CPSS key terms

A documented, unbroken record of who held, moved, or accessed an item or shipment from origin to destination, used to prove integrity and support investigations or legal proceedings.

A voluntary U.S. Customs and Border Protection partnership in which importers, carriers, and other supply chain actors commit to documented security criteria in exchange for reduced inspection risk and trade benefits.

A status granted under the WCO SAFE Framework to businesses that meet customs, security, and compliance standards, enabling simplified procedures and mutual recognition benefits across participating countries.

A formal arrangement between customs administrations that accepts each other's AEO or equivalent certifications, so trusted traders receive streamlined treatment in both jurisdictions without duplicate vetting.

A written description of a company's supply chain security measures, facilities, and procedures, submitted to a customs partnership program and used as the basis for validation.

An on-site or documentary review by customs or an assessor confirming that a participant's declared security measures actually exist and operate as described in its security profile.

A structured process that identifies threats and vulnerabilities, estimates likelihood and consequence, and ranks risks so resources can be directed to the most significant exposures.

The chosen response to an assessed risk, such as avoiding an activity, reducing likelihood or impact through controls, transferring it via insurance or contract, or consciously accepting the residual level.

The level of risk that remains after existing controls and treatments have been applied, which management must formally accept or address with further action.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed as thresholds or statements that guide decisions about security investment and trade-offs.

The path or method by which an adversary or hazard can reach and exploit a supply chain asset, such as a compromised vendor, unsecured loading dock, or phishing email.

A weakness in a process, facility, system, or supplier relationship that a threat can exploit, increasing the likelihood or severity of loss.

A safeguard or countermeasure, whether administrative, physical, or technical, designed to prevent, detect, or reduce the impact of an unwanted event.

Layering multiple independent controls, such as fencing, access control, seals, and monitoring, so that failure of one measure does not leave an asset fully exposed.

The outermost physical layer of protection around a facility or cargo area, including fencing, lighting, gates, barriers, and patrols intended to deter and delay unauthorized entry.

Procedures and technology that restrict entry to facilities, yards, or systems to authorized people, often through badges, biometrics, visitor logs, and least-privilege permissions.

A documented set of measures, responsibilities, and procedures for protecting a site, covering perimeter, access, lighting, visitor handling, incident reporting, and coordination with local authorities.

Unauthorized interference with a shipment or its packaging, such as opening cartons, inserting contraband, or altering contents, often detected through seals, weight checks, or inspections.

A controlled process for applying, recording, and verifying high-security seals on containers and trailers, including serial number capture, inspection for damage, and immediate reporting of discrepancies.

Inspection of freight by physical search, X-ray, or detection technology to identify prohibited items, undeclared goods, or tampering before a shipment moves onward.

A consignor whose identity and security practices have been verified by a carrier or forwarder, allowing its cargo to be handled under reduced screening requirements in certain air cargo regimes.

The process of assessing, contracting with, monitoring, and periodically reviewing suppliers, carriers, and service providers for security, financial, and compliance risks they introduce.

Pre-contract investigation of a prospective supplier's ownership, reputation, security controls, financial stability, and compliance history before granting access to goods, data, or facilities.

Exposure created by the subcontractors and sub-suppliers of a direct vendor, which the buying organization does not contract with directly but which can still disrupt or compromise its supply chain.

The danger of depending heavily on a single supplier, port, route, or geography, so that one disruption or failure causes disproportionate harm across the supply chain.

Any component, supplier, system, or person whose failure alone can halt an operation or break a security control, making redundancy essential for resilience.

Documented procedures for maintaining or restoring critical operations during and after a disruption, including roles, alternate sites, communication paths, and recovery time objectives.

A study identifying critical business functions and quantifying how disruption over time affects revenue, safety, compliance, and reputation, used to set recovery priorities and targets.

The maximum acceptable duration a process or system may remain unavailable after a disruption before the impact becomes unacceptable to the organization.

Risk arising from employees, contractors, or partners who misuse legitimate access, whether maliciously for theft or sabotage or inadvertently through error or coercion.

The principle of granting people and systems only the access needed to perform their duties, limiting the damage an accidental error or malicious insider can cause.

Splitting sensitive tasks among different people, such as separating order creation, payment approval, and goods release, so no single person can commit and conceal a fraud.

Checking customers, suppliers, vessels, and transactions against restricted-party and embargo lists before doing business, to avoid violating trade control laws.

Verification that a counterparty does not appear on government lists of prohibited or restricted persons and entities, a core compliance step in export and logistics transactions.

Laws and regulations governing the transfer of sensitive goods, technology, and software across borders, including licensing requirements, end-use checks, and deemed export rules.

The structured cycle of detecting, reporting, containing, investigating, recovering from, and learning from security events, with defined roles, escalation paths, and evidence handling.

A time-bound plan assigning responsibility for fixing a deficiency found in an audit, incident, or validation, including verification that the fix actually worked.

A structured post-incident or post-exercise debrief that identifies root causes and systemic weaknesses, then converts findings into concrete improvements to controls and plans.

A discussion-based simulation in which participants walk through a plausible disruption scenario to test decision-making, communications, and plan adequacy without moving real assets.

A quantifiable measure, such as seal discrepancy rate or on-time carrier arrival, used to track whether security and operational objectives are being achieved over time.

Records, observations, interviews, and system logs gathered during an assessment to support conclusions about whether controls exist and operate effectively.

Deliberate duplication of capacity, suppliers, routes, systems, or staff so that a failure in one element can be absorbed by an alternate without stopping critical operations.

The total set of entry points, interfaces, and dependencies, including digital systems, facilities, and supplier connections, through which an adversary could attempt compromise.

Dividing a computer network into isolated zones so that compromise of one area, such as a warehouse terminal, cannot spread freely to critical business or customer systems.