Table of contents
TAPA FSR (Facility Security Requirements) is a security standard developed by the Transported Asset Protection Association (TAPA) for warehouses, distribution centres and facilities used to store goods in the supply chain. It helps organisations reduce exposure to cargo theft, unauthorised access and loss of high-value or theft-targeted products.
TAPA FSR 2026 places greater emphasis on demonstrable security controls, effective surveillance, personnel and contractor management, and documented implementation. Businesses in Vietnam should follow the transition arrangements published by TAPA Asia Pacific (TAPA APAC) and determine whether Level A, B or C is appropriate before investing in upgrades.
TTS Cert Vietnam provides readiness consulting, site gap assessments, documentation guidance, training and pre-certification support. Independent assessment and certification follow TAPA's approved procedures.
1. What Is TAPA FSR and Who Needs It?
TAPA FSR specifies security requirements for facilities that store cargo or provide in-transit storage. It is used in agreements between cargo owners, logistics service providers, warehouse operators and other supply chain partners. TAPA FSR is not a mandatory warehouse operating licence under Vietnamese law; adoption is usually driven by customer requirements, contracts or risk-management decisions.
Potential users include:
Third-party logistics warehouses, distribution centres and transit storage facilities.
Sites handling electronics, pharmaceuticals and other high-value or theft-sensitive goods.
Manufacturing plants whose finished-goods warehouses are subject to customer security requirements.
Organisations managing several storage sites under a common security programme.
Certification must be tied to a defined scope: the site address, protected areas, cargo activities and relevant third parties. Certification of one warehouse does not automatically cover every facility operated by the same company.
2. TAPA FSR 2026 Updates and the APAC Transition Timeline
Compared with FSR 2023, the 2026 revision places stronger emphasis on objective audit evidence, visitor and subcontractor controls, CCTV coverage and vulnerabilities in physical protection. It recognises certain digital identification methods where legally accepted and properly verified. Cyber-related awareness features within the Enhanced Option; this does not mean every warehouse must hold a separate cybersecurity certificate.
TAPA APAC's announcement, updated 26 June 2026, sets out the following milestones for the region, including Vietnam:
| Date | FSR transition milestone |
|---|---|
| 30 Sep 2026 | Last date to request an FSR 2023 audit tracking number |
| 1 Oct 2026 | FSR 2026 audit applications begin |
| 30 Nov 2026 | Last date to submit FSR 2023 audit documentation to TAPA APAC |
| 31 Dec 2026 | Deadline to finalise FSR 2023 certification processing |
| From Jan 2027 | All new and recertification audits are conducted to FSR 2026 |
As of November 2026, applicants starting a new project should assess whether they can proceed directly under FSR 2026 rather than build a system around requirements that are being phased out. Existing valid certificates do not automatically expire when a new standard is released; their expiry dates and continuing obligations must still be checked.
See TAPA APAC's official FSR 2026 transition guidance for updates to the regional schedule.
3. TAPA FSR Levels A, B and C Explained
The three FSR levels reflect different degrees of required warehouse protection. The appropriate level depends on the customer's expectations, cargo value and risk exposure, and the site's ability to comply with the relevant criteria.
| Level | Protection | TAPA APAC assessment route |
|---|---|---|
| A | Highest protection level | Audit by a TAPA-approved Independent Audit Body (IAB) |
| B | Intermediate protection | Audit by a TAPA-approved IAB |
| C | Entry level under the FSR framework | Audit by an IAB, or the TAPA APAC self-audit programme if eligible |
For the Level C self-audit route, the company must meet programme conditions and have a TAPA-trained and qualified Authorised Auditor (AA). The self-audit report is submitted for TAPA APAC review and approval. Self-audit does not mean issuing a certificate without oversight.
TAPA APAC describes FSR multi-site certification for Levels A and B through IABs. Organisations should not assume that Level C may automatically be included in the same multi-site arrangement.
4. Core TAPA FSR Warehouse Security Controls
An effective warehouse security system combines physical protection, personnel procedures, technical monitoring and operating evidence. Installing cameras alone is not enough.
| Control area | Practical focus |
|---|---|
| Perimeter and structure | Fencing, gates, external access points, doors, roofs and likely intrusion routes |
| Access management | Employees, visitors, drivers and subcontractors; permissions, identification, logs and removal of access rights |
| CCTV and alerts | Coverage of receiving, storage, staging and loading areas; blind spots, checks and system reliability |
| Cargo protection | Restricted areas, key control, higher-value goods, dispatch reconciliation and discrepancies |
| Personnel and contractors | Assigned responsibilities, lawful screening, supervision of temporary staff and external providers |
| Response and assurance | Security incident reporting, investigation, training, relevant drills and corrective actions |
A warehouse may appear secure on paper while its controls fail in practice: racks obstruct cameras after a layout change, visitors enter without registration, or security inspection forms are completed only before the audit. These gaps need operational fixes, not just revised procedures.
The specific technical requirements must be verified against the official FSR 2026 standard and the level requested. Camera quantities, footage retention periods and technical specifications should not be assumed to be identical across all facilities.
5. TAPA FSR Audit and Certification Process
A structured implementation helps operators avoid spending on the wrong controls:
Define the scope and level. Confirm buyer requirements, site boundaries, cargo profile and Level A, B or C.
Conduct a gap assessment. Compare the existing site, infrastructure, procedures and evidence with FSR 2026.
Close gaps and operate controls. Complete required improvements, train personnel and generate reliable operational records.
Select an eligible audit route. Use a TAPA-approved IAB or verify eligibility for the APAC Level C self-audit route, including AA requirements.
Complete the audit and corrective actions. Present records, participate in the site assessment and address findings within applicable deadlines.
Confirm certification and maintain compliance. Verify site scope, certificate level and dates, then plan interim checks and recertification.
