Table of contents
The Minimum Security Criteria (MSC) are the security requirements U.S. Customs and Border Protection (CBP) sets for the CTPAT programme. The current criteria were updated by CBP in 2019 and are organised into 3 focus areas and 12 categories.
Factories in Vietnam cannot register for CTPAT themselves, but when U.S. customers request a security audit, it is usually based on these criteria. This guide explains each category: the key requirements and the evidence a factory needs.
For an overview of the programme first, see What Is CTPAT? Security Criteria and CTPAT Audits for Factories in Vietnam.
1. What Are the CTPAT Minimum Security Criteria?
The MSC are the security measures that companies in supply chains bringing goods into the U.S. are expected to apply. CBP publishes a separate set for each member type (importers, exporters, carriers, foreign manufacturers and others), but all follow the same structure of 3 focus areas and 12 categories.
The 2019 update added significant new content, notably cybersecurity, agricultural security and a requirement to review the risk assessment regularly. CBP began applying the updated criteria in member validations from early 2020.
For factories in Vietnam, the criteria for foreign manufacturers are the closest reference, as they reflect factory activities: packing, storage, container stuffing and handover.
2. "Must" vs "Should" Requirements
Each MSC criterion is classified as:
Must: mandatory. In a customer audit, an unmet "must" criterion is usually recorded as a finding that needs correction.
Should: recommended best practice. Not meeting it is usually not a finding, but it can affect the overall assessment.
Note that customers may use their own questionnaires and treat some "should" items as mandatory. Confirm which criteria your customer uses.
3. Overview: 3 Focus Areas, 12 Categories
| Focus area | Categories |
|---|---|
| Corporate security | 1. Security vision and responsibility · 2. Risk assessment · 3. Business partners · 4. Cybersecurity |
| Transportation security | 5. Conveyance and instruments of international traffic security · 6. Seal security · 7. Procedural security · 8. Agricultural security |
| People and physical security | 9. Physical security · 10. Physical access controls · 11. Personnel security · 12. Education, training and awareness |
4. Focus Area 1 — Corporate Security
4.1. Security Vision and Responsibility
Key requirements:
A knowledgeable supply chain security point of contact who reports to senior management.
A written review process to confirm that security procedures are being followed.
Should: a signed statement of support from management, communicated across the factory.
Evidence: appointment of the security lead; internal review plans and reports; management statement of support.
4.2. Risk Assessment
Key requirements:
Conduct and document a supply chain security risk assessment.
Review it at least once a year, or sooner when risks change (new carrier, new warehouse, an incident…).
Should: map how cargo moves from packing to handover to the carrier; maintain crisis management and business continuity plans.
Evidence: dated risk assessment and review records; cargo flow map; continuity plan.
4.3. Business Partners
Key requirements:
A written, risk-based process to screen new and existing partners: suppliers, subcontractors, carriers, warehouses and security contractors.
Where a partner is a CTPAT member or a mutually recognised Authorized Economic Operator (AEO), keep evidence of that status.
For other partners, carry out due diligence (security questionnaires, site assessments…), require weaknesses to be corrected and keep records.
Should: a social compliance programme, including controls against forced labour in the supply chain.
Evidence: partner list with risk ratings; completed questionnaires; assessment results; corrective action tracking.
4.4. Cybersecurity
Key requirements:
Written cybersecurity policies, reviewed regularly.
Up-to-date anti-malware and firewall protection; procedures against social engineering (phishing).
Regular testing of IT security and remediation of vulnerabilities found.
Individual user accounts with strong passwords; access based on job role and removed as soon as an employee leaves. CBP encourages multi-factor authentication.
Secure remote access (e.g. VPN).
Should: regular data backups and encryption of sensitive data.
Evidence: IT policy; account and access list; account removal records on termination; backup logs; IT test results.
5. Focus Area 2 — Transportation Security
5.1. Conveyance and Instruments of International Traffic Security
Instruments of International Traffic (IIT) include containers, trailers, air cargo pallets and similar equipment.
Key requirements:
Store conveyances and IIT in secure areas to prevent unauthorised access.
Written procedures for security and agricultural (pest) inspections.
Inspect empty containers before loading using a 7-point inspection; refrigerated containers use an 8-point inspection (adding the refrigeration unit). Tractors and trailers have their own checklists.
Check locking mechanisms, hinges and door bars for signs of tampering.
Remove visible pest contamination and keep records.
| Point | Area | Warning signs |
|---|---|---|
| 1 | Front wall | Unusual thickness, new rivets |
| 2 | Left side | Welds, fresh paint, patches |
| 3 | Right side | Welds, fresh paint, patches |
| 4 | Floor (inside) | Raised floor, new boards |
| 5 | Ceiling/roof | Low ceiling, tampered frame |
| 6 | Inside/outside doors | Replaced locks, hinges, rivets or bars |
| 7 | Outside/undercarriage | Hidden compartments, distorted frame |
Evidence: inspection procedure; completed checklist for each shipment; inspector training records.
5.2. Seal Security
Key requirements:
Written procedures for purchasing, issuing, using, logging and handling broken or tampered seals.
Use high-security seals that meet or exceed ISO 17712, placed in the correct position on the container door; keep evidence of compliance (e.g. the seal manufacturer's test certificate).
Audit seal inventory regularly and document the audit.
Verify seals when affixing them using VVTT: View, Verify, Tug, Twist.
Evidence: seal control procedure; seal issue log; inventory audit records; ISO 17712 certificate; photos of seals at loading.
5.3. Procedural Security
Key requirements:
Secure cargo staged overnight or for extended periods; inspect staging areas for pests.
