Guide · Trusted-Trader Programs

What Are the C-TPAT Minimum Security Criteria?

By Mandy-Lynn Aitken, 30 years on both sides of the supply-chain auditUpdated September 27, 2026

The call usually comes three weeks out: a validation date, and a request for evidence you thought you already had. It does not only land on the importer's desk. It lands on the carrier whose trucks are named in someone else's business-partner section, the customs broker whose own status is what lets a client self-certify, the freight forwarder or warehouse operator asked to prove criteria they never applied for directly, and the manufacturer or exporter feeding all of them. The C-TPAT certification you hold, or the one your customer holds and needs you to stand behind, rests on 12 criteria areascovering physical security, personnel security, cargo and conveyance security, and business-partner security. You meet them by completing and documenting CBP's 5-step risk assessment, then passing your validation, CBP's own audit of whether the paper matches the practice. The criteria themselves are not the hard part. Proving them, partner by partner, year after year, is. This guide walks through what the criteria are, why they stopped being optional in 2026, and how importers, carriers, brokers and the suppliers behind them actually meet them without turning an operations team into a customs office.

Try this before you read another word. Pull the file on whichever partner moves the most freight for you — a carrier, a supplier, a warehouse — and open it now. Can you point to all 12 areas with evidence behind each one, a name and a date on whoever verified it? Or does the file stop being specific somewhere around area four? That gap is what the rest of this guide is about.

What are the C-TPAT Minimum Security Criteria?

The Minimum Security Criteria, the MSC, are the standards you adopt the day you apply to C-TPAT and the standards CBP validates you against afterward. There are 12 criteria areas, and together they cover physical security, personnel security, cargo and conveyance security, and the part most members struggle with: business-partner security — meaning every carrier, broker, forwarder, warehouse operator, and manufacturer that touches the freight, not only the company whose name is on the C-TPAT certificate.

C-TPAT is the Customs-Trade Partnership Against Terrorism, run by U.S. Customs and Border Protection and launched in 2001. It costs nothing to apply. The path runs like this: you apply and adopt the Minimum Security Criteria, CBP has up to 90 days to certify or reject, and a certified company is validated within a year of certification, including a site visit, with revalidation at least once in each four-year period afterwards. C-TPAT is one of three trusted-trader programs built on the same principles; for how PIP and AEO compare, see C-TPAT vs PIP vs AEO: differences and mutual recognition.

Two things about the criteria trip up almost everyone who reads them for the first time.

First, they are not a checklist about your building. Business-partner security means the program holds you responsible for verifying every supplier, carrier, and vendor that touches your freight. Your fence can be perfect. If a sub-supplier three hands down the chain is a gap, that gap is yours.

Second, the standard of proof is evidence, not self-attestation. A supplier saying “yes, we do that” on a form does not meet a criterion. A documented gap analysis against all 12 areas, with evidence behind each answer, does. That distinction is the difference between a binder that looks ready and a chain that passes. Everything else in this article flows from those two facts.

Why do the criteria matter more in 2026 than ever?

Because C-TPAT stopped being voluntary in practice. For most of its life, C-TPAT was a program you joined for faster border treatment. The “Strengthening Customs Enforcement” Executive Order, signed June 3, 2026, changed that: within roughly 180 days, about November 30, 2026, foreign importers of record must be CTPAT-validated, where CBP deems them eligible, or file entries through a CTPAT-validated and licensed customs broker.

After that date, importers without C-TPAT certification are barred from informal U.S. entry and must file formal entry through a certified broker. The order also raises bond minimums, expands importer registration data into a risk-tiered registry, adds a good-standing compliance requirement, and sets a 50% minimum penalty floor for customs violations, with no mitigation for repeat offenders.

The everyday math was already lopsided before the order. CBP's own position is that CTPAT members are considered to be of low risk, and are therefore less likely to be examined at a U.S. port of entry. In my own files the gap between a certified and an uncertified importer runs several times over on examination rates, and for an uncertified importer moving real volume the exposure compounds fast: 20,000 shipments held at $10K a day is a $200M exposure.

Here is the part that matters if you are the person reading this at 9 p.m.: none of this makes you the problem. The criteria were written for a customs officer, not for a procurement team with a day job. The June 2026 order raised the stakes on the work. It did not remove the work, and it did not hand anyone more hours to do it in. The obligation underneath every route, validated importer or validated broker, is the same: the business-partner due diligence the criteria demand still has to be done, documented, and kept current. The clock is the problem. The work is knowable, and it comes in exactly five steps.

How do importers actually meet the criteria?

You meet the criteria by completing and documenting CBP's 5-step risk assessment, then passing your validation. The 5-step is the mechanism. The criteria are the standard it proves you against.

Here is what CBP's Five Step Risk Assessment guide sets out, step by step:

Step 1: Map the cargo journey and every partner.This is the step most teams skip. You map the cargo's whole journey, every hand it passes through from the plant floor to the dock: every supplier and sub-supplier, each one's role at every handoff, their volume and level of access. Map only your direct suppliers and the risk hides in the ones you forgot.

Step 2: Conduct a threat assessment. For each stop on that map, you weigh what could go wrong: smuggling, tampering, theft, and the pressures a region puts on its people. A threat rating for every node, country and regional risk built in, re-rated when routes or partners change.