TAPA APAC guidance covers an Audit Tracking Number, report approval and Security Corrective Action Requirements (SCAR). Applicants should follow the relevant TAPA APAC or IAB instructions for detailed submissions and deadlines because the independent and self-audit routes are not identical.
6. Documents and Evidence to Prepare
The objective is to demonstrate that controls operate consistently, rather than simply having procedures on file. Assign the following evidence to the relevant departments:
| Responsible function | Suggested evidence |
|---|---|
| Management / security | Security policy, risk assessment, responsibilities, access permissions and inspection schedule |
| Reception / guarding | Visitor, driver and contractor logs; badges, keys, vehicle entry and exit controls |
| Technical / IT | CCTV layout, system tests, maintenance and incident records; relevant system access rights |
| Warehouse / logistics | Site plan, cargo receiving and dispatch procedures, high-value area controls, reconciliation records |
| HR / training | Security roles, appropriate screening procedures, training plan and attendance evidence |
| Contractor management | Contractor records, site rules, supervision and risk review |
| Compliance / internal audit | Internal assessment findings, corrective action register and effectiveness checks |
Before the formal audit, conduct a practical readiness review during normal operations, including night shifts, loading periods and contractor visits where relevant. This often reveals issues not apparent in the management documents.
7. Certification Cost, Timeline and Validity
There is no universal TAPA FSR price that applies to every warehouse. Cost depends on the target level, site size and number, existing controls, required hardware or building improvements, personnel training, certification route and any further assessments.
Separate the budget into consulting and training, facility/system improvements, and audit or programme charges. IAB commercial terms are agreed with the approved audit body; a consultancy proposal must not be presented as an official certification fee.
Lead time depends on site readiness, procurement and installation needs, staff training and the availability of the relevant audit route. Major building or surveillance upgrades may take substantially longer than preparing documentation.
TAPA FSR certification is valid for three years, subject to the applicable ongoing controls, interim assessment requirements and recertification before expiry. TAPA APAC identifies AA responsibilities and interim audits in Years 2 and 3. Planning recertification around three months before the certificate expires helps avoid unnecessary gaps.
8. Who Oversees TAPA FSR Certification and How to Verify It
TAPA owns and administers the scheme, with TAPA APAC responsible for the relevant Asia-Pacific framework. Three roles must not be confused:
TAPA APAC: administers the regional programme and the approvals required by its certification routes.
Independent Audit Body (IAB): an external organisation approved by TAPA to conduct eligible certification audits.
Authorised Auditor (AA): a qualified individual who has completed the relevant TAPA training and assessment and may perform authorised functions under the appropriate route.
Practical certification checks
Consult TAPA APAC's list of approved Independent Audit Bodies before selecting an external audit provider. A familiar company name or ISO accreditation is not, by itself, proof of current TAPA approval.
Search the TAPA APAC list of certified sites by name or country and review the displayed FSR version and level.
Compare the result with the certificate: legal entity, exact location, certificate identifier, scope, level, version and validity dates. If public information is incomplete or inconsistent, seek confirmation from TAPA APAC or the approved audit body.
A certificate screenshot or TAPA-like graphic should not be accepted as sufficient proof of current certification. The public list is a useful initial check, not a substitute for proper verification of all certificate details.
9. TAPA FSR vs TAPA TSR vs CTPAT
| Framework | Main focus | Key distinction |
|---|---|---|
| TAPA FSR | Warehouses, distribution centres and in-transit storage sites | Facility certification at A/B/C levels under TAPA procedures |
| TAPA TSR | Road transport operations and vehicle-related cargo security | Different scope; an operator with warehousing and road transport may need to consider both standards |
| CTPAT | U.S. Customs and Border Protection supply chain security partnership | CBP membership and benefits follow specific eligibility rules; this is not an A/B/C warehouse certification scheme |
A Vietnamese factory may be assessed against CTPAT security criteria for manufacturers at a customer's request. That does not automatically mean its warehouse holds TAPA FSR certification. Likewise, FSR certification does not replace buyer-specific CTPAT audit requirements.
Clarifying the programme, version, assessment scope and accepted evidence before the project begins helps prevent unnecessary investments or duplicate work.
10. TTS CERT Vietnam's TAPA FSR Consulting Services
TTS Cert helps warehouse operators, logistics facilities and manufacturers prepare for TAPA FSR certification within a clearly defined scope and level.
| Phase | Support provided |
|---|---|
| Site review and planning | Confirm buyer requirements and site boundaries, assess FSR 2026 gaps and prioritise improvements |
| Implementation and training | Support access control, warehouse protection, surveillance procedures, contractor oversight, incident response, staff training and relevant records |
| Pre-audit readiness | Conduct internal readiness reviews, track corrective actions and support preparation for the appropriate IAB/TAPA audit route |
TTS Cert is a consultancy, not a TAPA-approved IAB, and does not issue TAPA FSR certificates. Certification decisions remain with the competent parties under the applicable TAPA programme.
Frequently asked questions
Can a small warehouse apply for Level A? Warehouse size alone does not determine the level. Buyer requirements, scope and ability to meet the applicable criteria matter.
Is an IAB always required for Level C? Not necessarily. TAPA APAC provides a conditional Level C self-audit route; applicants must meet programme requirements and obtain the required approval.
Must an existing FSR 2023 certificate be renewed immediately? Not solely because FSR 2026 has been published. Check the existing certificate's expiry date and ongoing obligations.
Can several warehouses share one certificate? Only under a TAPA-approved multi-site arrangement meeting the applicable requirements, not simply because the sites have common ownership.
Planning for TAPA FSR 2026? Contact TTS Cert Vietnam to discuss the requested security level, current site readiness and an appropriate improvement plan.
