6 U.S. Code § 963. Minimum requirements

An applicant seeking to participate in C–TPAT shall—
demonstrate a history of moving cargo in the international supply chain;
(2) conduct an assessment of its supply chain based upon security criteria established by the Secretary, acting through the Commissioner, including—
business partner requirements;
container security;
physical security and access controls;
personnel security;
procedural security;
security training and threat awareness; and
information technology security;
implement and maintain security measures and supply chain security practices meeting security criteria established by the Commissioner; and
meet all other requirements established by the Commissioner, in consultation with the Commercial Operations Advisory Committee.