File Name: ctpat_best_practices.pdf
File Size: 2.46 MB
File Type: Application/pdf
Last Modified: 12 years
Status: Available
Last checked: 2 hours ago!
This Document Has Been Certified by a Professional
100% customizable
Language: English
We recommend downloading this file onto your computer
Supply Chain SecurityBest PracticesCatalogCustoms-Trade Partnership Against Terrorism (C-TPAT) c o n t e n t SPrologue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iiiIntroduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Using this Catalog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2Tiered Benefits Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Tier Three Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Corporate Governance Structure Supporting Supply Chain Security . . . . . . . . . . . . . . . . . 4Management Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5Advanced Data/Entry Level Data Submission . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Risk Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8Self-Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9Security Planning and Program Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Business Partner Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Manufacturer/Supplier/Vendor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Service Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Customer Screening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Customer Outreach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Container/Trailer/ULD Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Container/Trailer/Unit Load Device (ULD) Inspections . . . . . . . . . . . . . . . . . . . . . . . . . 17 Container Seals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Tracking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Storage/Inventory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21Conveyance Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Conveyance Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Conveyance Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Conveyance Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Cargo Tracing in Route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Physical Access Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Employees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Visitors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Deliveries/Cargo Pick-Up (Including Mail) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Search Vehicles/Persons/Packages (Incoming) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Challenging and Removing Unauthorized Persons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30Supply Chain Security Best Practices Catalog c o n t e n t sPersonnel Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Pre-Employment Verifications, Background Checks, and Investigations . . . . . . . . . . . . . 31 Personnel Termination Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Internal Code of Conduct/Employee Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Procedural Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Identifying/Reporting/Tracking Incidents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Brand Name/Identity Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Manifesting/Invoicing/EDI Receiving . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Shipping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Packing/Packaging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Cargo Discrepancies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Preventing Collusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37Security Training/Threat Awareness/Outreach . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Awareness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Specialized Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Outreach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Employee Incentives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Incident Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41Physical Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Fencing/Gates/Gate Houses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Guards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Parking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Locking Mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Lighting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Alarm Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Video Surveillance Cameras . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44Information Technology Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Password Protection/Access Restrictions (Internal) . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Viruses/Firewalls/Tampering Prevention (External) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Policies/Procedures/Management Support/Training . . . . . . . . . . . . . . . . . . . . . . . . . . 47 System/Data Back-Ups/Recovery Plans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Hardware Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47Emergency Preparedness/Disaster Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48Program Memberships to Enhance Supply Chain Security . . . . . . . . . . . . . . . . . 48ii Supply Chain Security Best Practices Catalog P r o l o g u eThe Customs-Trade Partnership Against Terrorism (C-TPAT) is, beyond question, the largest andmost successful government-private sector partnership to emerge from the terrorist attacks onSeptember 11, 2001. C-TPAT was launched in November 2001, with just seven companies—sevenmajor importers who embraced the necessity of supply chain security within the highest corporatemanagement levels of their organizations. Today, more than 10,000 companies—critical players inthe global supply chain—have applied for membership, and more than 6,000 have been acceptedas certified partners
