C-TPAT · Customs Trade Partnership Against Terrorism
C-TPAT requirements and validation readiness for US importers and the suppliers who ship to them.
U.S. Customs and Border Protection sets the Minimum Security Criteria and validates the partners in its programme. Sterling's expert and experienced consultants prepare your security profile, controls and evidence, whether you import into the United States or supply a customer who does, in 60+ countries. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced supply chain security consultants, supporting importers, manufacturers and logistics providers since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not validate or admit anyone to the programme; CBP decides
8,100+ client engagements in 60+ countries.
Why supply chain clients choose Sterling
What it is
What is C-TPAT?
C-TPAT, the Customs Trade Partnership Against Terrorism, is a programme run by U.S. Customs and Border Protection. CBP now writes the name as CTPAT; both spellings refer to the same programme. Partners agree to meet CBP's Minimum Security Criteria, which CBP publishes as separate documents for different types of business, such as U.S. importers and foreign manufacturers.
Applicants complete a security profile in the CTPAT Portal, and CBP then carries out a validation of the partner's security practices. CBP has finalised an update to the Minimum Security Criteria, publishes a CTPAT Trade Compliance handbook for partners that also want trade compliance benefits, and keeps mutual recognition arrangements with other customs programmes.
Current status. CBP updates the Minimum Security Criteria and portal guidance from time to time. We work from the documents on cbp.gov for your business type when the engagement starts.
Who it is for
Who needs C-TPAT?
The programme is American, but the requirements travel down the supply chain to wherever goods are made and packed. We meet three situations:
- A US importer wants to join or keep its status. The company needs a security profile that CBP will accept and a validation it can pass.
- A US customer asks its overseas supplier to comply. Factories and packers receive questionnaires or visits based on the Minimum Security Criteria and must show the controls are in place.
- A logistics provider serves US-bound cargo. Carriers, brokers and third-party logistics providers are asked to demonstrate the security criteria that apply to their role.
Requirements
What are the C-TPAT requirements?
CBP's Minimum Security Criteria set the requirements, and they differ by type of business. We have not reproduced CBP's criteria here; the list shows what Sterling's work covers, checked against the criteria document for your business type.
- Supply chain risk assessment: the routes, partners and points where goods could be tampered with.
- Business partner requirements: screening and security expectations for suppliers, carriers and service providers.
- Conveyance, container and seal security: inspections, seals and the records that prove they were done.
- Physical, access and personnel security: premises, entry control, staff checks where required and visitor management.
- Security training and the portal profile: awareness for staff and a CTPAT Portal profile backed by evidence.
What does useful C-TPAT evidence look like?
A documented supply chain risk assessment, partner screening records, container and trailer inspection checklists, seal logs, access records, training attendance and proof that findings were acted on. CBP's validation looks at practice, so we help you keep records that show the controls running day to day.
Your engagement
What your C-TPAT engagement includes
Route: validation by CBP. Choose one of two support levels under Sterling OS™: Design™ (guided), where your team does the work with our method and reviews, or Drive™ (managed), where our consultants carry more of it. Sustain™ keeps the controls in use after validation; Automate™ is Effivity.
Scope and gap assessment
Your business type, sites and partners, assessed against the applicable criteria document.
Security improvement plan
Physical, procedural and partner actions with owners and dates.
Effivity ISO & GRC software
Risk assessments, inspections, partner records and actions in one place, included with the engagement at no additional cost.
Training for your people
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal review
A rehearsal of the validation, with gaps closed before CBP's visit or your customer's audit.
Portal and validation support
Help preparing the security profile and support through the validation.
Sterling does not validate, certify or admit anyone to CTPAT; CBP reviews the security profile, carries out the validation and decides.
Often combined with
Standards organisations pair with C-TPAT
- AEOAuthorised Economic Operator (AEO) readiness: what customs examines, who can apply and how Sterling prepares your controls and evidence for the customs visit.
- BRCGS Storage and Distribution · Agents and BrokersBRCGS Storage and Distribution certification and Agents and Brokers: Issue 4 and Issue 3 requirements, scopes, audits and cost factors, with Sterling's support.
- CBAMCBAM compliance and requirements explained: authorised declarant status, the 50-tonne threshold, verified embedded emissions and how Sterling helps you prepare.
- EcoVadisEcoVadis rating consulting: evidence on environment, labour and human rights, ethics and sustainable procurement, prepared for the assessment EcoVadis runs.
