CTPAT Minimum Security Criteria
CTPAT visitor log: what a US customer’s security questionnaire asks a UK supplier to keep
A US customer has sent you a security questionnaire with CTPAT on the front, and the physical access section asks about your visitor log. You cannot join CTPAT from the UK, and you do not need to: the questionnaire is how the criteria reach you. This page quotes the criteria it is built on, from U.S. Customs and Border Protection’s own documents, and says what an iPad at the door records towards each, including the one field it does not.
Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.
From £150 a month plus VAT, iPad and stand included. We are not customs advisers or consultants.
What the criteria ask
One criterion about the visitor log, two about why you are being asked, and two about the yard
CTPAT publishes separate criteria for each kind of member. The foreign manufacturer criteria are the ones a US importer measures a supplier against, and the importer criteria are the ones that oblige them to ask. Each criterion carries Must or Should in the document, and the words below are copied from that column.
Foreign Manufacturers 10.2, Must
The visitor log, and what it must hold
Visitors, vendors, and service providers must present photo identification upon arrival, and a log must be maintained that records the details of the visit. All visitors should be escorted. In addition, all visitors and service providers should be issued temporary identification. If temporary identification is used, it must be visibly displayed at all times during the visit. The registration log must include the following: Date of the visit; Visitor’s name; Verification of photo identification (type verified such as license or national ID card). Frequent, well known visitors such as regular vendors may forego the photo identification, but must still be logged in and out of the facility; Time of arrival; Company point of contact; and Time of departure.
The criterion the questionnaire is paraphrasing. Six fields, two of them times, one of them a record that somebody looked at a document. Escorting and temporary identification are should; the log, the photo ID and the visible display of a badge once issued are must.
U.S. Importers 3.5, Must
Why a UK supplier is being asked
When a CTPAT Member outsources or contracts elements of its supply chain, the Member must exercise due diligence (via visits, questionnaires, etc.) to ensure these business partners have security measures in place that meet or exceed CTPAT’s Minimum Security Criteria (MSC).
Your customer is the Member. You are the business partner. The questionnaire on your desk is the due diligence this criterion requires of them, and the criteria it reaches you with are the foreign manufacturer ones above. CBP’s own page says the foreign manufacturer programme is open to manufacturers in Mexico and Canada and others by invitation only, so a UK site is not applying for anything; it is answering.
U.S. Importers 3.4, Must
AEO as an alternative proof
The business partner screening process must take into account whether a partner is a CTPAT Member or a Member in an approved Authorized Economic Operator (AEO) program with a Mutual Recognition Arrangement (MRA) with the United States (or an approved MRA). Certification in either CTPAT or an approved AEO is acceptable proof for meeting program requirements for business partners, and Members must obtain evidence of the certification and continue to monitor these business partners to ensure they maintain their certification.
The guidance column beside it lists the current United States mutual recognition arrangements and names the United Kingdom among them. A UK AEO security and safety authorisation is therefore the document that can answer the whole questionnaire at once. If you hold one, send the certificate; if you do not, the questionnaire is the route, and the AEO page on this site covers the same door under HMRC’s wording.
Foreign Manufacturers 10.1, Must
Badges and access devices, in writing
CTPAT Members must have written procedures governing how identification badges and access devices are granted, changed, and removed. Where applicable, a personnel identification system must be in place for positive identification and access control purposes.
A written procedure is yours to hold. The guidance beside it says that for smaller companies, where personnel know each other, no identification system is required, and that generally a company with more than 50 employees needs one. A visitor badge with a name, a host and a date is the visitor half of that.
Foreign Manufacturers 10.3 and 10.4, Must
Drivers and the cargo pickup log
Drivers delivering or receiving cargo must be positively identified before cargo is received or released. Drivers must present government-issued photo identification to the facility employee granting access to verify their identity. A cargo pickup log must be kept to register drivers and record the details of their conveyances when picking up cargo.
Two separate requirements for the yard. The guidance beside 10.4 says a visitor log may double as a cargo log as long as the extra information is recorded in it. The kiosk’s visitor record holds a vehicle registration and nothing else about the conveyance, so it is not a cargo log, and the page says so below.
Quoted from CTPAT Minimum Security Criteria, Foreign Manufacturers, March 2020, and U.S. Importers, October 2021, both published by U.S. Customs and Border Protection and read on 26 September 2026. CBP’s own spelling is kept inside the quotations. Nothing in the criteria tells you to buy anything: a paper log with the six columns of 10.2, filled in every time and kept somewhere you can find it, satisfies the criterion. What paper struggles with is the departure time, the customer’s request for a sample from a date last quarter, and a badge that shows on its face who issued it and when.