Since the beginning, the guiding principles for C-TPAT have been voluntary participation andjointly developed security criteria, best practices and implementation procedures. C-TPAT partnershave worked cooperatively with U.S. Customs and Border Protection (CBP) to protect their supplychains from concealment of terrorist weapons, including weapons of mass effect, and global sup-ply chains are more secure today as a result of C-TPAT. In exchange, CBP provides reduced inspec-tions at the port of arrival, expedited processing at the border, and other significant benefits, suchas “front of line” inspections and penalty mitigation. Additionally, C-TPAT status is one variablefactored into post-incident contingency planning should a terrorist act impact international supplychains. The security commitment demonstrated by C-TPAT members is strong and meaningful, asare the benefits provided by CBP
U.S. Customs and Border Protection would like to recognize and thank its many partners in thetrade community who have embraced the goals and objectives of the C-TPAT program to improvesupply chain security worldwide
Supply Chain Security Best Practices Catalog iii C-TPAT U.S. Customs and Border Protectioniv Supply Chain Security Best Practices Catalog U.S. Customs and Border Protection C-TPATIntroductionThis catalog of Supply Chain Security Best Practices (Best Practices) is organized based on theCustoms Trade Partnership Against Terrorism (C-TPAT) Security Criteria. The best practices includ-ed herein are those that have been identified through more than 1,400 validations and site visitsconducted by C-TPAT Supply Chain Security Specialists (SCSS). “Best Practices” are defined as:1) Security measures that exceed the C-TPAT Security Criteria,2) incorporate management support,3) have written policies and procedures that govern their use,4) employs a system of checks and balances, and5) have measures in place to ensure continuity
This catalog is not exhaustive or all-inclusive of best practices in the international supply chain
It is intended to serve as a living document and will be updated periodically to reflect the bestpractices found during validations
Best practices are achieved through the effective utilization of people, processes and technology
Best practices incorporate a system of checks and balances, oversight, accountability, and verifica-tion of reliability throughout each aspect of the supply chain in order to ensure that the supplychain cannot be compromised. While many of the best practices listed in this catalog may assistbusinesses in theft prevention and asset protection, their intended use focuses on the preventionof weapons of mass effect, terrorists, or other contraband from entering the supply chain. A singlebest practice does not constitute an effective supply chain security program. Security best practicesmust be applied to appropriately reduce the level of risk associated with any international supplychain. It is of paramount importance to approach the international supply chain in its totality,because a chain is only as strong as its weakest link
In order for a supply chain security best practice to exist, continue to thrive and be effective, theymust have the full support of high-level company management. Security best practices shouldbecome an integral part of a company’s culture by being incorporated into the company’s missionand core business processes. Through the validation process, CBP has found that those businesseswhose core philosophy is “continuous improvement” have achieved effective supply chain securityand have realized many collateral benefits from analyzing the security of their supply chains. Suchbenefits include but are not limited to development of standards, elimination of duplicative pro-cesses to increase efficiency, and greater supply chain visibility. Most importantly, these companieshave made significant contributions to global supply chain security by continually improving theirsecurity practices
CBP recognizes the diverse size and financial abilities of C-TPAT members, and this catalogattempts to provide examples of not only advanced security technologies, but of lower costsecurity practices as well, both of which may help achieve the same security goals. For example,concerning “conveyance tracking,” the intended purpose of accurately tracking conveyance move-ments and detect deviations can be achieved through the use of GPS tracking systems, or throughSupply Chain Security Best Practices Catalog C-TPAT U.S. Customs and Border Protectiona lower cost security practice of requiring drivers to follow designated routes with predeterminedaverage travel times, along with periodic communication between the truck driver and companyofficials. Both of these security best practices help achieve the security goal of conveyance trackingthus providing a more secure environment
Using this CatalogThis catalog is written in a generic manner to allow for flexibility, maintaining the confidentialityof C-TPAT partners and preventing the endorsement of specific technology, services, or products
Generic business entity names are used (e.g., Company, Logistics Provider, Consolidator, HighwayCarrier, Port, Terminal Operator, Sea Carrier, and Air Carrier) in order to provide the contextin which the best practice was identified. It is important to note that the best practices listedfor these entity types are not necessarily exclusive to the entity mentioned. These best practicesare applicable to many industries where the process is performed within the supply chain. Forexample, a best practice for seal control may be listed as being performed by a consolidator, but afactory may be able to use the same best practice, given that seal control also applies to factories
Generic terms referring to time such as “routinely,” “randomly,” “intervals,” “specified period oftime,” and “periodically” are meant to convey that a definitive time frame should be establishedfor that best practice
