1. Customs Trade Partnership Against Terrorism (C-TPAT) An Introduction
September 2016

2. C-TPAT Training Outline
The C-TPAT Program
Mallinckrodt’s role
What is C-TPAT
Safe Port Act 2006
Supply Chain
C-TPAT Approach, Objectives, Membership, Benefits
CBP Supply Chain Security Specialist
Validation Process
Minimum Security Criteria
Security
Information Technology
Access Device Controls, Visitor Procedures, Escort Procedures
Suspicious Persons
Reporting Security Incidents/Concerns
Security website

3. Mallinckrodt Pharmaceuticals
Mallinckrodt joined with U.S. Customs and Border Protection (CBP) to help secure the international supply chain.
The Customs-Trade Partnership Against Terrorism (C-TPAT) is a voluntary initiative between CBP and private businesses to build relationships that strengthen international supply chains and improve U.S. border security.
On August 4, 2014, Mallinckrodt qualified for Tier II benefits under the C-TPAT Program.

4. Mallinckrodt Pharmaceuticals
As a member of the C-TPAT program, Mallinckrodt has committed itself to new and improved security procedures throughout our operations.
These new procedures are designed to enhance the security of our facilities, people, cargo shipping, cargo receiving and cargo tracking processes.
Our goal is to prevent cargo loss and cargo tampering including the introduction of illegal merchandise such as drugs and weapons of mass destruction into our cargo boxes and containers.
As a part of our commitment to supply chain security, we now require all of our employees to be aware of and seriously consider supply chain security as a significant risk to our business.

5. What is C-TPAT
U.S. Customs and Border Patrol (CBP) and Industry working together to enhance international supply chain security and facilitate legitimate compliant trade.
C‐TPAT seeks to safeguard the world's trade industry from terrorists, drug dealers and human traffickers while maintaining the economic health of the United States and its neighbors.
The partnership develops and adopts measures that facilitate security without sacrificing an expedient trade process, a difficult balancing act.
Today, more than 11,400 certified partners have been accepted into the program and account for over 52 percent of the value of imports to the United States.

6. Safe Port ACT 2006 (Excerpt)
CBP initiated C-TPAT in November 2001, to complement other maritime security programs as part of the agency’s layered security strategy.
In October 2006, the SAFE Port Act formalized C-TPAT into law.
C-TPAT is a voluntary program that enables CBP officials to work in partnership with private companies to review the security of their international supply chains and improve the security of their shipments to the United States.
In return for committing to improve the security of their shipments by joining the program, C-TPAT members receive benefits that result in the likelihood of reduced scrutiny of their shipments, e.g., a reduced number of inspections or shorter wait times for their shipments.

7. Description of Supply Chain
Supply Chain Management: Refers to the flow of material and the relationships among intermediaries from origin to consumer.
Unknown Business Partners
No Visits/ Audits Conducted
Security a non-factor
No participation in International security programs
Supply Chain Security
Note: A supply chain that has no security procedures in place will eventually have a weak link and be vulnerable to an attack.

8. Description of Supply Chain
End-to-End Supply Chain Security Solution
Securing the entire supply chain from end-to-end – C-TPAT type measures.
Supply Chain Security
Note: A supply chain that has good security procedures in place will have a more secure supply chain. The idea for a secure supply chain is to implement good security practices throughout the chain (point of packaging to point of receipt).
There is no one thing (silver bullet) that can prevent an attack. In many cases, multiple defenses have to be in place in order to prevent an attack.

9. Why do we protect the Supply Chain?
Any one individual, shipment, or conveyance
could be…
Weapons of mass destruction
Biological warfare chemicals
Arms/munitions
Terrorists

10. The C-TPAT Approach
Voluntary Partnership - As previously stated, the C-TPAT program is a voluntary partnership w/ jointly developed minimum security criteria.
Because of the scale and mission of C-TPAT, (supply chains, anti terrorism and national security), this approach was deemed to be more effective than creating mandatory requirements, that are sometimes necessary in certain situations, but always effective.
Customized application of guidelines by members - More times than not, positive validation results in companies not only meeting expectations but in many cases exceeding the minimum standard.
Clear Benefits - C-TPAT certified companies are eligible for benefits to include a reduced number of examinations.
Trust But Verify Information - This approach adopts the requirement for conducting the supply chain security validations on C-TPAT companies by verifying information submitted in the companies security profile.

