C-TPAT Security Profile
Produces an evidence-based C-TPAT profile draft aligned to U.S. CBP minimum security criteria, mapped directly to company operations and source documents.
Quick Start
- Collect governing docs (policies, SOPs, audits, training records, partner questionnaires).
- Confirm corporate identifiers (legal name, EIN, DUNS, C-TPAT account number, facility addresses).
- Gather operations data (importer role, volumes, countries/lanes, supply chain map).
- Gather security evidence per module (physical, personnel, cargo, conveyance, IT, business partner).
- Set document version baseline and submission target date.
Core Workflow
- Validate inputs — verify each factual claim against source documents.
- Identify gaps — emit a Gap Register before drafting if required facts are missing.
- Draft sections — populate all 13 mandatory sections (see below).
- Crosswalk compliance — map each company control → C-TPAT minimum → supporting evidence.
- Quality check — scan for accuracy, contradictions, completeness, and CBP-appropriate tone.
Intake Matrix
| Domain |
Evidence Needed |
Maps To |
| Eligibility |
Import role, volume, facilities, prior tier |
Intro + jurisdiction |
| Governance |
Security leadership, reporting lines, budget |
Org framework |
| Risk methodology |
Assessment cadence, criteria, data sources |
Risk assessment |
| Physical controls |
Access, surveillance, lighting, alarms, patrols |
Physical security |
| Personnel |
Screening, onboarding, training, revocations |
Personnel security |
| Procedural |
Partner due diligence, custody chain, inspections |
Business-partner security |
| Conveyance |
Carrier vetting, 7-point inspections, seals, transit |
Conveyance/cargo integrity |
| IT |
MFA, segmentation, patching, incident response |
IT security |
| Compliance |
Self-assessments, corrective actions, validation prep |
Continuous improvement |
Mandatory Sections
- Cover Page — company info, title, version, date, preparer
- Profile Summary — tier objective, participation status, confidence level
- Organizational Framework
- Risk Assessment
- Physical Security
- Personnel Security
- Procedural / Business-Partner Security
- Conveyance and Cargo Integrity
- Information Technology Security
- Recordkeeping and Compliance Management
- Self-Assessment and Corrective Action Register
- Validation Readiness
- Appendix Index and Signature Statement
Section Template
Each security module section follows this structure:
- Current Practice — fact-based description
- Controls in place — specific measures
- Evidence references — document name + date
- Gaps and residual risks
- Planned improvements — owner assigned
- Status: Compliant / Partially Compliant / Non-Compliant
Specialized Records
Seven-Point Inspection Log (per container/trailer): Unit ID, date/time, inspector, front wall, left side, right side, floor, ceiling/roof, doors inside/out, undercarriage, anomalies + photos + corrective actions.
Seal Control Register: Seal number, vendor/standard, issuance date, assigned shipment, installation point, receipt verification, discrepancy response, disposition.
Corrective Action Plan: Finding, control owner, corrective action, deadline, verification method, status.
Pitfalls and Checks
- Use only verifiable facts from provided records — never invent documents, certifications, or findings.
- Every claim requires a source pointer (policy, SOP, log, audit report, contract, training record).
- Use exact terms from company records for titles, systems, equipment, and locations.
- Mark uncertain regulatory specifics with [VERIFY] for human confirmation.
- Enforce 7-point inspection checks and ISO 17712 high-security seal handling.
- Default to U.S.-only CBP scope unless user provides multinational authority requirements [VERIFY].
- Final output must be validator-ready: consistent cross-references, indexed exhibits, revision control.
1---2name: ctpat-security-profile3description: Drafts a submission-ready C-TPAT Security Profile from verified company records for U.S. CBP enrollment, recertification, or validation prep. Use when preparing security profiles for importers, brokers, freight forwarders, or logistics participants. Trigger keywords: C-TPAT, CTPAT, CBP, security profile, customs compliance, validation visit, revalidation.4license: Apache-2.05---67# C-TPAT Security Profile89Produces an evidence-based C-TPAT profile draft aligned to U.S. CBP minimum security criteria, mapped directly to company operations and source documents.1011## Quick Start12131. Collect governing docs (policies, SOPs, audits, training records, partner questionnaires).142. Confirm corporate identifiers (legal name, EIN, DUNS, C-TPAT account number, facility addresses).153. Gather operations data (importer role, volumes, countries/lanes, supply chain map).164. Gather security evidence per module (physical, personnel, cargo, conveyance, IT, business partner).175. Set document version baseline and submission target date.1819## Core Workflow20211. **Validate inputs** — verify each factual claim against source documents.222. **Identify gaps** — emit a Gap Register before drafting if required facts are missing.233. **Draft sections** — populate all 13 mandatory sections (see below).244. **Crosswalk compliance** — map each company control → C-TPAT minimum → supporting evidence.255. **Quality check** — scan for accuracy, contradictions, completeness, and CBP-appropriate tone.2627## Intake Matrix2829| Domain | Evidence Needed | Maps To |30|---|---|---|31| Eligibility | Import role, volume, facilities, prior tier | Intro + jurisdiction |32| Governance | Security leadership, reporting lines, budget | Org framework |33| Risk methodology | Assessment cadence, criteria, data sources | Risk assessment |34| Physical controls | Access, surveillance, lighting, alarms, patrols | Physical security |35| Personnel | Screening, onboarding, training, revocations | Personnel security |36| Procedural | Partner due diligence, custody chain, inspections | Business-partner security |37| Conveyance | Carrier vetting, 7-point inspections, seals, transit | Conveyance/cargo integrity |38| IT | MFA, segmentation, patching, incident response | IT security |39| Compliance | Self-assessments, corrective actions, validation prep | Continuous improvement |4041## Mandatory Sections42431. Cover Page — company info, title, version, date, preparer442. Profile Summary — tier objective, participation status, confidence level453. Organizational Framework464. Risk Assessment475. Physical Security486. Personnel Security497. Procedural / Business-Partner Security508. Conveyance and Cargo Integrity519. Information Technology Security5210. Recordkeeping and Compliance Management5311. Self-Assessment and Corrective Action Register5412. Validation Readiness5513. Appendix Index and Signature Statement5657## Section Template5859Each security module section follows this structure:6061- **Current Practice** — fact-based description62- **Controls in place** — specific measures63- **Evidence references** — document name + date64- **Gaps and residual risks**65- **Planned improvements** — owner assigned66- **Status**: Compliant / Partially Compliant / Non-Compliant6768## Specialized Records6970**Seven-Point Inspection Log** (per container/trailer): Unit ID, date/time, inspector, front wall, left side, right side, floor, ceiling/roof, doors inside/out, undercarriage, anomalies + photos + corrective actions.7172**Seal Control Register**: Seal number, vendor/standard, issuance date, assigned shipment, installation point, receipt verification, discrepancy response, disposition.7374**Corrective Action Plan**: Finding, control owner, corrective action, deadline, verification method, status.7576## Pitfalls and Checks7778- Use only verifiable facts from provided records — never invent documents, certifications, or findings.79- Every claim requires a source pointer (policy, SOP, log, audit report, contract, training record).80- Use exact terms from company records for titles, systems, equipment, and locations.81- Mark uncertain regulatory specifics with [VERIFY] for human confirmation.82- Enforce 7-point inspection checks and ISO 17712 high-security seal handling.83- Default to U.S.-only CBP scope unless user provides multinational authority requirements [VERIFY].84- Final output must be validator-ready: consistent cross-references, indexed exhibits, revision control.
ThomasMoreAI