Quality Systems Enhancement (QSE), Inc.Roswell, Georgia, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for C-TPAT, ISO 27001, ISO 9001, CMMC, ISO 14001 and more.
- Standards
- Pricing
- Not published
C-TPAT
The Customs Trade Partnership Against Terrorism (CTPAT) is a voluntary supply chain security program run by US Customs and Border Protection.
Companies in the international trade chain (importers, exporters, carriers, brokers, consolidators, foreign manufacturers, and others) apply, document how they meet CBP's Minimum Security Criteria, and are then validated by a CBP Supply Chain Security Specialist.
In return, members get reduced examination rates, front-of-line processing, access to the FAST lanes, and other trade benefits.
The Minimum Security Criteria were substantially rewritten in 2019 and 2020 and are organized under corporate security, transportation security, and people and physical security, adding cybersecurity, agricultural security, and security vision and responsibility as newer areas.
CTPAT is a paperwork-heavy program. Members must complete and keep current a security profile in the CTPAT Portal that explains, criterion by criterion, how the requirement is met, and must back it with written procedures: a supply chain security risk assessment refreshed at least annually, a written cybersecurity policy, container and trailer inspection procedures, seal control procedures, personnel screening and termination procedures, visitor and access control, business partner screening and monitoring, and training records.
Validators check that the written procedures match what happens at the sites they visit.
Joining is voluntary and free. CBP says its validations are not audits: a CBP specialist gives about 30 days' notice and reviews the member's procedures.
An executive order signed June 3, 2026 (Executive Order 14411) directs the Department of Homeland Security to require foreign importers of record to be validated in CTPAT if CBP finds them eligible, or otherwise to use a licensed, CTPAT-validated customs broker for formal entries.
"Foreign" can include a U.S.-registered company whose controlling owners are not U.S. citizens or permanent residents. As of September 2026 no rule putting this in place had been published.
New to this? Read C-TPAT explained simply →
Share
Ad from the publisher
Policy Acknowledgment Proof
AcknowledgedSecurity procedures v5by name, on record
MSC 4 Handledwith AllyMatter
Clear Customs the Modern WayYour written security procedures, acknowledged by every dock hand
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every warehouse and driver on record
Who read which version, and when
03
Hand the CBP validator the trail
From $29/mo, 20 editors, unlimited staff (published)
Who has to comply
Voluntary. Open to US importers and exporters, US and Canadian highway carriers, rail, sea, and air carriers, licensed customs brokers, consolidators and NVOCCs, marine port authorities and terminal operators, foreign manufacturers in specified countries, and certain third-party logistics providers, each with its own eligibility rules.
Members are expected to check, where they have leverage, that their business partners meet the criteria. The June 2026 executive order may make CTPAT validation, or use of a CTPAT-validated broker, a requirement for foreign importers of record once CBP writes the rule.
What you have to write
Documents on this site that C-TPAT requires or expects, each with who must have it, the review cycle and the obligations that cite it.
What the assessor asks to see
Security profile in the CTPAT Portal; supply chain security risk assessment with threat and vulnerability analysis by route and partner; written procedures for each criterion (business partner screening, cybersecurity, conveyance and container inspection, seal control, procedural security, physical security, access controls, personnel security, education and training, agricultural security); business partner questionnaires and monitoring records; training attendance and materials; audit and self-assessment records; corrective action records from prior validations.
Where the requirement sits: CTPAT Minimum Security Criteria (2020): security vision and responsibility, risk assessment, business partners, procedural security, personnel security, education/training and awareness
Tiers
For importers, Tier I is certified but not yet validated; Tier II is validated as meeting the Minimum Security Criteria; Tier III is validated as exceeding the criteria and adopting recognized best practices. Higher tiers receive larger risk score reductions and fewer security examinations.
Every internal policy in one place
AllyMatter is a full system for every internal policy your company keeps, including the ones C-TPAT turns on. Build the whole library in one place, across every department, and prove who has read what.
Policies you can run here
How it works
Every document is approved by someone other than its author, versioned, distributed to the people it covers and acknowledged by name. Sign it where a signature is what the standard wants, send a set out together as a package, and export a dated record of who read which version when an assessor asks.
Most of what an assessor reads for this standard is written policy and proof that people acknowledged it. That is the layer AllyMatter owns.
Who helps with C-TPAT
A well-developed consultant market helps companies write the security profile, run the risk assessment, draft procedures, train staff, and prepare for validation visits. Typical engagement is a readiness project of one to three months before application, plus periodic help before revalidation.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
Who assesses C-TPAT
CBP Supply Chain Security Specialists (government officers) perform validations and revalidations. There are no private third-party certifiers for CTPAT; consultants can prepare a member but cannot validate it. Validation is performed by the government agency that runs the program.
Assessors
Be the first C-TPAT assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for C-TPAT
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads. AllyMatter, the publisher of this site, is always first.
AllyMatterPolicy management tool, the policy and acknowledgment layerPublisher of this siteRelated reading
- Understanding the CTPAT minimum security criteriaBreaks the twelve criteria categories into musts and shoulds and shows which of them require written procedures.Thomson Reuters
- CTPAT validation and minimum security criteriaPractitioner walkthrough of how a CBP validation actually runs: document review, staff interviews and site inspection.Diaz Trade Law
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for C-TPAT
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of C-TPAT in AllyMatter
Approve the policies C-TPAT asks for, keep every version, and record a named acknowledgment from each person who has to read them.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff