Department of Homeland Security Privacy Impact Assessement Update

Status: Original and derived artifacts are available for this document.

Download: pdf

Privacy Impact Assessment Update
for the

Customs Trade Partnership Against Terrorism
(CTPAT)
DHS Reference No. DHS/CBP/PIA-013(a)
January 3, 2022

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 1

Abstract
The Customs Trade Partnership Against Terrorism (CTPAT) is a U.S. Customs and Border
Protection (CBP) voluntary trade partnership program in which CBP and members of the trade
community work together to secure and facilitate the movement of legitimate international trade.
The program focuses on improving security throughout the supply chain, beginning at the point of
origin (including manufacturer, supplier, or vendor), through a point of distribution, to the
destination. CTPAT member companies, called partners, agree to implement certain security
procedures throughout their supply chains to protect those supply chains from terrorist infiltration
and other illegal activities that threaten the security of the United States. CBP is publishing this
Privacy Impact Assessment (PIA) Update to provide notice of: (1) the CTPAT Trade Compliance
Program; (2) the collection of additional data elements for the CTPAT Security Program; and (3)
an update to the proposed National Archives and Records Administration records retention
schedule.

Overview
In 2013, CBP issued DHS/CBP/PIA-013 Customs Trade Partnership Against Terrorism
(CTPAT) 1 to provide transparency for the CTPAT program. The original PIA focused on the
CTPAT Security Program, a voluntary public-private sector partnership program between CBP
and international supply chain stakeholders such as importers, carriers, consolidators, licensed
customs brokers, and manufacturers to strengthen cargo security. 2 As a supply chain security
program for international cargo and conveyances, CTPAT increases security measures, practices,
and procedures throughout all sectors of the international supply chain. The program focuses on
improving security from the point of origin (including manufacturer, supplier, or vendor) through
a point of distribution to the final destination. The current security criteria for CTPAT Security
Program members address a broad range of topics including personnel, physical, agricultural,
cyber, business partner, and procedural security; access controls; education, training, and
awareness; manifest procedures; conveyance security; threat awareness; and documentation
processing. The criteria offer a customized solution for the members, while providing a clear
minimum standard that approved companies must meet.
CTPAT Security Program benefits are offered to only the most secure and compliant
program participants. To uphold this relationship, CBP requires the trade partner to assume
See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S. CUSTOMS AND BORDER PROTECTION,
PRIVACY IMPACT ASSESSMENT FOR THE CUSTOMS-TRADE PARTNERSHIP AGAINST TERRORISM
(CTPAT), DHS/CBP/PIA-013 (2013), available at https://www.dhs.gov/privacy-documents-us-customs-andborder-protection.
2
On October 13, 2006, the President signed the Security and Accountability for Every Port Act of 2006 (SAFE Port
Act), 6 U.S.C. § 901 note, which legislatively authorized the establishment of CBP’s Customs Trade Partnership
Against Terrorism program.
1

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 2

responsibility for securing its supply chain according to agreed-upon security standards and
implementing changes as needed. Businesses accepted into the CTPAT Security Program agree to
take actions to protect their supply chain, identify security gaps, and implement specific security
measures and best practices in return for certain benefits that may speed-up processing of their
shipments by CBP. Businesses eligible to fully participate in the CTPAT Security Program include
U.S. importers and exporters; U.S./Canada highway carriers; U.S./Mexico highway carriers; rail
and sea carriers; licensed U.S. Customs brokers; U.S. marine port authority/terminal operators;
U.S. freight consolidators; ocean transportation intermediaries and non-operating common
carriers; Mexican and Canadian manufacturers; and Mexican long-haul carriers.
To participate in the CTPAT Security Program, a company is required to submit a
confidential online application using the CTPAT Portal. 3 The CTPAT Portal is the public-facing
portion of the CTPAT Security Program system used by companies to submit information about
their company and supply chain. As part of the application process in the CTPAT Portal,
companies create a Security Profile (SP) and a narrative description of the procedures the business
uses to adhere to each CTPAT Security Program criteria or guideline articulated for their particular
business type (e.g., importer, customs broker, freight forwarder, air, sea, and land carriers, and
contract logistics providers), together with any supporting documentation. 4 The company provides
information that is focused on the security procedures of their business (e.g., whether the business
conducts background investigations on employees), rather than the individuals related to those
businesses (e.g., a list of employee names). Upon completion, the company submits the application
to CBP via the CTPAT Portal.
Upon receipt, a CBP Supply Chain Security Specialist (SCSS) reviews and vets the
application by conducting various systems checks, including, but not limited to TECS, 5 Automated
Commercial Environment (ACE), 6 Automated Targeting System (ATS), 7 and queries of publicly
available data (e.g., Google search). Derogatory vetting results are evaluated by the SCSS and a
Launched in 2014, the CTPAT Portal is designed to streamline applications to U.S. partnership programs, add
functionality requested by CTPAT Partners, and meet DHS mandated security requirements. The portal provides
flexibility to adapt to future data requirements and administer multiple partnership programs, e.g., CTPAT
and CTPAT Trade Compliance within a single site. The CTPAT Portal is available at https://ctpat.cbp.dhs.gov/tradeweb/index.
4
The CTPAT minimum security criteria can be found at: https://www.cbp.gov/border-security/ports-entry/cargosecurity/ctpat-customs-trade-partnership-against-terrorism/apply/security-criteria.
5
See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S. CUSTOMS AND BORDER PROTECTION,
PRIVACY IMPACT ASSESSMENT FOR THE TECS SYSTEM: CBP PRIMARY AND SECONDARY
PROCESSING, DHS/CBP/PIA-009 (2010 and subsequent updates) and TECS SYSTEM PLATFORM,
DHS/CBP/PIA-021 (2016), available at https://www.dhs.gov/privacy-documents-us-customs-andborder-protection.
6
See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S. CUSTOMS AND BORDER PROTECTION,
PRIVACY IMPACT ASSESSMENT FOR THE AUTOMATED COMMERICAL ENVIRONMENT,
DHS/CBP/PIA-003 (2015), available at https://www.dhs.gov/privacy-documents-us-customs-and-border-protection.
7
See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S. CUSTOMS AND BORDER PROTECTION,
PRIVACY IMPACT ASSESSMENT FOR THE AUTOMATED TARGETING SYSTEM, DHS/CBP/PIA-006(e)
(2017), available at https://www.dhs.gov/privacy-documents-us-customs-and-border-protection.
3

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 3

CTPAT Security Program supervisor for approval. The SCSS uses a combination of an internal
module of the CTPAT Portal and the CTPAT Security Program SharePoint site to store vetting
results and application decisions. The SCSS routinely conducts vetting on partners to ensure
companies remain low risk. 8
Once CBP completes the application review process, CBP initially designates approved
businesses as Tier One certified partners who may then be eligible for beneficial processing.
Companies that have passed the initial CTPAT application phase and had its security profile
approved are designated as Tier One certified partners. In order to become a Tier Two partner,
CBP makes a site visit to the business to validate the partner’s supply chain security. As part of
the validation process, CBP physically verifies that the security profile submitted by the partner is
accurate and matches the business’s submissions, and that its supply chain complies with CTPAT
Security Program minimum security criteria. Tier Two partners receive a lower likelihood of cargo
examinations and become eligible for priority “front-of-the-line” cargo inspections at ports of
entry, should an examination be required. Importers achieve Tier Three status if the validation
process shows the partner exhibits security best practices that exceed the minimum-security
criteria. In turn, Tier Three partners receive the facilitated processing of Tier One and Tier Two
status as well as (1) further reduction in the likelihood of cargo examinations; (2) highest priority
when examinations of cargo are required; (3) inclusion in joint incident management exercises;
and (4) participation in secure supply chain pilot programs.

Reason for the PIA Update
CBP is publishing this update to the original 2013 PIA to address the following: (1)
introduce the CTPAT Trade Compliance Program, which is available to companies already
designated as a CTPAT Security Program partner; (2) the collection of additional data elements
for CTPAT Security Program company owners and designated company points of contact; and (3)
document the change to the proposed National Archives and Records Administration records
retention schedule.
1. CTPAT Trade Compliance Program
As described above, the original 2013 PIA primarily focused on the CTPAT Security
Program, which falls under CBP’s larger Trusted Trader framework. 9 In addition to the CTPAT
Security Program, the Trusted Trader framework also previously included the Importer SelfHighway carriers participating in CBP’s Free and Secure Trade (FAST) program are initially vetted through FAST
and then re-vetted and certified by CTPAT.
9
The strategy for the Trusted Trader framework is based on a continuum of activity providing a consistent level of
engagement between the trade and regulatory government partners that demonstrates the highest level of
commitment in practice to security, compliance, and partnership within the global supply chain. This is a trusted
relationship that is articulated with trading and/or facilitative benefits, streamlining the global trading process,
allowing focus and global attention on those that pose the highest risk.
8

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 4

Assessment (ISA) program. 10 Certified partners in the CTPAT Security Program could voluntarily
participate in the ISA program, which provided meaningful benefits that were tailored to industry
needs and required that importers demonstrated readiness to assume responsibilities for managing
and monitoring their own compliance through self-assessment. On June 16, 2014, CBP provided
public notice 11 of the transformation from the ISA program to the CTPAT Trade Compliance
Program, which provides importers and exporters a process to achieve an integrated partnership
program for security and compliance.
The CTPAT Trade Compliance Program is a voluntary program that is mutually beneficial
to both CBP and the importer, as it increases importer compliance and the flow of legitimate cargo
into the United States. This program is built on the knowledge, trust, and willingness to maintain
an ongoing relationship between CBP and importers that, like the former ISA program, allows
importers to monitor their own compliance through self-assessment. In exchange for compliance
with regulatory trade requirements imposed by CBP and other government entities, the CTPAT
Trade Compliance Program offers several benefits for importers, which are a combination of
legacy CTPAT and ISA benefits, including:
•

Access to an assigned National Account Manager (NAM), who acts as an advisor
and liaison between CBP and the CTPAT Trade Compliance Program member;

•

Opportunity for the importer to apply for coverage for multiple business units
within their company;

•

Removal of the importer from the Regulatory Audit’s (RA) audit pool established
for Focused Assessments (however, importers may still be subject to a singleissue audit to address a specific concern); and

•

Ability to receive Importer Trade Activity (ITRAC) 12 data free of charge directly
through the CTPAT Portal.

An importer must meet the following criteria to become eligible for the CTPAT Trade Compliance
Program: (1) be a current Tier Two or Tier Three member of the CTPAT Security Program; (2) be
a U.S. or Canadian resident importer; (3) have a minimum of two years import experience; and (4)
maintain no evidence of financial debt to CBP.

The ISA program was a voluntary approach to trade compliance. The ISA program was superseded by the CTPAT
Trade Compliance Program.
11
See 79 Fed. Reg. 13992.
12
The Office of Trade (OT) provides ITRAC data to Importers of Record, to filers, and to their legal representatives,
who have submitted requests under the Freedom of Information Act (FOIA). ITRAC is company-specific import
data placed in an MS-Access 97 database and provided on CD-ROM for a processing fee via the Freedom of
Information Act (FOIA) process.
10

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 5

If an importer meets these eligibility standards, the importer will be automatically notified of their
potential eligibility within the CTPAT Portal. 13 To apply for the CTPAT Trade Compliance
Program, the company completes the following: (1) the CTPAT Trade Compliance Eligibility
Questions; (2) the CTPAT Trade Compliance Questionnaire; and (3) a Memorandum of
Understanding (MOU). Upon submission of these items in the CTPAT Portal, CBP begins
reviewing the application process.
Eligibility Questions
The importer must complete a series of eligibility questions to determine its suitability for
the CTPAT Trade Compliance Program. A complete list of eligibility questions is included in
Appendix A to this PIA, but the list generally consists of questions such as, “Are you willing to
complete a Memorandum of Understanding and Trade Compliance Questionnaire?” and “Do you
agree to notify CBP of all major organizational changes?” Once the eligibility questions are
answered in full, importers who favorably responded to the eligibility questions are automatically
directed to the CTPAT Trade Compliance application screen. If an importer does not meet the
eligibility prerequisites, it will receive an ineligibility notification within the portal and will be
unable to proceed to the CTPAT Trade Compliance questionnaire.
Questionnaire
Importers are required to submit a questionnaire and accompanying documentation as
evidence that their company has implemented internal controls within their import process.
Importers complete this questionnaire through the CTPAT Portal and CBP uses the information to
begin the vetting and application review process.
The questionnaire has several sections for the importer to provide responses to questions
relating to import activity, internal controls, risk assessment, and periodic testing results. A copy
of the questionnaire is included as Appendix B to this PIA. As an example, companies are asked
if they monitor/track their annual duties, fees, and taxes paid to CBP to ensure bond sufficiency.
If the response is yes, the company is asked to briefly describe how this is done and include how
payments of duties and fees are made. In addition to the business practice-related questions, the
questionnaire asks the company to provide contact information such as company name, company
address, phone number, company website, company type (e.g., public or private), and information
related to the company point of contact (e.g., name, title, phone number, and email address).
As part of the application process, companies are asked to submit supporting
The CTPAT Portal streamlines applications to U.S. partnership programs and meets DHS mandated security
requirements. The CTPAT Trade Compliance section of the portal serves as a central electronic location for CTPAT
Security Program importers to learn more about the CTPAT Trade Compliance Program and apply when eligible.
Launched in 2019, the CTPAT Trade Compliance section of the portal complements the existing Security section of
the CTPAT Portal and provides an electronic and streamlined process for eligible importers to apply and manage
their status in the CTPAT Trade Compliance Program.

