Table of contents
CTPAT is a voluntary partnership between U.S. Customs and Border Protection (CBP) and the trade community to protect supply chains bringing goods into the United States. Factories in Vietnam cannot register for CTPAT themselves, but U.S. customers often require them to be audited against the programme's Minimum Security Criteria (MSC).
This guide explains what CTPAT is, how it applies to factories in Vietnam, the 12 security criteria categories and how to prepare for an audit.
1. What Is CTPAT?
CTPAT stands for Customs Trade Partnership Against Terrorism. CBP now writes the name as CTPAT without a hyphen; C-TPAT and CTPAT refer to the same programme.
Key facts:
Managed by: U.S. Customs and Border Protection (CBP).
Launched: November 2001, after the 9/11 attacks.
Legal basis: the programme was written into law by the SAFE Port Act of 2006.
Nature: voluntary. Members commit to supply chain security measures and are reviewed and validated by CBP.
Purpose: to prevent cargo from being used to move dangerous items, contraband or unauthorised people, while helping legitimate trade clear customs more smoothly.
2. Is CTPAT a Certification? Can Factories in Vietnam Join Directly?
This is a common misunderstanding.
CTPAT is a membership approved by CBP, not a certificate issued by a certification body. Companies apply through the CTPAT Portal, submit a security profile and are reviewed by CBP.
According to CBP, foreign manufacturers are eligible only if they are incorporated in Mexico or Canada. A factory in Vietnam therefore cannot become a CTPAT member, and there is no CBP-issued "CTPAT certificate" for Vietnamese factories.
Even so, Vietnamese factories are directly affected. U.S. importers that are CTPAT members must manage the security risks of their business partners, including overseas suppliers. As a result, they commonly:
Send security questionnaires to factories.
Require factories to be audited against the MSC, either by the customer itself or by an audit firm the customer appoints.
Require factories to close gaps through a corrective action plan (CAP).
When people say a factory has "achieved CTPAT", the accurate meaning is that the factory has met its customer's CTPAT-based security audit requirements. Official programme benefits go to members such as importers; the practical benefits for Vietnamese factories are covered in CTPAT Benefits for Vietnamese Exporters.
3. Which Companies Are Asked for a CTPAT Audit?
Companies in Vietnam usually receive CTPAT audit requests when they:
Export directly or indirectly to the U.S., especially to large brands, retailers and importers.
Operate in sectors with long supply chains and many packing, storage and transport steps: apparel, footwear, furniture, packaging, electrical and electronics, components, energy and consumer goods.
Are onboarding with a new customer that requires an audit before ordering, or are asked by an existing customer for a periodic re-audit.
Provide services within the chain: warehousing, domestic transport, container stuffing or subcontracted production.
Audit scope and frequency are set by each customer. Ask your customer which criteria apply, who will conduct the audit, what counts as a pass and the deadline.
Has a customer asked for a CTPAT audit? TTS Cert helps you clarify customer requirements and identify what needs to be prepared.
4. CTPAT Minimum Security Criteria (MSC)
CBP updated the Minimum Security Criteria in 2019. They are organised into three focus areas and 12 categories. Each member type (importers, exporters, carriers, manufacturers and others) has its own set of criteria, but all follow this structure.
| Focus area | Category | What it means at a factory |
|---|---|---|
| Corporate security | 1. Security vision and responsibility | Management commitment and a named supply chain security lead |
| 2. Risk assessment | Identify supply chain risks and review them regularly | |
| 3. Business partners | Screen and assess suppliers, subcontractors and carriers | |
| 4. Cybersecurity | Protect IT systems, accounts and data | |
| Transportation security | 5. Conveyance and instruments of international traffic security | Inspect containers, tractors and trailers before loading |
| 6. Seal security | Control, issue, affix and verify seals | |
| 7. Procedural security | Control documents, packing, loading and cargo discrepancies | |
| 8. Agricultural security | Prevent pest contamination; control wood packaging materials | |
| People and physical security | 9. Physical security | Fencing, gates, lighting, locks and CCTV |
| 10. Physical access controls | Employee, visitor, contractor and vehicle access | |
| 11. Personnel security | Lawful background checks, hiring and termination procedures | |
| 12. Education, training and awareness | Threat awareness and incident reporting training |
For a detailed look at each category, see CTPAT Minimum Security Criteria (MSC).
4.1. High-Security Seals Meeting ISO 17712
Seals used on containers and trailers bound for the U.S. must meet or exceed the ISO 17712 standard for high-security seals. Beyond buying the right seals, factories must control them: locked storage, issue by authorised staff only, a seal log, verification when affixing and matching seal numbers against shipping documents.
4.2. Container and Conveyance Inspection Before Loading
Containers must be inspected before loading to detect hidden compartments, damage or signs of tampering. In practice, factories use a 7-point inspection for containers (front wall, left side, right side, floor, ceiling, inside/outside doors, outside/undercarriage) and a 17-point inspection for tractor-trailers. Inspection results must be recorded and kept.
5. CTPAT Membership Tiers (Tier 1, 2, 3)
For importer members, CBP uses three tiers:
Tier 1: security profile approved by CBP.
Tier 2: validated by CBP as meeting the minimum criteria.
Tier 3: validated as exceeding the minimum criteria (best practices).
Higher tiers bring greater customs benefits, which gives importers a strong reason to require good security performance from suppliers, including factories in Vietnam. See also: High-Level Analysis of CTPAT Tier Benefits.
