Warehouse security best practices ctpat.pdf
- 1. WAREHOUSE SECURITY BEST PRACTICE GUIDELINES CUSTOMS-TRADE PARTNERSHIP AGAINST TERRORISM BACKGROUND In the aftermath of September 11, U.S. Customs and Border Protection (CBP) in cooperation with its trade partners initiated the Customs Trade Partnership Against Terrorism (C-TPAT). One of its goals is to ensure that C-TPAT partners improve the security of their supply chains pursuant to C-TPAT security criteria. The Warehouse Security Best Practices was developed by the International Warehouse and Logistics Association (IWLA) in response to customer queries regarding warehouse security and C-TPAT certification. CBP does not C-TPAT certify third-party warehouses. However, CBP has agreed to endorse a Warehouse Security Best Practice Guideline for third party warehouses. OBJECTIVE To provide IWLA Members with best practice guidelines to ensure security of cargo handling facilities and cargoes from point of receipt to shipping. It is incumbent upon warehouses to develop and implement a sound Security Plan incorporating the IWLA Best Practice Guidelines to demonstrate compliance with related C-TPAT security criteria as identified by CBP. Warehouses as defined in this guideline are facilities that are used to store and stage international cargo, both bonded and non-bonded cargoes, and domestic cargo for export. APPLICABILITY A written Security Plan should apply to all company employees, visitors, vendors and outside carriers. SECURITY PLANNING & MANAGEMENT IWLA warehouses will establish a security management team with a designated leader accountable to a senior executive. Warehouses will develop a Security Plan based on the IWLA’s Best Practice Guidelines and shall review not less than annually all procedures to verify required actions are implemented and effective. Security Plans will be kept in a secure location and shared on a "need-to-know" basis with appropriate regulatory officials, employees and customers. Warehouses will annually update a list of local, state, and federal emergency contacts, local CBP contacts, and local public health official contacts.
- 2. 2 THE SECURITY PLAN Warehouse will develop The Security Plan and undertake a self assessment process of their warehouse security. Components of the Security Plan will include the following elements: I) Physical Security II) Standard Operating Procedures III) Personnel Security & Training IV) Visitors V) IT Security VI) Customer Evaluation I) PHYSICAL SECURITY: Cargo handling and storage facilities must have physical barriers and deterrents that guard against unauthorized access. Warehouses should incorporate the following C- TPAT physical security criteria throughout their supply chains as applicable. Alarms Systems and/or Video Surveillance Cameras Alarm systems and video surveillance cameras should be utilized to monitor premises and prevent unauthorized access to cargo handling and storage areas. Retrieval of recorded activities should be maintained for a reasonable period. Building Structure Buildings must be constructed of materials that resist unlawful entry and protect from outside intrusion. The integrity of structures must be maintained by periodic inspection and repair. Critical Facility Protection Systems Facility protection systems, such as fire suppression and alarm systems, hazardous gas detection systems, and air scrubbers should be secured and monitored for unauthorized tampering or shut-down by an approved remote alarm company. The integrity of such monitored alarms should be periodically tested. Yard Security Perimeter fencing should enclose the areas around cargo handling and storage facilities. In the event there is no perimeter fencing, procedural practices to secure the yard from unlawful entry and protection from outside intrusion must be documented. Gates and Gate Houses Where there are gates through which vehicles and/or personnel enter or exit they must be manned and/or monitored. The number of gates should be kept to the minimum necessary for proper access and safety.
- 3. 3 Lighting Adequate lighting must be provided inside and outside the facility including the following areas: entrances and exits, cargo handling and storage areas, fence lines and parking areas. Locking Devices and Key Controls All external and internal windows, gates and fences must be secured with locking devices. Management or security personnel must control the issuance of all locks and keys. Parking Private passenger vehicles should be prohibited from parking in or adjacent to cargo handling and storage areas. Visitor parking should be separated from employee and container parking. II) STANDARD OPERATING PROCEDURES: Standard operating procedures must be in place to ensure that all documentation and operational requirements are being followed and adhered to in a consistent manner. Cargo Discrepancies All shortages, overages, and other significant discrepancies or anomalies must be resolved and/or investigated appropriately. Customs and/or other appropriate law enforcement agencies must be notified if illegal or suspicious activities are detected - as appropriate. Container Seals Written procedures must stipulate how seals are to be controlled and affixed to loaded containers - to include procedures for recognizing and reporting compromised seals and/or containers to CBP or the appropriate authority. Only designated employees will distribute container seals for integrity purposes. There will be procedures in place to effectively communicate seal numbers to consignees. Container Storage Containers must be stored in a secure area to prevent unauthorized access and/or manipulation. Warehouses must put procedures in place for reporting and neutralizing unauthorized entry into containers or container storage areas. Documentation Processing Procedures must be in place to ensure that all information used in the clearing of merchandise/cargo is legible, complete, accurate, and protected against the exchange, loss or introduction of erroneous information. Documentation is provided to freight forwarders, carriers, consignees by secure means of transmission. Documentation control must include safeguarding computer access and information. Management has review of process and corrective actions if any of the above guidelines are not followed.