13

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 6

documentation, including their documented policies and procedures relating to the import process,
organizational chart for their compliance department, and a self-testing plan. 14
To assist importers in completing the questionnaire, CBP developed a CTPAT Trade
Compliance Handbook to refer to during the application process. 15 The handbook allows importers
to easily access links with valuable information to address questions and concerns that may arise
during the completion of the questionnaire.
Memorandum of Understanding (MOU)
After finishing the questionnaire, the company then completes a MOU within the portal.
This is a standard template that importers complete by inserting company-specific information.
The MOU outlines both importer and CBP responsibilities and identifies all the entities within a
company covered by the MOU, in cases where a company has multiple divisions. Importers may
submit one MOU and list each eligible entity to be covered under the MOU, to include the
complete name of the importer, company address, and Importer of Record (IOR) number(s).
Signing the MOU is part of the application process and must be done prior to CBP beginning the
application review and vetting process. Once the importer answers the eligibility questions,
completes the application questionnaire, and uploads the requested supplemental documents, the
portal generates a MOU between the importer and CBP. The importer adds all entities intended
for coverage under the MOU and signs it. While the importer signs the MOU at this point in the
process, CBP does not sign the MOU or enter into the agreement until after completing vetting. 16
CBP Application Review Process
Once an application is submitted, the account is considered to be officially under review
and the company will not be able to modify the information submitted. Upon submission, the CBP
CTPAT Trade Compliance Team 17 accesses and reviews the application package within the
CTPAT Portal. If questions from this team arise during the review process, an alert will appear in
the “Action Items” section of the CTPAT Portal for the importer to review and address. The
A CTPAT Trade Compliance partner must design a self-testing plan to address the areas of risk based on the
company’s risk assessment. CBP allows flexibility and does not dictate specific testing requirements, because selftesting is part of the monitoring activities of a company’s system of internal control. It is important that a company
has the flexibility to design a program that fits its specific needs. Therefore, each company performs its own risk
assessment, develops its own control procedures, and designs its own self-testing program to monitor and mitigate
risk and ensure that import transactions are accurate and compliant with CBP laws and regulations. The goal is to
identify and eliminate vulnerabilities in a company’s import compliance program.
15
See https://www.cbp.gov/border-security/ports-entry/cargo-security/ctpat/trade-compliance.
16
Once a company is approved to take part in the CTPAT Trade Compliance Program, the company may amend its
MOU to add an entity previously not covered by the original MOU. To add an entity, the company must submit a
revised MOU reflecting both current and additional business units, addresses, and associated IOR number(s). CBP
will review the amended MOU as it would a new MOU submitted with a CTPAT Trade Compliance application.
17
The CBP CTPAT Trade Compliance Team is responsible for reviewing the application and granting CTPAT
Trade Compliance Program approval. The CTPAT Trade Compliance Team consists of representatives from the
Trade Compliance Branch, Office of Trade, Regulatory Audit, and a designated National Account Manager.
14

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 7

company will also receive an email informing them of the awaiting message in the Action Items
section. CBP uses a combination of an internal module of the CTPAT Portal and a CTPAT
SharePoint site to store information collected during this process, such as the risk assessment,
vetting results, and application decisions.
After review, CBP schedules a formal Application Review Meeting (ARM) with the
importer, which includes a risk assessment and review of the company’s internal controls to
determine their readiness to assume the responsibilities for self-assessment. The risk assessment
process is critically important as it allows importers to better understand their supply chains, where
the vulnerabilities lie within those supply chains, and determine what to do to mitigate any risks
identified. Importers are required to complete a Risk Assessment to analyze external threats against
company procedures, to identify where vulnerabilities exist, and to determine what procedures can
be implemented or improved to reduce such risk. When the importer demonstrates readiness to
assume the responsibilities for self-assessment, CBP establishes the partnership by signing the
CBP portion of the MOU. CBP is committed to working with the importer to approve the
application and will work with the importer to obtain additional information to establish eligibility
for the CTPAT Trade Compliance Program. However, if the importer fails to establish eligibility,
CBP will deny the application. CBP will provide a notice to the importer with the reasons for the
denial and will allow the importer 120 days to correct and resubmit the application.
CTPAT Trade Compliance Program members continue to receive the benefits of CTPAT
Security Program in addition to the Trade Compliance benefits so long as the importer fulfills the
continuing responsibilities of the Program. CTPAT Trade Compliance Program members are
responsible for continuing to comply with Program requirements. Responsibilities include:
•

Maintain membership in CTPAT Security;

•

Continue to comply with all applicable CBP laws and regulations;

•

Maintain an internal control system;

•

Make appropriate disclosures to CBP (such as post-summary corrections and
misclassification errors);

•

Submit an Annual Notification Letter to CBP to reaffirm that the participant continues
to meet the Program’s requirements through the CTPAT Portal; and

•

Notify CBP of major organizational changes as soon as possible through the CTPAT
Portal.