- EU Deforestation Regulation (EUDR)EUDR compliance and requirements for cattle, cocoa, coffee, palm oil, rubber, soya and wood: due diligence, risk assessment and the 30 December 2026 date.
- FSC and PEFC chain of custodyFSC and PEFC chain of custody certification and requirements: FSC-STD-40-004 V3-1, PEFC ST 2002:2020, the audit route and cost factors, with Sterling.
Effivity · ISO and GRC software, included in every engagement
How Effivity helps you run, automate and simplify C-TPAT security controls.
Every Sterling C-TPAT engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up the workspace within the agreed scope, so risk assessments, partner screening, container inspections, seal logs, training records and internal reviews sit together, and the controls keep running between validations. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Sites, routes and roles
Each site and trade lane in scope, with the people responsible for security.
Supply chain risk assessment
Threats and controls by route and partner, reviewed on a schedule.
Business partner screening
Questionnaires, reviews and follow-up for suppliers, carriers and providers.
Container and seal inspections
Checklists completed on a phone or tablet, with photos and dates.
Training records
Who has completed security awareness and when refreshers are due, linked to Sterling Academy.
Security incidents and findings
Reported, investigated and closed with the cause fixed.
Internal review and management review
Checks of the controls, findings and decisions recorded in one place.
Your own forms and reports
Checklists, workflows and reports shaped to your operation, without code.
What this means at the validation
CBP and your customers ask for the risk assessment, partner screening, inspection records and training evidence. In Effivity each of those is a screen with dates, owners and evidence attached. After validation, Sustain™ runs in the same workspace, so the next review finds controls that kept working.
In your engagement
- Subscription included with the engagement, at no additional cost
- Set up by your Sterling consultant within the agreed scope
- Existing records and registers migrated, not retyped
- Admin and user training for your team
- Modules for QMS, ISMS, OHSMS and more when you integrate other standards
Sterling Academy · e-learning for supply chain teams
Help every person on the dock and in the office recognise a security risk.
Sterling Academy provides e-learning for whole teams and for the people who run the system: video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients receive preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Security awareness for every employee, with completion records
- Internal auditor training for the people who will review the controls, as applicable to your standard, as part of the engagement
- Progress by site and a training status report for management
- New starters trained as they join, so records stay current
- A Sterling consultant available when a learner has a question
Keep exploring
Explore more about C-TPAT
Why Sterling
Why choose Sterling for C-TPAT?
C-TPAT expectations reach factories and warehouses far from the United States. Sterling works on both sides of that chain, with US importers and with the overseas suppliers and logistics providers they rely on, so the controls line up from the loading dock to the port of entry.
60+ countries since 2003
Management system consulting across sectors and regions, with offices in 21 countries and one engagement team accountable across your sites.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with any third-party fees shown separately. No surprises, ever.
Controls that fit the operation
Inspections, seals and partner checks built into daily routines, so security does not slow shipments.
Expert and experienced consultants
Consultants who have built security and management systems for manufacturing and logistics clients since 2003.
The Sterling Promise
What the Sterling Promise means for C-TPAT
We stay with you until the agreed C-TPAT outcome is reached: controls implemented, evidence in place and support through CBP's validation or your customer's audit. Clear explanations, practical delivery, included software and employee learning leave you with controls that last.
The engagement identifies the business type, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. CBP carries out the validation and retains its decisions on the programme. Our commitment concerns the agreed support, not a promise of any particular customs benefit.
FAQs
Frequently asked questions about C-TPAT
Is C-TPAT the same as CTPAT?
Yes, they are the same programme. U.S. Customs and Border Protection now writes the name as CTPAT, while many customers and questionnaires still use the older C-TPAT spelling.
Can a supplier outside the United States meet C-TPAT requirements?
Yes. CBP publishes Minimum Security Criteria for foreign manufacturers, and many overseas suppliers are asked by their US customers to meet them. Whether a foreign business can apply to the programme directly depends on CBP's eligibility rules for its business type.
Does Sterling carry out C-TPAT validation?
No. CBP carries out the validation and decides on participation. Sterling prepares your controls, evidence and security profile, and can rehearse the validation with your team beforehand.
Keep exploring
More on C-TPAT and related standards
More in Supply chain, logistics & customs
Talk to a consultant
Plan your C-TPAT readiness with confidence.
Tell us your business type, sites and customer or CBP deadline. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice