CPSS cheat sheet

Supply chain security protects the end-to-end flow of goods, information, money, and people across tiers of suppliers, carriers, and intermediaries.

Core objectives: integrity of goods, confidentiality of commercial data, availability of flow, and regulatory compliance.

Defense in depth layers physical, personnel, information, and procedural controls so no single failure compromises the chain.

The weakest-link principle: overall chain security equals the resilience of its least-secured node or link.

Tier visibility: Tier 1 suppliers are direct; Tier 2 and below are indirect and usually carry the greatest unknown risk.

Chain-of-custody means documented, unbroken accountability for goods from origin to destination.

C-TPAT, AEO, and ISO 28000 are common frameworks that formalize supply chain security management.

Risk transfer via cargo insurance and contractual liability clauses complements, but does not replace, preventive controls.

Governance defines decision rights, accountability, and oversight for security across the enterprise and its partners.

Risk = likelihood × impact; risk appetite is the acceptable exposure level, risk tolerance is the allowable deviation from it.

Risk treatment options: avoid, reduce/mitigate, transfer, accept, and exploit (for opportunities).

A written security policy, approved by executive leadership, sets mandatory requirements and is reviewed at planned intervals.

Roles: board/executive sponsor, chief security officer, supply chain security manager, site security officers, and internal audit.

Key risk indicators (KRIs) measure exposure trends; key performance indicators (KPIs) measure control effectiveness.

Third-party risk governance requires due diligence before contracting and periodic reassessment during the relationship.

Residual risk is the risk remaining after controls; it must be documented and accepted by an accountable owner.

Threat = actor or event with potential to cause harm; vulnerability = weakness that a threat can exploit; risk arises when threat meets vulnerability.

Common cargo threats: theft, pilferage, hijacking, tampering, contraband concealment, counterfeiting, and cyber-enabled fraud.

Threat actors include organized cargo crime groups, insiders, terrorists, competitors, and nation-state or hacktivist actors.

Risk assessment steps: identify assets and flows, identify threats and vulnerabilities, assess likelihood and impact, prioritize, treat, monitor.

CARVER and threat/vulnerability/risk (TVR) matrices are structured scoring methods for prioritizing sites and routes.

Attack surface expands with handoffs: each transfer point between carrier, warehouse, and customs is a potential vulnerability.

Scenario analysis and red-team exercises reveal vulnerabilities that checklists miss.

Risk registers record identified risks, owners, ratings, treatment plans, and review dates.

Layered physical protection: perimeter, building envelope, interior zones, and high-value asset enclosures.

Access control uses badge, biometric, or PIN credentials with least-privilege zoning and anti-passback where appropriate.

CCTV should cover gates, docks, high-value storage, and exits, with recorded retention meeting policy and legal requirements.

Lighting standards for perimeter and dock areas deter intrusion and support camera effectiveness.

Intrusion detection (alarms, motion sensors, contact switches) must be monitored and responded to, not merely recorded.

Visitor management: sign-in, escort, badge display, and logs are baseline controls at all secure facilities.

Key and seal control programs prevent unauthorized access and detect tampering in transit.

Warehouse layout should separate receiving, storage, and shipping to reduce mixing of inbound and outbound goods.

Seals: high-security bolt seals meeting ISO 17712 are affixed at origin, recorded, and verified at each handoff.

Seal numbers must be logged on shipping documents and reconciled on arrival; a broken or mismatched seal triggers inspection.

Carrier selection criteria include vetting of drivers, vehicle tracking, and adherence to security protocols.

Route risk assessment considers crime rates, border crossings, rest stops, and known hijack corridors.

Tracking technologies include GPS, RFID, and geofencing with alerts for route deviation and unscheduled stops.

Consolidation and deconsolidation points are high-risk because cargo is exposed and documents change hands.

Chain-of-custody documentation records every transfer with time, location, and responsible party.

Air, sea, rail, and road modes each carry distinct risk profiles and regulatory security programs.

Supply chain cyber risk includes compromise of partners, EDI/API integrations, and logistics platforms.

Confidentiality, integrity, and availability (CIA triad) are the standard security objectives for information assets.

Access control principle of least privilege limits data exposure to what each role requires.

Encryption protects data in transit (TLS) and at rest (storage encryption) to prevent interception and theft.

Third-party integration security requires contractual security requirements, access reviews, and monitoring.

Incident response for cyber events includes detection, containment, eradication, recovery, and lessons learned.

Data classification determines handling, retention, and sharing rules for commercial and personal data.

Software supply chain risk includes compromised vendors, malicious updates, and counterfeit components.

Insider threat originates from employees, contractors, or partners with authorized access who misuse it.

Motivations include financial gain, coercion, ideology, disgruntlement, and negligence.

Indicators include unusual access patterns, unexplained wealth, refusal to take leave, and bypassing controls.

Segregation of duties and mandatory vacation rotation reduce opportunity for concealment.

Background screening at hire and periodic re-screening are preventive controls.

Monitoring of access logs and exception reporting supports early detection.

Whistleblower and reporting channels encourage early disclosure without retaliation.

Insider threat programs balance security monitoring with privacy and employment law obligations.

Pre-employment screening verifies identity, employment history, criminal record where lawful, and references.

Role-based screening depth should match the sensitivity of the position and access granted.

Supplier due diligence assesses security posture, financial stability, and compliance history before onboarding.

Contracts should include security requirements, audit rights, breach notification, and termination clauses.

Periodic supplier reassessment and scorecards track performance against agreed security criteria.

Personnel security includes onboarding, training, awareness, and offboarding with access revocation.

Sub-tier suppliers must be disclosed and vetted where the risk warrants it.

Confidentiality and non-disclosure agreements protect commercial and security-sensitive information.

Compliance obligations arise from customs law, transport security regulations, data protection law, and sector rules.

Penalties for non-compliance include fines, shipment delays, loss of trusted-trader status, and criminal liability.

Recordkeeping requirements typically mandate retention of shipping, screening, and access records for defined periods.

Customs brokers and forwarders must be licensed and their filings accurate; errors create legal exposure.

Sanctions and export control screening (denied-party lists) is a mandatory compliance step for many shipments.

Data protection laws (e.g., GDPR) govern personal data collected in security screening and monitoring.

Compliance programs should include policies, training, monitoring, and a reporting mechanism.

Regulatory changes require periodic review and update of procedures and training.

C-TPAT (US) is a voluntary partnership between CBP and trade stakeholders to strengthen supply chain security.

AEO (Authorized Economic Operator) is the WCO-aligned EU and international trusted-trader program.

Trusted-trader benefits include reduced inspections, faster clearance, and priority processing.

Program requirements typically include security assessments, documented procedures, and partner vetting.

Customs-Trade Partnership validation involves on-site verification of security measures.

Importer Self-Assessment and similar programs require internal controls over classification and valuation.

Container security initiatives (e.g., CSI) target pre-shipment screening at foreign ports.

Trade security programs complement, not replace, customs compliance obligations.

Incident management lifecycle: prepare, detect, report, assess, respond, recover, and learn.

Incident classification by severity drives escalation, notification, and resource allocation.

A documented incident response plan defines roles, communication channels, and decision authority.

Notification obligations may include customs authorities, insurers, regulators, and affected parties within defined timeframes.

Evidence preservation supports investigation, insurance claims, and legal proceedings.

Post-incident reviews identify root causes and corrective actions tracked to closure.

Tabletop exercises and simulations test the response plan before a real event.

Incident logs and metrics feed continuous improvement of controls.

Business impact analysis (BIA) identifies critical processes, dependencies, and maximum tolerable downtime.

Recovery time objective (RTO) is the target restoration time; recovery point objective (RPO) is the acceptable data loss window.

Continuity strategies include alternate suppliers, redundant routes, buffer stock, and backup facilities.

Resilience is the ability to absorb disruption and recover while maintaining critical operations.

Plans must be tested through exercises and updated after significant changes or incidents.

Supplier and carrier diversification reduces single-point-of-failure exposure.

Crisis communication plans define internal and external messaging during disruption.

Continuity plans should address cyber, physical, and geopolitical disruptions alike.

Audit types include internal, external, supplier, and certification audits; each has distinct scope and independence.

Audit evidence should be sufficient, relevant, and reliable; sampling must be documented and defensible.

Findings are classified by severity (critical, major, minor, observation) and tracked to corrective action closure.

KPIs measure performance (e.g., on-time delivery, incident rate); KRIs measure risk exposure trends.

Benchmarking compares performance against industry standards or peer organizations.

Assurance activities include self-assessments, third-party audits, and management reviews.

Audit programs should be risk-based, prioritizing high-risk sites, routes, and suppliers.

Continuous monitoring and data analytics supplement periodic audits for faster detection.

Governance defines decision rights, accountability, and oversight for security across the enterprise and its partners.

Risk = likelihood × impact; risk appetite is the acceptable exposure level, risk tolerance is the allowable deviation from it.

Risk treatment options: avoid, reduce/mitigate, transfer, accept, and exploit (for opportunities).

A written security policy, approved by executive leadership, sets mandatory requirements and is reviewed at planned intervals.

Roles: board/executive sponsor, chief security officer, supply chain security manager, site security officers, and internal audit.

Key risk indicators (KRIs) measure exposure trends; key performance indicators (KPIs) measure control effectiveness.

Third-party risk governance requires due diligence before contracting and periodic reassessment during the relationship.

Residual risk is the risk remaining after controls; it must be documented and accepted by an accountable owner.

Threat = actor or event with potential to cause harm; vulnerability = weakness that a threat can exploit; risk arises when threat meets vulnerability.

Common cargo threats: theft, pilferage, hijacking, tampering, contraband concealment, counterfeiting, and cyber-enabled fraud.

Threat actors include organized cargo crime groups, insiders, terrorists, competitors, and nation-state or hacktivist actors.

Risk assessment steps: identify assets and flows, identify threats and vulnerabilities, assess likelihood and impact, prioritize, treat, monitor.

CARVER and threat/vulnerability/risk (TVR) matrices are structured scoring methods for prioritizing sites and routes.

Attack surface expands with handoffs: each transfer point between carrier, warehouse, and customs is a potential vulnerability.

Scenario analysis and red-team exercises reveal vulnerabilities that checklists miss.

Risk registers record identified risks, owners, ratings, treatment plans, and review dates.

Layered physical protection: perimeter, building envelope, interior zones, and high-value asset enclosures.

Access control uses badge, biometric, or PIN credentials with least-privilege zoning and anti-passback where appropriate.

CCTV should cover gates, docks, high-value storage, and exits, with recorded retention meeting policy and legal requirements.

Lighting standards for perimeter and dock areas deter intrusion and support camera effectiveness.

Intrusion detection (alarms, motion sensors, contact switches) must be monitored and responded to, not merely recorded.

Visitor management: sign-in, escort, badge display, and logs are baseline controls at all secure facilities.

Key and seal control programs prevent unauthorized access and detect tampering in transit.

Warehouse layout should separate receiving, storage, and shipping to reduce mixing of inbound and outbound goods.

Seals: high-security bolt seals meeting ISO 17712 are affixed at origin, recorded, and verified at each handoff.

Seal numbers must be logged on shipping documents and reconciled on arrival; a broken or mismatched seal triggers inspection.

Carrier selection criteria include vetting of drivers, vehicle tracking, and adherence to security protocols.

Route risk assessment considers crime rates, border crossings, rest stops, and known hijack corridors.

Tracking technologies include GPS, RFID, and geofencing with alerts for route deviation and unscheduled stops.

Consolidation and deconsolidation points are high-risk because cargo is exposed and documents change hands.

Chain-of-custody documentation records every transfer with time, location, and responsible party.

Air, sea, rail, and road modes each carry distinct risk profiles and regulatory security programs.

Supply chain cyber risk includes compromise of partners, EDI/API integrations, and logistics platforms.

Confidentiality, integrity, and availability (CIA triad) are the standard security objectives for information assets.

Access control principle of least privilege limits data exposure to what each role requires.

Encryption protects data in transit (TLS) and at rest (storage encryption) to prevent interception and theft.

Third-party integration security requires contractual security requirements, access reviews, and monitoring.

Incident response for cyber events includes detection, containment, eradication, recovery, and lessons learned.

Data classification determines handling, retention, and sharing rules for commercial and personal data.

Software supply chain risk includes compromised vendors, malicious updates, and counterfeit components.

Insider threat originates from employees, contractors, or partners with authorized access who misuse it.