6. CTPAT Benefits for Companies in Vietnam
Vietnamese factories do not receive CTPAT members' customs benefits directly. The practical value comes from meeting U.S. customer requirements and strengthening security management:
Qualifying to start or keep receiving orders from customers that require CTPAT.
Lower risk of cargo intrusion, loss or contamination with prohibited items.
Better control of packing, loading and handover.
Fewer export disruptions after security incidents.
For the full analysis, including the official benefits CBP offers members, see CTPAT Benefits for Vietnamese Exporters.
7. How to Prepare for a CTPAT Audit at a Factory
Step 1. Confirm Customer Requirements
Clarify which criteria the customer uses, who will audit, the scope (main factory, warehouses, subcontractors), the pass criteria and the deadline.
Step 2. Risk Assessment and Gap Assessment
Compare current practice with the 12 MSC categories. List the gaps and prioritise them.
Step 3. Build Procedures and Controls
Issue a security policy and procedures for seal control, container inspection, access control, business partner screening, cybersecurity and incident response. Upgrade facilities where needed (fencing, lighting, CCTV, locks).
Step 4. Train and Operate
Train the people involved (security guards, warehouse, shipping, HR and IT). Run the system and keep records long enough before the audit.
Step 5. Audit
The customer, or an audit firm it appoints, visits the factory to review records, observe operations and interview staff.
Step 6. Correct and Maintain
Carry out the corrective action plan (CAP) for any findings and send evidence to the customer. Maintain the system, review the risk assessment regularly and prepare for the next audit.
8. Documents to Prepare for a CTPAT Audit
Supply chain security policy, organisation chart and security lead.
Supply chain risk assessment and review records.
Business partner list, screening records, questionnaires or partner assessment results.
Seal control procedure and seal log (receipt, issue, use, disposal).
Completed 7-point and 17-point inspection checklists.
Access control procedure; visitor, contractor and vehicle logs; badge list.
Site plan, CCTV locations and footage retention period.
Hiring procedure, lawful background checks and badge recovery on termination.
Cybersecurity policy, account and password management, data backup.
Security training plan and records.
Security incident reporting and response procedure.
Previous audit results and CAP, if any.
9. Common Findings in CTPAT Audits
Weak seal control: seals stored unlocked, no issue log, seal numbers not matched to documents.
Container inspections done only on paper: pre-filled forms; staff cannot show how they inspect.
No business partner screening: no records for carriers or subcontractors.
Cybersecurity overlooked: shared accounts, no password policy, no data backup.
Inconsistent access control: unregistered visitors without badges; loading areas not restricted.
CCTV gaps: critical areas not covered, or footage not kept as long as the customer requires.
Generic training: no threat awareness content and no training records.
One-off risk assessment: never reviewed after changes in partners, processes or incidents.
10. Timeline and Cost Factors
There is no fixed timeline for every factory. Preparation time depends on:
How far current practice is from the 12 MSC categories.
Factory size and the number of sites, warehouses and subcontractors in scope.
Facility upgrades needed (fencing, CCTV, lighting).
How long the customer expects the system to run, with records, before the audit.
Costs fall into two separate parts: audit fees (set by the customer or the audit firm) and preparation costs (consulting if used, training and facility upgrades). A gap assessment first gives the most accurate estimate.
11. How TTS Cert Supports CTPAT Audit Preparation
TTS Cert provides consulting to help companies prepare for CTPAT security audits. TTS Cert is not CBP and does not conduct the customer's official audit. Our support covers:
Clarifying customer requirements and scope.
Gap assessment against the 12 MSC categories.
Developing supply chain security policies, procedures and forms.
Training relevant staff.
Internal mock audits before the audit date.
Helping prepare and carry out the corrective action plan after the audit.
Practical experience: TTS Cert advised HW Energy Company Limited (Hai Phong) on building its supply chain security system and meeting its CTPAT audit requirements.
The TTS Cert team reviews your factory against the 12 security criteria categories and proposes a corrective plan.
12. Frequently Asked Questions About CTPAT
What does CTPAT stand for? Customs Trade Partnership Against Terrorism, a programme run by U.S. Customs and Border Protection (CBP).
Is CTPAT mandatory? For CBP, CTPAT is voluntary. However, U.S. customers can make a CTPAT-based security audit a purchasing condition, so for suppliers it can become a contractual requirement.
Can a factory in Vietnam obtain CTPAT certification? No. CBP only accepts foreign manufacturers incorporated in Mexico or Canada. Factories in Vietnam are audited at the request of customers that are CTPAT members.
How many categories are in the CTPAT Minimum Security Criteria? Twelve, grouped into three focus areas: corporate security, transportation security, and people and physical security.
Is a customer-requested CTPAT audit the same as a CBP validation? No. CBP validations apply to CTPAT members. Audits at Vietnamese factories are carried out by the customer or an audit firm it appoints, as part of the customer's business partner risk management.
What standard must container seals meet? Seals on containers and trailers bound for the U.S. must meet or exceed ISO 17712 for high-security seals.
How often is a re-audit needed? Each customer sets its own frequency. In all cases, the supply chain risk assessment should be reviewed regularly and whenever there is a significant change.
13. Conclusion
CTPAT is a U.S. Customs programme, but it reaches Vietnamese factories through customer requirements. Understanding that a factory is audited against CTPAT criteria rather than "CTPAT certified" helps companies focus on what matters: the 12 security categories, evidence to prove them and keeping the system running after the audit.