The Best Practices Catalog is not designed as a master check list of security practices which must beadopted in order to receive Tier Three Benefits. The C-TPAT program from its inception has takena flexible approach, where it is recognized that “one size does not fit all,” and that customizedsecurity measures must be developed and implemented in accordance with the risk present. Forexample, the adoption of certain best practices in a low risk environment may be sufficient tomitigate the risk present and enable the importer to qualify for Tier Three standing. However, ina high-risk environment, the adoption of the same practices may be viewed as a necessary, mini-mum security measure, and therefore not elevate the overall security environment to the point atwhich the importer would be considered for Tier Three. A determination of Tier Three eligibilityis thus based on the totality of the security measures employed, not on any specific practice(s),and whether or not the overall security environment effectively addresses the risk adherent to thatspecific international supply chain
C-TPAT Supply Chain Security Specialists are committed to working alongside members to helpdesign the security measures necessary to address the risk, exceed minimum security standards,and thus enable the importer to achieve Tier Three standing and receive the greatest benefitsafforded by CBP
Supply Chain Security Best Practices Catalog U.S. Customs and Border Protection C-TPATTiered Benefits StructureTo ensure the success of C-TPAT, the security criteria or standards which members must meet orexceed must remain robust, dynamic, and within a flexible security framework, with the overallobjective of elevating the security measures employed throughout the international supply chain
As C-TPAT members enhance their security measures to meet these clearly defined security crite-ria, CBP must also provide enhanced benefits. In May 2005, CBP moved to a three-tiered benefitsstructure, where C-TPAT importers who do more, receive more
Under Tier One, certified importers receive meaningful risk score reductions, resulting in fewercargo examinations for security concerns, a lower level of random Compliance Measurementexaminations than those afforded to non-C-TPAT importers, and the negation of most tradecargo examine selectivity. These three conditions afford Tier One importers with a low level ofexaminations. Additionally, Tier One importers are also eligible for expedited cargo processing atthe border (FAST lanes at the land borders), receive ‘front of line’ inspection privileges at portsof entry should an examination be required, are entitled to certain penalty mitigation for TradeAct of 2002 violations, become eligible for the Importer Self Assessment program, and may attendC-TPAT training seminars. CBP believes that the level of benefits afforded Tier One importers iscommensurate to the level of commitment demonstrated by the C-TPAT member
With the additional commitment demonstrated as a result of having successfully undergone a vali-dation, the validated importer then becomes eligible for Tier Two or Tier Three status. An importerwhose validation reveals that minimum security criteria have been met will receive Tier Two benefits
Tier Two benefits include all the same benefits associated with Tier One, but Tier Two import-ers are provided with twice the level of risk score reductions received by Tier One importers,resulting in significantly fewer examinations for security reasons than those received by Tier Oneimporters
Finally, for those importers whose security measures exceed the minimum security criteria and haveadopted “security best practices” as evidenced by the successful completion of a validation, TierThree status is granted. Under Tier Three, all benefits associated with Tier One and Tier Two aregranted, and the most significant risk score reductions available are provided by CBP, resultingin very infrequent examinations for security reasons. Tier Three status is also the precursor forCBP’s “Green Lane” which will afford members with zero inspections upon arrival except for anoccasional random examination, contingent on meeting other “Green Lane” requirements, suchas shipment through a Container Security Initiative (CSI) port, and the use of a container securitydevice. CBP intends to roll out the “Green Lane” in 2006 once effective container security technol-ogy becomes available
Tier Three StatusTo help importers achieve the highest level of benefits provided, Tier Three benefits and the pre-cursor to the “Green Lane,” CBP has committed to outline “Security Best Practices” and work withmembers to adopt, modify, and implement those security best practices which will help take themember’s security practices to the next level
Supply Chain Security Best Practices Catalog C-TPAT U.S. Customs and Border ProtectionThis inaugural edition of the C-TPAT Best Practices Catalog is intended to categorize specific securitymeasures which C-TPAT Supply Chain Security Specialists have identified as ‘best practices’ result-ing from the more than 1,400 validations conducted to date. This catalog will be a living docu-ment, updated periodically as additional validations are conducted and new security best practicesare noted. The outlined “best practices” pertain to security procedures used throughout an inter-national supply chain, such as conveyance monitoring and tracking, cargo tracing, preventing col-lusion, employee awareness, physical security and surveillance, and other areas crucial to supplychain security
Corporate Governance Structure SupportingSupply Chain SecurityAs C-TPAT Supply Chain Security Specialists conduct security validations, one common, essentialpractice has emerged which is so significant to the overall supply chain security environment, thatTier Three status can only be obtained by the presence of this practice. That practice is a corporategovernance structure through which supply chain security is embraced at the highest levels of thecompany—the CEO, the COO, the President, etc. The security of a company’s supply chain shouldbe a required topic of discussion in corporate boardrooms. Security of supply chains is often asimportant to the financial survival of a company as the accuracy of a company’s financial state-ments. Supply chain security practices must be periodically reviewed for adequacy by CEOs andcorporate boards, and noted deficiencies must be addressed timely