11. C-TPAT Objectives
C-TPAT allows CBP to use its knowledge, long interdiction and enforcement experience and expand upon those qualities with C- TPAT objectives, e.g.:
Prevention: The mission and goal to help identify a “security compromise” as early as possible (i.e., CSI, Supply Chain Validations) vs. traditional interdiction, in which CBP is looking for the threats after arrival, (not an ideal situation because the WMD may be already here).
Shared Responsibility: The program invites participation of all trade sectors and create opportunities for companies to become proactive in their supply chain procedures (i.e., training employees about container security, having reporting mechanisms in place at their owned or vendor facilities for reporting anomalies).

12. C-TPAT Objectives
C-TPAT allows CBP to use its knowledge, long interdiction and enforcement experience and expand upon those qualities with C- TPAT objectives, e.g.:
Security awareness: Opportunity of having employees understand how smuggling, theft, organized crime networks work - they will help identify them.
Security and efficiency: Efficient supply chain is a more secure supply chain environment, which helps overall in conveying your legitimacy and commitment amongst the international trade community.

13. Layered Strategy NII Trade Act/24-Hour Rule/NTC
Advanced electronic information analysis and targeting
Non -
Intrusive Inspection Technology
Employing the use of advanced inspection
technologies
NII
Container Security Initiative
Expanding our borders by pre-screening high
risk shipments prior to arrival in the U.S.
Customs-
Trade Partnership Against Terrorism
Engaging the private sector to increase supply
chain security

14. C-TPAT Membership U.S. Importers of record
U.S./ Canada Highway Carriers
U.S./ Mexico Highway Carriers
Rail Carriers
Sea Carriers
Air Carriers
U.S. Port Authority/ Terminal Operator
U.S Air Freight Consolidators, Ocean Transportation Intermediaries and Non- Vessel Operating Common Carriers (NVOCC)
Mexican and Canadian Manufacturers
Certain Invited Foreign Manufacturers
Licensed U.S. Customs Brokers
Third Party Logistics Providers (3PL)
Long Haul Highway Carriers in Mexico

15. Benefits & Incentives Reduced inspection (ATS score reduction)
Front of the line treatment for exams
Assigned CBP Supply Chain Security Specialist (SCSS) (POC)
C-TPAT Internet Portal; Security alerts ( )
Access to Status Verification Interface (SVI)
Eligibility for other CBP Programs (FAST) & Training Seminars
More efficient & secure supply chain; transparency
Emphasis on self-policing, not an audit; C-TPAT guides and catalogs (best practices)
Penalty mitigation assistance
Stratified compliance benefits
Business resumption

16. C-TPAT Benefits – Trade Based
Security
Efficiency
Good Corporate Citizen
Product and Brand Protection
Partnering with Other Government Programs
Protecting Corporate Information
Better Use of Resources
Reduced Entry Costs
Timely Product Delivery
Increased Productivity
Enhanced Marketing
Competitive Advantage
Leveraging Information
Resiliency 16

17. Tiered Benefits
Tier 1 – Importers who have submitted a security profile that has been reviewed and accepted. No negative findings during vetting.
Tier 2 – Importers who have been validated and are meeting the “minimum security criteria.” (Mallinckrodt is currently approved as Tier II)
Tier 3 – Importers who have been validated and exceed the “minimum security criteria” and have adopted C-TPAT best practices. (Approved by C-TPAT Director. A small number of companies approved.)

18. Supply Chain Security Specialist
“The C-TPAT Supply Chain Security Specialist (SCSS) primarily conducts C-TPAT Validations of C-TPAT member companies and serves as the principal advisor and primary point of contact (POC) for certified members in the C-TPAT program.”

19. What is a Validation?
The validation process involves creating a “Validation Team” that performs a joint review of the supply chain based on the security profile submitted and a documented risk assessment
Each validation is customized according to the partner
An open forum to discuss issues, share ideas, address vulnerabilities and develop solutions
Understand the role of CBP and the Trading Community in the war against terrorism
Ensure company’s C-TPAT security profile is Reliable, Accurate, and Effective. (Trust but verify system)
Share best practices and cooperatively develop solutions to address potential vulnerabilities.