Step 3: Conduct a vulnerability assessment. This is where the Minimum Security Criteria live. You hold each supplier against all 12 criteria and look for the space between the policy on paper and the practice on the floor. A gap analysis against the MSC per supplier, evidence, not self-attestation, all 12 areas, not just the easy ones.

Step 4: Write a corrective action plan. Every gap gets a name, an owner, and a date. Not a note in a binder, but a fix someone is accountable for, with proof it actually happened.

Step 5: Document the process, every year. You write down how you did all of it and keep it current, so when a validator asks, you hand them a living process instead of scrambling to rebuild one.

Run all five, on every supplier, and refresh it annually — the criteria put it as “risk assessments must be reviewed annually, or more frequently as risk factors dictate”. That is what “meeting the criteria” means in practice. Which raises the obvious question: why do prepared companies still fail?

Why do companies fail validation on criteria they thought they met?

Because C-TPAT looks like a security checklist and it is actually a behavioral audit. A validator rarely fails you on a missing fence. They fail you on the distance between what a supplier wrote on a form and what actually happens on the floor: at the end of a double shift, on the load that is already late, when the trained manager is away.

That distance has a name: the human factor. Not negligence. People doing their best in moments no procedure prepared them for. It hides in the three places almost no assessment looks:

1. The sub-supplier you never mapped.
2. The process that works on paper but not under pressure.
3. The new hire onboarded after the busy season, not before.

A form cannot see a moment like that. A person under pressure cannot be audited by a questionnaire. And CBP knows it, which is why they do not validate your binder. They talk to your people and measure the distance between what the paper says and what the floor does.

So the fix is not more paperwork, and it is not treating your people as the risk. Your people are the ones who will carry the answer when the validator asks the question. The fix is assessing the way the validation actually runs: live, scenario by scenario, against all 12 MSC areas, so the gap between policy and practice surfaces while it is still yours to close quietly instead of a finding on someone else's report. A vulnerability assessment that only collects signatures on forms is rehearsal for the wrong exam.

Do your suppliers have to meet the criteria too?

Yes, and this is the criterion that decides most validations. If your suppliers move goods across the US border on your behalf, their security is part of what your certification stands on. Business-partner security is not a section of the MSC you can staff your way around: criterion 3.1 requires “a written, risk based process for screening new business partners and for monitoring current ones,”and criterion 3.5 requires due diligence — “via visits, questionnaires, etc.” — that those partners meet or exceed the criteria. So the program makes you responsible for verifying every partner in the chain, and for proving you did.

That is why Step 1 exists. You cannot assess a supplier you cannot name, and the risk that hurts you usually sits with the sub-supplier nobody put on the map. The documented partner map, with each party's role, volume, and level of access, is the foundation every other step builds on.

Then comes the question every importer eventually asks: what if a supplier refuses to participate? That refusal is the signal. A supplier who refuses a documented security assessment is not a supplier you want crossing the border on your behalf. For validation purposes, a documented refusal, the outreach attempts, and your response plan are themselves evidence that you identified the risk. Refusing to assess is a finding in itself.

The last piece is cadence. The criteria set the floor at an annual review of the risk assessment, with business partner assessments updated “on a regular basis, or as circumstances/risks dictate,” so supplier evidence that was true last year does not carry this year's validation. A practical habit: begin renewal outreach 60 to 90 days before any program deadline, so the evidence is in hand before the report is finalized rather than scrambled for afterward. One supplier assessed once is a data point. Every supplier, assessed on a rhythm, documented the same way, is a program.

What evidence does a C-TPAT validator actually ask for?

A validator wants to see the living output of the 5-step, not a summary of it. Concretely, that means five artifacts, current and consistent with each other:

1. A documented map of every supplier and sub-supplier, with each one's role at every handoff, their volume, and their level of access.
2. A threat rating for every node on that map, with country and regional risk built in, re-rated when routes or partners change.
3. A gap analysis against the MSC for each supplier: all 12 areas, backed by evidence, never self-attestation.
4. A corrective action plan for every gap, with named owners, real deadlines, and proof the fix actually happened.
5. A documented, repeatable process, refreshed annually, ready to hand over on demand.

For the department-level procedures and forms behind this evidence, see the seven department compliance manuals.

Static tools stop short of this. The rating platforms score your supplier and walk away: a medal, not a fix. The mapping tools show you where the risk sits, and knowing where the leak is does not stop the water. A validator has seen a hundred once-a-year PDFs. What survives a real review is gaps found, corrected, and signed.

It can be done, and there is a record. Global MLX, an XFACTOR Verified company, helped Lepage Millwork meet every mandatory C-TPAT criterion and pass U.S. Customs validation with zero actions required, maintaining Tier II. The founder behind the methodology carries a 20-year, zero-failure record on C-TPAT and PIP validations, with the F.F. Soucy 2009 CBP Tier-II validation letter in the reference archive, across 30 years, 44,000+ organizations assessed, and 500,000+ assessments completed. The criteria are demanding. They are not a mystery.

Sources: CTPAT Minimum Security Criteria — U.S. Importers, October 2021 (CBP, PDF) · CBP, Supply Chain Risk Assessment guide (the Five Step guide) · CBP, CTPAT program page · Executive Order 14411, Strengthening Customs Enforcement (Federal Register, 10 June 2026) · 6 U.S.C. §969, Revalidation (SAFE Port Act)

The program this maps to: C-TPAT · Related reading: What Should C-TPAT Compliance Software Actually Do?