Annual Notification Letter (ANL)
To maintain program membership, an importer must complete an Annual Notification
Letter, which notifies CBP of any business modifications that may have an impact on its customs
operations and to reaffirm its commitment to the requirements listed in the Trade Compliance

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 8

MOU and other program documentation. This letter is submitted electronically through the
CTPAT Portal and is due annually within 30 days of the anniversary of the program acceptance
date. The Annual Notification Letter collects the following six categories of information: (1)
Company Information: Organizational and/or Personnel Changes; (2) Import Activity Changes;
(3) Internal Control Adjustments and Changes; (4) Risk Assessment Results; (5) Periodic Testing
Results; and (6) Disclosures of any issues discovered during self-testing (e.g., post summary
corrections and misclassification errors).
Continuation of Trade Compliance Program
After an importer has been in the CTPAT Trade Compliance Program for 5 years, a
Continuation Review Meeting (CRM) may be considered; however, risk indicators or noncompliance with the CTPAT Trade Compliance Program requirements may warrant a
Continuation Review Meeting prior to the 5-year period. The purpose of the Continuation Review
Meeting is to assess whether the participant is continuing to fulfill the CTPAT Trade Compliance
Program requirements. If CBP identifies weaknesses or noncompliance, the participant will be
notified as early as possible and will have the opportunity to correct any issues.
CBP will remove participants from the CTPAT Trade Compliance Program for any issues
that pose a significant risk to compliance with CBP laws and regulations and/or failure to
demonstrate they have fulfilled Program requirements.
2. Collection of New Data Elements for CTPAT Security Program
In 2020, CBP updated the vetting process used to determine whether a company is eligible
to participate in CTPAT. CBP vets both new companies seeking enrollment and companies already
enrolled in the CTPAT Security Program at least once annually.
CTPAT is a program designed for low-risk companies. Program members receive benefits
such as lower examination levels and expedited clearance of cargo through FAST lanes at CBP
land border crossings, therefore the identification of high risk and or current violators is an
essential part of CBP’s risk management strategy. CBP expanded the vetting process to require
additional data elements to screen companies more effectively and accurately. The newly added
data elements enhance CBP’s ability to identify companies and their points of contacts/owners’
involvement in illegal activities that may threaten the safety of U.S. borders and cargo entering
and exiting the United States.
With this PIA Update, CBP is collecting additional information related to the individual
company owner and company point of contact. CBP separately issued an update to the CTPAT
System of Records Notice (SORN) 18 to provide notice of this new collection:
•
18

Date of Birth;

DHS/CBP-018 Customs Trade Partnership Against Terrorism (CTPAT), 86 Fed. Reg. 15241 (March 22, 2021).

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 9

•

Country of Birth;

•

Country of Citizenship;

•

Travel Document number (e.g., visa or passport number);

•

Immigration status information (e.g., A-Number, Naturalization number);

•

Driver’s license information (e.g., state and country of issuance, number, date of
issuance/expiration);

•

Social Security number (SSN);

•

Trusted Traveler membership type and number (e.g.,
FAST/NEXUS/SENTRI/Global Entry ID); and

•

Registro Federal de Contribuyentes (RFC) Persona Fisica (for Mexican Foreign
Manufacturers, Highway Carriers, and Long Haul Carriers Only).

This information and the company information will be screened against existing CBP information
sources and systems, including, but not limited to TECS, 19 ACE, 20 and ATS, 21 as well as publicly
available search engines (e.g., Google, Yahoo), and Dun & Bradstreet. 22
3. Retention Requirements Update
The 2013 PIA stated that CBP was in the process of developing retention requirements for
approval by the National Archives and Records Administration. The previous PIA stated that CBP
was proposing to retain information collected by the company and results generated by CBP for
no more than 5 years beyond the application or partner’s enrollment, whichever is longer, and no
more than 25 years for any derogatory information. With this update, CBP is now retaining the
information collected by companies and results generated by CBP for the period during which the
application is pending decision by CBP and for the period of active membership of the business
entity, plus 20 years after program membership has ended. Where information regarding the
possible ineligibility of an applicant for CTPAT membership is found, it will be retained by CBP

See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S. CUSTOMS AND BORDER PROTECTION,
PRIVACY IMPACT ASSESSMENT FOR THE TECS SYSTEM, DHS/CBP/PIA-009 (2010 and subsequent
updates), available at https://www.dhs.gov/privacy-documents-us-customs-and-border-protection.
20
See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S. CUSTOMS AND BORDER PROTECTION,
PRIVACY IMPACT ASSESSMENT FOR THE AUTOMATED COMMERCIAL ENVIRONMENT,
DHS/CBP/PIA-003 (2006 and subsequent updates), available at https://www.dhs.gov/privacy-documents-uscustoms-and-border-protection.
21
See U.S. DEPARTMENT OF HOMELAND SECURITY, U.S. CUSTOMS AND BORDER PROTECTION,
PRIVACY IMPACT ASSESSMENT FOR THE AUTOMATED TARGETING SYSTEM, DHS/CBP/PIA-006
(2007 and subsequent updates), available at https://www.dhs.gov/privacy-documents-us-customs-and-borderprotection.
22
Dun & Bradstreet, Inc. is a company that provides commercial data, analytics, and insights for businesses.
19

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 10

for 20 years after the denial to assist with future vetting, or consistent with the applicable retention
period for the system of records from which such information was derived, whichever is longer.