- 4. 4 Manifesting Procedures To help ensure the integrity of cargo, procedures must be in place to ensure that information received from business partners is reported accurately and timely. Physical Access Controls Access controls prevent unauthorized entry to facilities, maintain control of employees and visitors, and protect company assets. Access controls must include the positive identification of all employees, visitors, and vendors at all points of entry. Warehouses must establish secured waiting areas where drivers can be identified and allowed limited access for confirmed pick ups and deliveries. Shipping & Receiving Arriving cargo must be reconciled against information on the cargo manifest. The cargo must be accurately described, and the weights, labels, marks and piece count indicated and verified. Departing cargo must be verified against purchase or delivery orders. Drivers delivering or receiving cargo must be positively identified before cargo is received or released. Conveyance Security The following elements outline a sound conveyance security process: Procedures for the inspection of conveyance (trailers and containers) prior to loading with the awareness that no hidden compartments could conceal contraband. Procedures for the inspection of vehicles of conveyance prior to loading to ensure that un-manifested materials are not shipped A process is in place for the refusal of vehicles of conveyance if they do not meet internal guidelines. A process is in place to prevent unauthorized persons from gaining access to empty conveyance vehicles on your site. A process is in place to prevent unauthorized persons from gaining access to conveyance vehicles which have been loaded and are ready for removal from your site. A process is in place for approving and certifying transporting materials from your location. A process is in place for securing that only certified carriers have access to materials leaving your site.
- 5. 5 III) EMPLOYEES (PERSONNEL): Security Training and Threat Awareness A threat awareness program should be established and maintained by security personnel to recognize and foster awareness of the threat posed by terrorists at each point in the supply chain. Employees must be made aware of the procedures the company has in place to address a situation and how to report it. Additional training should be provided to employees in the shipping and receiving areas, as well as those receiving and opening mail. Additionally, specific training should be offered to assist employees in maintaining cargo integrity, recognizing internal conspiracies, and protecting access controls. These programs should offer incentives for active employee participation. Personnel Security/ Background checks / investigations Processes must be in place to screen prospective employees and to periodically check current employees. An employee identification system must be in place for positive identification and access control purposes. Employees should only be given access to those secure areas needed for the performance of their duties. Company management or security personnel must adequately control the issuance and removal of employee, visitor and vendor identification badges. Warehouses must establish procedures for the issuance; removal and changing of access devices (e.g. keys, key cards, etc.) must be documented. Pre-Employment Verification Application information, such as employment history and references must be verified prior to employment. To extent authorized by national law, warehouses conduct employment screening, background checks, and thorough interviewing prior to hire. Personnel Termination Procedures Companies must have procedures in place to remove identification, facility, and system access for terminated employees. Education and Awareness Training Warehouse provides employees with procedures manuals covering process supporting all supply chain activities. Warehouse provides periodic internal training programs covering warehouse activities including the importance of maintaining cargo integrity. IV) ACCESS CONTROLS The Security Plan provides a process to positively identify and control the movement of all persons on site. Everyone on site is required to have and display a security badge certifying their approval to be on site. It is a Best Practice to employ Security Guards.
- 6. 6 Visitors A process implemented to register and account for all non-company employees onto the site (sign in – out procedures). Visitors must possess photo identification for documentation purposes upon arrival. Visitors will visibly display temporary identification. Deliveries (including mail) Proper vendor ID and/or photo identification must be presented for documentation purposes upon arrival by all vendors. Arriving packages and mail must be periodically screened before being disseminated. Challenging and Removing Unauthorized Persons Procedures must be in place to identify, challenge and address unauthorized/unidentified persons. V) INFORMATION TECHNOLOGY SECURITY Password Protection Automated systems must use individually assigned accounts that require a periodic change of password. IT security policies, procedures and standards must be in place and provided to employees in the form of training. Accountability A system must be in place to identify the abuse of IT including improper access, tampering or the altering of business data. All system violators must be subject to appropriate disciplinary actions for abuse. VI) CUSTOMER EVALUATION A process is in place to verify company legitimacy by confirming contact names, a U.S. mailing address for the company, references, and verification of phone numbers. Reasonable care should be taken to understand the type of cargoes arriving at warehouse facilities. © IWLA 2008, All Rights Reserved