The record
What the kiosk holds against each line of 10.2, and the one it does not
Each line below describes what the kiosk’s code does, not what a brochure would like it to. Where the honest answer is a limit, the limit is stated.
- Date, name, time of arrival, time of departureThe sign in form asks for the visitor’s name, their company, the person they have come to see and, if they drove in, a vehicle registration. The arrival time is stamped by the server, not typed. The visitor signs out by name on the kiosk, or reception signs them out on the dashboard, and the departure time is stamped the same way.
- Company point of contactA host is required on every sign in, stored with the visit, and told by name in Microsoft Teams or Slack the moment the visitor arrives.
- Verification of photo identificationNot a field. The kiosk does not look at a document and has nowhere to record that a person did. The person at the desk verifies the ID, as 10.2 says, and if your procedure wants the fact recorded, it is recorded by them, against the visit the kiosk gives them. We would rather say that here than on the call.
- Temporary identification, visibly displayedWith the badge module, the label prints the visitor’s name, company, host and the date with a colour band for their clearance. Where the site requires approval, nothing prints until a named approver enters a PIN on the kiosk. Whether it is worn is the escort’s job; the record shows it was issued and when the visitor signed out.
- EscortedThe host is named on the visit and told at once. With the badge module the clearance colour tells anyone on the floor whether the wearer should be alone. The kiosk cannot see whether an escort stayed with them.
- Kept for how longCriterion 10.2 states no retention period. You set one for the company, anywhere from one day to two years, with a year the default, and records are deleted automatically when it expires. Set it to cover the period your customer’s questionnaire or contract asks for.
- Drivers and cargoA driver who signs in on the kiosk is on the visitor record with their vehicle registration and their host. The kiosk holds nothing else about a conveyance, so it is not the cargo pickup log 10.4 requires. A courier who only uses the delivery drop-off is logged as a delivery, with the carrier and the time, and is not a person on the record.
- Where it livesIn the European Union, in Ireland, on ISO 27001 certified infrastructure, under a data processing agreement supplied as standard. The security page lists every sub-processor and where each one is.
The kiosk does not make a site compliant, certified or approved. It produces a timestamped record for the criteria named on this page, and your customer decides what that record is worth.
The visitor management kiosk in fullThe same door under HMRC’s AEO criteria, which 3.4 accepts as proofThe same log for a TAPA FSR warehouseOur security and sub-processors
On the questionnaire
What gets asked, and what you put in front of them
| What you are asked | What you show them |
|---|---|
| Do you maintain a visitor log? Show us a sample. | A filtered, timestamped list on screen, exported to a file the customer can keep, with name, company, host, arrival and departure. |
| How is a visitor’s photo identification verified? | By the person at the desk, as the criterion says, against the visit the kiosk has just recorded. The kiosk itself does not record the check. |
| Are visitors issued temporary identification and escorted? | With the badge module, a printed badge released by a named approver, with a clearance colour; the host named on every visit and told at once. |
| How are drivers registered? | A driver who comes beyond the dock signs in with a vehicle registration and a host. The cargo pickup log with conveyance details is a separate record, and the page says so. |
| Do you hold AEO? | If you do, the certificate answers 3.4 on its own. If not, the questionnaire is the route, and this record is the physical access part of it. |
Temporary identification, made visible
A badge printed only after a named approver’s PIN
The visitor signs in and waits. The host is told, walks over and enters a PIN on the kiosk. No approval, no badge. The name, the host, the date and the colour band on the label are the temporary identification 10.2 wants visibly displayed.
The badge module is an add-on at £150 a month plus VAT, label printer included. The platform works without it. The player loads from YouTube only when you press play; nothing is sent to Google before that. What happens when you do.
Before you ask
The questions UK suppliers ask when the questionnaire arrives
Can a UK manufacturer join CTPAT?
Not under the current programme. CBP’s page for foreign manufacturers says it is open to manufacturers in Mexico, Canada and other foreign manufacturers by invitation only, and the first eligibility requirement is to be an active manufacturer incorporated in Mexico or Canada. A UK supplier meets CTPAT through its US customer, whose criterion 3.5 requires due diligence, via visits, questionnaires and the like, over business partners. That is the questionnaire you have been sent.
What must a CTPAT visitor log include?
Criterion 10.2 for foreign manufacturers lists six items: the date of the visit, the visitor’s name, verification of photo identification with the type verified, the time of arrival, the company point of contact, and the time of departure. It adds that frequent, well known visitors such as regular vendors may forego the photo identification but must still be logged in and out. The kiosk records five of the six; the photo ID check is the desk’s to make and record.