Privacy Impact Analysis
Authorities and Other Requirements
Since the publication of the 2013 PIA, there are no changes to the legal authorities and/or
agreements that define the collection of information for CTPAT. However, on March 22, 2021,
CBP published an update to the CTPAT SORN23 to provide notice of the integration of the CTPAT
Trade Compliance Program into the CTPAT framework and the collection of additional data
elements from the individual company owner and company point of contact. CBP is also in the
process of revising the CTPAT Paperwork Reduction Act (PRA) package, under OMB control
number 1651-0077.
Characterization of the Information
CTPAT continues to collect the information described in the 2013 PIA. However, in
addition to the existing data elements, CTPAT is expanding the collection of data elements for
individual company owners and individual company points of contact to include: date of birth,
country of birth and/or citizenship, travel document number (e.g., passport number, visa number),
SSN, immigration status information (e.g., A-Number and Naturalization number, if applicable),
driver’s license information, NEXUS/SENTRI/Global Entry ID, and Registro Federal de
Contribuyentes (RFC) Persona Fisica (needed for Mexican Foreign Manufacturers, Highway
Carriers, and Long Haul Carriers). Furthermore, since CTPAT now includes the CTPAT Trade
Compliance Program, CBP collects the following information as part of the CTPAT Trade
Compliance Program application process:
•

Company name;

•

Business address;

•

Phone number;

•

Company website;

•

Company type (public or private); and

•

Company owner/point of contact information (e.g., name, date of birth, title, phone
number, and email address).

Additionally, the company provides operational information to CBP through various documents
requested through the application and to demonstrate its ability to continue to remain in
compliance with the program requirements. Operational company information is provided through
23

DHS/CBP-018 Customs Trade Partnership Against Terrorism (CTPAT), 86 Fed. Reg. 15241 (March 22, 2021).

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 11

the Annual Notification Letter; import activity change records; internal control adjustments and
change records; risk assessment results; periodic testing results; and disclosures. Since the
publication of the 2013 PIA, there have been no changes as to how CBP uses information from
commercial sources or publicly available data or how the accuracy of CTPAT data is ensured.
Privacy Risk: There is a risk of over-collection due to the expanded collection of
information regarding company owner and company point of contact.
Mitigation: This risk is mitigated. The majority of information that CBP collects is related
to the company’s business operations. With this update, CBP is now expanding the collection to
include additional data elements related to the individual company owner and company point of
contact. CBP is collecting this information to enhance the screening of companies. Previously, the
CBP vetting process primary focused on conducting screening on the company. CBP is now
enhancing the screening process to screen individuals related to the company (e.g., company
owner, company point of contact). The additional information enables CBP to conduct system
checks using additional identifiers that could not previously be accomplished. This may help CBP
uncover additional potentially derogatory information that may not have previously been
uncovered during the former vetting process that only used business information. The additional
identifiers allow CBP to search a wider range of systems and databases to help CBP determine
whether a company is considered high-risk and may be involved in illegal activities.
Uses of the Information
CBP continues to use the company information, including personally identifiable
information for the company owner and company point of contact, to determine eligibility for the
CTPAT Security Program. More specifically, CBP uses the information to verify the identity of a
company’s partners, determine enrollment level, and provide identifiable “low risk” entities with
fewer random checks and facilitated processing. With this PIA Update, CBP has integrated the
Trade Compliance Program into the CTPAT framework. Similar to CBP’s use of company
information to determine eligibility for the CTPAT Security Program, CBP uses company
information to determine eligibility for the CTPAT Trade Compliance Program, which allows
importers to monitor their own compliance through self-assessment. In both programs, the
information is cross-referenced with data maintained in CBP’s other cargo and enforcement
databases, which is then shared with other law enforcement systems, agencies or foreign entities,
as appropriate, when related to ongoing investigations or operations. Information is also used to
analyze, measure, monitor, report, and enhance business supply chains to permit facilitated
processing of CTPAT partner shipments by CBP.
Notice
CBP is providing general notice of the expansion through this PIA Update and the CTPAT
SORN published on March 22, 2021. The CTPAT Portal continues to provide a Privacy Act