Additionally, a unified corporate governance structure which embraces the importance of supplychain security has proven to be more effective in leveraging their corporate strength to requiresupply chain security practices and enhancements through their entire international supply chain,from all business partners. These security measures must be pushed back from the point of stuff-ing of the container or air cargo shipment, through the ultimate arrival of the cargo into a U.S
port of entry. The active engagement by top corporate officials in a company’s supply chain secu-rity efforts cannot be understated, and as a result, the involvement by senior corporate leaders is arequisite for Tier Three status
Supply Chain Security Best Practices Catalog U.S. Customs and Border Protection C-TPATManagement SupportSenior management support determines whether or not the appropriate resources (human, financial,and technological) will be dedicated toward improving supply chain security, and ensuring that secu-rity is a priority for the company as a whole. This support is demonstrated by senior management’sinvolvement in and understanding of the company’s supply chain security program
Domestic“Continuous Improvement” Philosophy: Company management integrated supply chain securityinto its business processes, practices, policies, procedures, and employee job descriptions. TheCompany considers security part of its “continuous improvement” business philosophy
Proactively Engaged: Senior management from key departments (Information Technology,Purchasing, Contracting, Finance, Sales/Marketing, Shipping/Receiving, Transportation, CustomsCompliance, Human Resources, and Facilities Maintenance) are fully engaged in overseeing and insome cases are actively involved in supply chain security initiatives. This support is demonstratedby their allocation of resources to security related programs and their participation in monthlysecurity assessment meetings. Senior Management is proactively engaged in seeking ways toimprove security measures for the company and its business partners
Weekly Briefings: A President of a Highway Carrier provides breakfast to his dispatchers anddrivers on Saturday. During that time, he conducts a meeting, provides training, and discussestransportation security concerns. The President documents topics discussed and employees whoattended. Follow-up is conducted to ensure that absent employees remain informed
Supply Chain Security Committee: A Supply Chain Security Committee was established by seniorcompany executives to evaluate the Company’s overall supply chain security and make recommen-dations for improvement. The Supply Chain Security Committee is comprised of senior managers,operational supervisors, line employees, and key management from foreign locations who areresponsible for international supply chain security
Top Management Knows Business Partners: Company’s senior executive management maintainsa high level of familiarity with its overseas agents, their practices, and affiliations by using formaland alternative methods to collect information. In addition, the company president has conductedextensive international travel to meet with buying agents to discuss factory and transportationprovider security requirements
Full Integration of Supply Chain Security Policies: Company executive management is com-mitted to ensuring that supply chain security procedures are adopted by all of their subsidiaries,suppliers, and service providers worldwide. All company subsidiaries must develop and imple-ment a sound security plan that addresses terrorist risks in the international supply chain andcrisis management. Executive management reviews these plans to ensure their completeness andimplementation
Supply Chain Security Best Practices Catalog C-TPAT U.S. Customs and Border ProtectionWorldwideEstablishing Security Directors and Country Managers: An International Corporation has estab-lished Regional Supply Chain Security Directors and Country Managers worldwide to ensure thatsupply chain security procedures are implemented and consistently followed by factories and ser-vice providers. These Security Directors and Country Managers also are responsible for continualsupply chain security risk analysis and contingency planning for the corporation
Security Councils: Company established a Security Council to formulate global security guide-lines, determine methods to evaluate security weaknesses, formulate action plans, and determinemethods to control security procedures worldwide. Senior management at all locations is respon-sible for documenting actions they have taken to support and improve supply chain securitypractices
Mission Statement: International Company has incorporated supply chain security into its mis-sion statement
Supply Chain Security Best Practices Catalog
While many of the best practices listed in this catalog may assist businesses in theft prevention and asset protection, their intended use focuses on the prevention of weapons of mass effect, terrorists, or other contraband from entering the supply chain. A single best practice does not constitute an effective supply chain security program.
This inaugural edition of the C-TPAT Best Practices Catalogis intended to categorize specific security measures which C-TPAT Supply Chain Security Specialists have identified as ‘best practices’ result- ing from the more than 1,400 validations conducted to date.
u.S. customs and Border ProtectonC-TPAT Supply Chain Security Best Practices Catalog tion including packing list data to the Company’s distribution center. The barcode system ensures product accountability from the time of packing until its delivery to the distribution center in the United States.
In order for best practices to be effective, they should include high-level managerial support, employ a system of checks and balances, and have written and verifiable policies and procedures. C-TPAT personnel have conducted over 8,000 validations and site visits since the publication of the 2006 Supply Chain Security Best Practices Catalog.
C-TPATu.S. customs and Border Protecton Supply Chain Security Best Practices Catalog Inspecting Vehicles:Terminal Operator’s security personnel randomly inspect X% of all trucks entering the facility. A plan is established to randomly search X% of all private vehicles entering the facility each day.