Shipping information (bills of lading, manifests, filing data) must be accurate, complete and timely.
Written procedures for reporting security incidents and for challenging unauthorised or unidentified persons.
Investigate and resolve cargo discrepancies (overages, shortages, misdescriptions) and keep records.
Should: supervise loading; photograph loading and sealing; print seal numbers on shipping documents.
Evidence: loading procedure; loading photos; document reconciliation records; incident and discrepancy logs.
5.4. Agricultural Security
Key requirements:
Written procedures to prevent visible pest contamination of cargo, packaging and conveyances.
Wood packaging materials (pallets, crates) must comply with ISPM 15: debarked, heat-treated or fumigated, and marked with the IPPC stamp.
Evidence: pest inspection procedure and records; wood packaging treatment documents and IPPC marks.
6. Focus Area 3 — People and Physical Security
6.1. Physical Security
Key requirements:
Physical barriers that prevent unauthorised access to cargo handling and storage areas.
Gates staffed or monitored; adequate lighting in key areas.
If CCTV is used: cover loading and shipping areas; record continuously; review footage randomly and regularly with written records; protect recorders and footage from unauthorised access.
Should: perimeter fencing; private vehicle parking separated from cargo areas; keep footage long enough for investigations (CBP recommends at least 14 days after the shipment reaches its first point of distribution).
Evidence: site plan with camera locations; CCTV review records; guard schedules.
6.2. Physical Access Controls
Key requirements:
Written procedures for issuing, changing and removing employee badges and access devices; access to sensitive areas limited by job role.
Visitors and service providers show photo ID, are logged, wear temporary badges and are escorted.
Verify drivers' identity before releasing or receiving cargo; keep a cargo pickup log with driver, vehicle and seal details.
Staff know how to challenge and deal with unauthorised persons.
If security guards are used: written post orders, verified periodically by management.
Evidence: badge procedure; badge list; visitor log; cargo pickup log; guard post orders.
6.3. Personnel Security
Key requirements:
Written hiring procedures; verify application information (employment history, references) where permitted by law.
An employee code of conduct, signed by employees and contractors, with signed copies kept on file.
Should: background checks within legal limits, with periodic re-checks for sensitive positions.
Evidence: hiring procedure; verification records; signed code of conduct acknowledgements.
In Vietnam, collecting and processing employees' personal data must comply with personal data protection rules. Collect only what is necessary and lawful.
6.4. Education, Training and Awareness
Key requirements:
A security training programme covering CTPAT requirements, for new hires and on a regular basis; keep records (date, attendees, topics).
Specialised training for staff who inspect containers and conveyances, handle pest prevention and wood packaging, use IT systems, and operate security technology.
Training on reporting incidents and suspicious activity: what to report, to whom and how.
Should: check training effectiveness (tests, drills).
Evidence: training plan; attendance sheets; training materials; test results.
7. Quick Self-Assessment Checklist for the 12 Categories
| # | Category | Self-check question |
|---|---|---|
| 1 | Security responsibility | Is there a named security lead and regular internal review? |
| 2 | Risk assessment | Has the risk assessment been reviewed in the past 12 months? |
| 3 | Business partners | Are there screening records for carriers and subcontractors? |
| 4 | Cybersecurity | Does everyone have an individual account, and are leavers' accounts disabled? |
| 5 | Conveyances | Is there a completed 7-point checklist for every container shipped? |
| 6 | Seals | Are seals ISO 17712 certified, with an issue log and inventory audits? |
| 7 | Procedural | Are there loading photos and records of discrepancy handling? |
| 8 | Agricultural | Do wood pallets carry the ISPM 15 IPPC mark? |
| 9 | Physical security | Does CCTV cover the loading area, with review records? |
| 10 | Access controls | Are visitors logged, badged and escorted? |
| 11 | Personnel | Have employees signed the code of conduct? |
| 12 | Training | Are there security training records for new hires and refreshers? |
Every "no" is an item to address before the customer audit.
8. How TTS Cert Helps Factories Meet CTPAT Security Criteria
TTS Cert provides consulting to help factories meet the Minimum Security Criteria before a customer audit: a gap review against the 12 categories, procedures and forms, staff training and support with corrective actions after the audit. The full support process is described in What Is CTPAT? Security Criteria and CTPAT Audits for Factories in Vietnam.
9. Frequently Asked Questions About CTPAT Minimum Security Criteria
How many categories are in the CTPAT Minimum Security Criteria? Twelve, grouped into three focus areas: corporate security, transportation security, and people and physical security. Each category contains several specific criteria; the number varies by member type.
When were the MSC last updated? CBP updated the criteria in 2019 and began applying them in validations from early 2020.
What standard must container seals meet? High-security seals meeting or exceeding ISO 17712, with evidence of compliance and procedures for seal control and verification.
What does the 7-point container inspection cover? Front wall, left side, right side, floor, ceiling/roof, inside/outside doors, and outside/undercarriage. Refrigerated containers add the refrigeration unit (8 points).
Must a factory in Vietnam meet every criterion? The scope is set by the customer. Customers usually audit against the criteria closest to the factory's activities, focusing on the "must" requirements.
10. Conclusion
The Minimum Security Criteria are the core of every CTPAT audit at a factory. Work through each category, prioritise the "must" criteria and prepare real evidence, not just procedures on paper.
References
CBP — CTPAT Minimum Security Criteria (2019 criteria sets)
CBP — CTPAT Minimum Security Criteria Booklet for Foreign Manufacturers (April 2019)
Expert Pham Van Chien has nearly 20 years of experience in quality management, information security and product technical standards.
SEE MORE