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 12

Statement regarding the authority of CBP to collect the requested information and identifying the
use of the information. Furthermore, CTPAT continues to be a voluntary program in which
partners must apply. There are no new risks to notice.
Data Retention by the Project
With this update, CBP is documenting a change in the proposed retention. CBP previously
proposed to retain the company information and results generated by CBP for no more than 5 years
beyond the application or partner’s enrollment, whichever is longer, and no more than 25 years for
any derogatory information. CBP is now proposing to retain the information for the period during
which the application is pending decision by CBP and for the period of active membership of the
business entity, plus 20 years after program membership has ended. Where information regarding
the possible ineligibility of an applicant for CTPAT membership is found, it will be retained by
CBP for 20 years after the denial to assist with future vetting, or consistent with the applicable
retention period for the system of records from which such information was derived, whichever is
longer.
Privacy Risk: There is a risk that CBP will retain information for longer than necessary.
Mitigation: This risk is mitigated. Although there is always an inherent risk with retaining
data for any length of time, CBP carefully considered the operational need to retain the information
for longer than what was previously proposed. CBP Office of Field Operations and the Records
Management Division collaboratively worked together to develop a retention plan that takes both
the operational need and the concept of data minimization into consideration. This retention period
allows CBP to address any follow-up inquiries or requests related to the application, including
inquiries related to law enforcement, public safety, and national security. Retaining the company
information also permits CBP to reference the information for historical purposes and future
vetting. This new proposed retention schedule is both consistent with the concept of not retaining
information for longer than necessary, as well as ensuring that CBP continues to have access to
these vital records for a designated period.
Information Sharing
CBP continues to share CTPAT information for vetting and supply chain security purposes
with federal, state, local, foreign, and private entities in strict compliance with the CTPAT SORN,
published in the Federal Register. In addition, CBP continues to partner with several countries
through signed Mutual Recognition Arrangements (MRA). CBP is concurrently publishing an
update to Appendix B of the original 2013 PIA to make transparent the additional countries that
have signed MRAs. There are no new risks to information sharing.
Redress
There are no changes to redress as a result of this update. Company owners and points of
contact can update and edit information directly within the CTPAT Portal. Individuals may also

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 13

continue to seek access to CTPAT information by filing a Privacy Act/Freedom of Information
Act (FOIA) request. Furthermore, CTPAT partners continue to be responsible for correcting any
erroneous information within the CTPAT Portal. If CTPAT partnership is suspended or removed,
the business continues to have the same appeal opportunities as described in the 2013 PIA. Appeals
can be sent to CBP Headquarters, to the attention of the Executive Director, CTPAT Program
Division:
Executive Director
Cargo and Conveyance Security
U.S. Customs and Border Protection
1300 Pennsylvania Avenue N.W., Room 2.2A
Washington, D.C. 20229
Auditing and Accountability
This update does not impact auditing and accountability. There are no new risks associated
with auditing and accountability.

Responsible Official
Manuel A. Garza
CTPAT Director
Office of Field Operations
U.S. Customs and Border Protection
(202) 344-3969
Debra L. Danisek
CBP Privacy Officer
Privacy and Diversity Office
U.S. Customs and Border Protection
[email protected]

Approval Signature
Original, signed copy on file at the DHS Privacy Office.

________________________________
Lynn Parker Dupree
Chief Privacy Officer
U.S. Department of Homeland Security

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 14

APPENDIX A:

Trade Compliance Eligibility Questions

#

Eligibility Questions / Requirements

Yes

No

1.

Do you have a general authority to do business without requiring the approval of
another person outside the United States or Canada?

Yes

No

2.

Are you an active United States importer or Non-Resident Canadian importer who
meets the requirements set forth in 19 CFR Part 141, including in particular, sections
141.17 and 141.18?

Yes

No

3.

Do you maintain separate books and records for your United States / Canada
operations, prepare separate financial statements, maintain accounts for the
imported goods, and are you responsible for payment of import duties and taxes?

Yes

No

4.

Do you possess a valid continuous importation bond filed with CBP?

Yes

No

5.

Are you willing to complete a Memorandum of Understanding (MOU) and Trade
Compliance Questionnaire?

Yes

No

6.

Do you maintain an internal control system that is designed to provide assurance of
compliance with CBP laws and regulations?

Yes

No

7.

Do you perform annual risk assessments to identify risks to compliance with CBP
laws and regulations?

Yes

No

Yes

No

8.

Do you maintain and make appropriate adjustments to the system of internal controls?

9.

Have you designed an annual self-testing plan in response to identified risks?
Do you implement corrective action in response to errors and internal control
weaknesses disclosed by self-testing?

Yes

No

10.

Do you maintain an audit trail of financial records to CBP declarations, or an
alternate system that ensures accurate values are reported to CBP?

Yes

No

11.

Do you make appropriate disclosures through a prior disclosure, reconciliation, post
summary corrections, or a supplemental letter to CBP?

Yes

No

12.

Are you willing to submit an Annual Notification Letter (ANL) certifying that you
continue to meet CTPAT Trade Compliance requirements as listed in the Handbook?

Yes

No

13.

Do you agree to notify CBP of all major organizational changes?

Yes

No

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 15

APPENDIX B
Trade Compliance Application Questions

I.

Company Information

1.

Company Information (Required Document):
•

Date Prepared;

•

Company Name;

•

Business Address;

•

Phone Number;

•

Company Website;

•

Company Type: Public or Private;

•

Business Fiscal Year;

•

Name, Title, Phone Number, and email address of company contact; and

•

Please describe the overall organization/operating structure and provide organizational
chart of the company.

2. IOR(s) Numbers:

•

3.