Does holding AEO mean we can skip the questionnaire?
Criterion 3.4 for importers says certification in either CTPAT or an approved AEO programme under a mutual recognition arrangement with the United States is acceptable proof for meeting programme requirements for business partners, and the guidance beside it names the United Kingdom among the current arrangements. Whether your customer accepts your AEO certificate in place of their questionnaire is their call, but the criterion gives them the room to. The AEO page on this site covers what HMRC asked at the same door.
Does the kiosk record the photo ID check?
No. The form is name, company, host and a vehicle registration, and the kiosk stores no answers to anything else. Criterion 10.2 asks for the verification to be recorded, so if your procedure wants it in writing, reception records the type of document checked against the visit the kiosk has created. We would rather you knew that before you answered the questionnaire.
How long should the log be kept?
Criterion 10.2 does not say. Your customer’s questionnaire or contract may, and your own procedures should. The kiosk’s retention period runs from one day to two years, a year by default, and applies to the whole company; records are deleted automatically when it expires.
Do drivers go in the visitor log?
Criteria 10.3 and 10.4 treat drivers separately: photo identification before cargo is received or released, and a cargo pickup log recording the driver and the details of their conveyance. The guidance says a visitor log may double as a cargo log if the extra information is recorded in it. The kiosk’s record holds a vehicle registration and no other conveyance detail, so a driver who signs in is on the visitor record, and the cargo log is a separate document.
Being straight with you
What this does not do
- We are not U.S. Customs and Border Protection, not a CTPAT consultant, not a customs broker and not your customer’s security team. This is general information about published criteria, not advice on a questionnaire.
- A UK manufacturer is not a CTPAT Member. CBP’s own page limits the foreign manufacturer programme to Mexico, Canada and invitees. The criteria reach you through your customer’s due diligence under 3.5, and how your customer scores your answers is their decision.
- The kiosk does not verify photo identification and has no field to record that a person did. That stays a job for the desk.
- It is not a cargo pickup log. It records a vehicle registration and nothing else about a conveyance.
- It does not badge your own personnel, does not control doors and cannot see whether an escort stayed with a visitor.
- If your customer has raised a specific finding, bring their wording to the call and we will tell you honestly whether this closes it.
Sources
Check any of this yourself
- CBP, CTPAT Minimum Security Criteria, Foreign Manufacturers, March 2020Section 10, Physical Access Controls. Criteria 10.1 to 10.4 are quoted from it, each marked Must in the document. Read 26 September 2026.
- CBP, CTPAT Minimum Security Criteria, U.S. Importers, October 2021Criteria 3.4 and 3.5, both Must, are quoted from it; the list of mutual recognition arrangements naming the United Kingdom is its guidance column. Read 26 September 2026.
- CBP, CTPAT for Foreign ManufacturersThe eligibility page: Mexico, Canada and invitees only. Last updated 12 September 2025, read 26 September 2026.
General information about published criteria, not advice on your questionnaire. Criterion numbers differ between CTPAT’s documents; confirm against the one your customer sent.
Also asked of sites like yours
The other things somebody may ask you to evidence
Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.
Every standard on one page: the clause numbers, the version and the date each was read, on one printable table.
- GDPR and the visitor book
- CMMC physical security
- List X visitor control
- ITAR visitor log
- Def Stan 05-138 visitor access
- ISO 27001 visitor access
- PCI DSS visitor log
- AEO visitor access control
- TISAX visitor management
- TAPA FSR visitor log
- BRCGS visitor control
- BRCGS packaging visitor control
- BRCGS storage and distribution visitors
- BRCGS unannounced audit
- Visitor control non-conformity
- SALSA visitor control
- IFS Food visitor hygiene
- UFAS feed mill visitor control
- GMP visitors in production areas
- GDP wholesale visitor control
- Fire roll call
- Contractor management
- Construction work in occupied premises
- HSE inspection records
- ISO 45001 contractor control
- Visitor NDA sign in
- Visitor record retention
- What a visitor log must contain
- Standards calendar
- Sign in sheet template
- Visitor health questionnaire template
- Contractor induction template
- Permit to work template
- Hot work permit template
- Fire drill record template
Advise sites on this standard? Referral terms are on one page.
Next step
Read us the question on the questionnaire
Fifteen minutes on the phone. Read us the physical access questions your customer sent, and we will tell you straight which ones a kiosk record answers and which one stays with the desk.
Book a 15 minute callNo site visit needed and nothing to install. If it is not a fit we will say so on the call.
Would rather email? [email protected]
Not the person who signs it off? Send them the one page business case