Motivations include financial gain, coercion, ideology, disgruntlement, and negligence.

Indicators include unusual access patterns, unexplained wealth, refusal to take leave, and bypassing controls.

Segregation of duties and mandatory vacation rotation reduce opportunity for concealment.

Background screening at hire and periodic re-screening are preventive controls.

Monitoring of access logs and exception reporting supports early detection.

Whistleblower and reporting channels encourage early disclosure without retaliation.

Insider threat programs balance security monitoring with privacy and employment law obligations.

Pre-employment screening verifies identity, employment history, criminal record where lawful, and references.

Role-based screening depth should match the sensitivity of the position and access granted.

Supplier due diligence assesses security posture, financial stability, and compliance history before onboarding.

Contracts should include security requirements, audit rights, breach notification, and termination clauses.

Periodic supplier reassessment and scorecards track performance against agreed security criteria.

Personnel security includes onboarding, training, awareness, and offboarding with access revocation.

Sub-tier suppliers must be disclosed and vetted where the risk warrants it.

Confidentiality and non-disclosure agreements protect commercial and security-sensitive information.

Compliance obligations arise from customs law, transport security regulations, data protection law, and sector rules.

Penalties for non-compliance include fines, shipment delays, loss of trusted-trader status, and criminal liability.

Recordkeeping requirements typically mandate retention of shipping, screening, and access records for defined periods.

Customs brokers and forwarders must be licensed and their filings accurate; errors create legal exposure.

Sanctions and export control screening (denied-party lists) is a mandatory compliance step for many shipments.

Data protection laws (e.g., GDPR) govern personal data collected in security screening and monitoring.

Compliance programs should include policies, training, monitoring, and a reporting mechanism.

Regulatory changes require periodic review and update of procedures and training.

C-TPAT (US) is a voluntary partnership between CBP and trade stakeholders to strengthen supply chain security.

AEO (Authorized Economic Operator) is the WCO-aligned EU and international trusted-trader program.

Trusted-trader benefits include reduced inspections, faster clearance, and priority processing.

Program requirements typically include security assessments, documented procedures, and partner vetting.

Customs-Trade Partnership validation involves on-site verification of security measures.

Importer Self-Assessment and similar programs require internal controls over classification and valuation.

Container security initiatives (e.g., CSI) target pre-shipment screening at foreign ports.

Trade security programs complement, not replace, customs compliance obligations.

Incident management lifecycle: prepare, detect, report, assess, respond, recover, and learn.

Incident classification by severity drives escalation, notification, and resource allocation.

A documented incident response plan defines roles, communication channels, and decision authority.

Notification obligations may include customs authorities, insurers, regulators, and affected parties within defined timeframes.

Evidence preservation supports investigation, insurance claims, and legal proceedings.

Post-incident reviews identify root causes and corrective actions tracked to closure.

Tabletop exercises and simulations test the response plan before a real event.

Incident logs and metrics feed continuous improvement of controls.

Business impact analysis (BIA) identifies critical processes, dependencies, and maximum tolerable downtime.

Recovery time objective (RTO) is the target restoration time; recovery point objective (RPO) is the acceptable data loss window.

Continuity strategies include alternate suppliers, redundant routes, buffer stock, and backup facilities.

Resilience is the ability to absorb disruption and recover while maintaining critical operations.

Plans must be tested through exercises and updated after significant changes or incidents.

Supplier and carrier diversification reduces single-point-of-failure exposure.

Crisis communication plans define internal and external messaging during disruption.

Continuity plans should address cyber, physical, and geopolitical disruptions alike.

Audit types include internal, external, supplier, and certification audits; each has distinct scope and independence.

Audit evidence should be sufficient, relevant, and reliable; sampling must be documented and defensible.

Findings are classified by severity (critical, major, minor, observation) and tracked to corrective action closure.

KPIs measure performance (e.g., on-time delivery, incident rate); KRIs measure risk exposure trends.

Benchmarking compares performance against industry standards or peer organizations.

Assurance activities include self-assessments, third-party audits, and management reviews.

Audit programs should be risk-based, prioritizing high-risk sites, routes, and suppliers.

Continuous monitoring and data analytics supplement periodic audits for faster detection.