Note, if the IOR number (s) in the Trade Compliance application is also used for
Drawback and/ or FTZ activities, those activities will be included in the Trade
Compliance application review process unless you choose otherwise.

o

If the Drawback or FTZ activity use a different IOR number, please specify those
IOR numbers if you’d like them included in this Trade Compliance application.

Provide the names and addresses of any related foreign and/or domestic companies,
such as the company’s parent, sister, subsidiaries, or joint ventures.

Do all of your company’s business units/subsidiaries operate under a centrally
controlled customs compliance policy/system? (Y/N)
•

4.

o

If no, describe how the compliance system operates in other divisions/subsidiaries. (Open
Text)

Does your company maintain an in-house compliance department dedicated to maintaining and
updating your company’s operations in adherence to government regulations, laws, executive
orders and procedures that will affect your CBP operations? (Y/N)
•

If so, please provide details on management and operational activities performed by this
department.
(Required Document—Organizational Chart/ Free Text)

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 16

5.

If not in house (per #4 above), do you have a contract with a CBP brokerage house or
consulting service to provide this advisory assistance? (Y/N)
•

6.

Does the company have compliance training (external, internal, or both) that provides pertinent
training for its internal compliance office and other departments that are involved with CBP
related activities? (Y/N)
•

7.

Would you like this company/firm to participate with you in the Trade Compliance
application/review process? If yes, which company/firm? (Y/N – Free Text)

If so, evidence of the training program, such as a training log that describes
course taken and attendees, must be included in the application. (Y/N –
Required Document)

Is your company applying to Trade Compliance due to successfully completing a Focused
Assessment (FA)? If so, please provide your invitation letter from the Trade Compliance
Branch. (Y – Required Document)

II. Import Activity
8.

Does the company monitor/track its annual duties, fees, and taxes paid to CBP to ensure bond
sufficiency?
•

9.

If yes, briefly describe how this is done and include how payments of duties and fees
are made? (i.e. PMS, ACH, Debit, Credit or by Broker)? (Y/N – If Y, Supporting Text
Required)

Has the company’s surety been required to pay a claim on its behalf in the past 5 years?
•

If yes, please provide claim details. (Y/N – If Y, Supporting Text Required)

10. Does the company own, or hold a licensed to use, trademarks, or copyrights for goods it
imports into the United States? (Y/N)
•

If yes, please identify the imported merchandise that falls under the license agreement or
pertains to the company owned intellectual property rights (IPR). (If Y, Supporting Text
Required)

11. Does the company import products that are subject to an exclusion order from the
International Trade Commission (ITC)? (Y/N)
•

If yes, please list them. (If Y, Supporting Text Required)

III. System of Internal Controls
12. Does your company have a written, comprehensive system of internal controls for its import
processes that is consistent with the five interrelated components of internal control as defined
by Committee of Sponsoring Organizations of the Treadway Commissions (COSO) published
report entitled “Internal Control-Integrated Framework”: (Y/N – Check)
•

Control environment

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 17

•

Risk assessment

•

Control activities

•

Information and communication

•

Monitoring

13. Do the company’s written internal control procedures focus on ensuring trade compliance for the
following areas? (Y/N Check all of the applicable options below)
•

Value
o

All elements of costs are included.

o

All additions to the price paid or payable such as assists are also included etc.

•

Drawback

•

Foreign Trade Zone

•

Classification

•

Country of Origin

•

Free Trade Agreements

•

AD/CVD

•

Forced Labor Note: CBP is still determining social compliance disclosure requirements.

•

Other

IV. Risk Assessment Results
14. Is your company prepared to provide risk assessment testing results to include areas of potential risks?
(Y/N)
•

If so, please summarize the risk management and assessment process. (Free Text)

V. Periodic Testing Results
15. Do the company’s internal control procedures include a process for conducting periodic self-testing
to include reporting results and implementing corrective actions? (Y/N)
•

If so, please provide details. (Free Text)

16. Do you make adjustments to your internal control system when tests or other information shows a
need for improvement with your compliance procedures? (Y/N)
•

If so, please provide details. (Free Text)

Privacy Impact Assessment Update

DHS/CBP/PIA-013(a) CTPAT

Page 18

17. Does your internal control process include a record keeping system that maintains evidence of testing
and testing results for at least three years and enables you to submit documents in a timely manner to
CBP upon request, to include tests and test results? (Y/N)
•

If so, please provide details. (If Y, Supporting Text Required)

VI. Prior Disclosures
18. What processes do you have in place to initiate appropriate disclosures to CBP when issues are
discovered through your self-testing?
•

Provide Response. (Free Text)

VII. Government Agency Affiliation
19. Do you participate in any other partnership programs with any other government agencies? (Check
one or more of the applicable options below) (Y/N Check One)
•

Food and Drug Administration (FDA)

•

Consumer Product Safety Commission (CPSC)

•

Not Applicable

•

Other