C-TPAT · Customs Brokers· U.S. Customs & Border Protection
You file on their behalf.
Your clients’ C-TPAT certifications lean on your entries being accurate and your systems being secure. A validator asking about your business is really asking whether an importer who trusts you to file for them is trusting the right company.
Who CBP actually certifies here
Licensed customs brokers are their own eligible C-TPAT trade entity type. Their criteria weigh personnel and data security heavily, because a broker’s exposure is the integrity of the entries they file and the client data they hold, not a warehouse or a trailer.
How the 5-step risk assessment applies
The five-step risk assessment maps every system and every employee with access to entry data and client information, rates the threat at each one (a shared login, an unscreened new hire with full system access), holds your procedures against the twelve criteria, writes a corrective action plan for every gap, and keeps the record current as staff and systems change.
The Minimum Security Criteria that carry the most weight for customs brokers
Personnel Security
Background screening for employees with access to entry filings and client data, re-verified on a cadence, because a broker’s risk is concentrated in who can touch the filing, not who can touch a truck.
Cybersecurity
Access controls, authentication and monitoring on the systems that file entries and hold client shipment and identity data, assessed the way a validator assesses an importer’s ERP.
Procedural Security
Documented procedures for verifying the accuracy of entry data against source documents, so an error or a fraudulent filing is caught before it is submitted, not after.
Business Partner Requirements
Knowing, and being able to document, who you are actually filing on behalf of, and what due diligence you ran on that relationship.
Source: U.S. CBP, C-TPAT Minimum Security Criteria (cbp.gov)
Questions specific to customs brokers
Why does a desk-based business like ours need a physical security assessment?
It mostly does not, in the way a warehouse does. A broker’s C-TPAT criteria weigh personnel and cybersecurity far more heavily than physical security, because the broker’s actual exposure is the integrity of the data and the people who can touch it, not a loading dock.
What does a validator actually want to see from a brokerage?
Evidence that access to entry-filing systems is controlled and logged, that employees with that access were screened before they got it, and that there is a documented process for catching a data entry error or a suspicious filing request before it goes to CBP, not after.
Also on C-TPAT
8 suppliers · 14-day trial
Start your 14-day trial: run your 8 highest-risk suppliers through the full C-TPAT 5-step risk assessment. No contract, no card.
30 years · 44,000 organizations · 500,000 assessments · 100% success on C-TPAT, PIP and AEO validations.