C-TPAT Security Survey

Step 1 of 12

Initial agreement(Required)

Agreed

By checking “Agreed”, immediately below, you agree that you are authorized to complete this form on behalf of the company listed below and that all answers given are accurate. Further, you agree that all documentation provided by your company to Custodia will be complete, legible, and accurate. You understand that Custodia will hold accountable the party responsible for completing documentation. You agree that all electronic information will be secured your company’s computer system. Further, you agree that any detected illegal or suspicious activity will be reported by your company to CBP and/or local law enforcement immediately upon discovery. Finally, on behalf of your company, you accept responsibility for security as long as cargo is in your company's possession.

Name of company(Required)

Email address(Required)

Name of person completing this application(Required)

Is your company a participant in the C-TPAT security program?(Required)

Yes

Enter your C-TPAT number(Required)

Does your company participate in any domestic or foreign supply chain security program?

Yes

Does your company audit or review its security program?

Yes

Does your company conduct risk assessments?

Yes

Does your company screen or vet new business partners and monitor current business partners?

Yes

Does your company review any import/export documents to identify or recognize suspicious cargo shipments?

Yes

Does your company require that all information used in the clearing of cargo is legible, complete, accurate, and timely?

Yes

Does your company ensure that all weight and piece counts are accurate?

Yes

If your company creates bills of lading or provides information that is used on bills of lading, does your company ensure these documents are accurate and timely? If possible, do they show the first foreign location where the carrier takes possession of the cargo destined for the United States?

Yes

Not applicable

Does your company store any sensitive paper documents securely so as to prevent unauthorized access?

Yes

Not applicable

Is arriving / departing cargo verified against cargo manifests or purchase/delivery orders?

Yes

Not applicable

Are any shortages, overages, and other significant discrepancies or anomalies investigated and resolved, as appropriate?

Yes

Not applicable

Are procedures in place to identify, challenge, and addressed unauthorized / unidentified persons? Do personnel know these procedures and what to do if an unauthorized or unidentified person enters your facility?

Yes

Not applicable

Does your company have a notification protocol to report any suspicious activities or incidents?

Yes

Not applicable

In the event of a security incident, would your company conduct and document an investigation?

Yes

Not applicable

In accordance with the applicable business model, are there written procedures in place that are designed to prevent visible pest contamination to include compliance with Wood Packaging Materials (WPM) regulations? Do measures regarding WPM meet the International Plant Protection Convention’s (IPPC) International Standards for Phytosanitary Measures No. 15 (ISPM 15)?

Yes

Not applicable

Does your company follow procedures to prevent pest infestation of cargo?

Yes

Not applicable

Are cargo staging areas, and the immediate surrounding areas, inspected on a regular basis to ensure these areas remain free of visible pest contamination?

Yes

Not applicable

Are gates where vehicles and/or personnel enter or exit (as well as other points of ingress/egress) manned or monitored?

Yes

Not applicable

Are there written procedures governing how identification badges and access devices are granted, changed, and removed?

Yes

Not applicable

Is a personnel identification system in place for positive identification and access control purposes?

Yes

Not applicable

Is access to sensitive areas restricted based on job description or assigned duties?

Yes

Not applicable

Does removal of access devices take place upon the employee’s separation from the company?

Yes

Not applicable

Do visitors, vendors and service providers present photo identification upon arrival? Is a log maintained that records the details of the visit? Does the registration log must include the following: date of the visit, visitor's name, verification of photo identification (type verified such as license or national ID card)? Frequent, well known visitors such as regular vendors may forego the photo identification, but are they still logged in and out of the facility, including time of arrival, company point of contact and time of departure?

Yes

Not applicable

Are all visitors and service providers issued temporary identification? Is that ID visibly displayed at all times during the visit?

Yes

Not applicable

Are all visitors escorted?

Yes

Not applicable

Are arriving packages and mail periodically screened for contraband before being admitted?

Yes

Not applicable

If security guards are used, are work instructions for security guards contained in written policies and procedures? Does management periodically verify compliance and appropriateness with these procedures through audits and policy reviews?

Yes

Not applicable

Do you screen prospective employees by conducting background checks or verifying references?

Yes

Not applicable

Does any vetting requirements extend to temporary workforce or contactors?

Yes

Not applicable

Does your company have an Employee Code of Conduct that includes expectations and defines acceptable behaviors?

Yes

Not applicable

Do your employees receive security threat and awareness training?

Yes

Not applicable

Are employees trained on how to report security incidents and suspicious activities?

Yes

Not applicable

Are relevant personnel trained on how to identify information in shipping documents, such as manifests, that might indicate a suspicious shipment?

Yes

Not applicable

As applicable based on their functions and/or positions, are employees trained on the company's cybersecurity policies and procedures? Does this include the need for employees to protect passwords/passphrases and computer access?

Yes

Not applicable

Are comprehensive written cybersecurity policies and/or procedures in place to protect information technology (IT) systems? Are cybersecurity policies and procedures reviewed annually, or more frequently, as risk or circumstances dictate? Following the review, are policies and procedures updated if necessary?

Yes

Not applicable

If a data breach occurs or an event results in the loss of data and/or equipment, do procedures include the recovery (or replacement) of IT systems and/or data?

Yes

Not applicable

Do cybersecurity policies include how to share information with government or business partners? How to prevent attacks? Preventing use of counterfeit technological products?

Yes

Not applicable

Is a system in place to identify unauthorized access of IT systems/data or abuse of policies and procedures including improper access of internal systems or external websites and tampering or altering of business data by employees or contractors? Are all violators subject to appropriate disciplinary actions?

Yes

Not applicable

Is security software current and does it receive regular security updates?

Yes

Not applicable

When utilizing network systems, is the security of the IT infrastructure regularly tested? If vulnerabilities are found, are corrective actions implemented as soon as feasible?

Yes

Not applicable

Is data backed up once a week or as appropriate? Is all sensitive and confidential data stored in an encrypted format?

Yes

Not applicable

Are all media, hardware, or other IT equipment that contains sensitive information regarding the import/export process accounted for through regular inventories?

Yes

Not applicable

When disposed, are they properly sanitized and/or destroyed in accordance with the National Institute of Standards and Technology (NIST) Guidelines for Media Sanitization or other appropriate industry guidelines?

Yes

Not applicable

If employees are allowed to use personal devices to conduct company work, do all such devices adhere to the company’s cybersecurity policies and procedures to include regular security updates and a method to securely access the company’s network? When users are allowed to remotely connect to a network, are secure technologies employed, such as virtual private networks (VPNs), to allow employees to access the company’s intranet securely when located outside of the office? Are procedures in place that are designed to prevent remote access from unauthorized users?

Yes

Not applicable

Do individuals with access to IT systems use individually assigned accounts?

Yes

Not applicable

Is access to IT systems protected from infiltration via the use of strong passwords, passphrases, or other forms of authentication and is user access to IT systems safeguarded?

Yes

Not applicable

Is user access restricted based on job description or assigned duties? Is authorized access reviewed on a regular basis to ensure access to sensitive systems is based on job requirements?

Yes

Not applicable

Is computer and network access removed upon employee separation?

Yes

Not applicable

Is the loading/stuffing of cargo into containers or international instruments of transit (“IIT”) supervised by a security officer, manager, or other designated personnel?

Yes

Not applicable

Prior to loading/stuffing/packing, do all conveyances and empty IIT undergo security and agricultural inspections to ensure their structures have not been modified to conceal contraband or have not been contaminated against visible agricultural pests?

Yes

Not applicable

Does your company conduct a seven-point inspection on all employ containers and ULD, and an eight-point inspection on all empty refrigerated containers (if applicable)?

Yes

Not applicable

Does your company inspect 7 points of a tractor (1. Bumper/tires/rims; 2. Doors, tool compartments and locking mechanisms; 3. Battery box; 4. Air breather; 5. Fuel tanks; 6. Interior cab compartments/sleeper; 7. Faring/roof?)

Yes

Not applicable

Does your company inspect 10 points of trailers? (1. Fifth wheel area - check natural compartment/skid plate; 2. Exterior - front/sides; 3. Rear - bumper/doors; 4. Front wall; 5. Left side; 6. Right side; 7. Floor; 8. Ceiling/roof; 9. Inside/outside doors and locking mechanisms; 10. Outside/Undercarriage)

Yes

Not applicable

Are conveyances and IIT (as appropriate) equipped with external hardware that can reasonably withstand attempts to remove it? Are the doors, handles, rods, hasps, rivets, brackets, and all other parts of a container’s locking mechanism fully inspected to detect tampering and any hardware inconsistencies prior to the attachment of any sealing device?

Yes

Not applicable

If visible pest contamination is found during the conveyance/IIT inspection, is washing/vacuuming carried out to remove such contamination? Is this decontamination documented?

Yes

Not applicable

Are inspections of conveyances and IIT systematic and are they conducted at conveyance storage yards? Where feasible, are inspections conducted upon entering and departing the storage yards and at the point of loading/stuffing?

Yes

Not applicable

Are security inspections performed in an area of controlled access and, if available, monitored via a CCTV system?

