visitor and vendor identification badges.
Procedures for the issuance, removal and changing of access devices (e.g.
keys, key cards, etc.) must be documented.
Visitors
Controls
Visitors must present photo identification for documentation purposes upon
arrival. All visitors should be escorted and visibly display temporary
identification.
Deliveries (including mail)
Proper vendor ID and/or photo identification must be presented for
documentation purposes upon arrival by all vendors. Arriving packages and
mail should be periodically screened before being disseminated.
Challenging and Removing Unauthorized Persons
Procedures must be in place to identify, challenge and address
unauthorized/unidentified persons.
Personnel Security
Processes must be in place to screen prospective employees and to
periodically check current employees. Maintain a current permanent employee
list (foreign and domestic), which includes the name, date of birth,
national identification number or social security number, position held and
submit such information to CBP upon written request, to the extent permitted
by law.
Pre-Employment Verification
Application information, such as employment history and references must be
verified prior to employment.
Background checks / investigations
Consistent with foreign, federal, state and local regulations, background
checks and investigations should be conducted for prospective employees.
Periodic checks and reinvestigations should be performed based on cause
and/or the sensitivity of the employee’s position.
Personnel Termination Procedures
Companies must have procedures in place to remove identification; facility
and system access for terminated employees.
Procedural Security
Security measures must be in place to ensure the integrity and security of
processes relevant to the transportation, handling and storage of cargo in
the supply chain.
Documentation Processing
Procedures must be in place to ensure that all documentation used in the
movement of merchandise/cargo is legible, complete, accurate and protected
against the exchange, loss or introduction of erroneous information.
Documentation control must include safeguarding computer access and
information.
Manifesting Procedures
To help ensure the integrity of cargo received from abroad, procedures must
be in place to ensure that information received from business partners is
reported accurately and timely.
Shipping
& Receiving
Arriving cargo should be reconciled against information on the cargo
manifest. The cargo should be accurately described, weighed, labeled,
marked, counted and verified. Departing cargo should be checked against
purchase or delivery orders. Drivers delivering or receiving cargo must be
positively identified before cargo is received or released.
Cargo
Discrepancies
All shortages, overages and other significant discrepancies or anomalies
must be resolved and/or investigated appropriately. CBP and/or other
appropriate law enforcement agencies must be notified if illegal or
suspicious activities are detected.
Security Training and
Threat Awareness
A threat awareness program should be established and maintained by security
personnel to recognize and foster awareness of the threat posed by
terrorists at each point in the supply chain. Employees must be made aware
of the procedures the company has in place to address a situation and how to
report it. Additional training should be provided to employees in the
shipping and receiving areas, as well as those receiving and opening mail.
Additionally, specific training should be offered to assist employees in
maintaining cargo integrity, recognizing internal conspiracies and
protecting access controls. These programs should offer incentives for
active employee participation.
Physical Security
Cargo handling and storage facilities in domestic and foreign locations must
have physical barriers and deterrents that guard against unauthorized
access. Consolidators should incorporate the following C-TPAT physical
security guidelines throughout their supply chains as applicable.
Fencing
Perimeter fencing should enclose the areas around cargo handling and storage
facilities. Interior fencing within a cargo handling structure should be
used to segregate domestic, international, high value and hazardous cargo.
All fencing must be regularly inspected for integrity and damage.
Gates
Gate Houses
Gates through which vehicles and/or personnel enter or exit must be manned
and/or monitored. The number of gates should be kept to the minimum
necessary for proper access and safety.
Parking
Private passenger vehicles should be prohibited from parking in or adjacent
to cargo handling and storage areas.
Building
Structure
Buildings must be constructed of materials that resist unlawful entry. The
integrity of structures must be maintained by periodic inspection and
repair.
Locking
Devices and Key Controls
All external and internal windows, gates and fences must be secured with
locking devices. Management or security personnel must control the issuance
of all locks and keys.
Lighting
Adequate lighting must be provided inside and outside the facility including
the following areas: entrances and exits, cargo handling, storage areas,
fence lines and parking areas.
Alarms
Systems & Video Surveillance Cameras
Alarm systems and video surveillance cameras should be utilized to monitor
premises and prevent unauthorized access to cargo handling and storage
areas.
Information Technology Security
Information Technology (IT) integrity must be maintained to protect data
from unauthorized access or manipulation.
Password
Protection
Automated systems must use individually assigned accounts that require a
periodic change of password. IT security policies, procedures and standards
must be in place and provided to employees in the form of training.
Accountability
A system must be in place to identify the abuse of IT including improper
access, tampering or the altering of business data. All system violators
must be subject to appropriate disciplinary actions for abuse.
|