C-TPAT Security Profile
Produces an evidence-based C-TPAT profile draft aligned to U.S. CBP minimum security criteria, mapped directly to company operations and source documents.
Quick Start
- Collect governing docs (policies, SOPs, audits, training records, partner questionnaires).
- Confirm corporate identifiers (legal name, EIN, DUNS, C-TPAT account number, facility addresses).
- Gather operations data (importer role, volumes, countries/lanes, supply chain map).
- Gather security evidence per module (physical, personnel, cargo, conveyance, IT, business partner).
- Set document version baseline and submission target date.
Core Workflow
- Validate inputs — verify each factual claim against source documents.
- Identify gaps — emit a Gap Register before drafting if required facts are missing.
- Draft sections — populate all 13 mandatory sections (see below).
- Crosswalk compliance — map each company control → C-TPAT minimum → supporting evidence.
- Quality check — scan for accuracy, contradictions, completeness, and CBP-appropriate tone.
Intake Matrix
| Domain |
Evidence Needed |
Maps To |
| Eligibility |
Import role, volume, facilities, prior tier |
Intro + jurisdiction |
| Governance |
Security leadership, reporting lines, budget |
Org framework |
| Risk methodology |
Assessment cadence, criteria, data sources |
Risk assessment |
| Physical controls |
Access, surveillance, lighting, alarms, patrols |
Physical security |
| Personnel |
Screening, onboarding, training, revocations |
Personnel security |
| Procedural |
Partner due diligence, custody chain, inspections |
Business-partner security |
| Conveyance |
Carrier vetting, 7-point inspections, seals, transit |
Conveyance/cargo integrity |
| IT |
MFA, segmentation, patching, incident response |
IT security |
| Compliance |
Self-assessments, corrective actions, validation prep |
Continuous improvement |
Mandatory Sections
- Cover Page — company info, title, version, date, preparer
- Profile Summary — tier objective, participation status, confidence level
- Organizational Framework
- Risk Assessment
- Physical Security
- Personnel Security
- Procedural / Business-Partner Security
- Conveyance and Cargo Integrity
- Information Technology Security
- Recordkeeping and Compliance Management
- Self-Assessment and Corrective Action Register
- Validation Readiness
- Appendix Index and Signature Statement
Section Template
Each security module section follows this structure:
- Current Practice — fact-based description
- Controls in place — specific measures
- Evidence references — document name + date
- Gaps and residual risks
- Planned improvements — owner assigned
- Status: Compliant / Partially Compliant / Non-Compliant
Specialized Records
Seven-Point Inspection Log (per container/trailer): Unit ID, date/time, inspector, front wall, left side, right side, floor, ceiling/roof, doors inside/out, undercarriage, anomalies + photos + corrective actions.
Seal Control Register: Seal number, vendor/standard, issuance date, assigned shipment, installation point, receipt verification, discrepancy response, disposition.
Corrective Action Plan: Finding, control owner, corrective action, deadline, verification method, status.
Pitfalls and Checks
- Use only verifiable facts from provided records — never invent documents, certifications, or findings.
- Every claim requires a source pointer (policy, SOP, log, audit report, contract, training record).
- Use exact terms from company records for titles, systems, equipment, and locations.
- Mark uncertain regulatory specifics with [VERIFY] for human confirmation.
- Enforce 7-point inspection checks and ISO 17712 high-security seal handling.
- Default to U.S.-only CBP scope unless user provides multinational authority requirements [VERIFY].
- Final output must be validator-ready: consistent cross-references, indexed exhibits, revision control.
1---2name: ctpat-security-profile3description: Drafts a submission-ready C-TPAT Security Profile from verified company records for U.S. CBP enrollment, recertification, or validation prep. Use when preparing security profiles for importers, brokers, freight forwarders, or logistics participants. Trigger keywords: C-TPAT, CTPAT, CBP, security profile, customs compliance, validation visit, revalidation.4---56# C-TPAT Security Profile78Produces an evidence-based C-TPAT profile draft aligned to U.S. CBP minimum security criteria, mapped directly to company operations and source documents.910## Quick Start11121. Collect governing docs (policies, SOPs, audits, training records, partner questionnaires).132. Confirm corporate identifiers (legal name, EIN, DUNS, C-TPAT account number, facility addresses).143. Gather operations data (importer role, volumes, countries/lanes, supply chain map).154. Gather security evidence per module (physical, personnel, cargo, conveyance, IT, business partner).165. Set document version baseline and submission target date.1718## Core Workflow19201. **Validate inputs** — verify each factual claim against source documents.212. **Identify gaps** — emit a Gap Register before drafting if required facts are missing.223. **Draft sections** — populate all 13 mandatory sections (see below).234. **Crosswalk compliance** — map each company control → C-TPAT minimum → supporting evidence.245. **Quality check** — scan for accuracy, contradictions, completeness, and CBP-appropriate tone.2526## Intake Matrix2728| Domain | Evidence Needed | Maps To |29|---|---|---|30| Eligibility | Import role, volume, facilities, prior tier | Intro + jurisdiction |31| Governance | Security leadership, reporting lines, budget | Org framework |32| Risk methodology | Assessment cadence, criteria, data sources | Risk assessment |33| Physical controls | Access, surveillance, lighting, alarms, patrols | Physical security |34| Personnel | Screening, onboarding, training, revocations | Personnel security |35| Procedural | Partner due diligence, custody chain, inspections | Business-partner security |36| Conveyance | Carrier vetting, 7-point inspections, seals, transit | Conveyance/cargo integrity |37| IT | MFA, segmentation, patching, incident response | IT security |38| Compliance | Self-assessments, corrective actions, validation prep | Continuous improvement |3940## Mandatory Sections41421. Cover Page — company info, title, version, date, preparer432. Profile Summary — tier objective, participation status, confidence level443. Organizational Framework454. Risk Assessment465. Physical Security476. Personnel Security487. Procedural / Business-Partner Security498. Conveyance and Cargo Integrity509. Information Technology Security5110. Recordkeeping and Compliance Management5211. Self-Assessment and Corrective Action Register5312. Validation Readiness5413. Appendix Index and Signature Statement5556## Section Template5758Each security module section follows this structure:5960- **Current Practice** — fact-based description61- **Controls in place** — specific measures62- **Evidence references** — document name + date63- **Gaps and residual risks**64- **Planned improvements** — owner assigned65- **Status**: Compliant / Partially Compliant / Non-Compliant6667## Specialized Records6869**Seven-Point Inspection Log** (per container/trailer): Unit ID, date/time, inspector, front wall, left side, right side, floor, ceiling/roof, doors inside/out, undercarriage, anomalies + photos + corrective actions.7071**Seal Control Register**: Seal number, vendor/standard, issuance date, assigned shipment, installation point, receipt verification, discrepancy response, disposition.7273**Corrective Action Plan**: Finding, control owner, corrective action, deadline, verification method, status.7475## Pitfalls and Checks7677- Use only verifiable facts from provided records — never invent documents, certifications, or findings.78- Every claim requires a source pointer (policy, SOP, log, audit report, contract, training record).79- Use exact terms from company records for titles, systems, equipment, and locations.80- Mark uncertain regulatory specifics with [VERIFY] for human confirmation.81- Enforce 7-point inspection checks and ISO 17712 high-security seal handling.82- Default to U.S.-only CBP scope unless user provides multinational authority requirements [VERIFY].83- Final output must be validator-ready: consistent cross-references, indexed exhibits, revision control.
lev-os