Yes

Not applicable

Is the inspection of all conveyances and IIT recorded on a checklist? Are the following elements documented on the checklist: container/trailer/instruments of international traffic number, date of inspection, time of inspection, name of employee conducting the inspection, and specific areas of the instruments of international traffic that were inspected

Yes

Not applicable

If the inspections are supervised and a checklist is used, does the supervisor should also sign the checklist?

Yes

Not applicable

Is the completed container/IIT inspection sheet part of the shipping documentation packet?

Yes

Not applicable

Based on risk, does management conduct random searches of conveyances after the transportation staff have conducted conveyance/IIT inspections? Are searches of the conveyance done periodically, with a higher frequency based on risk? Are the searches conducted at random without warning, so they will not become predictable?

Yes

Not applicable

Are written high security seal procedures in place that describe how seals are issued and controlled at the facility and during transit? Are procedures in place that provide the steps to take if a seal is found to be altered, tampered with, or has the incorrect seal number to include documentation of the event, communication protocols to partners, and investigation of the incident? Are the findings from the investigation documented, and any corrective actions implemented as quickly as possible?

Yes

Not applicable

Do written seal controls include the following elements? Controlling access to seals: management of seals is restricted to authorized personnel, secure storage, inventory, distribution, & tracking (seal log), recording the receipt of new seals, issuance of seals recorded in log, track seals via the log, and only trained, authorized personnel may affix seals to instruments of international traffic (IIT). Controlling seals in transit: when picking up sealed IIT (or after stopping), verify the seal is intact with no signs of tampering, confirm the seal number matches what is noted on the shipping documents, Seals broken in transit: if load examined--record replacement seal number, the driver must immediately notify dispatch when a seal is broken, indicate who broke it, and provide the new seal number; the carrier must immediately notify the shipper, broker, and importer of the seal change, and the replacement seal number; and the shipper must note the replacement seal number in the seal log. Seal discrepancies: hold any seal discovered to be altered or tampered with to aid in the investigation, Investigate the discrepancy, follow-up with corrective measures (if warranted), and as applicable, report compromised seals to CBP and/or the appropriate foreign government to aid in the investigation.

Yes

Not applicable

Are seal-control procedures reviewed at least once a year and updated as necessary?

Yes

Not applicable

Are written seal-control procedures maintained at the local, operating level so that they are easily accessible?

Yes

Not applicable

Are all shipments that can be sealed secured immediately after loading/stuffing/packing by the responsible party (e.g. the shipper or packer acting on the shippers’ behalf) with a high security seal that meets or exceeds the most current International Standardization Organization (ISO) 17712 standard for high security seals? Qualifying cable and bolt seals are both acceptable. Are seals securely and properly affixed to IIT that are transporting cargo to/from the United States?

Yes

Not applicable

Is CTPAT’s seal verification process followed to ensure all high security seals (bolt/cable) have been affixed properly to IIT, and are operating as designed? The procedure is known as the VVTT process: V – View seal and container locking mechanisms; ensure they are OK; V – Verify seal number against shipment documents for accuracy; T – Tug on seal to make sure it is affixed properly; T – Twist and turn the bolt seal to make sure its components do not unscrew, separate from one another, or any part of the seal becomes loose.

Yes

Not applicable

Is it documented that the high security seals either meet or exceed the most current ISO 17712 standard?

Yes

Not applicable

As documented evidence of the properly installed seal, are digital photographs taken at the point of stuffing? If so, could images be forwarded to the destination for verification purposes?

Yes

Not applicable

Are seal numbers electronically printed on the bill of lading or other shipping documents?

Yes

Not applicable

Are seal numbers assigned to specific shipments transmitted to the consignee or freight forwarder prior to departure?

Yes

Not applicable

If an inventory of seals is maintained, does company management or a security supervisor conduct audits of seals that includes periodic inventory of stored seals and reconciliation against seal inventory logs and shipping documents? Are all audits documented? As part of the overall seal audit process, do dock supervisors and/or warehouse managers periodically verify seal numbers used on conveyances and IIT?

Yes

Not applicable

Are drivers and other personnel that conduct security and agricultural inspections of empty conveyances and IIT trained to inspect their conveyances/IIT for both security and agricultural purposes? Does inspection training include the following topics: signs of hidden compartments, concealed contraband in naturally occurring compartments, and signs of pest contamination? These are requirements.

Yes

Not applicable

When cargo is staged overnight or for an extended period of time, does your company have measures in place to secure the cargo from unauthorized access?

Yes

Not applicable

Are conveyances and Instruments of International Traffic (IIT) stored in a secure area to prevent unauthorized access, which could result in an alteration to the structure of an Instruments of International Traffic or (as applicable) allow the seal/doors to be compromised?

Yes

Not applicable

Does your company have procedures in place for security and agricultural inspections of IIT?

Yes

Not applicable

Are there physical barriers and/or deterrents in place to prevent unauthorized access to offices, trailer yards, cargo handling and storage facilities?

Yes

Not applicable

Does perimeter fencing enclose the areas around cargo handling and storage facilities? Is fencing inspected for integrity and damage, and repairs made if needed?

Yes

Not applicable

Is interior fencing used to secure cargo and cargo handling areas? Based on risk, does additional interior fencing segregate various types of cargo such as domestic, international, high value, and/or hazardous materials?

Yes

Not applicable

Are private passenger vehicles prohibited from parking in or adjacent to cargo handling and storage areas, and conveyances?

Yes

Not applicable

Is adequate lighting provided inside and outside the facility including, as appropriate, the following areas: entrances and exits, cargo handling and storage areas, fence lines, and parking areas?

Yes

Not applicable

Is Security Technology utilized to monitor the premises and prevent unauthorized access to sensitive areas?

Yes

Not applicable

Do cameras monitor the facility’s premises and sensitive areas to deter unauthorized access?

Yes

Not applicable

Are alarms used to alert unauthorized access into sensitive areas?

Yes

Not applicable

If relying on security technology for physical security, are there written policies and procedures governing the use, maintenance, and protection of this technology? At a minimum, do these policies and procedures stipulate: How access to the locations where the technology is controlled/managed or where its hardware (control panels, video recording units, etc.) is kept, is limited to authorized personnel? The procedures that have been implemented to test/inspect the technology on a regular basis? That the inspections include verifications that all of the equipment is working properly, and if applicable, that the equipment is positioned correctly? That the results of the inspections and performance testing is documented? That if corrective actions are necessary, these are to be implemented as soon as possible and that the corrective actions taken are documented? That the documented results of these inspections be maintained for a sufficient time for audit purposes? These are requirements.

Yes

Not applicable

Are security technology policies and procedures reviewed and updated annually, or more frequently, as risk or circumstances dictate?

Yes

Not applicable

If a third party central monitoring station (off-site) is utilized, does the CTPAT Member have written procedures stipulating critical systems functionality and authentication protocols such as (but not limited to) security code changes, adding or subtracting authorized personnel, password revisions(s), and systems access or denial(s)?

Yes

Not applicable

Are licensed/certified resources utilized when considering the design and installation of security technology?

Yes

Not applicable

Is all security technology infrastructure physically secured from unauthorized access?

Yes

Not applicable

Are security technology systems configured with an alternative power source that will allow the systems to continue to operate in the event of an unexpected loss of direct power?

Yes

Not applicable

If camera systems are deployed, do cameras have an alarm/notification feature, which would signal a “failure to operate/record” condition? Are cameras positioned to cover key areas of facilities that pertain to the import/export process? Are cameras programmed to record at the highest picture quality setting reasonably available, and be set to record on a 24/7 basis? If cameras are being used, are recordings of footage covering key import/export processes maintained for a sufficient time for a monitored shipment to allow an investigation to be completed?

Yes

Not applicable

If legally allowed, and permissible under union rules, do carriers conduct random screening of truck drivers’ luggage and personal belongings? If any suspicious anomalies are found during the screening, does the carrier document and report its findings to U.S. Customs and Border Protection.

Yes

Not applicable

Is the delivery of goods limited to a specific monitored area?

Yes

Not applicable

Are drivers delivering or receiving cargo positively identified before cargo is received or released? Do drivers present government-issued photo identification to the facility employee granting access to verify their identity? If presenting a government-issued photo identification is not feasible, the facility employee may accept a recognizable form of photo identification issued by the highway carrier company that employs the driver picking up the load.

Yes

Not applicable

Is a cargo pickup log kept to register drivers and record the details of their conveyances when picking up cargo? When drivers arrive to pick up cargo at a facility, does a facility employee register them in the cargo pickup log? Upon departure, are drivers logged out? Is the cargo log kept secured and are drivers not allowed access to it?

Yes

Not applicable

Does the cargo pickup log have the following items recorded: driver's name, date, time of arrival, employer, truck number, trailer number, time of departure, and the seal number affixed to the shipment at the time of departure?

Yes

Not applicable

Have employees operating and managing security technology systems received training in their operation and maintenance? Prior experience with similar systems is acceptable. Self-training via operational manuals and other methods is acceptable.

Yes

Not applicable

Please provide any further information in order that Custodia may fully understand your security practices.