C-TPAT · Exporters· U.S. Customs & Border Protection
CBP certifies your customer.
Your importer is on the hook for proving your security practices meet the Minimum Security Criteria, whether or not you ever apply for anything yourself. The questionnaire they send you is their Business Partner Requirements obligation, not a formality.
Who CBP actually certifies here
CBP does not publish a C-TPAT Minimum Security Criteria document for 'exporters' as a trade entity type. C-TPAT certifies the U.S. side of the import chain: importers, carriers, brokers, consolidators, and (for a short list of eligible countries) foreign manufacturers. If your company exports to a C-TPAT-certified U.S. importer, you are not the one CBP certifies, you are the business partner whose security practices that importer is required to assess and document under their own Business Partner Requirements and Risk Assessment criteria.
How the 5-step risk assessment applies
The five-step risk assessment runs on your customer's side of the border, but it runs straight through your facility, your personnel screening, and your own sub-suppliers. Running the same assessment on yourself, before your customer's audit finds the gap, is how you stay the supplier they keep choosing instead of the one that gets flagged.
The Minimum Security Criteria that carry the most weight for exporters
Business Partner Requirements
Your customer's program requires them to document that you meet comparable security practices. This is the pillar their questionnaire to you is actually satisfying.
Physical Security
Perimeter, loading dock and storage area controls at your facility, the part of your operation a C-TPAT importer is required to have visibility into.
Personnel Security
Background screening for staff with access to cargo and shipping documentation, one of the first things a validator asks an importer to demonstrate about its suppliers.
Procedural Security
Documented chain of custody from production to the point the goods leave your control, so a discrepancy traces to a shift and a name, not a shrug.
Source: U.S. CBP, C-TPAT Minimum Security Criteria (cbp.gov)
Questions specific to exporters
Can an exporter apply for C-TPAT directly?
Not as a distinct 'exporter' category. CBP's published trade entity types for C-TPAT are importers, U.S./Canada and U.S./Mexico highway carriers, rail, sea and air carriers, marine port and terminal operators, consolidators and NVOCCs, customs brokers, and foreign manufacturers from a limited list of eligible countries. If none of those describes your business, your path into the program is as a certified importer's assessed and documented business partner, not a direct member.
Why does my importer keep asking me to redo the same security questionnaire?
Because their own C-TPAT certification requires it, on a cadence, not once. Their validator checks that their business partner assessments are current, not just on file from the year they joined. Running your own five-step assessment and handing them the finished evidence, instead of filling in their form from scratch each time, is the fastest way to stop that cycle.
If I am not C-TPAT certified myself, does any of this matter to me?
It matters every time a customer asks. A documented security assessment is what turns "we think we are fine" into evidence your buyer can hand their own validator. Buyers increasingly choose, and keep, the suppliers who can produce that evidence without being chased for it.
Also on C-TPAT
8 suppliers · 14-day trial
Start your 14-day trial: run your 8 highest-risk suppliers through the full C-TPAT 5-step risk assessment. No contract, no card.
30 years · 44,000 organizations · 500,000 assessments · 100% success on C-TPAT, PIP and AEO validations.