20. Validation Process C-TPAT Guidelines and Security Criteria
Conduct Pre-Validation Risk Assessment
Conduct domestic and foreign site visit (CBP visited the Petten and St. Louis Plants in 2014)
Site tours: Facility, D/C, customers or service providers
Verify security practices with Security Criteria
Jointly identify gaps, vulnerabilities and weaknesses
Make recommendations or actions required
Close-out meeting; Prepare Report - send to C-TPAT HQ
90-days to respond to the report
Self Policing/ Continue relationship with CBP

21. C-TPAT Minimum Security Criteria
What procedures the C-TPAT member is required to have in place.
The starting point for partners to develop and employ effective security practices.
It is the responsibility of the member to study their supply chain(s), assess the risk, and develop security controls to deal with those risks.

22. Minimum Security Criteria – U.S. Importers
Business Partner Security - includes who the company does business with, verify security of their business partners, verify SVI of their C-TPAT partners, conduct security assessments of foreign business partners.
Container Security & Inspection (Seals) - includes container/ conveyance inspections, tracking, sealing containers with high security seal, reporting suspicious seals/ containers to CBP, control and access to containers and sea.

23. Minimum Security Criteria – U.S. Importers
Physical Access Controls - includes procedures for properly identifying, employees, visitors and vendors as well as preventing unauthorized access to facilities and conveyances, removing access of terminated employees.
Personnel Security - includes ensuring that companies conduct adequate screening and interviewing of employees to include background checks (reference, criminal, drug testing), termination policy in place.

24. Minimum Security Criteria – U.S. Importers
Procedural Security - includes the protection of un-manifested material into the supply chain, and includes supervision and control of the movement of goods (some criteria consists of the proper marking, weighing of cargo, reporting shortages and overages, and verifications of seals on containers), ensuring that manifests are complete and accurate.
Physical Security - includes building structure, perimeter fencing, locking devices on internal and external doors, windows, etc., adequate lighting, CCTV capability, and security alarms.

25. Minimum Security Criteria – U.S. Importers
Security Training & Threat Awareness - includes formal training program for employees about cargo integrity, internal conspiracies, container inspections, reporting any anomalies.
Information Technology Security (IT) - includes the protection of companies information, protecting IT access (passwords, firewalls, virus protection), servers in a locked room, access to shipment information.

26. Information Technology Security
Passwords should be changed every 90 days
Do not share your password with anyone
Do not share access to your computer with strangers
Log-off when you leave your computer
Do not write down your password.

27. Information Technology Security
Use hard-to-guess passwords
Do not use the same password in more than one place
A password should have a mix of letters, numbers and symbols
I Love to be Secure
Always on time to work !AoT2wx
My Password is Very Secure MyP1VS#
Yo Quiero Taco Bell Yqtb!10

28. Electronic Mail and Telephone Restrictions
Do not use company for private business activities, amusement or entertainment.
Do not send containing racist, sexist, threatening or other objectionable language.
Do not join mailing lists.
Do not open unknown or unexpected attachments.
Do not provide personal information over the telephone

29. Employee notifies Reception of visitor
Visitor Controls
Security personnel, the receptionist or a designated employee must adequately control the issuance and collection of visitor badges. Follow applicable site procedures.
Register Visitor with Reception or Security (Site procedures).
Visitor Entrance Requirements:
Ensure that your visitor has provided you a photo identification (i.e., driver’s license, passport), logged in and has been issued a visitor badge.
All visitors must be escorted and visibly display their visitor badge.
Employee notifies Reception of visitor
Visitor Entrance
Visitor arrives
Notify
hosting
employee
Document
arrival on
Visitor Log
Check
Photo ID
Issue
Visitor
badge

30. Visitor Controls Visitor Escort Requirements
You must escort your visitor(s) at ALL times
Do not leave your visitor unattended
Visitor Exit Requirements
Ensure that your visitor has logged out and has returned the visitor badge to the guard or receptionist.
Visitor Exit
Collect
Visitor
badge
Document
departure on
Visitor Log

31. Employee Identification
Employee Responsibilities:
While on company property:
Your company identification badge must be properly displayed and worn at all times.
Properly secure and protect the following:
ID badge
Uniform
Keys
Access control devices, etc.

32. Suspicious Persons LOOK FOR….. Any person without a badge
Determine if the person is an employee or a visitor
If an employee, remind them always to display their ID badge.
If a visitor, escort them to the reception area or to the person with whom they are visiting.
Report the incident to your immediate supervisor and Security.

33. Reporting Security Incidents/Concerns
Report any security incident or concerns to Security.
Security will report identifiable events to law enforcement (e.g., FBI, DHS/CBP, DEA, Local or State authorities).
View Security for latest security information.
Travel Warnings
Travel Tips
Identity Theft
Contact Information

34. Security Website